Security Analysis and Improvement of an Anonymous Authentication Scheme for Roaming Services

An anonymous authentication scheme for roaming services in global mobility networks allows a mobile user visiting a foreign network to achieve mutual authentication and session key establishment with the foreign-network operator in an anonymous manner. In this work, we revisit He et al.’s anonymous authentication scheme for roaming services and present previously unpublished security weaknesses in the scheme: (1) it fails to provide user anonymity against any third party as well as the foreign agent, (2) it cannot protect the passwords of mobile users due to its vulnerability to an offline dictionary attack, and (3) it does not achieve session-key security against a man-in-the-middle attack. We also show how the security weaknesses of He et al.’s scheme can be addressed without degrading the efficiency of the scheme

An enhanced secure delegation-based anonymous authentication protocol for PCSs

Rapid development of wireless networks brings about many security problems in portable communication systems (PCSs), which can provide mobile users with an opportunity to enjoy global roaming services. In this regard, designing a secure user authentication scheme, especially for recognizing legal roaming users, is indeed a challenging task. It is noticed that there is no delegation-based protocol for PCSs, which can guarantee anonymity, untraceability, perfect forward secrecy, and resistance of denial-of-service (DoS) attack. Therefore, in this article, we put forward a novel delegation-based anonymous and untraceable authentication protocol, which can guarantee to resolve all the abovementioned security issues and hence offer a solution for secure communications for PCSs

Reconfigurable Security: Edge Computing-based Framework for IoT

In various scenarios, achieving security between IoT devices is challenging since the devices may have different dedicated communication standards, resource constraints as well as various applications. In this article, we first provide requirements and existing solutions for IoT security. We then introduce a new reconfigurable security framework based on edge computing, which utilizes a near-user edge device, i.e., security agent, to simplify key management and offload the computational costs of security algorithms at IoT devices. This framework is designed to overcome the challenges including high computation costs, low flexibility in key management, and low compatibility in deploying new security algorithms in IoT, especially when adopting advanced cryptographic primitives. We also provide the design principles of the reconfigurable security framework, the exemplary security protocols for anonymous authentication and secure data access control, and the performance analysis in terms of feasibility and usability. The reconfigurable security framework paves a new way to strength IoT security by edge computing.Comment: under submission to possible journal publication

A Privacy-Preserving Method with Flexible Charging Schedules for Electric Vehicles in the Smart Grid

The Smart Grid (SG) is an emerging modernized electrical power system with advanced monitoring and control mechanism, and improved faulttolerance. The SG converges traditional power grid with a bidirectional communication and information system into the same infrastructure. Electric Vehicles (EVs), with their energy storage capacity and bidirectional communication capability, are envisioned to be an essential component of the SG. EVs can play the role of distributed energy resources by storing energy in off-peak hours and providing energy to the grid during peak hours or system contingencies. The energy stored by an EV is equivalent to the average energy drawn by multiple residential houses. As a result, simultaneous charging by a large number of EVs can create sudden energy imbalance in the grid. The mismatch between the energy generation and demand can create cascading faults resulting in load shedding. To prevent such situation, EVs are required to pre-schedule charging events at a Charging Station (CS). To efficiently manage a scheduled event, an EV is required to transmit information such as a valid ID, state-of-charge, distance from a CS, location, speed, etc. However, the data transmitted by an EV can be used to reveal information such as the movement of the vehicle, visits to a hospital, time to arrive at office, etc. The transmitted information can be used to create profiles of the owners of the EVs, breaching their location privacy. In the existing literature, it is recommended to use pseudonyms for different transactions by an EV to achieve location privacy. The majority of the works in the literature are based on anonymous authentication mechanism, where missing a charging event by an EV is considered as malicious and the corresponding EV is penalized (e.g., blacklisted). However, missing a charging event may happen due to many valid reasons and flexibility of scheduling can encourage consumer participation. On the other hand, missing charging events results in monetary loss to the CSs. In this thesis, an authentication method is developed to provide anonymity to EVs. The proposed method also addresses the cost-effectiveness of flexibility in charging events for the EVs and the CSs. A network setup that sub-divides a regional area into smaller zones to achieve better privacy, is proposed. A MATLAB simulation is designed to demonstrate the Degree of Anonymity (DoA) achieved in different stages of the proposed method and the optimal number of missed charging events. Additionally, a method to determine sub-division of zones from the simulation results, is studied

