Search Results (288)

Cyberattacks represent a serious threat for the security of network-based systems and are responsible for large economic losses every year. In this context, physical unclonable function (PUF)-based authentication can provide access to the network resources to legitimate users only, thus preventing unauthorized accesses. On the other hand, transient disturbances (e.g., noise, temperature and power supply variations) and permanent faults can lead to erroneous PUF responses, resulting in failed authentication and reduced network availability for legitimate users. Error-correcting codes have been proposed in the literature to improve PUF reliability. However, they typically require significant costs in terms of processing power and area overhead, meaning they are often unsuitable for resource-constrained devices, such as low-cost microcontrollers and FPGAs. In this paper, we have investigated strategies based on the use of different kinds of error-detecting and error-correcting codes, as well as their possible combination, with limited requirements in terms of processing power and no need for helper data. These strategies have been evaluated using both a synthetic PUF dataset and a real PUF dataset. The results show that the strategy based on a checksum error-detecting code achieves a good performance in terms of network availability, i.e., an error probability in the order of 10⁻³ (3.69 × 10⁻²) when the error on the PUF response (without any ECC) is 12.89% (55.04%), with a low data overhead (1.56% of the PUF challenge size), but it is effective only in the presence of transient disturbances. Instead, the strategy combining the checksum and the Hamming codes provides even higher network availability, i.e., an error probability in the order of 10⁻⁴ (1.6 × 10⁻³) when the error on the PUF response (without any ECC) is 12.89% (55.04%), at the cost of a slightly higher data overhead (7.81% of the PUF challenge size), while also enabling the capability to correct erroneous PUF responses caused by both disturbances and permanent faults. Full article

Smart-manufacturing Industrial Internet of Things (IIoT) deployments increasingly depend on low-latency device-to-device (D2D) communication among resource-constrained, physically exposed field devices. This setting makes mutual authentication and session-key establishment difficult: public-key-intensive or cloud-dependent schemes add overhead, availability dependence, and single points of failure, while weak PUF-based designs may expose challenge-response pairs (CRPs) to replay, disclosure, and modeling attacks. This paper proposes PASMAP, a lightweight PUF-ASCON mutual authentication protocol for gateway-assisted D2D communication in smart-manufacturing IIoT. PASMAP combines SRAM-PUF key reconstruction, fuzzy-extractor helper data, hash- and XOR-based obfuscation, and ASCON authenticated encryption with associated data (AEAD) to protect hardware-rooted identities, hide raw PUF responses, and establish fresh session keys for post-authentication data exchange under an explicitly trusted local-gateway model. The protocol is evaluated against physical, protocol-level, and insider threats, including cloning, tampering, replay, man-in-the-middle, CRP disclosure, PUF modeling, stolen-verifier, and known-key attacks. A real-or-random (ROR) analysis bounds the adversary’s session-key advantage using hash collisions, PUF-response prediction, online guessing, and ASCON AEAD security. A mixed-platform evaluation based on ESP32 primitive timings for the edge devices and desktop timings for the resource-rich gateway yields an estimated total computation cost of 4.762 ms. The initiator and responder require 2.006 ms/264.79 $\mathsf{\mu }$J and 2.679 ms/353.63 $\mathsf{\mu }$J of computational energy, respectively, while the five-message exchange carries 4704 bits. These results indicate low computational overhead under the stated benchmark and power-model assumptions. However, the protocol totals are operation-count-based estimates, the PUF and fuzzy-extractor operations are simulated, and the energy model excludes several platform- and communication-dependent costs. A complete embedded implementation is therefore required to validate end-to-end latency, memory use, energy consumption, communication-stack overhead, SRAM-PUF reliability, and fuzzy-extractor performance. Full article

This paper presents AERO-GUARD, a formally verified drone authentication and road surveillance system that integrates Kyber post-quantum key encapsulation, physical unclonable functions (PUFs), decentralized IPFS-based identity storage, and blockchain-anchored audit logging. AERO-GUARD operates across three phases, key provisioning, enrollment, and authentication, enforcing mutual authentication, replay resistance, and privacy-preserving comparison through an off-chain evaluator (OCE) that performs homomorphic subtraction on encrypted PUF responses without accessing plaintext secrets. The protocol is modeled and verified using ProVerif 2.05 under the Dolev–Yao adversary model. To evaluate the system beyond theoretical verification, a simulation environment was developed to replicate realistic road conditions, incorporating a simulated road network and a virtual drone traversing monitored routes. An AI model is deployed to perform real-time detection of suspicious and anomalous activities along the road. All detection events are surfaced through a centralized monitoring dashboard that provides authorized personnel with live alerts, a drone camera livestream with detection annotations, and contextual drone telemetry, enabling timely and informed incident response. Formal verification results demonstrate that AERO-GUARD satisfies the targeted security properties, including mutual authentication, secrecy preservation, and replay resistance, confirming the protocol’s resilience against common authentication attacks. Full article

