By the drone capturing attacks, the adversaries can extract the long-term secret keys stored in the drones. Therefore, it is necessary to consider forward secrecy and forward unlinkability to minimize the damage by the drone capturing attacks. Forward secrecy protects the secrecy of the past sessions between users and drones, and forward unlinkability guarantees the strong anonymity of users and drones participated in the past sessions, even when the long-term secret keys are revealed to the attackers via the drone capturing attacks. In 2022 Jeong et el. suggested a three-party key agreement scheme for internet of drones which provides forward secrecy and forward unlikability. However, their scheme has some shortcomings. Especially, in their scheme a drone (or a user) can not run concurrently multiple key exchange sessions with multiple users (or drones). And their scheme provides only weak forward secrecy, not standard forward secrecy. In this paper, we propose a key exchange protocol resolving all the shortcomings of the Jeong et al.’s scheme. That is, our key exchange protocol provides the standard forward secrecy and forward unlinkability. And a drone can run concurrently multiple sessions with users without communication with the server. We also suggest a formal model for the forward unlinkability, and prove the forward unlinkability of our scheme in the formal model.
By the drone capturing attacks, the adversaries can extract the long-term secret keys stored in the drones. Therefore, it is necessary to consider forward secrecy and forward unlinkability to minimize the damage by the drone capturing attacks. Forward secrecy protects the secrecy of the past sessions between users and drones, and forward unlinkability guarantees the strong anonymity of users and drones participated in the past sessions, even when the long-term secret keys are revealed to the attackers via the drone capturing attacks. In 2022 Jeong et el. suggested a three-party key agreement scheme for internet of drones which provides forward secrecy and forward unlikability. However, their scheme has some shortcomings. Especially, in their scheme a drone (or a user) can not run concurrently multiple key exchange sessions with multiple users (or drones). And their scheme provides only weak forward secrecy, not standard forward secrecy. In this paper, we propose a key exchange protocol resolving all the shortcomings of the Jeong et al.’s scheme. That is, our key exchange protocol provides the standard forward secrecy and forward unlinkability. And a drone can run concurrently multiple sessions with users without communication with the server. We also suggest a formal model for the forward unlinkability, and prove the forward unlinkability of our scheme in the formal model.
With the rapid advancement of Internet of Things (IoT) applications, efficient and secure communication is considered a challenging task. Symmetric authenticated key exchange (AKE) is a promising solution due to its lightweight design. However, existing studies have demonstrated that traditional symmetric AKE schemes are unable to achieve perfect forward secrecy (PFS). Although some improved schemes were proposed based on the evolution of long-term secrets, the analysis indicates that there exists a zero-sum trade-off between PFS and self-synchronization. In addition, privacy preservation remains a critical issue. In response, this paper proposes a novel three-party symmetric AKE scheme. Specifically, the secret evolving mechanism to prevent the reverse inference of crucial secret values is constructed in the scheme. Meanwhile, any reachable session state can be self-transferred to the synchronization state at the end of a complete session. The proposed scheme provides anonymity and pseudonym unlinkability to the required party, while also improving the robustness of conditional identity traceability, avoiding false accusations caused by misdirected requests. The formal analysis, heuristic analysis based on the state transition and secrecy dependency, and performance comparison indicate that the proposed scheme achieves essential properties while maintaining manageable overhead.
The Internet of Drones (IoD) will have revolutionized civil and commercial applications, in much the similar way that the Internet of Things (IoT) transformed the way information is exchanged with other devices and systems over the Internet. The drones are generally considered to have constrained resources, which make them less compatible with complicated algorithms and more prone to attacks. Moreover, the IoD applications are facing information security and privacy challenges in the cyber-threat environment, where the adversary could intercept communicating messages and compromise their confidentiality or integrity. Consequently, the security protocols which are designed for IoD applications should not only provide desirable security guarantees, but also be resource-efficient. Existing authenticated key exchange protocols can authenticate the identities of communication parties and realize the exchange of session key, however, they either incur high communication overhead, suffer from non-negligible computational cost, or have inherent security design flaws. Thus, these approaches are not suitable for resource-constrained drones involved in critical IoD applications. To address the above challenges, this paper presents a featherweight authentication and key agreement scheme (hereafter referred to as fwAKA) for IoD applications based on elliptic curve cryptography, physical unclonable function, hash function, and XOR operation. The fwAKA only requires two handshakes to achieve authenticated key agreement. We prove that the fwAKA is perfectly secure in the adversarial setting through the security verification using the AVISPA. We set up a simulation environment, implement the fwAKA and its counterparts, and conduct performance evaluation in terms of communication overhead and running time. Experimental results indicate that not only is the fwAKA robust against well-known attacks but also it is more resource-efficient than its opponents.
