Algorithms for Lightweight Key Exchange

This paper is an extended version of our paper published in Álvarez, R.; Santonja, J.; Zamora, A. Algorithms for Lightweight Key Exchange. In Proceedings of the 10th International Conference on Ubiquitous Computing and Ambient Intelligence, UCAmI 2016, San Bartolomé de Tirajana, Spain, 29 November–2 December 2016; Part II 10; Springer International Publishing: Cham, Switzerland, 2016; pp. 536–543.Public-key cryptography is too slow for general purpose encryption, with most applications limiting its use as much as possible. Some secure protocols, especially those that enable forward secrecy, make a much heavier use of public-key cryptography, increasing the demand for lightweight cryptosystems that can be implemented in low powered or mobile devices. This performance requirements are even more significant in critical infrastructure and emergency scenarios where peer-to-peer networks are deployed for increased availability and resiliency. We benchmark several public-key key-exchange algorithms, determining those that are better for the requirements of critical infrastructure and emergency applications and propose a security framework based on these algorithms and study its application to decentralized node or sensor networks.Research partially supported by the Spanish MINECO and FEDER under Project Grant TEC2014-54110-R

SMCP: a Secure Mobile Crowdsensing Protocol for fog-based applications

The possibility of performing complex data analysis through sets of cooperating personal smart devices has recently encouraged the definition of new distributed computing paradigms. The general idea behind these approaches is to move early analysis towards the edge of the network, while relying on other intermediate (fog) or remote (cloud) devices for computations of increasing complexity. Unfortunately, because both of their distributed nature and high degree of modularity, edge-fog-cloud computing systems are particularly prone to cyber security attacks that can be performed against every element of the infrastructure. In order to address this issue, in this paper we present SMCP, a Secure Mobile Crowdsensing Protocol for fog-based applications that exploit lightweight encryption techniques that are particularly suited for low-power mobile edge devices. In order to assess the performance of the proposed security mechanisms, we consider as case study a distributed human activity recognition scenario in which machine learning algorithms are performed by users’ personal smart devices at the edge and fog layers. The functionalities provided by SMCP have been directly compared with two state-of-the-art security protocols. Results show that our approach allows to achieve a higher degree of security while maintaining a low computational cost

Optimizing a Password Hashing Function with Hardware-Accelerated Symmetric Encryption

Password-based key derivation functions (PBKDFs) are commonly used to transform user passwords into keys for symmetric encryption, as well as for user authentication, password hashing, and preventing attacks based on custom hardware. We propose two optimized alternatives that enhance the performance of a previously published PBKDF. This design is based on (1) employing a symmetric cipher, the Advanced Encryption Standard (AES), as a pseudo-random generator and (2) taking advantage of the support for the hardware acceleration for AES that is available on many common platforms in order to mitigate common attacks to password-based user authentication systems. We also analyze their security characteristics, establishing that they are equivalent to the security of the core primitive (AES), and we compare their performance with well-known PBKDF algorithms, such as Scrypt and Argon2, with favorable results.Research partially supported by the Spanish Government under Project Grant TEC2014-54110-R (CASUS)

Analysis of Key Establishment Techniques for Secure D2D Communication in Emerging 5G Cellular Networks

Device-to-Device (D2D) communication as part of emerging 5G wireless networks presents a new paradigm for enhancing the performance of traditional cellular networks. The number of devices connected over the internet is dramatically increasing, and cellular operators are struggling to harness the overwhelming data traffic on their networks. D2D communication in a cellular network allows two cellular devices in close proximity to communicate directly with each other without going through the base station. D2D communication faces various challenges that include device discovery, resource allocation, interference and security; however, the security aspects of D2D are not sufficiently addressed. Due to limited computing capability and energy-constrained D2D devices, effective and lightweight security solutions are required for enabling successful D2D capability. To secure D2D communication, session key establishment is the most vital task. Public Key Cryptography (PKC) is the most widely used cryptosystem and have numerous security applications such as encryption, digital signature, and key exchange. This work analyses the performance of three PKC protocols that are commonly used for session key establishment and exchange, namely, Diffie-Hellman (DH), Rivest-Shamir-Adleman (RSA) and Elliptic Curve Diffie-Hellman (ECDH), with a focus on D2D communication. We performed extensive simulations for DH, RSA and ECDH, in D2D communication scenarios using OMNET++ simulator and explored the effect of various network factors on key establishment delays such as network size, the impact of interference between D2D pairs and the effect of interference from cellular users upon D2D users as well. The results reported in this paper can provide significant insight in assessing the suitability of DH, RSA and ECDH for the key establishment for D2D in 5G networks

