Search Results (118)

The foundation of modern vehicle control relies on Electronic Control Units (ECUs) communicating via the Controller Area Network (CAN). However, CAN was not designed with security in mind. Limited bandwidth and lack of security make CAN vulnerable, while centralized solutions like AUTOSAR SecOC suffer from high latency. To solve this problem, we propose a novel security protocol named Self-Updating Hash Chain Layered Security Protocol (SUHC-LSP), which uses a “space-time coupled” frame structure to fit a robust authentication code into the limited CAN data field. Unlike conventional schemes that require explicit freshness negotiation during routine operation, SUHC-LSP adopts a self-updating hash-chain mechanism in which chain evolution proceeds autonomously under normal conditions. In addition, SUHC-LSP introduces a self-updating hash chain mechanism that enables freshness iteration during steady-state operation. Traditional AUTOSAR SecOC configuration schemes require additional synchronization messages and freshness counter management, whereas the approach proposed in this paper eliminates the resulting bandwidth overhead while adhering to the 8-byte CAN payload limit and ensuring message authenticity and integrity. In addition, a risk-adaptive two-layer architecture is designed to balance fast speed for local messages and strong encryption for cross-domain messages. BAN-logic and ProVerif verification show that the protocol preserves authentication, freshness, secrecy, and event-correspondence properties under the stated assumptions. Experiments on an STM32 platform show that, in a 4-device prototype, the computational overheads are 1.61 ms for intra-domain communication and 0.83 ms for inter-domain communication. Moreover, analytical overhead comparison indicates that the proposed protocol has lower sensitivity to network scale than the compared schemes. Full article

With the rapid development of quantum computing, in response to its disruptive threats to traditional cryptosystems and the urgent demand for lightweight and highly scalable secure group communication among resource-constrained devices in large-scale Internet of Things (IoT) scenarios, this paper proposes a lightweight anonymous group authentication scheme that integrates Physical Unclonable Functions (PUFs), distributed Gossip algorithms, and quantum key distribution. By exploiting the uniqueness and unclonability derived from the inherent physical characteristics of PUF hardware, the scheme fundamentally eliminates attack vectors against quantum computers without requiring devices to pre-store any secret keys in their memory, while the QKCS pre-provisions CRPs and key seeds, which is the standard enrollment procedure in PUF-based systems. Combined with information-theoretically secure quantum keys as session keys, it forms a dual protection mechanism: anti-forgery at the physical layer and anti-quantum attack at the cryptographic layer. Innovatively, the Gossip algorithm is deeply integrated with group key agreement, converting global broadcast into local iterative interactions between nodes, which effectively alleviates broadcast storms and improves the scalability and fault tolerance of the protocol. Meanwhile, a pseudonym mechanism is introduced to achieve anonymous identity protection, and a dynamic key update strategy guarantees forward and backward security when members join or leave the group. Formal verification based on BAN logic and security analysis show that the proposed protocol can resist typical attacks such as replay attacks, man-in-the-middle attacks, and impersonation attacks. Performance evaluations demonstrate that our scheme outperforms existing comparable schemes in terms of computational cost, communication overhead, and dynamic group management efficiency, demonstrating its potential for resource-constrained IoT environments, pending further validation on real hardware platforms. Full article

The Industrial Internet of Things (IIoT) demands authentication that protects resource-constrained field devices, supports fine-grained access control, and reduces reliance on implicitly trusted gateways. Existing IIoT authentication and key agreement schemes mainly verify cryptographic identity and establish session keys, but provide limited support for zero-trust access decisions after authentication such as role-specific operation control, gateway-side relation protection, emergency override, and context-aware re-verification. This paper proposes a lightweight zero-trust authentication and key agreement scheme for IIoT. The scheme embeds role-, device-, environment-, and behavior-aware control points into the authentication flow, protects gateway-side authentication relations and operator–asset mappings using secGear-based confidential computing, and supports pseudonym-based identity protection and break-the-glass emergency access. To complement deterministic access control, an optional auxiliary risk evaluation module provides trust evidence from contextual and operator-state signals without becoming part of the cryptographic critical path. This module is used to trigger re-verification, privilege degradation, audit escalation, or session termination before high-risk control privileges are released; it does not replace cryptographic authentication or constitute a formal guarantee of coercion detection, and the cryptographic layer remains fully functional and formally analyzable even when the auxiliary risk evaluation module is disabled. BAN logic and AVISPA analyses verify the cryptographic authentication and key agreement layer, while a comparative overhead analysis under an analytical operation count basis indicates low computation and communication cost relative to representative resource-constrained IoT authentication schemes. Full article