Review of Networking and Tangible Security Techniques for Domestic IoT Devices and Initial Ideas

The number of connected devices including Internet of Things (IoTs) on the Internet is growing fast. According to recent Gartner research, the estimated number of IoT devices is 5.8 billion in 2020 (Gartner, 2019). The countries that are leading the way to IoT deployment include North America, Western Europe and China (Kandaswamy and Furlonger, 2018). By 2024, the number of Machine-2-Machine (M2M) connections between these devices are expected to reach 27 billion in 2024 (Kandaswamy and Furlonger, 2018). This growth in M2M connectivity is expected to result from wide range of application areas such as smart cities, smart infrastructure, smart energy among many others (Hassija et al., 2019).This wide spread of IoTs has sparked significant research interest to understand various implications (Airehrour et al., 2016; Neshenko et al., 2019; Hassija et al., 2019). IoTs enable the integration between many objects in our daily life (Aazam et al., 2016; Alaba et al., 2017) such as sensors, objects, wearable devices and other types of machines. IoT devices are capable of communicating directly with one another and sharing data without direct human intervention (Crabtree et al., 2018). These “things” could be any traditional objects such as home appliance (e.g. microwave, fridge) or tiny sensor (e.g. humidity or health sensors). The devices are capable of constant collections of various sensitive and personal data about many aspect of our lives due to its pervasive deployment (Ren et al., 2019).This paper provides an overview of the literature relating to securing IoT with an emphasis on usability from a user perspective as well as approaches to securing access to these devices over the Internet. Although IoT deployment occurs in various settings, i.e. industrial IoT deployment, we mainly focus in this paper on private residential home deployment (i.e. consumer IoTs). We assume that in such settings, users are mostly not experts in security IoT or the underlying networking principles.This paper is organized as follows: section II discusses various protocols and networking security tools (e.g. firewall and Virtual Private Network (VPN)). Section II-D discusses various approaches to simplify cyber-security by using user-centred approaches. In section III, we present a number of existing including enterprise-grade solutions that could be adopted to secure remote access to IoT devices in domestic settings

On the Usability of Two-Factor Authentication

Smart-card-based password authentication, known as two-factor authentication, is one of the most widely used security mechanisms to validate the legitimacy of a remote client, who must hold a valid smart card and the correct password in order to successfully login the server. So far the research on this domain has mainly focused on developing more secure, privacy-preserving and efficient protocols, which has led to numerous efficient proposals with a diversity of security provisions, yet little attention has been directed towards another important aspect, i.e. the usability of a scheme. This paper focuses on the study of two specific security threats on usability in two-factor authentication. Using two representative protocols as case studies, we demonstrate two types of security threats on usability: (1) Password change attack, which may easily render the smart card completely unusable by changing the password to a random value; and (2) De-synchronization attack, which breaks the consistence of the pseudo-identities between the user and the server. These threats, though realistic in practice, have been paid little attention in the literature. In addition to revealing the vulnerabilities, we discuss how to thwart these security threats and secure the protocols