With the rapid development of quantum computing, in response to its disruptive threats to traditional cryptosystems and the urgent demand for lightweight and highly scalable secure group communication among resource-constrained devices in large-scale Internet of Things (IoT) scenarios, this paper proposes a lightweight anonymous group authentication scheme that integrates Physical Unclonable Functions (PUFs), distributed Gossip algorithms, and quantum key distribution. By exploiting the uniqueness and unclonability derived from the inherent physical characteristics of PUF hardware, the scheme fundamentally eliminates attack vectors against quantum computers without requiring devices to pre-store any secret keys in their memory, while the QKCS pre-provisions CRPs and key seeds, which is the standard enrollment procedure in PUF-based systems. Combined with information-theoretically secure quantum keys as session keys, it forms a dual protection mechanism: anti-forgery at the physical layer and anti-quantum attack at the cryptographic layer. Innovatively, the Gossip algorithm is deeply integrated with group key agreement, converting global broadcast into local iterative interactions between nodes, which effectively alleviates broadcast storms and improves the scalability and fault tolerance of the protocol. Meanwhile, a pseudonym mechanism is introduced to achieve anonymous identity protection, and a dynamic key update strategy guarantees forward and backward security when members join or leave the group. Formal verification based on BAN logic and security analysis show that the proposed protocol can resist typical attacks such as replay attacks, man-in-the-middle attacks, and impersonation attacks. Performance evaluations demonstrate that our scheme outperforms existing comparable schemes in terms of computational cost, communication overhead, and dynamic group management efficiency, demonstrating its potential for resource-constrained IoT environments, pending further validation on real hardware platforms. Full article

With the rapid development of Vehicular Ad Hoc Networks (VANETs), Vehicle-to-Infrastructure (V2I) communication plays a critical role in Intelligent Transportation Systems (ITS). However, existing authentication and key exchange protocols face challenges such as high computational cost, large communication overhead, and security and privacy risks in high-speed mobile environments. To address these problems, this paper proposes a lightweight V2I authentication key exchange and ticket-based fast handover authentication protocol based on consortium blockchain and a Physical Unclonable Function (PUF). The proposed framework integrates PUF-based device binding, biometric-assisted user binding, PRF-based dynamic pseudonym update, target-RSU-bound handover tickets, and consortium blockchain-assisted auditability. To avoid privacy leakage on immutable ledgers, the blockchain stores only keyed pseudonym indexes, cryptographic commitments, timestamps, revocation states, and audit records, whereas biometric helper information, PUF-derived values, long-term secrets, handover keys, and session keys are protected in TPM/HSM or encrypted off-chain storage. Formal verification using ProVerif indicates that the revised protocol satisfies the modeled secrecy properties, injective mutual authentication for initial authentication and handover, and non-injective ticket origin authenticity for accepted handover tickets. In addition, the Real-or-Random (RoR) model is used to prove fresh session key indistinguishability under explicit pre- and post-Test freshness, PUF unpredictability, fuzzy extractor security, and hardware-protected secret assumptions. Analytical performance evaluation further shows the core cryptographic cost of the proposed scheme while explicitly separating and parameterizing deployment-dependent TPM/HSM, AEAD, blockchain lookup, and PBFT confirmation costs. Full article

