With rapid increase of mobile computing and wireless network linkage, the information exchange between connected systems and within groups increases heavily. Exchanging confidential information within groups via unsecured communication channels is a high security threat. In order to prevent third parties from accessing this data, it is essential to encrypt it. For this purpose, the group participants need a common group key to enable encrypted broadcast messages. But efficient key management of secured group communication is a challenging task, if participants rely on low performance hardware and small bandwidth. For coordination and distribution, we present the modular group key management procedure CAKE that is centrally organized and meets strict security requirements. The lightweight G-IKEv2 protocol in combination with the key exchange concept of CAKE leads to an efficiently integrated solution. The hybrid approach combines the advantages of the existing protocols with the objective to reduce the computation and communication effort. It is shown that the procedure is more suitable for changing MANET groups than the existing ones. Moreover, the exchanged group key can be used for any services which provides a wide range of applications.
This paper reports on the development and evaluation of a prototype blockchain solution for private and secure individual omics health data management and sharing. This solution is one output of a multidisciplinary project investigating the social, data and technical issues surrounding application of blockchain technology in the context of personalized healthcare research. The project studies potential ethical, legal, social and cognitive constraints of self-sovereign healthcare data management and sharing, and whether such constraints can be addressed through careful user interface design of …
The recent FATF Recommendations defines virtual assets and virtual assets service providers (VASP), and requires under the Travel Rule that originating VASPs obtain and hold required and accurate originator information and required beneficiary information on virtual asset transfers. In this paper we discuss the notion of key ownership evidence as a core part of originator and beneficiary information required by the FATF Recommendation. We discuss approaches to securely communicate the originator and beneficiary information between VASPs, and review existing standards for public key certificate…
With rise of blockchain popularity, more and more people seek to implement blockchain technology into their projects. Most common way is to take existing blockchain stack, such as Azure Blockchain Workbench or Oracle Blockchain Platform. While the blockchain technology is well-protected by its algorithms it is still vulnerable because its privacy relies on regular cryptography. And mistakes or vulnerabilities in key management protocols can affect even the most secure blockchain projects. This article considers question of vulnerabilities within Azure Blockchain Workbench key management system…
This paper presents a new crypto scheme whose title promises it to be so boring that no-one will bother reading past the abstract. Because of this, the remainder of the paper is left blank.
Limited resources (such as energy, computing power, storage, and so on) make it impractical for wireless sensor networks (WSNs) to deploy traditional security schemes. In this paper, a hierarchical key management scheme is proposed on the basis of identity-based encryption (IBE).This proposed scheme not only converts the distributed flat architecture of the WSNs to a hierarchical architecture for better network management but also ensures the independence and security of the sub-networks. This paper firstly reviews the identity-based encryption, particularly, the Boneh-Franklin algorithm. Then…
An Efficient Group Key Management Using Code for Key Calculation for Simultaneous Join/Leave: CKCS
提出了一种有效的安全组播同时加入/离开的组密钥管理协议CKCS（Code for Key Calculation in Simultaneous Join/Leave）。该协议基于逻辑密钥层次结构。在该协议中，当新成员同时加入组时，服务器只发送这些新成员的组密钥。然后，当前成员和新成员通过节点编码和单向哈希函数计算出所需的密钥。节点代码是分配给每个密钥的随机数，以帮助用户计算所需的密钥。同样，在离开时，服务器只是将新的组密钥发送给剩余的成员。结果表明，CKCS减少了计算和通信开销，同时加入/离开的消息大小。
Within this the work applicability of Physical LayerSecurity (PHYSEC) based key management within Long RangeWide Area Network (LoRaWAN) is proposed and evaluatedusing an experimental testbed. Since Internet of Things (IoT)technologies have been arising in past years, they have as wellattracted attention for possible cyber attacks. While LoRaWANalready provides many of the features needed in order to ensuresecurity goals such as data confidentiality and integrity, it lacksin measures such as secure key management and distributionschemes. Since conventional solutions are not feasible here, e.g.d…
In the secure group communication, data is transmitted in such a way that only the group members are able to receive the messages. The main problem in the solution using symmetric key is heavy re-keying cost. To reduce re-keying cost tree based architecture is used. But it requires extra overhead to balance the key- tree in order to achieve logarithmic re-keying cost. The main challenging issue in dynamic and secure multimedia multicast communication is to design a centralized group key management scheme with minimal computational, communicational and storages complexities without breaching se…
Bitcoin users are directly or indirectly forced to deal with public key cryptography, which has a number of security and usability challenges that differ from the password-based authentication underlying most online banking services. Users must ensure that keys are simultaneously accessible, resistant to digital theft and resilient to loss. In this paper, we contribute an evaluation framework for comparing Bitcoin key management approaches, and conduct a broad usability evaluation of six representative Bitcoin clients. We find that Bitcoin shares many of the fundamental challenges of key manag…
In this work we provide a suite of protocols for group key management based on general semigroup actions. Construction of the key is made in a distributed and collaborative way. Examples are provided that may in some cases enhance the security level and communication overheads of previous existing protocols. Security against passive attacks is considered and depends on the hardness of the semigroup action problem in any particular scenario.
