The open radio access network (O-RAN) standard provides a foundational move towards disaggregated RAN architecture, allowing flexibility and multi-vendor integration. For example, the Radio Intelligent Controller (RIC) may involve third-party applications (xApps) to dynamically control and monitor network behavior, facilitating significant opportunities for multi-party involvement, but allowing potentially untrusted integration with the RAN. In this paper, we propose, design and evaluate ORANClaw — a structure aware, man-in-the-middle fuzzing framework that takes full control over the E2 interface between the xApps and the RIC, and systematically mutates or duplicates packets communicated via this interface to disrupt the behavior of the base station (gNB). ORANClaw takes into account the structural and semantic constraints while systematically mutating the packets. Furthermore, it optimizes the mutation strategy based on the coverage of explored state transitions.We have implemented ORANClaw and evaluated it with FlexRIC, O-RAN SC RIC, OpenAirInterface, ns-3 simulator and commercical VIAVI TeraVM AI RAN Scenario Generator gNB/RIC. In total, ORANClaw has discovered 71 unique bugs (eight CVEs already assigned): 28 in FlexRIC, one in O-RAN SC RIC, 37 in the gNB implementations of OpenAirInterface and ns-3. Additionally, ORANClaw uncovered five distinct vulnerabilities in commercial VIAVI TeraVM AI RSG gNB/RIC. Our evaluation also reveals that structure and semantic-aware mutations within ORANClaw are key factors in revealing these bugs. Overall, ORANClaw provides an open platform to automatically validate both the RIC and gNB implementations via xApp manipulations.

The increasing adoption of novel digital-based operations in the transportation industry introduces new cybersecurity challenges due to the reliance on digital communication and automation. This paper presents a novel cybersecurity risk assessment methodology that integrates System-Theoretic Process Analysis (STPA), Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (STRIDE), and Bayesian Networks (BN) to systematically identify and quantify cybersecurity threats in transport remote pilotage operations. The proposed framework applies STPA to identify unsafe/unsecured control actions (UCAs/U`CAs), utilizes STRIDE with emphasis on Spoofing, Tampering and Denial of Service attacks to identify potential cybersecurity threats related to safety losses, and employs BN to estimate and prioritize risk probabilities of critical cyber threats. A case study from maritime involving remote pilotage operations demonstrates the applicability of the methodology, highlighting key vulnerabilities such as cyber-attacks on navigation aids and communication channels. The results indicate that state-sponsored attacks pose higher risks than those from criminal hackers, with posterior probabilities for major losses being approximately 2.4 times higher. The findings emphasize the need for enhanced cybersecurity measures, particularly focusing on critical system components and human-system interactions. The proposed approach provides transportation stakeholders with a structured methodology for assessing and mitigating cybersecurity risks in evolving and more remote operations.

Recently reported attacks against Programmable Logic Controllers (PLCs) have shown that the exploitation of Industrial Control Protocols (ICPs), i.e., ICP-based attacks, poses significant threats to industrial control systems. ICP-based attacks include two essential steps: generating tailored attack payloads and breaking through the session-ID-based PLC defenses. Traditional approaches to performing the two steps rely on laborious manual analysis. To analyze the threats posed by ICP-based attacks to commercial-off-the-shelf PLCs, we propose AIAF, an Automated ICP-based Attack Framework leveraging proprietary binary protocols, which operates automatically through an offline construction of effective attack payloads and an online ICP-based attack test. We have evaluated AIAF with 9 mainstream PLCs, covering 9 protocols, showing that AIAF can reverse engineer 12 kinds of session-ID negotiation (6 value-changed and 6 value-same), generate attack payloads, and execute 35 ICP-based attacks with a 94.29% success rate. Our further Internet-wide evaluation reveals that over 28K PLCs exposed to the Internet are vulnerable to ICP-based attacks.

Proof of Aliveness (PoA) has emerged as a useful cryptographic concept for periodically ascertaining the operational status (aliveness) of devices, especially for those in cyber-physical systems. However, existing PoA schemes exhibit shortcomings stemming from intermittent aliveness proofs and a lack of resilience against the threats caused by malicious verifiers. Motivated by this, we introduce a new security notion called Proof of Persistent Aliveness (PoPA), which encompasses two new properties: persistent aliveness (PAlive) and audit (Audit). Our PAlive strengthens prior work by addressing the security concerns associated with generating persistent aliveness proofs in a continuous time manner, while Audit covers the threats posed by malicious verifiers. To efficiently realize PoPA, we developed two new building blocks: a deterministic hash-based Proof of Work (HPoW) scheme and private tweakable hash (PTH) functions. Using these primitives, we propose a scalable and lightweight PoPA construction, named SPAC, which is provably secure in our PoPA model without relying on random oracles. SPAC leverages HPoW and a customized authenticated credential structure that employs a variant of the Winternitz one-time signature scheme derived from PTH, enabling unlimited aliveness proofs with very small proof size. Over 93% of aliveness proofs are 84 bytes in size, with the worst-case proof size being only 372 bytes.

Programmable logic controllers (PLCs) play a crucial role in various industrial manufacturing processes. Recent attack events show that attackers have a strong interest in controller variables of PLCs, including the device status and internal program logic. Detecting anomalous messages targeting PLC controller variables, which relies on the analysis of controller variable semantics, has proven to be an effective method for identifying such attacks. However, the proprietary nature of industrial control protocols (ICPs) poses a challenge to extracting the required semantics. In this paper, we propose an automated framework namedSePannerto extract the semantics of controller variables from proprietary ICPs based on network traffic. Specifically, we first collect multiple groups of interaction traffic of PLCs and perform the starting-aligned comparisons on them to locate the semantic fields directly. Then, we identify and investigate a new problem in semantic extraction — interference resulting from misordered messages — and propose a set of filtering criteria to eliminate it effectively. We evaluate SePanner using the S7COMM protocol, and the results indicate that SePanner can successfully extract the semantics of controller variables with 100% accuracy. Additionally, we employ SePanner to analyze 7 proprietary ICPs, successfully extracting the semantics of 63 controller variables and their 134 states. Additionally, we demonstrate the extensive applications of SePanner in multiple ICS security scenarios and present its better performance compared with existing ICP semantic analyzing tools.

With the increasing adoption of Advanced Driver Assistance Systems (ADAS) in modern cars, the use of vision systems for autonomous vehicles, driving assistance, and in-vehicle entertainment has introduced new risks and attack vectors to existing In-Vehicle Networks (IVNs), thus bringing considerable concerns to the automotive cybersecurity space. Prior works have focused on analyzing functional or partial security aspects of vision systems during ADAS simulation using specialized Automotive Ethernet (AE) equipment or requiring expensive vehicle-in-the-loop setups. These approaches are either inaccessible to independent security researchers or do not offer comprehensive insights to help researchers understand the practical implications of attacks in a realistic car employing Automotive Ethernet IVNs for vision-related use cases. AEVisionLab allows replication of driving test scenarios directly with COTS ECUs and collection of key network performance metrics, facilitating the design, evaluation, and impact analysis of concrete attacks in the laboratory. We demonstrate the capability of AEVisionLab by designing and evaluating concrete attacks scenarios including eavesdropping and hijacking of SOME/IP services, manipulation and delaying video feed, among others. We envision AEVisionLab as a flexible platform for designing and evaluating both attack and mitigation techniques (e.g., intrusion detection) on AE network, which can be easily extended to support other automotive ECUs, machine learning models for ADAS, or sensors for assisted driving.

Secure three-party computation (3PC) with semi-honest security under an honest majority offers notable efficiency in computation and communication; for Boolean circuits, each party sends a single bit for every AND gate, and nothing for XOR. However, round complexity remains a significant challenge, especially in high-latency networks. Some works can support multi-input AND and thereby reduce online round complexity, but they requireexponentialcommunication for generating the correlations in either preprocessing or online phase. How to extend the AND gate to multi-input while maintaining high correlation generation efficiency is still not solved. To address this problem, we propose a round-efficient 3PC framework ALKAID for Boolean circuits through improved multi-input AND gate. By mixing correlations and redundancy, we propose a concretely efficient correlation generation approach for small input bitsNN> 4. Exploiting the improved multi-input AND gates, we design fast depth-optimized parallel prefix adder and share conversion primitives in 3PC, achieved with new techniques and optimizations for better concrete efficiency. We further apply these optimized primitives to enhance the efficiency of secure non-linear functions in machine learning. We implement ALKAID and extensively evaluate its performance. Compared to state of the arts like ABY3 (CCS’2018), Trifecta (PoPETs’2023), and METEOR (WWW’2023), ALKAID enjoys 1.5×–2.5× efficiency improvements for boolean primitives and non-linear functions, with better or comparable communication.

Privacy-preserving biometric authentication (PPBA) enables client authentication without revealing sensitive bio-metric data, addressing privacy and security concerns. Many studies have proposed efficient cryptographic solutions to this problem based on secure multi-party computation, typically assuming a semi-honest adversary model, where all parties follow the protocol but may try to learn additional information. However, this assumption often falls short in real-world scenarios, where adversaries may behave maliciously and actively deviate from the protocol. In this paper, we propose, implement, and evaluate FLAME, a Flexible and Lightweight biometric Authentication scheme designed for a Malicious Environment. By hybridizing lightweight secret-sharing-family primitives within two-party computation, FLAME carefully designs a line of supporting protocols that incorporate integrity checks with rationally extra overhead. Additionally, FLAME enables server-side authentication with various similarity metrics through a crossmetric-compatible design, enhancing flexibility and robustness without requiring any changes to the server-side process. A rigorous theoretical analysis validates the correctness, security, and efficiency of FLAME. Extensive experiments highlight FLAME's superior efficiency, with a communication reduction by 97.61x 110.13x and a speedup of 2.72x 2.82x (resp. 6.58x 8.51x) in a LAN (resp. WAN) environment, when compared to the state-of-the-art work.

The need for privacy-aware policies, regulations, and techniques has been widely recognized. This workshop discusses the problems of privacy in the global interconnected societies and possible solutions. The 2025 Workshop, held in conjunction with the ACM CCS conference, is the 24th in a yearly forum for papers on all the different aspects of privacy in today's electronic society.

Federated Learning (FL) is a distributed machine learning paradigm that allows multiple clients to train models collaboratively without sharing local data. Numerous works have explored security and privacy protection in FL, as well as its integration with blockchain technology. However, existing FL works still face critical issues. i) It is difficult to achieving poisoning robustness and data privacy while ensuring high model accuracy. Malicious clients can launch poisoning attacks that degrade the global model. Besides, aggregators can infer private data from the gradients, causing privacy leakages. Existing privacy-preserving poisoning defense FL solutions suffer from decreased model accuracy and high computational overhead. ii) Blockchain-assisted FL records iterative gradient updates on-chain to prevent model tampering, yet existing schemes are not compatible with practical blockchains and incur high costs for maintaining the gradients on-chain. Besides, incentives are overlooked, where unfair reward distribution hinders the sustainable development of the FL community. In this work, we propose FLock, a robust and privacy-preserving FL scheme based on practical blockchain state channels. First, we propose a lightweight secure Multi-party Computation (MPC)-friendly robust aggregation method through quantization, median, and Hamming distance, which could resist poisoning attacks against up to <50% malicious clients. Besides, we propose communication-efficient Shamir's secret sharing-based MPC protocols to protect data privacy with high model accuracy. Second, we utilize blockchain off-chain state channels to achieve immutable model records and incentive distribution. FLock achieves cost-effective compatibility with practical cryptocurrency platforms, e.g. Ethereum, along with fair incentives, by merging the secure aggregation into a multi-party state channel. In addition, a pipelined Byzantine Fault-Tolerant (BFT) consensus is integrated where each aggregator can reconstruct the final aggregated results. Lastly, we implement FLock and the evaluation results demonstrate that FLock enhances robustness and privacy, while maintaining efficiency and high model accuracy. Even with 25 aggregators and 100 clients, FLock can complete one secure aggregation for ResNet in 2 minutes over a WAN. FLock successfully implements secure aggregation with such a large number of aggregators, thereby enhancing the fault tolerance of the aggregation.

Circuit Private Set Intersection (Circuit-PSI) allows two parties to compute a function f on items in the intersection of their input sets without revealing items in the intersection set. It is a well-known variant of PSI and has numerous practical applications. However, existing Circuit-PSI protocols only provide security against semi-honest adversaries. A straightforward approach to constructing a maliciously secure Circuit-PSI is to extend a pure garbled-circuit-based PSI (NDSS'12) to a maliciously secure circuit-PSI, but it will not be concretely efficient. Another is converting state-of-the-art semi-honest Circuit-PSI protocols (EUROCRYPT'21; PoPETS'22) to be secure in the malicious setting. However, it will come across the consistency issue (EUROCRYPT'11) since parties can not guarantee the inputs of the function f stay unchanged as obtained from the last step. This paper tackles the previously mentioned issue by presenting the first maliciously secure Circuit-PSI protocol. Our key innovation, the Distributed Dual-key Oblivious Pseudorandom Function (DDOPRF), enables the oblivious evaluation of secret-shared inputs using dual keys within the SPDZ MPC framework. Notably, this construction seamlessly ensures fairness within the Circuit-PSI. Compared to the state-of-the-art semi-honest Circuit-PSI protocol (PoPETS'22), experimental results demonstrate that our malicious Circuit-PSI protocol not only reduces around 5x communication costs but also enhances efficiency, particularly for modest input sets (<= 2^{14}) in the case of the WAN setting with high latency and limited bandwidth.

In this paper, we present$\mathtt {Antelope}$, a semi-honest large-scale secure inference system without revealing either clients’ data or model parameters. The main contributions of$\mathtt {Antelope}$are new two-party computation (2PC) protocols over a ring$\mathbb {Z}_{2^\ell }$for non-linear layers, which optimize the online computation and communication overhead thus outperforming the state-of-the-art 2PC systems. Specifically, we reformulate the comparison function as an Equality-to-Zero test followed by multiplication, decoupling the bit-wise rounding dependency in traditional secret sharing-based bit extraction. With this technique, the evaluation of the ReLU non-linear activation function is$1.7\times$-$84.5\times$faster than existing solutions in online communication cost. We also develop a suite of optimizations that improve the efficiency of secure division protocols, which are tailored to different divisor settings in the neural networks. We extend our protocols to construct efficient implementations for several building blocks such as ReLU, Maxpool, truncation, and Softmax. End-to-end evaluation on realistic ImageNet-scale networks demonstrates that$\mathtt {Antelope}$achieves over$22.3\times$and$23.0\times$online runtime speedups in LAN and WAN settings, respectively, without accuracy loss, compared to the state-of-the-art works.