After an earthquake or major traffic accident, emergency rescue vehicles may be unable to access the accident site or communicate with the survey drones at the scene. In such cases, an emergency rescue vehicle can select any nearby drone as a communication relay to establish a connection with survey drones at the accident site, thereby forming a drone-assisted Vehicular Ad Hoc Network (VANET) to break through geographical constraints. These networks are characterized by flexible deployment, rapid survey, and real-time transmission of rescue data. However, existing authentication protocols for drone-assisted VANETs are insufficient in security and privacy protection, making them vulnerable to side-channel attacks, device capture attacks, and identity impersonation attacks. In addition, the excessively high computational overhead makes it difficult for them to meet the requirements of low latency and high security for real-time communication in emergency rescue. Therefore, this paper proposes a lightweight drone-assisted emergency rescue authentication protocol based on Physical Unclonable Functions (PUF) and the Chebyshev chaotic map. In this protocol, the authenticating entities, including emergency rescue vehicles, relay drones, and survey drones, register with the Trusted Authority (TA) in a symmetric manner and also authenticate each other’s identities and establish session keys symmetrically. The proposed scheme not only resists side-channel attacks and device capture attacks but also addresses the single point of failure problem of relay drones. Both formal and informal security analyses verify its security, and comparative experiments show that it has lower computational and communication overhead, making it more suitable for emergency rescue application scenarios. Full article

Sensor networks increasingly combine exposed sensing nodes, optical communication, photonic hardware, near-sensor inference, and distributed infrastructure monitoring. This changes the security problem from protecting packets alone to establishing device provenance, measurement integrity, link confidentiality and availability, trustworthy inference, physical situational awareness, lifecycle control, and governance. This structured review with documented scoping searches examines security by light: mechanisms in which optical or photonic phenomena directly realize, constrain, compute, or observe a security-relevant function. The review synthesizes screened evidence across photonic roots of trust, visible-light communication and LiFi security, photonic intelligence, reservoir and chaotic photonics, and distributed photonic sensing infrastructure. Searches across arXiv, IEEE Xplore, ACM Digital Library, and Scopus yielded 228 deduplicated candidate records, of which 187 were retained as core evidence and eight as contextual evidence. To avoid overstating heterogeneous photonic work, retained records were separated into direct security evidence, security-adjacent capability evidence, background/framework evidence, and excluded records. The central result is architectural: light-enabled mechanisms are most defensible when they provide explicit, confidence-rated evidence to conventional security engineering. In this paper, confidence-rated evidence means evidence whose security interpretation is tied to a stated asset, adversary or failure mode, evidence role, validation setting, robustness limits, deployment fit, and reproducibility condition. This avoids treating optical novelty, spatial confinement, analog complexity, or high-dimensional dynamics as assurance by themselves. The paper develops an auditable taxonomy, evidence appraisal rubric, mechanism-family synthesis, integration architecture, maturity analysis, and research agenda for incorporating light-enabled mechanisms into secure sensor-networked systems. Full article

Blockchain-assisted authentication frameworks have been introduced to mitigate the single point-of-failure problem in centralized IoT collaboration environments. Recently, a lightweight trust management framework based on a permissioned blockchain was proposed for distributed authentication and interaction traceability. However, our analysis shows that this protocol is vulnerable to offline password guessing, terminal device impersonation, session-key disclosure, and user traceability attacks. It also fails to provide perfect forward secrecy. Accordingly, we propose a secure and lightweight authentication and key agreement protocol for blockchain-assisted IoT collaboration environments. The proposed scheme integrates Physically Unclonable Functions to improve resistance against physical capture and device cloning attacks. It also uses a fuzzy extractor to support biometric-based authentication and a dynamic pseudo-identity update mechanism managed through a consortium blockchain to protect user anonymity and untraceability. The proposed protocol is verified using the Real-or-Random model, BAN logic, and AVISPA simulations. Full article

Distributed photovoltaic (PV) power stations are core enablers for dual-carbon goals in modern power systems, with IoT-based monitoring systems serving as their nerve center for real-time data collection and grid dispatch. However, PV monitoring nodes operate in harsh, unattended outdoor environments with severe computational resource constraints, exposing them to critical hardware security risks that can trigger cross-domain cascading hazards. Existing research focuses primarily on communication and software security, lacking systematic hardware security modeling and lightweight defense designs. Generic IoT hardware security solutions are also inapplicable due to excessive overhead. To address these gaps, this paper proposes LHSF, a lightweight hardware security framework tailored for resource-constrained PV edge nodes. It integrates an on-chip OTP-based lightweight hardware root of trust (L-HROT) with an SRAM-PUF-driven non-resident key management protocol, which implements full-lifecycle key management via a “power-on generation, on-demand usage, post-use destruction, zero-residue storage” paradigm. Experiments on ESP32 and Raspberry Pi 4B show that LHSF provides robust resistance to side-channel recovery, physical extraction, malicious firmware boot and rollback attacks, reducing fault injection bypass rate to 6.8%. Compared to standard TPM 2.0, it cuts boot delay by 60.7%, power consumption by 18.6% and memory footprint by 72.7% with negligible performance overhead. This work fills the hardware security gap for PV monitoring systems and provides a reusable technical pathway for distributed energy IoT terminals. Full article