Secure group-oriented communication is crucial to a wide range of applications in Internet of Things (IoT). Security problems related to group-oriented communications in IoT-based applications placed in a privacy-sensitive environment have become a major concern along with the development of the technology. Unfortunately, many IoT devices are designed to be portable and light-weight; thus, their functionalities, including security modules, are heavily constrained by the limited energy resources (e.g., battery capacity). To address these problems, we propose a group key management scheme based …
NuCypher KMS is a decentralized Key Management System (KMS) that addresses the limitations of using consensus networks to securely store and manipulate private, encrypted data. It provides encryption and cryptographic access controls, performed by a decentralized network, leveraging proxy re-encryption. Unlike centralized KMS as a service solutions, it doesn't require trusting a service provider. NuCypher KMS enables sharing of sensitive data for both decentralized and centralized applications, providing security infrastructure for applications from healthcare to identity management to decentr…
With the advent of modern communications systems, much attention has been put on developing methods for securely transferring information between constituents of wireless sensor networks. To this effect, we introduce a mathematical programming formulation for the key management problem, which broadly serves as a mechanism for encrypting communications. In particular, an integer programming model of the q-Composite scheme is proposed and utilized to distribute keys among nodes of a network whose topology is known. Numerical experiments demonstrating the effectiveness of the proposed model are c…
Security is a critical and vital task in wireless sensor networks, therefore different key management systems have been proposed, many of which are based on symmetric cryptography. Such systems are very energy efficient, but they lack some other desirable characteristics. On the other hand, systems based on public key cryptography have those desirable characteristics, but they consume more energy. Recently based on authenticated messages from base station a new PKC based key agreement protocol was proposed. We show this method is susceptible to a form of denial of service attack where resource…
After discussing the concept of DUKPT based symmetric encryption key management (e.g., for 3DES) and definition of cloud or remote wallet, the paper analyses applicability of DUKPT to different use cases like mobile banking, NFC payment using EMV contactless card and mobile based EMV card emulation, web browser based transaction and cloud or remote wallet. Cloud wallet is an emerging payment method and is gaining momentum very fast. Anticipating that the wallet product managers and security specialists may face these questions from different stakeholders, the authors have addressed applicabili…
Smart Grids are evolving as the next generation power systems that involve changes in the traditional ways of generation, transmission and distribution of power. Advanced Metering Infrastructure (AMI) is one of the key components in smart grids. An AMI comprises of systems and networks, that collects and analyzes data received from smart meters. In addition, AMI also provides intelligent management of various power-related applications and services based on the data collected from smart meters. Thus, AMI plays a significant role in the smooth functioning of smart grids. AMI is a privileged tar…
Managing cryptographic keys can be a complex task for an enterprise and particularly difficult to scale when an increasing number of users and applications need to be managed. In order to address scalability issues, typical IT infrastructures employ key management systems that are able to handle a large number of encryption keys and associate them with the authorized requests. Given their necessity, recent years have witnessed a variety of key management systems, aligned with the features, quality, price and security needs of specific organisations. While the spectrum of such solutions is welc…
In this paper, we introduce a novel Communication and Obfuscation Management Architecture (COMA) to handle the storage of the obfuscation key and to secure the communication to/from untrusted yet obfuscated circuits. COMA addresses three challenges related to the obfuscated circuits: First, it removes the need for the storage of the obfuscation unlock key at the untrusted chip. Second, it implements a mechanism by which the key sent for unlocking an obfuscated circuit changes after each activation (even for the same device), transforming the key into a dynamically changing license. Third, it p…
Many Internet of Things (IoT) scenarios require communication to and data acquisition from multiple devices with similar functionalities. For such scenarios, group communication in the form of multicasting and broadcasting has proven to be effective. Group Key Management (GKM) involves the handling, revocation, updation and distribution of cryptographic keys to members of various groups. Classical GKM schemes perform inefficiently in dynamic IoT environments, which are those wherein nodes frequently leave or join a network or migrate from one group to another over time. Recently, the `GroupIt'…
Due to hostile environment and wireless communication channel, security mechanisms are essential for wireless sensor networks (WSNs). Existence of a pair of shared key is a prerequisite for many of these security mechanisms; a task that key management system addresses. Recently, an energy efficient method based on public key cryptography (PKC) was proposed. We analyze this protocol and show that it is vulnerable to denial of service (DOS) attacks and adversary can exhaust memory and battery of nodes. Then, we analyze this protocol and show that using a more knowledgeable BS this vulnerability …
With the extraordinary maturity of data exchange in network environments and increasing the attackers capabilities, information security has become the most important process for data storage and communication. In order to provide such information security the confidentiality, data integrity, and data origin authentication must be verified based on cryptographic encryption algorithms. This paper presents a development of the advanced encryption standard (AES) algorithm, which is considered as the most eminent symmetric encryption algorithm. The development focuses on the generation of the inte…