Cryptocurrencies and permissionless blockchains allow nodes from all over the world to join, and their rapid development has created enormous blockchain networks with nodes spanning the globe. Blockchain network partitioning attacks split the network into separate node groups through disrupting communication, causing information inconsistency, and facilitating malicious behaviors like double-spending and selfish mining, threatening the blockchain security. Existing research primarily studies concrete partitioning attack methods. However, it is hard to analyze practical post-attack security and efficiency impacts on blockchains and design effective countermeasures. This paper studies practical network partitioning attacks’ impacts on existing proof-of-work-based (Bitcoin) and proof-of-stake-based (Ethereum) permissionless blockchains. We theoretically analyze and experimentally confirm the adverse effects of network partitioning on blockchain performance and security. Network partitioning will cause blockchain throughput to plummet, and cause block generation delay to increase rapidly. In our experiments on Ethereum 2.0, when the bandwidth between the partitioned networks is lower than 768 Kbps, the throughput begins to plummet precipitously until it ultimately falls to 0. What’s worse, network partitioning will significantly increase the success rate of double-spending. In our experiments on Bitcoin, when the bandwidth between the partitioned networks is less than 256 Kbps, the success rate of double-spending reaches 50%. To solve the above issues, we propose countermeasures leveraging a freezing threshold to safeguard the security of permissionless blockchains and resist double-spending attacks. We experimentally validate that the countermeasures enhance the resistance of permissionless blockchains to network partitioning attacks. It reduces the probability of double-spending in partitioned networks, thereby ensuring security and reliability.

Blockchain and cryptocurrencies are developing rapidly, and the scalability issue has become a constraint on their practical application and development. Off-chain payment channel is an effective solution to the scalability problem of blockchain. Currently, various payment channel protocols have been proposed. However, privacy issues are vital in payment channels. Existing works that consider privacy issues mainly focus on payment channel networks and payment channel hubs, while there is little work on two-party and multi-party channels. In addition, many existing payment channel works that consider privacy protection fix the transaction amounts to ensure the hiding of payment relationships or rely on smart contracts, which will hinder the practical application of payment channels. In this work, we propose a two-party privacy-preserving payment channel protocol that is compatible with Bitcoin (TBPChannel), achieving value privacy and unlinkability, while supporting variable transaction amounts. On this basis, we propose a privacy-preserving multi-party payment channel protocol (MBPChannel), which removes the role of untrusted operators in previous multi-party settings and further achieves robustness. We formally model the protocols in the universal composability framework and prove the security. Finally, we implement the protocols and provide a performance evaluation. The results demonstrate the scalability and practicality of our protocols. Compared to current protocols, even though we use privacy-preserving methods, our protocols are still efficient and applicable in practice.

In this paper, we introduce SeiFS, a Secure and Lightweight Feature Selection system designed to ensure high-quality inputs for Machine Learning (ML) tasks. Unlike previous approaches involving multiple non-colluding servers, SeiFS operates in a natural ML scenario where multiple entities interact with a single server, without relying on additional strong assumptions. Our work presents intrinsic optimizations in feature selection that yield substantial performance improvements, including a customized data encoding method, a size-optimized comparison circuit, and a shared oblivious dimensionality reduction technique. The customized data encoding method, combined with an optimized secure data access protocol, reduces expensive comparison operations from$O(m)$to$O(\log m)$, where m represents the number of samples. The size-optimized comparison circuit achieves up to a quadruple reduction in size compared to naïve implementations. Additionally, the shared oblivious dimensionality reduction technique incorporates a novel approximated top-k selection algorithm, resulting in a circuit size reduction of approximately$k\times $. Comprehensive experiments conducted across various network settings demonstrate that our protocols outperform existing solutions, delivering efficiency improvements of an order of magnitude. Specifically, the end-to-end execution of SeiFS on real-life datasets achieves at least$62.7\times $improvements in runtime compared to the naïve implementation and takes up to$112.9\times $fewer runtimes than the state-of-the-art in the LAN setting.

Industrial control systems (ICSs) govern the production activities of various critical infrastructures, where programmable logic controllers (PLCs) are essential devices for controlling industrial processes. However, PLCs have many vulnerabilities and might be configured inappropriately. With the trend of PLCs connecting to the Internet, such weaknesses will lead to various cyberattacks and have prompted many studies on the threat assessment for PLCs. Previous research has ignored PLCs’ security settings, such as operating mode and read/write authentication etc., which are the general security functionalities significantly affecting PLCs’ security. In this paper, we make the first attempt to propose a security settings-based threat assessment framework (SSTAF) to assess PLCs’ security.SSTAFconsists ofSScanner, a novel scanner to automatically extract the real-time configurations of security settings from PLCs, and the threat assessment criteria, serving to assess the appropriateness of PLC configurations and analyze risk levels of attacks based on PLCs’ security settings. Subsequently, usingSSTAF, we implement an Internet-wide threat assessment for PLCs exposed to the Internet. We deploySScanneron the Internet and interact with 41K ICS devices in cyberspace to acquire their configurations of security settings. Based on the scanning result and the threat assessment criteria, we reveal that 93.32% of PLCs have not appropriately configured their security settings. Additionally, each PLC might be subject to 4.96 attacks on average, of which 3.32 attacks are due to the inappropriate configurations of security settings.

The increasing network integration of industrial control systems amplifies the risk of cyberattacks on Programmable Logic Controllers (PLCs). In particular, the weak authentication of industrial communication protocols makes PLC program variables vulnerable to manipulation. Current defensive methods cannot reliably identify manipulated variables, even after PLC program manipulations have been detected. To bridge this gap, we presentADIS, a cross-domain Attack Detection and Identification System designed to detect and identify manipulated PLC program variables. Building on a novel state-aware graph representation of the PLC program,ADISdetects variable manipulations by comparing SCADA monitoring data with the control logic defined by the PLC program.ADISfurther identifies suspiciously manipulated program variables by excluding cascading failures from the detected anomalies and tracking suspicious variables based on the edges of the state-aware dependency graph. We have implemented and evaluatedADISon two platforms. The results demonstrate thatADISdetects attacks with a true positive rate exceeding 99% and a false positive rate of less than$0.04{\unicode {0x2030}}$. Furthermore, it successfully identifies manipulated program variables with up to a 71.3% reduction in suspicious variables compared to a baseline method.

Decentralized identity (DID) is a transformative paradigm that leverages blockchain, decentralized identifiers and verifiable credentials (VCs) to enable self-sovereign and decentralized identity management with myriad application areas. However, existing DID implementations are confronted with two key challenges: insufficient decentralization and vulnerability to mobile adversary attacks. First, they paradoxically introduce central identity resolvers, intermediaries or static committees to manage critical identity services, key management or credential issuance, which violates the decentralized controlling aim against a single point of failure. Second, these systems are vulnerable to mobile adversaries who can gradually compromise multiple nodes or committee members over a long period, eventually seizing control of the system. In this paper, we propose DP-DID, the first dynamic and proactive decentralized identity system specifically designed to resist mobile adversary attacks in dynamic committee settings. To eliminate centralized authorities, DP-DID leverages blockchain, dynamic committees and BLS1signatures, which achieves decentralization. In addition, we design a dynamic and batch proactive secret sharing (DBPSS) scheme for DP-DID to ensure proactive security against mobile adversary attacks. This is achieved by allowing at mostt(threshold) committees to be corrupted per period, with the set of corrupted committees changing dynamically even if all players are eventually compromised. By incorporating DBPSS, DP-DID achieves efficient key management for multiple users in dynamic settings, enhancing overall system scalability. Through rigorous analysis, DP-DID is proven to be forward secure and secure against mobile adversary attacks under a widely adopted malicious model. Extensive experiments show that DP-DID has efficient performance, and our DBPSS scheme outperforms FaB-DPSS by over 11.67× in key handover efficiency.

Federated recommender system (RS), a prevailing distributed paradigm, has been spawning significant interest in exploiting locally stored but tremendous data to predict items best aligned with clients. However, federated RS suffers severely from a single point of failure due to the dependency on the central server, leading to potential denial of service (DoS) attacks. To address this security weakness, in this paper, we propose a decentralized privacy-preserving federated graph convolutional network for RS, dubbed DeFedGCN. Specifically, DeFedGCN aggregates local updates by a decentralized consensus-reaching process and customizes local models for personalized recommendation, where the aggregation is enhanced by local differential privacy to resist model inversion attacks. More importantly, to promote the recommendation performance, DeFedGCN conducts asub-graph expansionbased on the private set interaction to explore high-order interactions among clients and items. Theoretical analysis confirms the effectiveness and privacy guarantee of DeFedGCN. Additionally, we conduct extensive experiments on four widespread real-world databases. The recommendation performance of DeFedGCN outperforms the state-of-the-art federated RS algorithms without security protection against DoS attacks by up to 7.4%.

With the widespread adoption of cloud computing, it is a popular trend to migrate shortest path and distance (SPD) retrieval on large-scale graphs to cloud environments, harnessing their immense computational capabilities. To protect sensitive information, these graphs are usually encrypted before being outsourced to the cloud. A significant challenge is how to answer SPD retrieval in a secure, efficient, and accurate manner. However, recent works have yet to concurrently tackle all three aspects to meet this challenge. To address this challenge, we design, implement, and evaluate Crypt-Graph, the first scheme simultaneously allowing private, efficient, and accurate retrieval over encrypted graphs. CryptGraph leverages additive homomorphic encryptions to protect graphs and client information. A series of secure protocols are tailored based on the two-cloud (i.e., server) model. Supported by these protocols, Crypt-Graph converts SPD retrieval from the ciphertext domain to both the plaintext (for vertices) and secret-sharing (for weights) domains, achieving access pattern protection and remarkable efficiency close to plain retrieval. The security of CryptGraph is formally analyzed under the semi-honest adversary model. Extensive experiments are conducted on both synthetic and real-world graph datasets, demonstrating millisecond-level efficiency and 100% accuracy rates.

The advancement of Industrial Internet-of-Things (IIoT) magnifies the cyber risk of automated production lines, especially to deception attacks that tamper with the monitoring data to prevent the manipulated operation of production lines from being detected. To address this issue, we propose Stochastic Manufacturing (StoM), a new paradigm of manufacturing that is resistant to deception by design. StoM voids the foundation of deception attacks — i.e., the highly predictable operation data due to the cyclical manufacturing process — by injecting controlled stochasticity into the operation of production lines without degrading manufacturing efficiency or quality. StoM then examines if this stochasticity can be observed from the operation data and triggers an alarm of deception attack if not. We have experimentally evaluated StoM on two production line platforms, showing StoM to detect deception attacks with a detection rate exceeding 99.1%, a false alarm rate below 0.1%, and a latency of less than 1.2 manufacturing cycles. Our empirical analysis also shows that it is highly impractical for attackers to spoof the controlled stochasticity.

Federated learning (FL) is becoming a major driving force behind machine learning as a service, where customers (clients) collaboratively benefit from shared local updates under the orchestration of the service provider (server). Representing clients' current demands and the server's future demand, local model personalization and global model generalization are separately investigated, as the ill-effects of data heterogeneity enforce the community to focus on one over the other. However, these two seemingly competing goals are of equal importance rather than black and white issues, and should be achieved simultaneously. In this paper, we propose the first algorithm to balance personalization and generalization on top of game theory, dubbed PAGE, which reshapes FL as a co-opetition game between clients and the server. To explore the equilibrium, PAGE further formulates the game as Markov decision processes, and leverages the reinforcement learning algorithm, which simplifies the solving complexity. Extensive experiments on four widespread datasets show that PAGE outperforms state-of-the-art FL baselines in terms of global and local prediction accuracy simultaneously, and the accuracy can be improved by up to 35.20% and 39.91%, respectively. In addition, biased variants of PAGE imply promising adaptiveness to demand shifts in practice.

Federated learning (FL) enhanced by local differential privacy (LDP) has gained promising privacy-preserving capabilities against privacy attacks on local contributions. In this context, noise-discounting LDP methods have been widely investigated to provide better model performance and stronger privacy guarantees. However, prior art calibrate privacy guarantees by distinct LDP definitions, resulting in nonuniform privacy-preserving capabilities. In this article, aligned with the standard LDP definition, we proposed QP-LDP, a noise-discounting algorithm for FL, which can yield better model performance without any privacy loss. Specifically, QP-LDP precisely disturbs noncommon components of quantized local contributions, which are selected by an extended multiparty private set intersection process. In particular, QP-LDP can comprehensively protect two types of local contributions, i.e., local models and gradients for prevailing FedAvg and FedSGD, respectively. Through theoretical analysis, QP-LDP provides component-level indistinguishability for clients’ private local contributions and rigorous convergence guarantees for the global model. Extensive experiments on four widespread databases show that, compared to the standard LDP method, the global model prediction accuracy and convergence rate achieved by QP-LDP can be improved by up to 14.99% and 23.08%, respectively. More importantly, QP-LDP achieves the same level of privacy-preserving capabilities against privacy attacks as the standard LDP method.

A trustworthy source of randomness is a crucial component of many decentralized and crypto-based application systems, especially blockchain consensus. A decentralized random beacon (DRB) periodically outputs a new source of randomness generated using a distributed technique, such as publicly verifiable secret sharing (PVSS) or distributed verifiable random functions (VRFs). These protocols offer a variety of efficiency versus randomness quality tradeoffs, but guarantee security under a variety of configurations, assumptions, and adversarial models. This article aims to provide a future-proof unbiased decentralized randomness (abbreviated as Funder) via a post-quantum threshold VRF for sustainable proof-of-stake blockchain. We also provide a generic compiler for achieving post-quantum VRF from a classical VRF solution, but our approach makes use of symmetric-key primitives Our novel compiler is validated and evaluated using the ZKBoo and ZKB++ quantum-secure zero-knowledge systems, respectively. The implementation of the proof-of-concept demonstrates that the overheads introduced by our solution are acceptable for real-world deployments even in the present day. In addition, we demonstrate the protocol’s possible application in lottery-based proof-of-stake consensus protocols.