Securing IP Mobility Management for Vehicular Ad Hoc Networks

The proliferation of Intelligent Transportation Systems (ITSs) applications, such as Internet access and Infotainment, highlights the requirements for improving the underlying mobility management protocols for Vehicular Ad Hoc Networks (VANETs). Mobility management protocols in VANETs are envisioned to support mobile nodes (MNs), i.e., vehicles, with seamless communications, in which service continuity is guaranteed while vehicles are roaming through different RoadSide Units (RSUs) with heterogeneous wireless technologies. Due to its standardization and widely deployment, IP mobility (also called Mobile IP (MIP)) is the most popular mobility management protocol used for mobile networks including VANETs. In addition, because of the diversity of possible applications, the Internet Engineering Task Force (IETF) issues many MIP's standardizations, such as MIPv6 and NEMO for global mobility, and Proxy MIP (PMIPv6) for localized mobility. However, many challenges have been posed for integrating IP mobility with VANETs, including the vehicle's high speeds, multi-hop communications, scalability, and ef ficiency. From a security perspective, we observe three main challenges: 1) each vehicle's anonymity and location privacy, 2) authenticating vehicles in multi-hop communications, and 3) physical-layer location privacy. In transmitting mobile IPv6 binding update signaling messages, the mobile node's Home Address (HoA) and Care-of Address (CoA) are transmitted as plain-text, hence they can be revealed by other network entities and attackers. The mobile node's HoA and CoA represent its identity and its current location, respectively, therefore revealing an MN's HoA means breaking its anonymity while revealing an MN's CoA means breaking its location privacy. On one hand, some existing anonymity and location privacy schemes require intensive computations, which means they cannot be used in such time-restricted seamless communications. On the other hand, some schemes only achieve seamless communication through low anonymity and location privacy levels. Therefore, the trade-off between the network performance, on one side, and the MN's anonymity and location privacy, on the other side, makes preservation of privacy a challenging issue. In addition, for PMIPv6 to provide IP mobility in an infrastructure-connected multi-hop VANET, an MN uses a relay node (RN) for communicating with its Mobile Access Gateway (MAG). Therefore, a mutual authentication between the MN and RN is required to thwart authentication attacks early in such scenarios. Furthermore, for a NEMO-based VANET infrastructure, which is used in public hotspots installed inside moving vehicles, protecting physical-layer location privacy is a prerequisite for achieving privacy in upper-layers such as the IP-layer. Due to the open nature of the wireless environment, a physical-layer attacker can easily localize users by employing signals transmitted from these users. In this dissertation, we address those security challenges by proposing three security schemes to be employed for different mobility management scenarios in VANETs, namely, the MIPv6, PMIPv6, and Network Mobility (NEMO) protocols. First, for MIPv6 protocol and based on the onion routing and anonymizer, we propose an anonymous and location privacy-preserving scheme (ALPP) that involves two complementary sub-schemes: anonymous home binding update (AHBU) and anonymous return routability (ARR). In addition, anonymous mutual authentication and key establishment schemes have been proposed, to authenticate a mobile node to its foreign gateway and create a shared key between them. Unlike existing schemes, ALPP alleviates the tradeoff between the networking performance and the achieved privacy level. Combining onion routing and the anonymizer in the ALPP scheme increases the achieved location privacy level, in which no entity in the network except the mobile node itself can identify this node's location. Using the entropy model, we show that ALPP achieves a higher degree of anonymity than that achieved by the mix-based scheme. Compared to existing schemes, the AHBU and ARR sub-schemes achieve smaller computation overheads and thwart both internal and external adversaries. Simulation results demonstrate that our sub-schemes have low control-packets routing delays, and are suitable for seamless communications. Second, for the multi-hop authentication problem in PMIPv6-based VANET, we propose EM3A, a novel mutual authentication scheme that guarantees the authenticity of both MN and RN. EM3A thwarts authentication attacks, including Denial of service (DoS), collusion, impersonation, replay, and man-in-the-middle attacks. EM3A works in conjunction with a proposed scheme for key establishment based on symmetric polynomials, to generate a shared secret key between an MN and an RN. This scheme achieves lower revocation overhead than that achieved by existing symmetric polynomial-based schemes. For a PMIP domain with n points of attachment and a symmetric polynomial of degree t, our scheme achieves t x 2^n-secrecy, whereas the existing symmetric polynomial-based authentication schemes achieve only t-secrecy. Computation and communication overhead analysis as well as simulation results show that EM3A achieves low authentication delay and is suitable for seamless multi-hop IP communications. Furthermore, we present a case study of a multi-hop authentication PMIP (MA-PMIP) implemented in vehicular networks. EM3A represents the multi-hop authentication in MA-PMIP to mutually authenticate the roaming vehicle and its relay vehicle. Compared to other authentication schemes, we show that our MA-PMIP protocol with EM3A achieves 99.6% and 96.8% reductions in authentication delay and communication overhead, respectively. Finally, we consider the physical-layer location privacy attacks in the NEMO-based VANETs scenario, such as would be presented by a public hotspot installed inside a moving vehicle. We modify the obfuscation, i.e., concealment, and power variability ideas and propose a new physical-layer location privacy scheme, the fake point-cluster based scheme, to prevent attackers from localizing users inside NEMO-based VANET hotspots. Involving the fake point and cluster based sub-schemes, the proposed scheme can: 1) confuse the attackers by increasing the estimation errors of their Received Signal Strength (RSSs) measurements, and 2) prevent attackers' monitoring devices from detecting the user's transmitted signals. We show that our scheme not only achieves higher location privacy, but also increases the overall network performance. Employing correctness, accuracy, and certainty as three different metrics, we analytically measure the location privacy achieved by our proposed scheme. In addition, using extensive simulations, we demonstrate that the fake point-cluster based scheme can be practically implemented in high-speed VANETs' scenarios