Physical unclonable function (PUF) based on intrinsic device randomness has emerged as promising hardware security primitives, yet combining secure encryption with neuromorphic recognition within a single device platform remains challenging. Here, we demonstrate a photosensing PUF based on an intrinsically random SnTe memristor capable of both image encryption and memristive neural network recognition. The SnTe memristor, fabricated with an In₂O₃:SnO₂/SnTe/Nb:SrTiO₃ structure, exhibits stable resistive switching and stable retention exceeding 4000 s. Synaptic biomimetic behaviors including learning-experience emulation, short-term plasticity and long-term plasticity are also realized. Notably, the device displays pronounced optical sensitivity that produces stochastic photocurrent fluctuations originating from unavoidable device-to-device variations under illumination. By quantizing these random photocurrents, an encryption key stream is generated and utilized for image scrambling and diffusion. A memristive neural network is constructed to classify the encrypted images, achieving a recognition accuracy of 95.1% with a loss of 0.15 after 300 training epochs. This work establishes a viable pathway from intrinsic optical randomness to secure neuromorphic computing, highlighting the multifunctional potential of SnTe memristors in integrated hardware security and brain-inspired computation. Full article

The Internet of Drones (IoD) has become an important platform for applications such as smart agriculture, industrial monitoring, and large-scale aerial sensing. However, securing IoD communications remains challenging because drones often operate in open environments and have limited computation, storage, and energy resources. Existing authentication and key agreement protocols still face practical limitations, including high computational overhead, exposure to physical capture attacks, and reliance on centralized servers for session-key generation. In this paper, we first analyze a recent IoD authentication scheme and show that it is vulnerable to session-key disclosure, offline identity/password guessing, and mobile device/drone impersonation attacks. To address these issues, we propose a lightweight Physically Unclonable Function (PUF)-based end-to-end authentication protocol for IoD environments. The proposed scheme avoids storing long-term secret keys in drone memory and enables the mobile device and drone to establish a session key directly, without involving the Ground Station Server in key derivation. The security of the proposed protocol is evaluated through informal analysis, BAN logic, the Real-or-Random model, and AVISPA simulation. The results show that the scheme resists common attacks, including replay, impersonation, stolen verifier, physical capture, and offline password guessing attacks. Performance evaluation further indicates that the protocol maintains low computational cost while providing stronger security guarantees, making it suitable for resource-constrained IoD deployments. Full article

In highly dynamic vehicular ad hoc networks (VANETs), vehicles frequently move across the coverage areas of multiple roadside units (RSUs), making secure and efficient continuous vehicle-to-infrastructure access essential. However, repeated full authentication and key agreement for each new RSU access impose considerable computational and communication overhead. This paper proposes a state-assisted privacy-preserving mutual authentication and key agreement scheme for lightweight multi-RSU access in VANETs. The proposed scheme consists of initial and subsequent authentication phases. In the initial phase, elliptic curve cryptography (ECC) is used to achieve anonymous mutual authentication and session key establishment between vehicles and RSUs. In the subsequent authentication phase, a vehicle leverages follow-up authentication state securely forwarded by the previous RSU to complete fast authentication with a neighboring RSU using only hash and XOR operations. In addition, physically unclonable functions (PUFs) are deployed on both vehicles and RSUs to protect critical secrets. Security analysis shows that the proposed scheme achieves mutual authentication, anonymity preservation, and resistance to common attacks. Performance evaluation shows that it reduces the computational cost of subsequent authentication by more than 90% while maintaining low communication overhead. Full article