The tremendous growth in the realm of Internet of Things (IoT) has materialized the architecture of Internet of Drones (IoD). Being an extension of the IoT technology, the IoD may control and monitor the drones in a particular flight area. The emerging 5G mobile communication infrastructure can greatly help in transmitting the High-Definition (HD) data making the drones to communicate even faster. Nonetheless, these drones remain vulnerable to known security threats due to exchange of communication messages on public channel. In addition, the drones may also be exposed to physical capture and examination by the malicious adversaries. Thus, more concerted efforts are required to address the security challenges for drone communication in IoD-based ecosystem. We propose a novel PUF-based authentication protocol SPAKE-DC to protect not only the drone communication on public channel but also if the drone is physically intercepted with captured resources. The SPAKE-DC protocol supports anonymity, mutual authenticity, perfect forward secrecy, and is also immune from drone physical capture attack. The proposed scheme is duly evaluated and formally analyzed under Real-or-Random Oracle model. The performance results show that SPAKE-DC carry convincing findings in terms of security, computation and communication. Moreover, it supports 42% more number of security features as compared to previous techniques.
The paper proposes a multi-party key exchange scheme with Perfect Forward Secrecy (PFS) which ensures that a session key derived from a set of long-term public and private keys used in the protocol to authenticate, does not compromise the secrecy of session key. In this protocol, each group establishes connection by communicating through a trusted third party. The trusted party acts as a group controller generates a public key and broadcasts it among the groups. Each group generate their public keys and send to trusted party. After receiving all the keys the group controller shares it among all the parties to generate the session key. Similarly, each group manager of individual group communicates with the members of the corresponding group. The security of the proposed scheme is analysed rigorously and proved to be resistant against non-repudiation attack, replay attack, chosen cipher attack, man-in-the middle attack. The scheme has wider applications such as, sending encrypted e-mail in a military environment to multiple users, securing submitted bids information in online tender, contract signing by many organizations, etc.
Recently, Yang and Tan proposed a certificateless key exchange protocol without pairing, and claimed their scheme satisfies forward secrecy, which means no adversary could derive an already-established session key unless the full user secret keys (including a private key and an ephemeral secret key) of both communication parties are compromised. However, in this paper, we point out their protocol is actually not secure as claimed by presenting an attack launched by an adversary who has learned the private key of one party and the ephemeral secret key of the other, but not the full user secret keys of both parties. Furthermore, to make up this flaw, we also provide an improved protocol in which the private key and the ephemeral secret key are closely intertwined with each other for generating the session key, thus above attack can be efficiently resisted.
Abstract As mobile internet and Internet of Things technologies continue to advance, the application scenarios of peer-to-peer Internet of Drones (IoD) are becoming increasingly diverse. However, the development of IoD also faces significant challenges, such as security, privacy protection, and limited computing power, which require technological innovation to overcome. For group secure communication, it is necessary to provide two basic services, user authentication and group key agreement. Due to the limited storage of IoD devices, group key negotiation requires lightweight calculations, and conventional schemes cannot satisfy the requirements of group communication in the IoD. To this end, a new lightweight communication scheme based on ring neighbors is presented in this paper for IoD, which not only realizes the identity verification of user and group key negotiation, but also improves computational efficiency on each group member side. A detailed security analysis substantiates that the designed scheme is capable of withstanding attacks from both internal and external adversaries while satisfying all defined security requirements. More importantly, in our proposal, the computational cost on the user side remains unaffected by the variability of the number of members participating in group communication, as members communicate in a non-interactive manner through broadcasting. As a result, the protocol proposed in this article demonstrates lower computational and communication costs in comparison to other cryptographic schemes. Hence, this proposal presents a more appealing approach to lightweight group key agreement protocol with user authentication for application in the IoD.