Vehicular Communication (VC) systems will greatly enhance intelligent transportation systems. But their security and the protection of their users' privacy are a prerequisite for deployment. Efforts in industry and academia brought forth a multitude of diverse proposals. These have now converged to a common view, notably on the design of a security infrastructure, a Vehicular Public Key Infrastructure (VPKI) that shall enable secure conditionally anonymous VC. Standardization efforts and industry readiness to adopt this approach hint to its maturity. However, there are several open questions r…
Nowadays log files handling imposes to ISPs (intended in their widest scope) strict normative duties apart from common technological issues. This work analyses how retention time policies and timestamping are deeply interlinked from the point of view of service providers, possibly leading to costs rise. A new schema is proposed trying to mitigate the need for third-party suppliers, enforcing cryptographic primitives well established in other fields of Information Technology but perhaps not yet widespread in logs management. The foundations of timestamping are recapped, and properties of crypto…
Wireless Sensor Network (WSN) is consisting of independent and distributed sensors to monitor physical or environmental conditions, such as temperature, sound, pressure, etc. However, the limited resources of sensors and hostile environments in which they could be deployed, make this type of networks vulnerable to several types of attacks similar to those occurring in ad hoc networks. The most crucial and fundamental challenge that WSN is facing is security. The primary subject of all my work is to address this issue. Due to minimum capacity in term of memory cost, processing and physical acce…
In recent years, the emerged network worms and attacks have distributive characteristic, which can spread globally in a very short time. Security management crossing network to co-defense network-wide attacks and improve efficiency of security administration is urgently needed. This paper proposes a hierarchical distributed network security management system (HD-NSMS), which can centrally manage security across networks. First describes the system in macrostructure and microstructure; then discusses three key problems when building HD-NSMS: device model, alert mechanism and emergency response …
Cellular (C) setups facilitate the connectivity amongst the devices with better provisioning of services to its users. Vehicular networks are one of the representative setups that aim at expanding their functionalities by using the available cellular systems like Long Term Evolution (LTE)-based Evolved Universal Terrestrial Radio Access Network (E-UTRAN) as well as the upcoming Fifth Generation (5G)-based functional architecture. The vehicular networks include Vehicle to Vehicle (V2V), Vehicle to Infrastructure (V2I), Vehicle to Pedestrian (V2P) and Vehicle to Network (V2N), all of which are r…
Advanced Metering Infrastructure forms a communication network for the collection of power data from smart meters in Smart Grid. As the communication between smart meters could be secured utilizing public-key cryptography, however, public-key cryptography still has certain challenges in terms of certificate revocation and management particularly related distribution and storage overhead of revoked certificates. To address this challenge, in this paper, we propose a novel revocation management approach by utilizing cryptographic accumulators which reduces the space requirements for revocation i…
With the development of wireless communication technologies which considerably contributed to the development of wireless sensor networks (WSN), we have witnessed an ever-increasing WSN based applications which induced a host of research activities in both academia and industry. Since most of the target WSN applications are very sensitive, security issue is one of the major challenges in the deployment of WSN. One of the important building blocks in securing WSN is key management. Traditional key management solutions developed for other networks are not suitable for WSN since WSN networks are …
Public key infrastructure (PKI) is the most widely used security mechanism for securing communications over the network. However, there are known performance issues, making it unsuitable for use in vehicular networks. In this paper, we propose a secure and authenticated key management protocol (SA-KMP) to overcome the shortcomings of the PKI. The SA-KMP scheme distributes repository containing the bindings of the en-tity's identity and its corresponding public key to each vehicle and road side unit. By doing so, certificate exchanges and certificate revocation lists are eliminated. Furthermore…
In the smart grid, smart meters, and numerous control and monitoring applications employ bidirectional wireless communication, where security is a critical issue. In key management based encryption method for the smart grid, the Trusted Third Party (TTP), and links between the smart meter and the third party are assumed to be fully trusted and reliable. However, in wired/wireless medium, a man-in-middle may want to interfere, monitor and control the network, thus exposing its vulnerability. Acknowledging this, in this paper, we propose a novel two level encryption method based on two partially…
Efficient ML-DSA Public Key Management Method with Identity for PKI and Its Application
Pengcheng Laboratory（鹏城实验室）；Nanjing Xunshi Data Technology Co., Ltd（南京寻石数据科技有限公司）；University of Science and Technology of China（中国科学技术大学）；Hefei National Laboratory（合肥国家实验室）；Hong Kong Polytechnic University（香港理工大学）
With the advent of cloud technologies, there is a growing number of easy-to-use services to store files and share them with other cloud users. By providing security features, cloud service providers try to encourage users to store personal files or corporate documents on their servers. However, their server-side encryption solutions are not satisfactory when the server itself is not trusted. Although, there are several client-side solutions to provide security for cloud sharing, they are not used extensively because of usability issues in key management. In this paper, we propose TwinCloud whi…
Public key authentication (PKA) has been deployed in various services to provide stronger authentication to users. In PKA, a user manages private keys on her devices called authenticators, and services bind the corresponding public keys to her account. To protect private keys, a user uses authenticators which never export private keys outside. On the other hand, a user regularly uses multiple authenticators like PCs and smartphones. She replaces some of her authenticators according to their lifecycle, such as purchasing new devices and losing devices. It is a burden for a user to register, upd…