While drones play important roles in areas such as communication and logistics delivery, they have certain limitations in emergency rescue scenarios due to their inability to carry passengers. Building on mature drone technologies such as autonomous flight and environmental perception, unmanned passenger Electric Vertical Take-off and Landing (eVTOL) aircraft are designed with a manned cabin, enabling them to operate without an onboard pilot while rapidly transporting injured people. Consequently, eVTOLs can play a significant role in emergency rescue that cargo-only drones cannot fulfill, as they are capable of rapidly reaching emergency scenes, effectively overcoming the delays caused by traditional ground traffic congestion. Despite their potential, eVTOLs still face several critical obstacles, including signal disruption, limited coverage of dispatching centers, mutual authentication among entities, and concerns related to security and privacy preservation. As a remedy, this paper presents a lightweight authentication protocol leveraging drone assistance to overcome these challenges for unmanned eVTOL emergency rescue. In scenarios where an unmanned eVTOL experiences signal blockage due to dense urban high-rise structures, neighboring drones can serve as a transmission relay to assist the unmanned eVTOL and the dispatch center (DC) in completing mutual authentication and session key negotiation, thereby enabling the unmanned eVTOL to safely complete its mission. To enhance security, physical unclonable functions (PUFs) are integrated into unmanned eVTOLs, drones, and the DC, safeguarding sensitive data against side-channel and physical capture attacks while preserving the confidentiality of unmanned eVTOL identities to mitigate privacy risks. Our protocol achieves provable security in the random oracle model while exhibiting strong resistance to various well-known attacks. Comparative analysis with the existing drone authentication and drone-assisted emergency rescue authentication protocols reveals that our protocol not only provides stronger security guarantees but also maintains a low computational overhead. Full article

The development of sensor and communication technology has enabled the Internet of Things in healthcare. In Medical Internet of Things (MIoT) environments, sensors support real-time patient monitoring, remote diagnosis, and early disease detection. However, communication between users and sensors over public channels is vulnerable to various security attacks, making secure and lightweight authentication with session key establishment essential for protecting medical data. Recently, a lightweight and anonymous authentication protocol for MIoT environments was proposed using Physical Unclonable Functions (PUFs); however, we show that their protocol is vulnerable to eavesdropping, stolen verifier, and ephemeral secret leakage attacks, and fails to guarantee untraceability. To address these weaknesses, we propose a secure and lightweight PUF-based authentication protocol for MIoT environments. The security of our protocol is formally verified using Burrows–Abadi–Needham logic, the Real-or-Random model, and the Scyther tool. Furthermore, the practical validation of the proposed protocol is conducted on a hardware platform along with an evaluation of energy consumption based on the MIRACL cryptographic library. Performance comparisons demonstrate that our protocol achieves enhanced security properties with minimal computational overhead and communication costs. Ultimately, this research provides a secure and robust architectural option for healthcare applications aiming to preserve patient privacy in resource-constrained MIoT. Full article

With the growing security requirements of sensor nodes in Internet of Things (IoT) systems, conventional silicon-circuit-based physical unclonable functions (PUFs) still face limitations in circuit overhead, design complexity, and system integration. To address these challenges, this paper proposes a lightweight gas sensor PUF (GS-PUF) design based on a Ni-doped SnO₂ nanoscale gas sensor array. The proposed method exploits both the unavoidable process randomness introduced during sensor fabrication and the device-to-device electrical response variations induced by gas–material interactions as entropy sources, thereby enabling high-quality PUF response generation. At the device level, Ni-SnO₂ nanomaterials are prepared by electrostatic spray deposition (ESD), and an indirectly heated gas sensor array is constructed to enhance the sensitivity and stability of the sensing response. At the algorithmic level, a random resistance balancing algorithm based on multi-sensor combinational comparison is proposed. By randomly comparing the summed resistances of multiple sensor clusters, a 128-bit multi-bit PUF response is generated, while the uniformity and independence of the output bits are effectively improved. Experimental results demonstrate that the proposed GS-PUF exhibits excellent randomness, uniqueness, and reliability: the information entropy of the PUF responses is greater than 0.99, approaching the ideal value; the probabilities of output bits “1” and “0” are 0.4988 and 0.5012, respectively, indicating a well-balanced distribution; the inter-device uniqueness reaches 49.8%, close to the ideal value of 50%; all items in the NIST randomness test suite are passed, with all p-values exceeding 0.01 and the minimum p-value being 0.0368, confirming a high level of statistical randomness confidence. In addition, long-term measurements under fixed laboratory conditions show that the PUF response reliability remains above 96%. Compared with other sensor-based PUFs, the proposed method provides a lightweight sensing-security integration approach for IoT sensor nodes by reusing intrinsic gas-sensor response variations and avoiding an additional dedicated silicon PUF circuit. Full article