A Flexible Encryption Technique for the Internet of Things Environment

IoT promises a new era of connectivity that goes beyond laptops and smart connected devices to connected vehicles, smart homes, smart cities and connected healthcare. The huge volume of data that is collected from millions of IoT devices raises information security and privacy concerns for users. This paper presents a new scalable encryption technique, called Flexible encryption Technique (FlexenTech), to protect IoT data during storage and in transit. FlexenTech is suitable for resource constrained devices and networks. It offers a low encryption time, defends against common attacks such as replay attacks and defines a configurable mode, where any number of rounds or key sizes may be used. Experimental analysis of FlexenTech shows its robustness in terms of its multiple configurable confidentiality levels by allowing various configurations. This configurability provides several advantages for resource constrained devices, including reducing the encryption computation time by up to 9.7% when compared to its best rivals in the literature

Розвиток методів захисту телекомунікаційних та інформаційних систем

Метою роботи є покращення методів безпеки передачі даних та їх стійкості до атак.The purpose of the work is to improve data transmission security methods and their resistance to attacks

Protocolos para la seguridad de la información en eHealth: Criptografía en entornos mHeath

Abstract. The advance of technology has brought with it the evolution of tools in various fields, among which the medical field stands out. Today’s medicine has tools that 30 years ago were unthinkable making its functioning completely different. Thanks to this fusion of medicine and technology new terms concerning this symbiosis, such as eHealth or mHealth, may be found in our daily lives. Both users and all the areas that work in the protection and performance of health and safety benefit from it. In this doctoral thesis we have worked in several lines with the aim of improving information security in several mHealth systems trying to make the proposed solutions extrapolable to other environments. Firstly, a tool, supported by an expert system and using identity-based encryption for the protection of patient information, for the diagnosis, treatment and monitoring of children with attention deficit disorder is proposed. Second, a solution focused on geared towards enhancing solutions for two of the fundamental problems of medical data information security: the secure management of patient information and the identification of patients within the hospital environment, is included. The solution proposed for the identification problem is based on the use of NFC bracelets that store an identifier associated with the patient and is generated through an HMAC function. In the third work, the problem of identification is again analyzed, but this time in emergency environments where no stable communication networks are present. It also proposes a system for the classification of victims whose objective is to improve the management of health resources in these scenarios. The fourth contribution is a system for improving the traceability and management of small emergencies and everyday events based on the use of blockchains. To conclude with the contributions of this thesis, a cryptographic scheme which improves security in healthcare devices with little computing capacity is presented. The general aim of this thesis is providing improvements in current medicine through mHealth systems, paying special attention to information security. Specifically, measures for the protection of data integrity, identification, authentication and nonrepudiation of information are included. The completion of this doctoral thesis has been funded through a pre-doctoral FPI grant from the Canary Islands Government.El avance de la tecnología ha traído consigo la evolución de herramientas en diversos ámbitos, entre ellos destaca el de la medicina. La medicina actual posee unas herramientas que hace 30 años eran impensables, lo que hace que su funcionamiento sea completamente diferente. Gracias a esta fusión de medicina y tecnología encontramos en nuestro día a día nuevos términos, como eHealth o mHealth, que hacen referencia a esta simbiosis, en la que se benefician tanto los usuarios, como todas las áreas que trabajan en la protección y actuación de la salud y seguridad de las mismas. En esta tesis doctoral se ha trabajado en varias líneas con el objetivo de mejorar la seguridad de la información en varios sistemas mHealth intentando que las soluciones propuestas sean extrapolables a otros entornos. En primer lugar se propone una herramienta destinada al diagnóstico, tratamiento y monitorización de niños con trastorno de déficit de atención que se apoya en un sistema experto y usa cifrado basado en identidad para la protección de la información de los pacientes. En segundo lugar, se incluye una solución centrada en aportar mejoras en dos de los problemas fundamentales de la seguridad de la información de los datos médicos: la gestión segura de la información de los pacientes y la identificación de los mismos dentro del entorno hospitalario. La solución planteada para el problema de identificación se basa en la utilización de pulseras NFC que almacenan un identificador asociado al paciente y que es generado a través de una función HMAC. En el tercer trabajo se analiza de nuevo el problema de identificación de las personas pero esta vez en entornos de emergencia en los que no se cuenta con redes de comunicaciones estables. Además se propone un sistema de clasificación de víctimas en dichos entornos cuyo objetivo es mejorar la gestión de recursos sanitarios en estos escenarios. Como cuarta aportación se presenta un sistema de mejora de la trazabilidad y de la gestión de pequeñas emergencias y eventos cotidianos basada en el uso de blockchain. Para terminar con las aportaciones de esta tesis, se presenta un esquema criptográfico que mejora los esquemas actuales de seguridad utilizados para dispositivos del entorno sanitario que poseen poca capacidad computacional. La finalidad general perseguida en esta tesis es aportar mejoras al uso de la medicina actual a través de sistemas mHealth en los que se presta especial atención a la seguridad de la información. Concretamente se incluyen medidas para la protección de la integridad de los datos, identificación de personas, autenticación y no repudio de la información. La realización de esta tesis doctoral ha contando con financiación del Gobierno de Canarias a través de una beca predoctoral FPI