At ACSAC 2019, we introduced a new cryptographic primitive called proof of aliveness (PoA), allowing us to remotely and automatically track the running status (aliveness) of devices in the fields in cyber-physical systems. We proposed to use a one-way function (OWF) chain structure to build an efficient proof of aliveness, such that the prover sends every node on the OWF chain in a reverse order periodically, and it can be verified by a remote verifier with the possession of the tail node (last node) of the OWF chain. However, the practicality of this initial construction is limited by the finite number of nodes on an OWF chain. We enhance our first PoA construction by linking multiple OWF chains together using a pseudo-random generator chain in our second PoA scheme. This enhancement allows us to integrate one-time signature (OTS) schemes into the structure of the second construction to realize the auto-replenishment of the aliveness proofs. This implies that securely an initialized PoA instance can be used forever without interruption for reinitialization. In this work, our primary motivation is to further improve our secondary PoA and auto-replenishment schemes. Instead of storing the tail nodes of multiple OWF chains on the verifier side, we use a Bloom Filter to compress them. This saves$ 4.7$times the storage cost compared to our previous version at ACSAC 2019. Moreover, the OTS-based auto-replenishment solution cannot be applied to our first scheme solely based on OWFs, and it is not so efficient despite its standard model security. To overcome these limitations, we design a new auto-replenishment scheme from a hash-based commitment under the random oracle model in this work, which is much faster and can be used by both PoA schemes. Additionally, we implement and evaluate our PoA constructions on Raspberry Pis to demonstrate their performance. Considering the implementation on a storage/memory-constrained device, we particularly study the strategies for efficiently generating proofs.

Group time-based one-time passwords (GTOTP) is a novel lightweight cryptographic primitive for achieving anonymous client authentication, which enables the efficient generation of time-based one-time passwords on behalf of a group without revealing any information about the actual client’s identity beyond their group membership. The security properties of GTOTP regarding anonymity and traceability have been formulated in a static group management setting (where all group members should be determined during the group initialization phase), yet, a formal treatment for real-world dynamic groups (i.e., group members may join and leave at any time) is still an open question. It is non-trivial to construct an efficient GTOTP scheme that can provide a lightweight password generation procedure run by group members and support dynamic group management, allowing group members to join and leave without affecting other members’ states (non-disruptively). To address the above challenge, we first define the notion and the security model of dynamic group time-based one-time passwords (DGTOTP) in this work. We then present an efficient DGTOTP construction that can generically transform an asymmetric time-based one-time passwords scheme into a DGTOTP scheme utilizing a chameleon hash function family and a Merkle tree scheme. Within our construction, we particularly tailor an outsourcing solution realizing an issue-first-and-join-later (IFJL) strategy, enabling smooth joining and revocation without disrupting other group members. Moreover, our scheme minimizes symmetric cryptographic operations and maintains constant storage for group members, compared to the linear storage cost that grows rapidly with respect to the lifetime of the GTOTP instance in the previous static GTOTP scheme. Our DGTOTP scheme satisfies stronger security guarantees in a dynamic group management setting without random oracles. Our experimental results confirm the efficiency of our DGTOTP scheme.

Blockchain rewriting with fine-grained access control allows a user to create a transaction associated with a set of attributes, while a modifier who possesses sufficient rewriting privileges from a trusted authority satisfying the attribute set can anonymously rewrite the transaction. However, it lacks accountability and is not designed for open blockchains that require no centralized trust authority. In this work, we introduce accountable fine-grained blockchain rewriting in a permissionless setting. The property of accountability allows the modifier’s identity and their rewriting privileges to be held accountable for the modified transactions in case of malicious rewriting. Our contributions are three-fold. First, we present a generic framework for secure blockchain rewriting in the permissionless setting. Second, we present an instantiation of our framework and show its practicality through evaluation analysis. Last, we demonstrate that our proof-of-concept implementation can be effectively integrated into open blockchains.

Vehicular cloud computing (VCC) is a network architecture that allows a group of entities (i.e., vehicles/roadside infrastructures) to share their resources with other entities. Task delivery in VCC involves the delegation of computation/storage task from a cloud user to some or all the cloud members within a vehicular cloud (VC) for processing. This process inevitably raises concerns regarding how to protect the confidentiality of the task content and the privacy of vehicles. To tackle these challenges, the establishment of a secure channel for task delivery becomes essential. However, the existing secure channel establishment schemes for task delivery in VCC suffer from a few problems including the reliance on a trusted dealer, sender restriction, recipient un-flexibility, or the ignorance of recipient privacy. In this paper, we propose a novel secure channel establishment scheme for task delivery in VCC. It allows a group of entities close to each other to form a VC dynamically without a trusted dealer and allows any entity to be a cloud user who can flexibly select favorable cloud members within a VC to handle its task. The secure channel established by our scheme not only protects the confidentiality of the content of the task but also the privacy of vehicles. Formal security analysis and simulation validate the security and efficiency of our scheme.

Programmable logic controllers (PLCs), the essential components of critical infrastructure, play a crucial role in various industrial manufacturing processes. Recent attack events show that attackers have a strong interest in tampering with the controller variables, such as the device status and internal program logic. A typical attack strategy is that the attackers just send malicious network traffic of industrial control protocols (ICPs) to change the controller variables of PLCs. To defend against this attack, a lot of countermeasures have been proposed to detect anomalies in network traffic based on the semantic analysis.

Most proposals for securing control systems are heuristic in nature, and while they increase the protection of their target, the security guarantees they provide are unclear. This paper proposes a new way of modeling the security guarantees of a Cyber-Physical System (CPS) against arbitrary false command attacks. As our main case study, we use the most popular testbed for control systems security. We first propose a detailed formal model of this testbed and then show how the original configuration is vulnerable to a single-actuator attack. We then propose modifications to the control system and prove that our modified system is secure against arbitrary, single-actuator attacks.

Networked Programmable Logic Controllers (PLCs) are proprietary industrial devices utilized in critical infrastructure that execute control logic applications in complex proprietary runtime environments that provide standardized access to the hardware resources in the PLC. These control applications are programmed in domain-specific IEC 61131-3 languages, compiled into a proprietary binary format, and process data provided via industrial protocols. Control applications present an attack surface threatened by manipulated traffic. For example, remote code injection in a control application would directly allow to take over the PLC, threatening physical process damage and the safety of human operators. However, assessing the security of control applications is challenging due to domain-specific challenges and the limited availability of suitable methods. Network-based fuzzing is often the only way to test such devices but is inefficient without guidance from execution tracing.

Swarm attestation, as an important branch of Remote Attestation (RA), enables a trusted party (verifier) to verify the security states of multiple devices (provers) in a large network (swarm) simultaneously via a challenge-response mechanism. However, swarm attestation suffers from significant redundancy overhead since all devices in the swarm need to be attested in each attestation round. Besides, it faces challenges such as verifier-impersonation Denial of Service (DoS) attacks, highly dynamic networks, transient & self-relocating malware, and Time-Of-Check-Time-Of-Use (TOCTOU) attacks. In this paper, considering not only the detection accuracy but also the privacy of swarm owners in real Internet of Things (IoT) scenarios, we propose an Automatic Federated Swarm Attestation scheme (FeSA). Under this scheme, we design a federated-learning-based automatic swarm attestation protocol that enables theverifiersto identify the suspicious devices by a neural network model and then attest them. To the best of our knowledge, this is the first scheme to apply a federated learning method to RA, ruling out the redundancy attestation rounds while preserving data privacy. The FeSA redesigns the interaction model of RA by a challenge-query mechanism to reduce the overhead of an individual device to a constant. In order to evaluate our scheme, we first set up a smart office environment with 12 types of smart IoT devices for real-world data collection up to 21 days. Based on the real dataset, we demonstrate that FeSA can indeed identify the compromised IoT devices while reducing redundancy. We further simulate large-scale swarms of up to 1,000,000 devices to validate the efficiency of FeSA in large-scale swarms. Last, the security analysis proves the ability of FeSA to resist various attacks.

Industrial Internet of Things (IIoT) is a new paradigm for building intelligent industrial control systems, and how to establish a secure channel in IIoT for machine-to-machine (M2M) communication is a critical problem because the devices in IIoT suffer from various attacks and may leak confidential information. Traditional authenticated and confidential channel establishment (ACCE) protocols neither apply for resource-constrained IIoT devices nor satisfy leakage resilience. In this paper, we introduce a new security notion: historical data based multi-factor ACCE (HMACCE) to address this issue and propose two HMACCE protocols. Our HMACCE protocols use three authentication factors, i.e., a symmetric secret key, historical data, and a set of secret tags associated with the historical data, to establish a secure communication channel between the client and the server. The key idea is to use the secret key managed by an IIoT edge device to quickly verify the relationship between the historical data and its associated tags stored on the server. Our HMACCE has the following remarkable features. First, it is lightweight and tailored for resource-constrained IIoT devices. Second, it is bounded historical tag leakage resilience, which means that if a small portion of the secret tags is leaked to an adversary, it will not affect its security with an overwhelming probability. Moreover, as a security enhancement service, our HMACCE can be easily integrated with legacy IIoT devices by running simple authenticated key exchange protocols.

The rapid evolution of technology has radically changed our everyday lives from multiple points of view. Systems and devices are nowadays more interconnected and capable of taking autonomous decisions without or with limited human intervention. Among the others, transportation systems are populated by smart and interconnected vehicles that need to communicate with each other and with critical infrastructures to orchestrate traffic and mobility. Such vehicles are equipped with multiple modules, which are sensing or communication devices that help the vehicle in assessing its well-being besides providing the basic information to be shared for the orchestration in the overall network. Transportation systems are hence operated through multiple technologies that need to cooperate to provide efficient delivery of goods and human mobility, as well as to provide security in the overall network. The latter task is complicated by the fact that vehicles autonomously drive and cooperate in the network without human intervention. In fact, thanks to the self-regulating capacity of the modules deployed both inside each vehicle and in the network infrastructure, vehicles do not need to be actively and fully driven by humans as in the past but require minimum intervention to mitigate extreme cases. The level of human intervention depends on the specific architecture and solution but is generally very limited. The overall transportation network can be therefore represented by a cyber--physical system, where a large number of sensors, actuators, and multiple technologies are connected and exchange information.

Pooled mining has become the most popular mining approach in the Bitcoin system, which can effectively reduce the variance of the block generation reward of participants. The security of pooled mining depends on whether it is incentive compatible, that is, an honest participant will get a reward proportional to his work. Recent attacks on mining pools, for example, Block Withholding, Fork After Withholding, and Power Adjusting Withholding (PAW) attacks, show that malicious participants may undermine the revenue of the honest pools and receive an unfair share of the mining reward. This paper shows that the security of Bitcoin is even worse than what the recent attacks demonstrated. We describe an attack called Fork Withholding Attack under a Protection Racket (FWAP), in which the mining pool pays the attacker for withholding a fork. Our insight is that the mining pools under forking attacks have incentives to pay in exchange for not being forked. The attacker and the paying pool negotiate how much to be paid, and we show that it is possible for both the attacker and the paying pool to earn higher rewards at the expense of the other pools. In particular, our formal analysis and simulation demonstrate that the payer and the FWAP attacker can get up to 1.8 × and 3.8 × of extra reward as in PAW, respectively. Furthermore, FWAP can escape from the “miners’ dilemma’’ when two FWAP attackers attack each other under some circumstances. We also propose simple approaches that serve as the first step towards preventing the FWAP attack.

SGX enclaves are trusted user-space memory regions that ensure isolation from the host, which is considered malicious. However, enclaves may suffer from vulnerabilities that allow adversaries to compromise their trustworthiness. Consequently, the SGX isolation may hinder defenders from recognizing an intrusion. Ideally, to identify compromised enclaves, the owner should have privileged access to the enclave memory and a policy to recognize the attack. Most importantly, these operations should not break the SGX properties.

Strategic evaluations of blockchain systems allow a better understanding of the security of the mining process. In recent years, many researchers have focused on developing optimal strategies to evaluate the impact of an adversary on the mining process using different attack situations such as selfish mining, double-spending, feather-forking, Denial of Service. These strategies rely on the use of the Markov Decision Process (MDP) to find optimal settings that an adversary can exploit to earn maximum profit in every round. However, these strategies do not consider a case where adversaries turn abusive, and their only aim is to harm the mining process without profit. Motivated by this, a self-defying adversary model is proposed that uses ZEBRA (Zero Expectation-Based Reward Abuse) strategy to cause a maximum impact on the rewards of the honest players at lower settings. With the proposed method, the adversary itself may not be profitable, but has better control over the chain growth and causes maximum damage to reward by delaying the blocks and inducing forks subject to its compliance degree. The evaluations are demonstrated to show the reward control by the adversary along with the impact on delays and forks, followed by the possibilities of attacks using the hashing powers of different mining pools.

Smart cities deploy large numbers of sensors and collect a tremendous amount of data from them. For example, Advanced Metering Infrastructures (AMIs), which consist of physical meters that collect usage data about public utilities such as power and water, are an important building block in a smart city. In a typical sensor network, the measurement devices are connected through a computer network, which exposes them to cyber attacks. Furthermore, the data is centrally managed at the operator’s servers, making it vulnerable to insider threats.Our goal is to protect the integrity of data collected by large-scale sensor networks and the firmware in measurement devices from cyber attacks and insider threats. To this end, we first develop a comprehensive threat model for attacks against data and firmware integrity, which can target any of the stakeholders in the operation of the sensor network. Next, we use our threat model to analyze existing defense mechanisms, including signature checks, remote firmware attestation, anomaly detection, and blockchain-based secure logs. However, the large size of the Trusted Computing Base and a lack of scalability limit the applicability of these existing mechanisms. We propose the Feather-Light Blockchain Infrastructure (FLBI) framework to address these limitations. Our framework leverages a two-layer architecture and cryptographic threshold signature chains to support large networks of low-capacity devices such as meters and data aggregators. We have fully implemented the FLBI’s end-to-end functionality on the Hyperledger Fabric and private Ethereum blockchain platforms. Our experiments show that the FLBI is able to support millions of end devices.