Blockchain-assisted authentication frameworks have been introduced to mitigate the single point-of-failure problem in centralized IoT collaboration environments. Recently, a lightweight trust management framework based on a permissioned blockchain was proposed for distributed authentication and interaction traceability. However, our analysis shows that this protocol is vulnerable to offline password guessing, terminal device impersonation, session-key disclosure, and user traceability attacks. It also fails to provide perfect forward secrecy. Accordingly, we propose a secure and lightweight authentication and key agreement protocol for blockchain-assisted IoT collaboration environments. The proposed scheme integrates Physically Unclonable Functions to improve resistance against physical capture and device cloning attacks. It also uses a fuzzy extractor to support biometric-based authentication and a dynamic pseudo-identity update mechanism managed through a consortium blockchain to protect user anonymity and untraceability. The proposed protocol is verified using the Real-or-Random model, BAN logic, and AVISPA simulations. Full article

The Internet of Drones (IoD) has become an important platform for applications such as smart agriculture, industrial monitoring, and large-scale aerial sensing. However, securing IoD communications remains challenging because drones often operate in open environments and have limited computation, storage, and energy resources. Existing authentication and key agreement protocols still face practical limitations, including high computational overhead, exposure to physical capture attacks, and reliance on centralized servers for session-key generation. In this paper, we first analyze a recent IoD authentication scheme and show that it is vulnerable to session-key disclosure, offline identity/password guessing, and mobile device/drone impersonation attacks. To address these issues, we propose a lightweight Physically Unclonable Function (PUF)-based end-to-end authentication protocol for IoD environments. The proposed scheme avoids storing long-term secret keys in drone memory and enables the mobile device and drone to establish a session key directly, without involving the Ground Station Server in key derivation. The security of the proposed protocol is evaluated through informal analysis, BAN logic, the Real-or-Random model, and AVISPA simulation. The results show that the scheme resists common attacks, including replay, impersonation, stolen verifier, physical capture, and offline password guessing attacks. Performance evaluation further indicates that the protocol maintains low computational cost while providing stronger security guarantees, making it suitable for resource-constrained IoD deployments. Full article

Edge computing has emerged as a distributed computing technology to mitigate the cloud computing overload caused by the rapid increase in connected devices. However, because communications between devices and edge servers are conducted over public channels, authentication and secure session key establishment are imperative to protect against various security attacks. In this paper, we show that Kenioua et al.’s authentication scheme for edge computing is vulnerable to several attacks such as impersonation, offline password guessing, and stolen verifier attacks, and also lacking quantum resistance against the emerging threat posed by quantum computing. To overcome these limitations, we propose a quantum-resistant authentication scheme by adopting module lattice-based key encapsulation mechanism (ML-KEM). We demonstrate the robustness of the proposed scheme through “the Burrows–Abadi–Needham (BAN) logic”, “Quantum Random Oracle Model (QROM)”, “Automated Validation of Internet Security Protocols and Application (AVISPA) tool”, and “Scyther tool”, and show that the proposed scheme achieves security with efficient communication and computation costs by comparing it with related studies. Full article

The Internet of Vehicles (IoV) is a rapidly evolving technology that provides real-time connectivity, enhanced road safety, and reduced traffic congestion; however, its inherently open communication channels expose it to serious security and privacy threats. In 2021, Chaudhry proposed SMEP-IoV, a lightweight message authentication protocol designed to satisfy essential security requirements. This paper presents a comprehensive security analysis of SMEP-IoV and reveals several serious vulnerabilities. Specifically, sensitive credentials are stored in plaintext without tamper-resistant protection, and both authentication and session key derivation depend directly on these credentials. These structural flaws allow an adversary to extract the stored secrets, generate valid authentication messages, and derive the established session key, enabling vehicle impersonation and session key disclosure attacks. Moreover, compromise of long-term secrets facilitates key compromise impersonation attacks. It also fails to ensure anonymity and perfect forward secrecy. To address these issues, we propose an enhanced authentication protocol for resource-constrained IoV environments, leveraging a three-factor authentication mechanism combined with lightweight cryptographic primitives. Formal security analyses using BAN logic, Tamarin, and ProVerif confirm its resilience against known attacks, while NS-3 simulations validate its scalability, high throughput, and low End-to-End Delay (E2ED). The results highlight the protocol as a robust, efficient, and scalable solution for large-scale IoV deployments. Full article