Vehicle-to-everything (V2X) communication is the key enabler for emerging intelligent transportation systems. Applications built on top of V2X require both authentication and privacy protection for the vehicles. The common approach to meet both requirements is to use pseudonyms which are short-term identities. However, both industrial standards and state-of-the-art research are not designed for resource-constrained environments. In addition, they make a strong assumption about the security of the vehicle's on-board computation units. In this paper, we propose a lightweight auto-refreshing pseudonym protocol (LARP) for V2X. LARP supports efficient operations for resource-constrained devices, and provides security even when parts of the vehicle are compromised. We provide formal security proof showing that the protocol is secure. We conduct experiments on a Raspberry Pi 4. The results demonstrate that LARP is feasible and practical.

Decentralized control, low-complexity, flexible and efficient communications are the requirements of an architecture that aims to scale blockchains beyond the current state. Such properties are attainable by reducing ledger size and providing parallel operations in the blockchain. Sharding is one of the approaches that lower the burden of the nodes and enhance performance. However, the current solutions lack the features for resolving concurrency during cross-shard communications. With multiple participants belonging to different shards, handling concurrent operations is essential for optimal sharding. This issue becomes prominent due to the lack of architectural support and requires additional consensus for cross-shard communications. Relying on the advantages of hybrid Proof-of-Work/Proof-of-Stake (PoW/PoS), like Ethereum , hybrid consensus and 2-hop blockchain , we propose Reinshard , a new blockchain that inherits the properties of hybrid consensus for optimal sharding. Reinshard uses PoW and PoS chain-pairs with PoS sub-chains for all the valid chain-pairs where the hybrid consensus is attained through Verifiable Delay Function (VDF). Our architecture provides a secure method of arranging nodes in shards and resolves concurrency conflicts using the delay factor of VDF. The applicability of Reinshard is demonstrated through security and experimental evaluations. A practical concurrency problem is considered to show the efficacy of Reinshard in providing optimal sharding.

We investigate existing “password+hardware token”-based authentication schemes deployed in real-world applications and observe that they are vulnerable to critical threats. Specifically, a compromised manufacturer may issue a backdoored hardware token to a user and later recover the user’s secret, which is well known as backdoor attacks. Additionally, an authentication credential in these schemes consists of two parts: the one is derived from the password, the other one is derived from the hardware token. However, since the two parts are independent of each other, if an adversary can physically access the hardware token of a victim, he is able to break security of these schemes by performing dictionary-guessing attacks (DGA), which is called mislaying-then-DGA. In this paper, we design a non-interactively re-randomizable reverse firewall signature mechanism for securing hardware tokens, such that the user’s secret is well protected even if a backdoor is embedded. We also utilize a servers-aided password-based encryption mechanism to harden hardware tokens, so as to “seamlessly” integrate the two factors into one credential. Based on the above mechanisms, we develop a secure two-factor authentication scheme, dubbed ATTACH. We evaluate ATTACH in terms of security and efficiency to demonstrate it achieves a strong security guarantee with high efficiency.

Time-based One-Time Password (TOTP) provides a strong second factor for user authentication. In TOTP, a prover authenticates to a verifier by using the current time and a secret key to generate an authentication token (or password) which is valid for a short time period. Our goal is to extend TOTP to the group setting, and to provide both authentication and privacy. To this end, we introduce a new authentication scheme, called Group TOTP (GTOTP), that allows the prover to prove that it is a member of an authenticated group without revealing its identity. We propose a novel construction that transforms any asymmetric TOTP scheme into a GTOTP scheme. Our approach combines Merkle tree and Bloom filter to reduce the verifier’s states to constant sizes.

Programmable Logic Controllers (PLCs) are a core component of an Industrial Control System (ICS). However, if a PLC is compromised or the commands sent across a network from the PLCs are spoofed, consequences could be catastrophic. In this work, a novel technique to authenticate PLCs is proposed that aims at raising the bar against powerful attackers while being compatible with real-time systems. The proposed technique captures timing information for each controller in a non-invasive manner. It is argued that Scan Cycle is a unique feature of a PLC that can be approximated passively by observing network traffic. An attacker that spoofs commands issued by the PLCs would deviate from such fingerprints. To detect replay attacks a PLC Watermarking technique is proposed. PLC Watermarking models the relation between the scan cycle and the control logic by modeling the input/output as a function of request/response messages of a PLC. The proposed technique is validated on an operational water treatment plant (SWaT) and smart grid (EPIC) testbeds. Results from experiments indicate that PLCs can be distinguished based on their scan cycle timing characteristics.

In this paper, we highlight a fundamental vulnerability associated with the widely adopted “Just Tap” push-based authentication in the face of a concurrency attack, and propose the method REPLICATE, a redesign to counter this vulnerability. In the concurrency attack, the attacker launches the login session at the same time the user initiates a session, and the user may be fooled, with high likelihood, into accepting the push notification which corresponds to the attacker's session, thinking it is their own. The attack stems from the fact that the login notification is not explicitly mapped to the login session running on the browser in the Just Tap approach. REPLICATE attempts to address this fundamental flaw by having the user approve the login attempt by replicating the information presented on the browser session over to the login notification, such as by moving a key in a particular direction, choosing a particular shape, etc. We report on the design and a systematic usability study of REPLICATE. Even without being aware of the vulnerability, in general, participants placed multiple variants of REPLICATE in competition to the Just Tap and fairly above PIN-based authentication.

Consortium blockchain has been widely used in many application scenarios, where there is the demand for a universal user authentication and key exchange mechanism for all the application users in the system like Know Your Customer. Since current solutions heavily rely on traditional public-key cryptosystems that are vulnerable to attacks from quantum computers, we design and implement the first post-quantum (PQ) user authentication and key exchange system for consortium blockchain, which is integrated with all the PQ public-key (i.e., signature and encryption/KEM) algorithms in the current round of NIST call for national standard. Furthermore, we also provide chaincodes, related APIs together with client codes for further development. Last but not least, we perform a systematic evaluation on the performance of the system including the consumed time of chaincodes execution and the needed on-chain storage space. Based on the experiment results, we discuss the implications of our findings, which are helpful for the PQ blockchain-based application developers, the undergoing NIST call and the developers of the PQ algorithms.

To protect an Industrial Control System (ICS), defenders need to identify potential attacks on the system and then design mechanisms to prevent them. Unfortunately, identifying potential attack conditions is a time-consuming and error-prone process. In this work, we propose and evaluate a set of tools to symbolically analyse the software of Programmable Logic Controllers (PLCs) guided by an information flow analysis that takes into account PLC network communication (compositions). Our tools systematically analyse malicious network packets that may force the PLC to send specific control commands to actuators. We evaluate our approach in a real-world system controlling the dosing of chemicals for water treatment. Our tools are able to find 75 attack tactics (56 were novel attacks), and we confirm that 96% of these tactics cause the intended effect in our testbed.

Industrial Internet of Things (IIoT) brings together computers, devices, advanced analytics, and people in industries, such as transportation, oil plant, and power grid that leads to major efficiency and productivity gains for almost any industrial procedures. Due to the interconnection of devices in IIoT, communication security has become a critical issue to address in many emerging industry standards that require the authentication and key exchange procedure to be done to guarantee the authorized machine access (e.g., from users) and secure the data transmission between machines. To overcome the shortcoming (i.e., low entropy) of the memorable password in user authentication, it is rightfully recommended by industry standards (such as IEC-62443 family) to use multifactor authentication (MFA) for higher security levels. Notably, latency is one of the main sources of inefficiency when a device is communicating with other machines on IIoT. To mitigate latency, a smooth projective hash function (SPHF) built from well-studied standard assumptions is used to achieve a lowinteractivity multifactor authenticated key exchange protocol (MFAKE) because SPHF allows each party to prove to the others that he knows the right authentication factor(s). In this article, we are, therefore, motivated to build a new MFAKE named “secure remote multifactor (SRMF)” to achieve the humaninvolved “machine-to-machine” secure communication in IIoT. That is, SRMF leverages multiple user-centric authentication factors (such as password, biometric fingerprints, and PIN), and it can synergistically support multifactor registration (MFR), MFA, and multifactor key exchange (MFKE). Furthermore, to prevent authentication factors stored at the server exposing to attackers, the password-harden service (i.e., Pythia-PRF and USENIX'15) inspires us to develop a multifactor hardening service (MFHS) utilizing an oblivious pseudorandom function (OPRF). The balanced security of the proposed protocol is proved under the model of Bellare-Pointcheval-Rogaway (EUROCRYPTO'00) along with theoretical and experimental evaluations.

Cloud storage has been in widespread use nowadays, which alleviates users' burden of local data storage. Meanwhile, how to ensure the security and integrity of the outsourced data stored in a cloud storage server has also attracted enormous attention from researchers. Proofs of storage (POS) is the main technique introduced to address this problem. Publicly verifiable POS allowing a third party to verify the data integrity on behalf of the data owner significantly improves the scalability of cloud service. However, most of existing publicly verifiable POS schemes are extremely slow to compute authentication tags for all data blocks due to many expensive group exponentiation operations, even much slower than typical network uploading speed, and thus it becomes the bottleneck of the setup phase of the POS scheme. In this article, we propose a new variant formulation called “Delegatable Proofs of Storage (DPOS)”. Then, we construct a lightweight privacy-preserving DPOS scheme, which on one side is as efficient as private POS schemes, and on the other side can support third party auditor and can switch auditors at anytime, close to the functionalities of publicly verifiable POS schemes. Compared to traditional publicly verifiable POS schemes, we speed up the tag generation process by at least several hundred times, without sacrificing efficiency in any other aspect. In addition, we extend our scheme to support fully dynamic operations with high efficiency, reducing the computation of any data update to O(log n) and simultaneously only requiring constant communication costs. We prove that our scheme is sound and privacy preserving against auditor in the standard model. Experimental results verify the efficient performance of our scheme.

As a versatile technique, cloud-fog computing extends the traditional cloud server to offer various on-demand data services. Maintaining data confidentiality is one of the most crucial requirements for data services, many cryptosystems have been proposed to reserve information privacy against such an untrusted environment. However, in cloud-fog computing, how to confidentially and efficiently share data and fetch desirable data without expensive data decryption for resource-constrained end-devices is challenging. In this paper, we propose a cloud-fog system for the Internet-of-Things (IoT) ecosystem by introducing a cryptographic primitive called server-aided revocable bilateral attribute-based encryption (SRB-ABE). Our solution is a secure and lightweight bilateral access control system with dynamic user groups, including (1) fine-grained data user and data owner access control simultaneously; (2) outsourced data source identification; (3) server-aided user revocation with publicly updatable ciphertexts; and (4) lightweight data decryption mechanism with one exponentiation computation. We present the formal definition and concrete construction of SRB-ABE with security proofs to build cloud-fog systems. The extensive comparison and experimental analysis demonstrate that our construction has superior functionality and comparable performance than the most relevant solutions.

Policy-based chameleon hash is a useful primitive for blockchain rewriting. It allows a party to create a transaction associated with an access policy, while another party who possesses enough rewriting privileges satisfying the access policy can rewrite the transaction. However, it lacks accountability. The chameleon trapdoor holder may abuse his/her rewriting privilege and maliciously rewrite the hashed object in the transaction without being identified. In this paper, we introduce policy-based chameleon hash with black-box accountability (PCHBA). Black-box accountability allows an attribute authority to link modified transactions to responsible transaction modifiers in case of dispute, in which any public user identifies those transaction modifiers from interacting with an access device/blackbox. We first present a generic framework of PCHBA. Then, we present a practical instantiation, showing its practicality through implementation and evaluation analysis.

Cyber-Physical Systems (CPS) provide the foundation of our critical infrastructures, which form the basis of emerging and future smart services and improve our quality of life in many areas. In such CPS, sensor data is transmitted over the network to the controller, which will make real-time control decisions according to the received sensor data. Due to the existence of spoofing attacks (more specifically to CPS, false data injection attacks), one has to protect the authenticity and integrity of the transmitted data. For example, a digital signature can be used to solve this issue. However, the resource-constrained field devices like sensors cannot afford conventional signature computation. Thus, we have to seek for an efficient signature mechanism that can support the fast and continuous message authentication in CPS, while being easy to compute on the devices.

In an Industrial Control System (ICS), its complex network of sensors, actuators and controllers have raised security concerns. In this paper, we proposed a technique called Process Skew that uses the small deviations in the ICS process (herein called as a process fingerprint) for anomaly detection. The process fingerprint appears as noise in sensor measurements due to the process fluctuations. Such a fingerprint is unique to a process due to the intrinsic operational constraints of the physical process. We validated the proposed scheme using the data from a real-world water treatment testbed. Our results show that we can effectively identify a process based on its fingerprint, and detect process anomaly with a very low false-positive rate.

Modern trains rely on balises (communication beacons) located on the track to provide location information as they traverse a rail network. Balises, such as those conforming to the Eurobalise standard, were not designed with security in mind and are thus vulnerable to cyber attacks targeting data availability, integrity, or authenticity. In this work, we discuss data integrity threats to balise transmission modules and use high-fidelity simulation to study the risks posed by data integrity attacks. To mitigate such risk, we propose a practical two-layer solution: At the device level, we design a lightweight and low-cost cryptographic solution to protect the integrity of the location information; at the system layer, we devise a secure hybrid train speed controller to mitigate the impact under various attacks. Our simulation results demonstrate the effectiveness of our proposed solutions.

Industrial Internet-of-Things (IIoT) is the basis of Industry 4.0, which extends Internet connectivity beyond traditional computing devices like computers and smartphones to the physical world for improving efficiency and accuracy while reducing the production cost. However, there are tremendous security threats to IIoT, such as IIoT device hijacking and data leaks. Therefore, a lightweight authenticated key agreement (AKA) protocol is commonly applied to establish a session key for securing the communication between IIoT devices. To protect the previous session keys from being compromised, perfect forward secrecy (PFS) has been one of the most important security properties of AKA. In this article, we present an efficient PFS-enabled AKA protocol for IIoT systems, which is developed based on a new dynamic authentication credential (DAC) framework, without using any public-key cryptographic primitives. It is worth noting that our protocol is also faster than the state-of-the-art DAC-based AKA protocols with PFS. Moreover, we give the formal security result of the proposed protocol in the random oracle model.

In this paper, we discuss the practical implementation of stealthy attacks on industrial control systems. We start by reviewing the attacks proposed in prior works. Then, we offer Zero-Residual Attacks (ZeRA), which allow the attacker to launch stealthy attacks leveraging estimation of the stateful anomaly detector and matching of residuals as a fraction of actual estimation residual. To perform the zero residual attack, the attacker will require the use of two state estimators each for the physical system state and the detector system state, adding complexity that was so far not discussed. We implement ZeRA and demonstrate its efficacy. Then, we propose to use a Stateful Detector (SD) to precisely detect such stealthy attacks. We design and implement the SD detector. The obtained results from the performance evaluation demonstrate that we can detect stealthy attacks such as the ZeRA, with precision above 99%, sensitivity above 99%, and Matthews correlation coefficient above 0.98.

In 2017, malware Triton was discovered in a petrol plant in Saudi Arabia, and it shut down the safety instrumented systems in the affected industrial control system without being noticed by the operators. If the malware was not discovered by a security company on time, it could leave the system running without any safety measures, and eventually lead to an explosion. To detect such attacks, one can track the running status of the devices in the field to know that they are still "alive". However, in practice, there yet does not exist an efficient and cryptographically secure mechanism/ protocol that can prove the aliveness of a device to control centers over an open network.

Ensuring the correct behaviour of an application is a critical security issue. One of the most popular ways to modify the intended behaviour of a program is to tamper its binary. Several solutions have been proposed to solve this problem, including trusted computing and anti-tampering techniques. Both can substantially increase security, and yet both have limitations. In this work, we propose an approach which combines trusted computing technologies and anti-tampering techniques, and that synergistically overcomes some of their inherent limitations. In our approach critical software regions are protected by leveraging on trusted computing technologies and cryptographic packing, without introducing additional software layers. To illustrate our approach we implemented a secure monitor which collects user activities, such as keyboard and mouse events for insider attack detection. We show how our solution provides a strong anti-tampering guarantee with a low overhead: around 10 lines of code added to the entire application, an average execution time overhead of 5.7% and only 300KB of memory allocated for the trusted module.

Billions of Internet of Things (IoT) devices are being adopted in our daily life as personal wearables, home automation agents, medical appliances, etc. Many domains of their use nowadays rely on the privacy and security of these devices-critical infrastructure, healthcare, logistics, manufacturing. In this paper, we aim to establish a standardized framework, which does not require access to physical devices yet allows to profile security and privacy-sensitive functionality in both existing and upcoming IoT products, based on semantic analysis of discovered technical information. We develop a software tool for automatic feature profiling of IoT devices and present case studies on two real-world IoT devices-a fitness tracker, Garmin Forerunner 230, and a voice-controlled home assistant, Amazon Echo Dot second generation and further provide comparative results analysis.

Public key cryptographic primitive (e.g., the famous Diffie-Hellman key agreement, or public key encryption) has recently been used as a standard building block in authenticated key agreement (AKA) constructions for wireless sensor networks (WSNs) to provide perfect forward secrecy (PFS), where the expensive cryptographic operation (i.e., exponentiation calculation) is involved. However, realizing such complex computation on resource-constrained wireless sensors is inefficient and even impossible on some devices. In this work, we introduce a new AKA scheme with PFS for WSNs without using any public key cryptographic primitive. To achieve PFS, we rely on a new dynamic one-time authentication credential that is regularly updated in each session. In particular, each value of the authentication credential is wisely associated with at most one session key that enables us to fulfill the security goal of PFS. Furthermore, the proposed scheme enables the principals to identify whether they have been impersonated previously. We highlight that our scheme can be very efficiently implemented on sensors since only hash function and XOR operation are required.

In-vehicle security research is challenging because it is hard for most researchers to get a real vehicle for security evaluation. On the other hand, the existing software solutions are either very expensive or having very limited functionality. There is a high demand for a convenient tool which can generate flexible datasets for in-vehicle attack and defense evaluation. In this work, we design and develop an Attack Traffic Generation (ATG) tool for security testing of in-vehicle CAN bus. It removes the barrier for research in this area by providing an open-source software package which works with a cheap, widely available hardware configuration. ATG provides a free and functional toolkit to automotive security researchers for easy and effective interaction with real or simulated CAN bus. One of the most important features of ATG is automatic generation of attack payloads. The payloads can be preconfigured and used within multiple attack modes. ATG can inject attack packets into CAN bus and record the CAN bus traffic in real time. The replay mode enables effective evaluation of CAN bus security implementations using the pre-classified datasets. In addition, a unified data format for raw re-playable CAN sequences enables different automotive research teams to exchange datasets and preform security testing simultaneously against different vehicles and simulation hardware.

A novel scheme is proposed to authenticate sensors and detect data integrity attacks in a Cyber Physical System (CPS). The proposed technique uses the hardware characteristics of a sensor and physics of a process to create unique patterns (herein termed as fingerprints) for each sensor. The sensor fingerprint is a function of sensor and process noise embedded in sensor measurements. Uniqueness in the noise appears due to manufacturing imperfections of a sensor and due to unique features of a physical process. To create a sensor's fingerprint a system-model based approach is used. A noise-based fingerprint is created during the normal operation of the system. It is shown that under data injection attacks on sensors, noise pattern deviations from the fingerprinted pattern enable the proposed scheme to detect attacks. Experiments are performed on a dataset from a real-world water treatment (SWaT) facility. A class of stealthy attacks is designed against the proposed scheme and extensive security analysis is carried out. Results show that a range of sensors can be uniquely identified with an accuracy as high as 98%. Extensive sensor identification experiments are carried out on a set of sensors in SWaT testbed. The proposed scheme is tested on a variety of attack scenarios from the reference literature which are detected with high accuracy

In modern societies, critical services such as transportation, power supply, water treatment and distribution are strongly dependent on Industrial Control Systems (ICS). As technology moves along, new features improve services provided by such ICS. On the other hand, this progress also introduces new risks of cyber attacks due to the multiple direct and indirect dependencies between cyber and physical components of such systems. Performing rigorous security tests and risk analysis in these critical systems is thus a challenging task, because of the non-trivial interactions between digital and physical assets and the domain-specific knowledge necessary to analyse a particular system. In this work, we propose a methodology to model and analyse a System Under Test (SUT) as a data flow graph that highlights interactions among internal entities throughout the SUT. This model is automatically extracted from production code available in Programmable Logic Controllers (PLCs). We also propose a reachability algorithm and an attack diagram that will emphasize the dependencies between cyber and physical domains, thus enabling a human analyst to gauge various attack vectors that arise from subtle dependencies in data and information propagation. We test our methodology in a functional water treatment testbed and demonstrate how an analyst could make use of our designed attack diagrams to reason on possible threats to various targets of the SUT.

An attack detection scheme is proposed to detect data integrity attacks on sensors in Cyber-Physical Systems (CPSs). A combined fingerprint for sensor and process noise is created during the normal operation of the system. Under sensor spoofing attack, noise pattern deviates from the fingerprinted pattern enabling the proposed scheme to detect attacks. To extract the noise (difference between expected and observed value) a representative model of the system is derived. A Kalman filter is used for the purpose of state estimation. By subtracting the state estimates from the real system states, a residual vector is obtained. It is shown that in steady state the residual vector is a function of process and sensor noise. A set of time domain and frequency domain features is extracted from the residual vector. Feature set is provided to a machine learning algorithm to identify the sensor and process. Experiments are performed on two testbeds, a real-world water treatment (SWaT) facility and a water distribution (WADI) testbed. A class of zero-alarm attacks, designed for statistical detectors on SWaT are detected by the proposed scheme. It is shown that a multitude of sensors can be uniquely identified with accuracy higher than 90% based on the noise fingerprint.

Bandwidth measurement is important for many network applications and services, such as peer-to-peer networks, video caching and anonymity services. To win a bandwidth-based competition for some malicious purpose, adversarial Internet hosts may falsely announce a larger network bandwidth. Some preliminary solutions have been proposed to this problem. They can either evade the bandwidth inflation by a consensus view (i.e., opportunistic bandwidth measurements) or detect bandwidth frauds via forgeable tricks (i.e., detection through bandwidth's CDF symmetry). However, smart adversaries can easily remove the forgeable tricks and report an equally larger bandwidth to avoid the consensus analyses. To defend against the smart bandwidth inflation frauds, we design magic train, a new measurement method which combines an unpredictable packet train with estimated round-trip time (RTT) for detection. The inflation behaviors can be detected through highly contradictory bandwidth results calculated using different magic trains or a train's different segments, or large deviation between the estimated RTT and the RTT reported by the train's first packet. Being an uncooperative measurement method, magic train can be easily deployed on the Internet. We have implemented the magic train using RAW socket and LibPcap, and evaluated the implementation in a controlled testbed and the Internet. The results have successfully confirmed the effectiveness of magic train in detecting and preventing smart bandwidth inflation attacks.

In this paper, we analyze the inherent characteristic of electronic medical records (EMRs) from actual electronic health (eHealth) systems, where we found that first, multiple patients would generate large amounts of duplicate EMRs and second, cross-patient duplicate EMRs would be generated numerously only in the case that the patients consult doctors in the same department. We then propose the first efficient and secure encrypted EMRs deduplication scheme for cloud-assisted eHealth systems (HealthDep). With the integration of our analysis results, HealthDep allows the cloud server to efficiently perform the EMRs deduplication, and enables the cloud server to reduce storage costs by more than 65% while ensuring the confidentiality of EMRs. Security analysis shows that HealthDep provides a stronger security guarantee than Marforio et al.'s scheme (NDSS 2014) and Bellare et al.'s scheme (USENIX Security 2013). Algorithm implementation and performance analysis demonstrate the feasibility and high efficiency of HealthDep.

Development and deployment of cyber security measures for legacy SCADA systems usually encounter challenges of limited computation resources in the field devices for supporting the designed cryptography processing. This paper presents a scheme with which the field device performs message authentication and integrity check only on selected critical packets such that it protects the system operation while avoiding high computation workload, and applies the scheme to a transportation SCADA system. The proposed scheme takes into account of the SCADA computation power limitation and real time requirements, and the extreme difficulty of making any changes to hardware or software in the legacy system. AES-CCM and symmetric key methods are applied for providing message authentication and integrity, and a bump-in-the-wire (BITW) implementation approach is adopted to avoid the changes to the legacy system. This lightweight packet authentication scheme is implemented and demonstrated over a testbed of a metro transportation SCADA system. Experiments show the effects of the scheme in blocking malicious packet attack and the comparison with a firewall approach.

The anonymous password authentication scheme proposed in ACSAC'10 under an unorthodox approach of password wrapped credentials advanced anonymous password authentication to be a practically ready primitive, and it is being standardized. In this paper, we improve on that scheme by proposing a new method of "public key suppression" for achieving server-designated credential verifiability, a core technicality in materializing the concept of password wrapped credential. Besides better performance, our new method simplifies the configuration of the authentication server, rendering the resulting scheme even more practical. Further, we extend the idea of password wrapped credential to biometric wrapped credential}, to achieve anonymous biometric authentication. As expected, biometric wrapped credentials help break the linear server-side computation barrier intrinsic in the standard setting of biometric authentication. Experimental results validate the feasibility of realizing efficient anonymous biometric authentication.

In this paper, we propose a privacy-preserving reservation system for electric vehicles (EV) charging stations. Due to the short driving range of EV, frequent charging is necessary. A mechanism for charging station reservation for EV owners is desirable. Our proposed system allows the vehicle owner to reserve a number of charging stations along the intended route at different time-slots. Yet it is secure against misuse such that a user can only hold a limited number of reservations simultaneously. More importantly, our system can provide privacy for users. The charging station does not know the identity of the user who has reserved it. Thus location privacy can be protected. We demonstrate the practicality of our system with a prototype implementation on a smart phone. Finally, we also provide a security proof to show that our system is secure under well-known computational assumptions.

Cryptographic computations are often carried out on insecure devices for which the threat of key exposure raises a serious concern. In an effort to address the key exposure problem, the notion of forward security was first presented by Günther in 1990. In a forward-secure scheme, secret keys are updated at regular periods of time; exposure of the secret key corresponding to a given time period does not enable an adversary to ‘break’ the scheme for any prior time period. In this paper, we first introduce forward security into certificate-based cryptography and define the security model of forward-secure certificate-based signatures (CBSs). Then we propose a forward-secure CBS scheme, which is shown to be secure against adaptive chosen message attacks under the computational Diffie–Hellman assumption in the random oracle model. Our result can be viewed as the first step toward solving the key exposure problem in CBSs and thus improving the security of the whole system.

Data sharing has never been easier with the advances of cloud computing, and an accurate analysis on the shared data provides an array of benefits to both the society and individuals. Data sharing with a large number of participants must take into account several issues, including efficiency, data integrity and privacy of data owner. Ring signature is a promising candidate to construct an anonymous and authentic data sharing system. It allows a data owner to anonymously authenticate his data which can be put into the cloud for storage or analysis purpose. Yet the costly certificate verification in the traditional public key infrastructure (PKI) setting becomes a bottleneck for this solution to be scalable. Identity-based (ID-based) ring signature, which eliminates the process of certificate verification, can be used instead. In this paper, we further enhance the security of ID-based ring signature by providing forward security: If a secret key of any user has been compromised, all previous generated signatures that include this user still remain valid. This property is especially important to any large scale data sharing system, as it is impossible to ask all data owners to re-authenticate their data even if a secret key of one single user has been compromised. We provide a concrete and efficient instantiation of our scheme, prove its security and provide an implementation to show its practicality.