Unmanned Aerial Vehicle (UAV)-assisted hierarchical federated learning (HFL) has emerged as a promising architecture for Internet of Things (IoT)-based smart agriculture, which enables scalable model training over large and sparse farmlands. In this setting, UAVs act as mobile edge servers, aggregating local updates from distributed agricultural IoT devices and relaying them to the cloud server. While HFL improves scalability and reduces communication overhead, it still faces critical security threats due to its reliance on public wireless channels and the vulnerability of model aggregation to malicious updates. In this paper, we propose a secure authentication scheme that integrates anomaly detection with elliptic curve cryptography (ECC)-based mutual authentication to protect both the communication and training phases. In the proposed scheme, UAVs authenticate participating clients before receiving their local models, then perform anomaly detection to identify and exclude malicious participants. If a client is found to be malicious, its identity credentials are revoked and broadcast by the cloud server to prevent future participation. The security of the proposed scheme is formally verified using Burrows–Abadi–Needham (BAN) logic, the Real-or-Random (RoR) model, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool, along with informal security analysis. The performance evaluation includes comparisons of security features, computation cost, and communication cost with other related schemes, and an experimental assessment of anomaly detection performance. The results demonstrate that our scheme provides strong security guarantees, low overhead, and effective malicious client detection, making it well suited for UAV-assisted HFL in smart agriculture. Full article

In Social Internet of Vehicles (SIoV) environments, fog computing plays a crucial role in supporting real-time services by reducing the latency inherent in cloud-based architectures. However, fog nodes are typically deployed in physically exposed roadside environments and can be operated by several system operators, making them vulnerable to physical compromise and unauthorized access. Despite these threats, many existing authentication schemes assume fog nodes to be fully trusted or honest-but-curious, allowing them to decrypt transmitted data using a session key shared among vehicles, fog nodes, and cloud servers. To overcome these limitations, this paper proposes a quantum-secure pairwise key agreement scheme that establishes distinct session keys for vehicle–fog, fog–cloud, and vehicle–cloud communications. This design effectively prevents the disclosure of sensitive information even in the event of fog node compromise. Furthermore, Physical Unclonable Functions (PUFs) are employed to mitigate physical capture attacks, while lattice-based cryptography based on the Module Learning with Errors (MLWE) problem is integrated to ensure resistance against quantum computing attacks. The security of the proposed protocol is rigorously validated through formal analysis using AVISPA, BAN logic, and the Real-or-Random (RoR) model, in addition to informal security analysis. Comparative performance evaluations against related schemes demonstrate that the proposed approach achieves a balance between efficiency and security, making it well suited for practical deployment in SIoV environments. Full article

The integration of unmanned aerial vehicles (UAVs) into vehicular ad hoc networks (VANETs) has emerged as a promising solution to overcome the limited coverage of conventional roadside unit (RSU)-based infrastructures. However, UAVs operate in open environments and cannot be fully trusted, while the rapid advancement of quantum computing threatens the long-term security of classical public-key cryptographic systems. As a result, many existing UAV-based VANET authentication schemes face fundamental limitations in future deployments. Most existing schemes either lack post-quantum security or incur excessive computational and communication overhead, making them unsuitable for real-time and high-mobility vehicular environments. In addition, the common assumptions of trusted UAVs do not align with realistic threat models. To address these issues, this paper proposes a lightweight post-quantum authentication and key exchange protocol based on the module learning with errors (MLWE) problem and physically unclonable functions (PUFs). The proposed scheme treats UAVs as untrusted relay nodes and excludes them from session key generation. Its security is evaluated using informal analysis, the real-or-random (RoR) model, BAN logic, and AVISPA, while performance evaluation indicates improved efficiency compared to existing schemes. Full article

As a non-contact identification technology, RFID (Radio Frequency Identification) is widely used in various Internet of Things applications. However, RFID systems are highly vulnerable to diverse attacks due to the openness of communication links between readers and tags, leading to serious security and privacy concerns. Numerous RFID authentication protocols have been designed that employ hash functions and symmetric cryptography to secure communications. Despite these efforts, such schemes generally exhibit limitations in key management flexibility and scalability, which significantly restricts their applicability in large-scale RFID deployments. Confronted with this challenge, public key cryptography offers an effective solution. Taking into account factors such as parameter size, computational complexity, and resistance to quantum attacks, the NTRU algorithm emerges as one of the most promising choices. Since the NTRU signature algorithm is highly complex and requires large parameters, there are currently only a few NTRU encryption-based RFID authentication protocols available, all of which exhibit significant security flaws—such as supporting only one-way authentication, failing to address public key distribution, and so on. Moreover, performance evaluations of the algorithm in these contexts are often incomplete. This paper proposes a mutual authentication protocol for RFID based on the NTRU encryption algorithm to address security and privacy issues. The security of the protocol is analyzed using the BAN-logic tools and some non-formalized methods, and it is further validated through simulation with the AVISPA tool. With the parameter set (N, p, q) = (443, 3, 2048), the NTRU algorithm can provide 128 bits of post-quantum security strength. This configuration not only demonstrates greater foresight at the theoretical security level but also offers significant advantages in practical energy consumption and computation time when compared to traditional algorithms such as ECC, making it a highly competitive candidate in the field of post-quantum cryptography. Full article