In this paper, we propose a new notion called$k$-times attribute-based anonymous access control, which is particularly designed for supporting cloud computing environment. In this new notion, a user can authenticate himself/herself to the cloud computing server anonymously. The server only knows the user acquires some required attributes, yet it does not know the identity of this user. In addition, we provide a$k$-times limit for anonymous access control. That is, the server may limit a particular set of users (i.e., those users with the same set of attribute) to access the system for a maximum$k$-times within a period or an event. Further additional access will be denied. We also prove the security of our instantiation. Our implementation result shows that our scheme is practical.

In previous privacy-preserving multiauthority attribute-based encryption (PPMA-ABE) schemes, a user can acquire secret keys from multiple authorities with them knowing his/her attributes and furthermore, a central authority is required. Notably, a user's identity information can be extracted from his/her some sensitive attributes. Hence, existing PPMA-ABE schemes cannot fully protect users' privacy as multiple authorities can collaborate to identify a user by collecting and analyzing his attributes. Moreover, ciphertext-policy ABE (CP-ABE) is a more efficient public-key encryption, where the encryptor can select flexible access structures to encrypt messages. Therefore, a challenging and important work is to construct a PPMA-ABE scheme where there is no necessity of having the central authority and furthermore, both the identifiers and the attributes can be protected to be known by the authorities. In this paper, a privacy-preserving decentralized CP-ABE (PPDCP-ABE) is proposed to reduce the trust on the central authority and protect users' privacy. In our PPDCP-ABE scheme, each authority can work independently without any collaboration to initial the system and issue secret keys to users. Furthermore, a user can obtain secret keys from multiple authorities without them knowing anything about his global identifier and attributes.

We propose an anonymous authentication protocol that supports time-bound credentials for an efficient revocation. It is especially suitable for large-scale network in roaming scenario. With our newly designed group signature scheme as a building block, a timestamp can be embedded to user secret key. No expired key can be used to authenticate, and hence naturally revoked users (e.g., due to contract expiration) are not required to be put into the revocation list. This makes our protocol much faster than previous roaming protocols in terms of revocation checking, which is a main part in verification.

Watchdog technique is a fundamental building block to many trust systems that are designed for securing wireless sensor networks (WSNs). Unfortunately, this kind of technique consumes much energy and hence largely limits the lifespan of WSN. Although the state-of-the-art studies have realized the importance of trust systems' efficiency in WSNs and proposed several preliminary solutions, they have overlooked to optimize the watchdog technique, which is perhaps among the top energy-consuming units. In this paper, we reveal the inefficient use of watchdog technique in existing trust systems, and thereby propose a suite of optimization methods to minimize the energy cost of watchdog usage, while keeping the system's security in a sufficient level. Our contributions consist of theoretical analyses and practical algorithms, which can efficiently and effectively schedule the watchdog tasks depending on the sensor nodes' locations and the target nodes' trustworthiness. We have evaluated our algorithms through experiments on top of a WSNET simulation platform and an in-door WSN testbed in our collaborative lab. The results have successfully confirmed that our watchdog optimization techniques can save at least 39.44% energy without sacrificing much security (<;0.06 in terms of trust accuracy and robustness), even in some cases enhance the protection against certain attacks.

Availability of the charging infrastructure is critical for a smooth rollout of wide-scale electric vehicle (EV) adoption. Safe integration of the charging infrastructure with the power grid heavily relies on an intelligent platform to support demand-side management and a secure information and communication system to coordinate events. However, security has been identified as an area falling short of the desired expectation in the smart grid, possibly introducing considerable risk to the reliability and stability of the power grid. In addition, a concrete demand-side management system that is compatible with state-of-the-art EVs is also lacking. This paper fills the gap by proposing a scalable defence-in-depth cybersecurity architecture for the charging infrastructure and a demand response scheme for smart EV charging. The feasibility of the system is demonstrated by implementation and testing on a real vehicle.

Entity authentication and related key management is an active research topic in smart grid security. However, existing works seem to have overlooked the significance that the smart grid is a cyber-physical system, which entails more considerations in the integration of its cyber and physical domains. Ignoring this could possibly undermine security since the effects of cyber authorization in the smart grid are usually extended into the physical domain. The substitution attack, a kind of the man-in-the-middle attack, has been demonstrated using this gap. This paper proposes a two-factor cyber-physical device authentication protocol to defend against coordinated cyber-physical attacks in the smart grid. The idea is to combine a novel contextual factor based on physical connectivity in the power grid with the conventional authentication factor in the challenge-response protocol, widely used in cybersecurity. The resulting protocol provides assurance on not only the digital identity of a device but also the device's controllability in the physical domain. While the design is for the electric vehicle ecosystem, the framework could be readily extended to other smart grid subsystems.

The vision of the Internet of Things (IoT), supported by industrial companies and governments all over the world, marks an evolution that will surely have a great impact on our environments and our lives. The central element of this vision is the existence of a network of interconnected objects (electrical appliances, wearable devices, industrial machinery, etc). Under the context of the IoT, these objects not only can exchange data anytime and anywhere, but also collaborate in the provisioning of novel services. In fact, some of these services are already available: web-based portals that enable the creation of aggregated services using world-wide sensor data, industrial systems that enable the development of preventive maintenance processes, and many others. However, protecting the IoT is a complex and difficult task. The current Internet is already under constant attack due to a mixture of several factors: technical (e.g. vulnerable systems, unsecure protocols), legal (e.g. jurisdiction problems), and human (e.g. targeted attacks, usability problems).The Internet of Things will not only inherit these problems, but will also have some important issues of its own. The heterogeneity of protocols and devices will make the development of interoperable, fault-tolerant security services a daunting task. The connectivity that is crucial to the IoT will make critical infrastructures extremely vulnerable against cascade failures. Moreover, as the IoT will process countless bits of personal data, the management of personal privacy might become a nightmare. The purpose of this special issue is to introduce six research articles whose goal is to provide solutions to some of the most urgent problems related to IoT security: secure communications, authentication and authorization, user privacy, and security assessment. Moreover, in line with the inherent heterogeneity of the IoT, this special issue will not focus on one single technology, but will provide an analysis of several protocols and systems (RFID systems, sensor networks, critical infrastructures). The contributions of these papers are outlined in the succeeding text. As Radio Frequency Identification (RFID) systems can be considered as one of the foundational stones of the IoT, it is important to develop a communication system that enables RFID tags to securely connect to the Internet. That is precisely the goal of the article entitled “Secure communication with RFID tags in the internet of things”, by Dominikus and Kraxberger. In this article, the authors develop Mobile-IPv6 enabled RFID tags, which can connect to the Internet through RFID readers. Moreover, these tags can also integrate end-to-end IPsec security services, effectively protecting the information exchange between the tags and the remote servers. Wireless sensor networks, or WSN, can also be considered as one of the essential elements of the IoT. These resource-constrained networks usually make use of the IPv6 over Low-power Wireless Personal Area Networks (6LoWPAN) protocol to connect to external Internet hosts. However, this protocol does not explicitly define an IPsec extension. Therefore, Shahid et al. analyzed how IPsec could be successfully integrated in 6LoWPAN in their article “Secure communication for the Internet of Things - A comparison of Link-Layer security and IPsec for 6LoWPAN”. Their analysis shows how IPsec can be a feasible option for securing the IoT in terms of performance and scalability. As aforementioned, privacy is one of the most important research challenges in the context of the IoT. More specifically, in the case of RFID systems, it is essential to develop security mechanisms that avoid user data to be leaked to unauthorized parties. This special issue introduces two mechanisms that provide efficient solutions to this particular problem. In “How to protect security and privacy in the IoT: A policy-based RFID tag management protocol”, Rekleitis, Rizomiliotis and Gritzalis provide a desirable set of management operations (from delegation of querying rights to ownership transfer) that allow users to manage their own set of RFID tags. On the other hand, in “A context-aware approach to defend against unauthorized reading and relay attacks in RFID systems”, Ma and Saxena make use of on-board sensors to provide contextual information to the RFID tags. This contextual information can be used to develop enhanced authorization policies, such as selective unlocking according to location. These two functions, authorization and context awareness, are also studied by Bai et al. in “Context-Aware Usage Control for Web of Things”. In this article, the authors develop a model that enables users to define their own context-aware security policies. Such policies are then applied to Internet-connected “intranet of things” environments, like smart homes. In fact, the authors provide an example of a working prototype, which enables users to control the appliances of their smart home in an intelligent and secure way. Finally, in “Assessing the Security of Internet Connected Critical Infrastructures”, Ghani et al. develop a set of security metrics that can be used to monitor the integrity of Internet-connected Critical Infrastructures (CIs). In particular, the authors first define a set of metric-based Service-Level Agreements (SLAs), which capture the user requirements of all CIs. Afterwards, a metrics monitoring system receives the measures from various sensors, which are then compared to the SLAs. Consequently, the system can detect potential problems before they happen – and act before a cascade event further damages the integrity of the CIs. We would like to express our gratitude to Professor Hsiao-Hwa Chen and Professor Hamid R. Sharif, Editors-in-Chief of the Security and Communication Networks journal, for their support before and during the development of this special issue. We would also like to thank the authors that chose to publish their research findings in this special issue. The Internet of Things is in dire need of strong security foundations, and we believe these research results will help to build a more secure future. Finally, we would like to thank all the reviewers that, with their time and their comments, helped the authors to strengthen their security protocols and mechanisms.

The convergence of multiple paradigms, visions, and technologies – Internet of Things (IoT) and Web of Things (WoT); Ambient Intelligence (AmI); Machine-to-Machine (M2M); and many others – is giving birth to a world of interconnected things. A world where any entity (be it a machine, an object, a person, or anything) can collaborate with each other, anytime and anywhere, in the provisioning of services. This concept of a truly interconnected world is at its infancy, yet there are various commercial players pushing previously envisioned services to the real world: from centralized Big Data repositories to “intranet of things” systems, from industrial information services to personal wearable sensor systems. Moreover, this evolution does not stop here, as the scientific community is constantly researching new advances in this area. Additionally, there is a factor that must not be overlooked in the development of this interconnected world: security. To truly understand the importance of this factor, we just need to check the state of another interconnected infrastructure: the current Internet. While functional and resilient, the current Internet is still a target of malicious attacks that affect both its users and its infrastructure. However, the scope of a truly interconnected world goes well beyond the current Internet: encompassing a global interoperable connectivity and accessibility by a myriad of heterogeneous entities, with countless data streams that can be aggregated and processed when necessary. Without the proper fault-tolerant security mechanisms, all this wealth of services and information might be not only accessed by users but also manipulated by malicious attackers. Precisely, due to the existence of such information flows, we also cannot let privacy go unnoticed in the development of security solutions for this particular context. Not only are the personal data of users at stake (e.g. daily life, medical records, private information), but also the confidential information managed by larger entities. Consequently, the purpose of this special issue is to introduce six research articles that study how to protect users and devices in the context of an interconnected world, with a special emphasis on privacy-preserving solutions. The contributions of these papers are outlined in the succeeding text. The privacy challenges are not only daunting, but also uncharted. Who are the stakeholders? What concrete threats exist, and how can they be defined? What is the impact of these threats? How can the stakeholders react against these threats? The goal of the article entitled “Privacy in the Internet of Things: Threats and Challenges”, by Ziegeldorf, Garcia-Monchon, and Wehrle, is to provide detailed answers to all these questions. Note that, even if the article focuses specifically on the Internet of Things, most of its analysis can be applied to all the other paradigms that compose this interconnected vision – as they share various underlying principles such as heterogeneous connectivity. In an interconnected world, it is essential for the devices to route the information to each other. One possible solution, which has been studied for years in the area of big distributed infrastructures, are P2P overlay networks. Still, there are several challenges in this area, such as how to manage the users’ identities while preserving their anonymity, and the existence of various attacks that can manipulate how identities are assigned (e.g. Sybil, Eclipse, MITM). The purpose of the paper entitled “RIAPPA: a Robust Identity Assignment Protocol for P2P overlays”, by Caubet et al., is to provide a generic, not algorithm-dependant protocol that can deal with these challenges. In the exchange of information between things, it is not only important to provide anonymity when necessary, but also to maintain a certain Quality of Service (QoS) to avoid excessive service degradation. The goal of the paper entitled “On Collaborative Anonymous Communications in Lossy Networks”, by Rebollo-Monedero et al., is to introduce a Crowds-like protocol for anonymous communication that establishes quantifiable metrics of anonymity and QoS. Such metrics enable the authors to perform a detailed mathematical analysis of the protocol, effectively improving the scope of the original Crowds protocol while achieving a reasonable balance between anonymity and QoS. In fact, due to the importance of maintaining a reasonable QoS while applying the security protocols, this special issue includes the paper entitled “Analysis and Taxonomy of Security/QoS tradeoff solutions for the Future Internet”, by Nieto and Lopez. This paper provides a thorough analysis of the coexistence of security and QoS mechanisms within the context of Future Internet scenarios. The paper analyses existing solutions and identifies potential problems, and also describes the major pitfalls in the integration of existing networking models such as Wireless Sensor Networks (WSN) and Cellular networks. Most of the previous papers focus on anonymity. But there are other privacy issues that must be taken into vaccount. For example, by continuously querying the network about several topics, users can be profiled – which in some cases might reveal bits of information even more important and private than our identities. The paper entitled “Enhancing Information Lookup Privacy through Homomorphic Encryption”, by Fotiou et al., provides a broker-based solution to this problem. Such a solution is also optimized, achieving a balance between the complexity of the computations and the communication overhead between the involved parties. Finally, if the networked embedded systems that comprise our interconnected world are not properly designed to comply with various security properties, attackers will surely find their way to break into them – no matter what security and privacy protocols are developed. The article entitled “Integrating security mechanisms into embedded systems by domain-specific modeling”, by Vasilevskaya et al., combine security and software engineering solutions (e.g. Model-based development (MBD), information security ontology) in order to allow system designers to easily integrate security requirements during the design process. We would like to express our gratitude to Professor Hsiao-Hwa Chen and Professor Hamid R. Sharif, Editors-in-Chief of the Security and Communication Networks journal, for their support before and during the development of this special issue. We would also like to thank the authors that chose to publish their research findings in this special issue, as a truly interconnected world is within our grasp – but we must find ways to protect it before it becomes a liability rather than a blessing. Finally, we would like to thank all the reviewers that, with their time, efforts, and their comments, helped the authors to strengthen their security protocols and mechanisms.