Underwater wireless sensor networks (UWSNs) are increasingly used in marine monitoring and naval coastal surveillance, where limited bandwidth, long propagation delays, and physically exposed nodes make efficient authentication critical. This paper analyzes the maritime-surveillance-oriented protocol of Jain and Hussain and identifies vulnerabilities to physical capture, replay, and denial-of-service (DoS) attacks. We propose a PUF-assisted mutual authentication and session key agreement protocol for UWSNs. The design relies on lightweight symmetric primitives (one-way hash and XOR) and uses a fuzzy extractor to support stable PUF-based key material. In addition, a lightweight continuous authentication procedure is introduced to facilitate fast re-authentication under intermittent link disruptions commonly observed in underwater communication. Security is evaluated using BAN logic, the Real-or-Random (ROR) model, and security verification with the Scyther tool. An analytical overhead evaluation reports a computational cost of 5.972 ms per mutual authentication and a 1152-bit communication overhead, supporting a practical security–efficiency trade-off for resource-constrained UWSN deployments. Full article

Wireless medical sensor networks (WMSNs) have evolved alongside the development of communication systems, and the integration of cloud computing has enabled scalable and efficient medical data management. However, since the messages in WMSNs are transmitted over open channels, they are vulnerable to eavesdropping, replay, impersonation, and other various attacks. In response to these security concerns, Keshta et al. suggested an authentication protocol to establish secure communication in the cloud-assisted WMSNs. However, our analysis reveals their protocol cannot prevent session key disclosure, impersonation of the user and sensor node, and denial of service (DoS) attacks. Moreover, Keshta et al.’s protocol cannot support user untraceability due to fixed hidden identity. To address these weaknesses, we propose a physical unclonable function (PUF) based secure authentication protocol for cloud-assisted WMSNs. The protocol uses lightweight operations, provides mutual authentication between user, cloud server, and sensor node, and supports user anonymity and untraceability. We validate the proposed protocol’s security through informal analysis on various security attacks and formal analysis including “Burrows–Abadi–Needham (BAN) logic”, “Real-or-Random (RoR) model” for session key security, and “Automated Validation of Internet Security Protocols and Application (AVISPA) simulations”. Performance evaluation demonstrates lower communication cost and computation overhead compared with existing protocols, making the proposed protocol suitable for WMSN environments. Full article

Secure authentication in vehicular ad hoc networks (VANETs) remains a fundamental challenge due to their dynamic topology, susceptibility to attacks, and scalability constraints in multi-hop communication. Existing approaches based on elliptic curve cryptography (ECC), blockchain, and fog computing have achieved partial success but suffer from latency, resource overhead, and limited adaptability, leaving a gap for lightweight and hardware-rooted trust models. To address this, we propose a multi-hop mutual authentication protocol leveraging Physical Unclonable Functions (PUFs), which provide tamper-evident, device-specific responses for cryptographic key generation. Our design introduces a structured sequence of phases, including pre-deployment, registration, login, authentication, key establishment, and session maintenance, with optional multi-hop extension through relay vehicles. Unlike prior schemes, our protocol integrates fuzzy extractors for error tolerance, employs both inductive and game-based proofs for security guarantees, and maps BAN-logic reasoning to specific attack resistances, ensuring robustness against replay, impersonation, and man-in-the-middle attacks. The protocol achieves mutual trust between vehicles and RSUs while preserving anonymity via temporary identifiers and achieving forward secrecy through non-reused CRPs. Conceptual comparison with state-of-the-art PUF-based and non-PUF schemes highlights the potential for reduced latency, lower communication overhead, and improved scalability via cloud-assisted CRP lifecycle management, while pointing to the need for future empirical validation through simulation and prototyping. This work not only provides a secure and efficient solution for VANET authentication but also advances the field by offering the first integrated taxonomy-driven evaluation of PUF-enabled V2X protocols in multi-hop Wi-Fi environments. Full article

Smart farming is an agricultural technology integrating advanced technology such as cloud computing, Artificial Intelligence (AI), the Internet of Things (IoT), and robots into traditional farming. Smart farming can help farmers by increasing agricultural production and managing resources efficiently. However, malicious attackers can attempt security attacks because communication in smart farming is conducted via public channels. Therefore, an authentication scheme is necessary to ensure security in smart farming. In 2024, Rahaman et al. proposed a privacy-centric authentication scheme for smart farm monitoring. However, we demonstrated that their scheme is vulnerable to stolen mobile device, impersonation, and ephemeral secret leakage attacks. This paper suggests a secure and privacy-preserving scheme to resolve the security defects of the scheme proposed by Rahaman et al. We also verified the security of our scheme through “the Burrows-Abadi-Needham (BAN) logic”, “Real-or-Random (RoR) model”, and “Automated Validation of Internet Security Protocols and Application (AVISPA) tool”. Furthermore, a performance analysis of the proposed scheme compared with related studies was conducted. The comparison result proves that our scheme was more efficient and secure than related studies in the smart farming environment. Full article