ABSTRACT Document clustering is a practical and powerful data mining technique to analyze large amount of documents and large sets of text or hypertext documents. However, it also brings the problem of sensitive information leaking in disregard of privacy, especially when it is executed in distributed environment. In this paper, we propose a cryptography‐based framework to realize privacy‐preserving document clustering among the users under the distributed environment; there are two parties, each having his private document database, want to collaboratively execute agglomerative document clustering without disclosing their private contents. We provide two implementations of such a framework, one is with more precision and stronger security but requires more computational resources. The other is a simplified version with less computational complexity and achieves higher processing speed. Additionally, we provide the security proofs and experimental analysis of precision and scalability of our proposal. Copyright © 2013 John Wiley & Sons, Ltd.

In this paper, we construct a linkable ring signature scheme with unconditional anonymity. It has been regarded as an open problem in [22] since 2004 for the construction of an unconditional anonymous linkable ring signature scheme. We are the first to solve this open problem by giving a concrete instantiation, which is proven secure in the random oracle model. Our construction is even more efficient than other schemes that can only provide computational anonymity. Simultaneously, our scheme can act as an counterexample to show that [19, Theorem 1] is not always true, which stated that linkable ring signature scheme cannot provide strong anonymity. Yet we prove that our scheme can achieve strong anonymity (under one of the interpretations).

Data sharing is an important functionality in cloud storage. In this paper, we show how to securely, efficiently, and flexibly share data with others in cloud storage. We describe new public-key cryptosystems that produce constant-size ciphertexts such that efficient delegation of decryption rights for any set of ciphertexts are possible. The novelty is that one can aggregate any set of secret keys and make them as compact as a single key, but encompassing the power of all the keys being aggregated. In other words, the secret key holder can release a constant-size aggregate key for flexible choices of ciphertext set in cloud storage, but the other encrypted files outside the set remain confidential. This compact aggregate key can be conveniently sent to others or be stored in a smart card with very limited secure storage. We provide formal security analysis of our schemes in the standard model. We also describe other application of our schemes. In particular, our schemes give the first public-key patient-controlled encryption for flexible hierarchy, which was yet to be known.

In smart grid, households may send the readings of their energy usage to the utility and a third-party service provider which provides analyzed statistics data to users. User privacy becomes an important issue in this application. In this paper, we propose a new cryptographic-based solution for the privacy issue in smart grid systems. The advantages of our system are twofold: Households can send authenticated energy consumption readings to a third-party service provider anonymously. The service provider learns only the region where the readings come from but not their respective identities. On the other hand, users with personal secret information can enquiry their usage history records or regional statistics.

Recently, Halevi et al. (CCS '11) proposed a cryptographic primitive called proofs of ownership (PoW) to enhance security of client-side deduplication in cloud storage. In a proof of ownership scheme, any owner of the same file F can prove to the cloud storage that he/she owns file F in a robust and efficient way, in the bounded leakage setting where a certain amount of efficiently-extractable information about file F is leaked. Following this work, we propose a secure client-side deduplication scheme, with the following advantages: our scheme protects data confidentiality (and some partial information) against both outside adversaries and honest-but-curious cloud storage server, while Halevi et al. trusts cloud storage server in data confidentiality; our scheme is proved secure w.r.t. any distribution with sufficient min-entropy, while Halevi et al. (the last and the most practical construction) is particular to a specific type of distribution (a generalization of "block-fixing" distribution) of input files.

Touchscreen mobile devices are becoming commodities as the wide adoption of pervasive computing. These devices allow users to access various services at anytime and anywhere. In order to prevent unauthorized access to these services, passwords have been pervasively used in user authentication. However, password-based authentication has intrinsic weakness in password leakage. This threat could be more serious on mobile devices, as mobile devices are widely used in public places.

The advances in the digital world (e.g. the Internet, Communications, etc.) are closing the gap between consumers and providers, in both Business to Consumer and Business to Business environments. Through the Internet, providers can offer their products directly to consumers, which increase their choices and allow them to contract a set of different services/products from different providers. But sometimes the consumer needs an all-or-nothing exchange with these providers: an atomic exchange. The consumer has negotiated/obtained a set of conditions that are only met if she acquires all the services/products. Thus, we need an Atomic Multi-Two-Party contract signing protocol. Even though digital signature of contracts is a topic that has been widely studied, it lacks a solution when applied to Atomic Multi-Two-Party scenarios. Here, we propose the first solution to solve this problem.

Linkable ring signatures have found many attractive applications. One of the recent important extensions is a linkable threshold ring signature (LTRS) scheme. Unfortunately, the existing LTRS schemes are only secure in the random oracle model (ROM). In this paper, we make the following contributions. First, we construct the first LTRS scheme that is secure without requiring the ROM. Further, we enhance the security of a threshold ring signature (for both linkable or non-linkable) by providing a stronger definition of anonymity. This strengthened notion makes threshold ring signature schemes more suitable in real life. Finally, we provide efficient schemes that outperform the existing schemes in the literature. Our scheme is particularly suitable for electronic commerce or electronic government where anonymity and accountability are the most concerned factors.

We describe a secure and unrestricted identity-based ring signature scheme in the standard model. Our construction is provably fully secure in the standard model under static assumptions and is motivated by an existing HIBE scheme. Our observation on the relationship between ID-based ring signatures and HIBE is of interest to researchers in other fields as well. Following the strongest anonymity definition in ring signatures, we define a new level of anonymity for ID-based ring signatures in which the attacker can specify the randomness used in the creation of the user secret key, in addition to the private key generators master key. Our scheme provides unconditional anonymity in this model.

A prominent issue in group signatures is revoking a group member's signing capability. To solve this issue, the group manager can send revocation messages only to signature verifiers, known as group signatures with verifier-local revocation (VLR). In existing VLR designs, the cost of revocation check grows linearly with the size of revocation messages. This paper introduces time-bound keys into group signatures to reduce the size of revocation messages and speed up the revocation check. In the new notion, the secret key of each group member is associated with an expiration date, and verifiers can tell (at a constant cost) whether or not a group signature is produced using an expired key. Consequently, revocation messages only need to provide the information about group members revoked prematurely (e.g., due to key compromise) but not those with expired keys. This will lead to a significant saving on revocation check in situations where prematurely revoked members are only a small fraction of revoked members. Following this approach, we give two concrete designs of group signatures with VLR to demonstrate the trade-offs between efficiency and privacy.

ABSTRACT The advance in information technology has made video service a market with great commercial value. As an example, in‐vehicle infotainment has been introduced to vehicles with which customers can enjoy subscribed media services wherever they are. This paper investigates the authentication in commercial video services using a recently proposed protocol, the Sun–Leu protocol, as baseline. Several important security and performance requirements are revisited, including mutual authentication, anonymous authentication, one‐to‐many delivery, low communication cost and the security against replay attacks. We provide a detailed analysis of the Sun–Leu protocol against these requirements, based on which an enhanced authentication scheme is proposed. The new scheme is designed within the framework of the Sun–Leu protocol, preserves all merits of the original protocol and provides a higher level of security for video communication services. Copyright © 2012 John Wiley & Sons, Ltd.

ABSTRACT A wireless sensor network composed of a number of sensor nodes is often deployed in unattended and harsh environments to perform various monitoring tasks. Due to cost concerns, usually, sensor nodes are not made tamper‐resistant, and a captured node may be easily compromised by an adversary. With the revealed secret credentials, the adversary can create many duplicate nodes that are seemingly legitimate, and deploy them into the network to cripple the monitoring applications. Defending against node replication attacks has become an important research topic in sensor network security, but so far, not many solutions have been proposed, most of which adopt a stationary network model where sensor nodes are fixed and immobile. In this work, we address the problem of detecting node replication attacks in a mobile sensor network, where each sensor node freely and randomly roams in the sensing region all the time, and one node meets with another in an occasional and unpredictable manner. For replication attacks where the replicas do not conspire, we employ very lightweight token‐based authentication as a detection approach. In case the replicas conspire by communicating with each other in an efficient manner, we harness the random encounters between physical nodes and propose a detection method based on statistics. Compared with existent solutions, our detections have the nice feature that sensor nodes are freed from the fragile assumption that they can correctly obtain their geographic positions, and that even loose time synchronization may be unnecessary. Copyright © 2011 John Wiley & Sons, Ltd.

In order to construct a CCA-secure (i.e. secure against chosen ciphertext attack) public key encryption scheme using the usual KEM/DEM (Key Encapsulation Mechanism/Data Encapsulation Mechanism) framework, one needs KEM and DEM schemes, both of which are CCA-secure. A CCA-secure DEM scheme can be constructed in a various way, but in order to construct a hybrid scheme producing ciphertexts of compact size, the DEM scheme needs to be a length-preserving symmetric cipher. However, it has been pointed out in the recent literature that the length-preserving symmetric cipher is in fact fairly expensive to realize because one needs strong PRP (pseudo random permutation) which is complex. As alternatives to the KEM/DEM framework for constructing compact hybrid encryption have been introduced in the public key (non identity-based) setting. In this paper, as contributions to this line of research, we construct hybrid identity-based encryption schemes which produce compact ciphertexts while providing both efficiency and strong security without resorting to the strong length-preserving symmetric cipher. In particular, all of the proposed schemes incur only one group element ciphertext expansion (defined as the size of the ciphertext minus the size of the plaintext message) and do not depend on the strong PRP. We provide security analysis of our schemes against chosen ciphertext attack under the well-known computational assumptions, in the random oracle model. We believe that our schemes are suitable for implementing on small devices.

An identity-based online/offline encryption (IBOOE) scheme splits the encryption process into two phases. The first phase performs most of the heavy computations, such as modular exponentiation or pairing over points on elliptic curve. The knowledge of the plaintext or the receiver's identity is not required until the second phase, where the ciphertext is produced by only light computations, such as integer addition/multiplication or hashing. This division of computations makes encryption affordable by devices with limited computation power since the preparation works can be executed "offline" or possibly by some powerful devices. The identity-based (ID-based) nature of the scheme also allows the preparation of ciphertext without certificate verification.

In an end-to-end encryption model for a wireless sensor network (WSN), the network control center preloads encryption and decryption keys to the sensor nodes and the subscribers respectively, such that a subscriber can use a mobile device in the deployment field to decrypt the sensed data encrypted by the more resource-constrained sensor nodes. This paper proposes SMS-SED, a provably secure yet practically efficient key assignment system featuring a discrete time-based access control, to better support a business model where the sensors deployer rents the WSN to customers who desires a higher flexibility beyond subscribing to strictly consecutive periods. In SMS-SED, a node or a mobile device stores a secret key of size independent of the total number of sensor nodes and time periods. We evaluated the feasibility of deploying 2000 nodes for 4096 time periods at 1024-bit of security as a case study, studied the trade off of increasing the storage requirement of a node to significantly reduce its computation time, and provided formal security argument in the random oracle model.

In this paper, we present the notion and construction of threshold ring signature without random oracles. This is the first scheme in the literature that is proven secure in the standard model. Our scheme extends the Shacham-Waters signature from PKC 2007 in a non-trivial way. We note that our technique is specifically designed to achieve a threshold ring signature in the standard model. Interestingly, we can still maintain the signature size to be the same as the Shacham-Waters signature, while only a tiny computation cost is added.

Abstract Energy distribution systems are becoming increasingly widespread in today's society. One of the elements that are used to monitor and control these systems are SCADA (Supervisory Control and Data Acquisition) systems. In particular, these control systems and their complexities, together with the emerging use of the Internet and wireless technologies, bring new challenges that must be carefully considered. Examples of such challenges are the particular benefits of the integration of those new technologies, and also the effects they may have on the overall SCADA security. The main task of this paper is to provide a framework that shows how the integration of different state‐of‐the‐art technologies in an energy control system, such as wireless sensor networks, mobilead hocnetworks, and the Internet, can bring some interesting benefits, such as status management and anomaly prevention, while maintaining the security of the whole system. Copyright © 2010 John Wiley & Sons, Ltd.

In March 2010, the 2010 Workshop on RFID Security (RFIDSec'10 Asia) was held in Singapore, in which we served as program co-chairs.Aligned with the earliest RFID security workshop (RFIDsec) starting in 2005, this workshop provided an international forum for sharing original research results and application experiences among researchers in the field of RFID system security.The workshop was an overwhelming success, with twelve high-quality papers being included in the workshop program.To further promote the fast-evolving research on RFID system security, we solicited original research papers in the theory and practice concerning RFID system security for a special issue in Journal of Computer Security.After rigorous review, this special issue selected two papers (after significant extensions) out of the twelve papers appeared in RFIDsec'10 Asia workshop and three papers out of fourteen new submissions after the workshop.These five papers reflect different aspects of RFID system security, ranging from theoretical study on unconditionally secure approach for low-cost RFID systems to experimental research on practical eavesdropping and skimming attacks, from RFID distance-bounding protocols, secure ownership transfer of RFID tags to efficient construction of HB family protocols.A brief description of the subject matter is provided below.While computationally secure protocols have been extensively studied in RFID system security research, the topic of unconditionally secure approach has been relatively neglected mainly for practical reasons: such approach would be less efficient and more costly.The paper "Securing low-cost RFID systems: An unconditionally secure approach", by Basel Alomair, Loukas Lazos and Radha Poovendran, seeks to bring more research to the design of unconditionally secure protocols that are suitable for low-cost RFID tags with stringent computational capabilities.The key idea in their work is to let RFID readers, which are computationally powerful, generate random numbers and deliver them to RFID tags in an unconditionally secure manner, after which an unconditionally secure message authentication code can be computed with a single multiplication operation on the tag side so as to solve the identity authentication problem in RFID systems."Practical eavesdropping and skimming attacks on high-frequency RFID tokens", by Gerhard P. Hancke, adds to our understanding of the feasibility of practical attacks against standard high-frequency RFID tokens.The major contribution of this paper is to provide enough details about experimental setup and results for eavesdropping and skimming attacks to high-frequency RFID tokens, confirming that near-field RFID devices are vulnerable to practical attacks beyond the advertised operating range.

Abstract A wireless sensor network (WSN) is anad hocwireless network composed of a large number of small sensor nodes. Sensor nodes are usually severely resource limited and power constrained, and as such security enforcement in WSNs is a challenging task. To facilitate security enforcement, we propose a heterogeneous architecture for WSNs, where a WSN is partitioned into clusters, each having a high‐end cluster head. The cluster heads are further equipped with trusted computing technology (TC), such that they act as online trusted parties, thereby expected to help enforce security in a more effective manner. To show this, we discuss various examples on both content security and context security. Copyright © 2010 John Wiley & Sons, Ltd.

Optimistic fair exchange (OFE) protocols are useful tools for two participants to fairly exchange items with the aid of a third party who is only involved if needed. A widely accepted requirement is that the third party's involvement in the exchange must be transparent, to protect privacy and avoid bad publicity. At the same time, a dishonest third party would compromise the fairness of the exchange and the third party thus must be responsible for its behaviors. This is achieved in OFE protocols with another property called accountability. It is unfortunate that the accountability has never been formally studied in OFE since its introduction ten years ago. In this paper, we fill these gaps by giving the first complete definition of accountability in OFE where one of the exchanged items is a digital signature and a generic (also the first) design of OFE where transparency and accountability coexist.

As part of the security within distributed systems, various services and resources need protection from unauthorized use. Remote authentication is the most commonly used method to determine the identity of a remote client. This paper investigates a systematic approach for authenticating clients by three factors, namely password, smart card, and biometrics. A generic and secure framework is proposed to upgrade two-factor authentication to three-factor authentication. The conversion not only significantly improves the information assurance at low cost but also protects client privacy in distributed systems. In addition, our framework retains several practice-friendly properties of the underlying two-factor authentication, which we believe is of independent interest.

The conventional approach for anonymous password authentication incurs O(N) server computation, linear to the total number of users. In ACSAC'09, Yang et al. proposed a new approach for anonymous password authentication, breaking this lower bound. However, Yang et al.'s scheme has not considered membership withdrawal and online guessing attacks, two issues must be addressed before anonymous password authentication is acceptable for practical use. Thus our main thrust in this work is to provide solutions to these issues. We do not just work upon Yang et al.'s scheme; rather, we use a set of different primitives, and as a result, our scheme has much better performance. We prove the security of our scheme. Furthermore, we empirically evaluate the efficiency of our scheme, and implement a proof-of-concept prototype.

In this paper, we propose a new practical identity-based encryption scheme which is suitable for wireless sensor network (WSN). We call it Receiver-Bounded Online/Offline Identity-based Encryption (RB-OOIBE). It splits the encryption process into two parts -- the offline and the online part. In the offline part, all heavy computations are done without the knowledge of the receiver's identity and the plaintext message. In the online stage, only light computations such as modular operation and symmetric key encryption are required, together with the receiver's identity and the plaintext message. Moreover, since each offline ciphertext can be re-used for the same receiver, the number of offline ciphertexts the encrypter holds only confines the number of receivers instead of the number of messages to be encrypted. In this way, a sensor node (with limited computation power and limited storage) in WSN can send encrypted data easily: A few offline ciphertexts can be computed in the manufacturing stage while the online part is light enough for the sensor to process.

Anonymous password authentication reinforces password authentication with the protection of user privacy. Considering the increasing concern of individual privacy nowadays, anonymous password authentication represents a promising privacy-preserving authentication primitive. However, anonymous password authentication in the standard setting has several inherent weaknesses, making its practicality questionable. In this paper, we propose a new and efficient approach for anonymous password authentication. Our approach assumes a different setting where users do not register their passwords to the server; rather, they use passwords to protect their authentication credentials. We present a concrete scheme, and get over a number of challenges in securing password-protected credentials against off-line guessing attacks. Our experimental results confirm that conventional anonymous password authentication does not scale well, while our new scheme demonstrates very good performance.

In this paper, we propose a new notion called Certificate-Based Sequential Aggregate Signature. Certificate-based cryptography proposed by Gentry [8] combines the merit of traditional public key cryptography and identity based cryptography, without use of the costly certificate chain verification process and the removal of key escrow security concern. Under this paradigm, we propose a first sequential aggregate signature. An aggregate signature scheme produces a short string that convinces any verifier that there are $n$ messages signed by $n$ parties, all of which may be distinct. The length of the string is a constant which is independent of $n$. Its compactness makes it particularly suitable to be employed in those environments where communication bandwidth is very limited, such as wireless network scenarios (e.g. MANETS, cellular networks, sensor networks, satellite communication). We provide a concrete construction of this new notion and prove its security in the random oracle model.

The sensitive information leakage and security risk is a problem from which both individual and enterprise suffer in massive data collection and the information retrieval by the distrusted parties. In this paper, we focus on the privacy issue of data clustering and point out some security risks in the existing data mining algorithms. Associated with cryptographic techniques, we initiate an application of random data perturbation (RDP) which has been widely used for preserving the privacy of individual records in statistical database for the distributed data clustering scheme. Our scheme applies linear transformation of Gaussian distribution perturbed data and general additional data perturbation (GADP) schemes to preserve the privacy for distributed kernel density estimation with the help of any trusted third party. We also show that our scheme is more secure against the random matrix-based filtering attack which is based on analysis of the distribution of the eigenvalues by using two RDP methods.

A wireless sensor network (WSN) is composed of many sensor motes that are resource-constrained tiny devices, usually driven by battery. It is critical to save the energy consumption, which is mainly due to the communication overheads, in order to extend the life-span of WSN. Key management protocol

In this paper we construct two new fuzzy identity-based encryption (IBE) schemes in the random oracle model. Not only do our schemes provide public parameters whose size is independent of the number of attributes in each identity (used as public key) but they also have useful structures which result in more efficient key extraction and/or encryption than the random oracle version of Sahai and Water's fuzzy IBE scheme, considered recently by Pirretti et al. We prove that the confidentiality of the proposed schemes is relative to the Bilinear Decisional Bilinear Diffie-Hellman problem.

In this paper, we will discuss the issues on the design and implementation of a mobile firewall framework (Qiu et al., 2004) and (Bao et al., 2005), Under this framework, the home agent (HA) will act as the centralized control for the firewall scheme, whereby the mobile nodes (MN) will be protected by the access routers (AR) that they are connected to. The ARs will serve as a security proxy for the MN, where the HA will forward the corresponding MN's security rules to whenever MN changes its point of attachment. Security rules for each of the MN can be modified and updated dynamically at their respective HA.

is a mature area in wired networks, and has also attracted many attentions in wireless ad hoc networks recently. Nevertheless, there is no previous work reported in the literature about IDS architectures in wireless sensor networks. In this paper, we discuss the general guidelines for applying IDS to static sensor networks, and introduce a novel technique to optimally watch over the communications of the sensors ’ neighborhood on certain scenarios.

Contract signing is a fundamental service in doing business. The Internet has facilitated the electronic commerce, and it is necessary to find appropriate mechanisms for contract signing in the digital world. A number of two-party contract signing protocols have been proposed with various features. Nevertheless, in some applications, a contract may need to be signed by multiple parties. Less research has been done on multi-party contract signing. In this paper, we propose a new synchronous multi-party contract signing protocol that, with n parties, it reaches a lower bound of 3( n − 1) steps in the all-honest case and 4 n − 2 steps in the worst case (i.e., all parties contact the trusted third party). This is so far the most efficient synchronous multi-party contract signing protocol in terms of the number of messages required. We further consider the additional features like timeliness and abuse-freeness in the improved version. These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

When a mobile node roams, its location information can be revealed from the IP prefix information of its care-of address. This paper proposes a technique for hiding a mobile node's care-of address from its correspondent node and its home address from an eavesdropper using reverse tunneling mode. In the protocol, any two real addresses regarding route optimization will never be included in a traffic packet. Hence the movement of mobile node can be hided from third party monitoring.

In 2003, Chu proposed an oblivious watermarking algorithm by modifying the CKLS scheme proposed by Cox, Kilian, Leighton, and Shamoon in 1997, known as the CKLS scheme. In this correspondence, we report that the modification presented by Chu is susceptible to a suitably modified attack devised by Das and Maitra in 2004. In fact, the experimental results show that Chu's scheme is even weaker than the CKLS scheme in terms of our attack.

As security enhanced systems for standard e-mail, certified e-mail schemes guarantee the fair exchange of a digital message with the corresponding receipt between two mistrusted parties. That is, the intended receiver gets the e-mail content if and only if the e-mail sender obtains an irrefutable receipt issued by the receiver, which could be used to prove that the message has been delivered to the receiver. A number of such protocols have been proposed in recent years. However, most of them are not suitable for mobile networks, since many intricate cryptographic primitives are involved so that considerable overheads are introduced. In this paper, we present a novel simple protocol for certified e-mail delivery. Technical discussions are provided to show that our new solution is both secure and very efficient so that it is truly suitable for wireless mobile users, where the available devices usually have limited resources on computation, communication, storage, and power supply.

Purpose As a value‐added service to deliver important data over the internet with guaranteed receipt for each successful delivery, certified email has been discussed for years and a number of research papers appeared in the literature. This paper aims to present two optimized multi‐party certified email protocols. Design/methodology/approach Reviews two existing email protocols and provides a modified version to overcome their security flaws and weaknesses. Extends the two‐party protocol to a multi‐party scenario. Findings Both of the protocols have three major features. A sender could notify multiple recipients of the same information while only those recipients who acknowledged are able to get the information. Both the sender and the recipients can end a protocol run at any time without breach of fairness. The exchange protocols are optimized, each of which has only three steps, and the trusted third party will not be involved unless an exception (e.g. a network failure or a party's misbehavior) occurs. Originality/value Provides a focus on a value‐added service – certified email.

More and more activities (such as, e-commerce, e-learning, e-chat, etc.) rely on mobile devices. It is an important issue on how to protect mobile users engaged in mobile services. Unfortunately, the conventional firewalls are inappropriate for mobile networks because of the limited computing and communication capabilities of mobile devices. Furthermore, with a conventional firewall, a guardian is not able to monitor/control dynamically the mobile node's activities when the mobile node roams. In this paper, we introduce a new concept of mobile personal firewall and propose a concrete scheme that matches mobile environment and exploits mobile network facilities. When a mobile node (MN) roams into a foreign network managed by a mobility anchor point (MAP), the home agent (HA) will authorize the MAP to serve as a security proxy. The HA will negotiate with the MAP on the security association and then transfer to the MAP the defined security rules that will be applied on all communications to the MN (via the MAP). The MAP could send the MVs traffic logs to the HA. The MVs guardian could dynamically monitor the MVs activities by retrieving the MVs traffic logs through the HA. If necessary, the MVs guardian could update the security rules so that the MVs activities could be controlled dynamically. All the operations are transparent to the MN, and the MN will be served in the way specified by his guardian no matter where he roams.

In this paper, we propose a comprehensive security solution for mobile IPv6 networks including secure binding update, secure fast handover, user authentication and session key management for data security. In our proposal, one of the home agent's functions is to act as a security proxy for its mobile nodes. The authentication is based on the home agent's certificate and the secret session keys are generated by strong cryptosystems. Since these session keys are long term, it is more suitable for fast handover in mobile network. In addition, as the major operations are deployed on the fixed and wired machines, i.e., the home agents of mobile nodes, it keeps well the balance between the strong security requirements for e-commerce and the weak capability of mobile devices in terms of computing power and communicating speed. Our proposal avoids many security obstacles in the return routability protocol and provides a simple, integrated and efficient security solution for mobile communication.

In a (t, n) threshold proxy signature scheme, the original signer can delegate his/her signing capability to n proxy signers such that any t or more proxy signers can sign messages on behalf of the former, but t-1 or less of them cannot do the same thing. Such schemes have been suggested for use in a number of applications, particularly, in distributed computing where delegation of rights is quite common. Based on the RSA cryptosystem, [M. -S. Hwang et al. (2003) recently proposed an efficient (t, n) threshold proxy signature scheme. We identify several security weaknesses in their scheme and show that their scheme is insecure.

The route optimization operation in Mobile IP Version 6 (MIPv6) allows direct routing from any correspondent node to any mobile node and thus eliminates the problem of "triangle routing" present in the base Mobile IP Version 4 (MIPv4) protocol. Route optimization, however, requires that a mobile node constantly inform its correspondent nodes about its new care-of addresses by sending them binding update messages. Unauthenticated or malicious binding updates open the door for intruders to perform redirect attacks, i.e., malicious acts which redirect traffic from correspondent nodes to locations chosen by intruders. How to protect binding update messages to defend against redirect attacks is a challenging problem given the open environment in which MIPv6 operates. In this paper, we first look at two solutions proposed by the IETF Mobile IP Working Group and point out their weaknesses. We then present a new protocol for securing binding update messages. We also show that our protocol achieves strong security and at the same time is highly scalable to wide spread deployment.

In the current mobile communication networks, users have to trtistnetwork operators to make correct.charges over the cds they made.There islack of evidence to resolve possible disputti+ over thenurnberofcdls and the duration of each cd.Such a concern may grow when users roam among different network operators.This paper proposes an efficient solution to undeniable b]~ng when a mobile user roams into foreign networks.This is achieved by the combination of digitd signature and hash-chaining techniques.Mobile users need to submit a digitd signature when requesting a cd and release chained h~

Fairness may be a desirable property of a non-repudiation service. Protocols can achieve fairness through the involvement of a trusted third party but the extent of the trusted third party's involvement can vary between protocols. Hence, one of the goals of designing an efficient non-repudiation protocol is to reduce the workload of the trusted third party. In this paper, we present a variant of our fair non-repudiation protocol (1996), where the trusted third party is involved only in the case that one party cannot obtain the expected non-repudiation evidence from the other party. This variant is efficient in an environment where the two parties are likely to resolve communications problems between themselves.

A fair non-repudiation protocol should not give the sender of a message an advantage over the receiver, or vice versa. We present a fair non-repudiation protocol that requires a trusted third party but attempts to minimize its involvement in the execution of the protocol. We draw particular attention to the nonstandard use of encryption in our protocol and discuss some aspects of its formal verification.