More Like this

1. P-HIP: A Lightweight and Privacy-Aware Host Identity Protocol for Internet of Things

   https://doi.org/10.1109/JIOT.2020.3009024  

   Hossain, Mahmud; Hasan, Ragib (July 2020, IEEE Internet of Things Journal)

   null (Ed.)

   The Host Identity Protocol (HIP) has emerged as the most suitable solution to uniquely identify smart devices in the mobile and distributed Internet of Things (IoT) systems, such as smart cities, homes, cars, and healthcare. The HIP provides authentication methods that enable secure communications between HIP peers. However, the authentication methods provided by the HIP cannot be adopted by the IoT devices with limited processing power because of the computation-intensive cryptographic operations involved in hash generation, signature validation, and session key establishment. Moreover, IoT devices cannot utilize the HIP as is to communicate securely in the low power and lossy networks as there is a considerable communication overhead, such as packet fragmentation and reassembly, for exchanging certificates over a lossy link. Additionally, the use of static host identifiers makes IoT devices vulnerable to cyber espionage and user-targeted attacks. In this article, we propose an authentication scheme, P-HIP, that protects the identity privacy of an IoT device by enabling the device to compute and use unique host identifiers from networks to networks and sessions to sessions. To make the HIP suitable for resource-constrained IoT devices, P-HIP provides methods that unburden IoT devices from computation-intensive operations, such as modular exponentiation, involved in authentication and session-key exchange. Additionally, P-HIP minimizes the communication overheads for exchanging certificates in lossy networks. We implement a prototype of P-HIP on Contiki enabled IoT that shows P-HIP can reduce computation costs, communication overheads, and the session-key establishment time when used by low-powered devices in a lossy network. 

   more » « less
2. Learning-Based Secure Spectrum Sharing for Intelligent IoT Networks

   https://doi.org/10.1109/ISQED60706.2024.10528684  

   Alipour-Fanid, Amir; Dabaghchian, Monireh; Jiao, Long; Zeng, Kai (April 2024, IEEE)

   In intelligent IoT networks, an IoT user is capable of sensing the spectrum and learning from its observation to dynamically access the wireless channels without interfering with the primary user’s signal. The network, however, is potentially subject to primary user emulation and jamming attacks. In the existing works, various attacks and defense mechanisms for spectrum sharing in IoT networks have been proposed. This paper systematically conducts a targeted survey of these efforts and proposes new approaches for future studies to strengthen the communication of IoT users. Our proposed methods involve the development of intelligent IoT devices that go beyond existing solutions, enabling them not only to share the spectrum with licensed users but also to effectively thwart potential attackers. First, considering practical aspects of imperfect spectrum sensing and delay, we propose to utilize online machine learning-based approaches to design spectrum sharing attack policies. We also investigate the attacker’s channel observation/sensing capabilities to design attack policies using time-varying feedback graph models. Second, taking into account the IoT devices’ practical characteristics of channel switching delay, we propose online learning-based channel access policies for optimal defense by the IoT device to guarantee the maximum network capacity. We then highlight future research directions, focusing on the defense of IoT devices against adaptive attackers. Finally, aided by concepts from intelligence and statistical factor analysis tools, we provide a workflow which can be utilized for devices’ intelligence factors impact analysis on the defense performance. 

   more » « less
3. PUFchain 3.0: Hardware-Assisted Distributed Ledger for Robust Authentication in Healthcare Cyber–Physical Systems

   https://doi.org/10.3390/s24030938  

   Bathalapalli, Venkata K.; Mohanty, Saraju P.; Kougianos, Elias; Iyer, Vasanth; Rout, Bibhudutta (February 2024, Sensors)

   This article presents a novel hardware-assisted distributed ledger-based solution for simultaneous device and data security in smart healthcare. This article presents a novel architecture that integrates PUF, blockchain, and Tangle for Security-by-Design (SbD) of healthcare cyber–physical systems (H-CPSs). Healthcare systems around the world have undergone massive technological transformation and have seen growing adoption with the advancement of Internet-of-Medical Things (IoMT). The technological transformation of healthcare systems to telemedicine, e-health, connected health, and remote health is being made possible with the sophisticated integration of IoMT with machine learning, big data, artificial intelligence (AI), and other technologies. As healthcare systems are becoming more accessible and advanced, security and privacy have become pivotal for the smooth integration and functioning of various systems in H-CPSs. In this work, we present a novel approach that integrates PUF with IOTA Tangle and blockchain and works by storing the PUF keys of a patient’s Body Area Network (BAN) inside blockchain to access, store, and share globally. Each patient has a network of smart wearables and a gateway to obtain the physiological sensor data securely. To facilitate communication among various stakeholders in healthcare systems, IOTA Tangle’s Masked Authentication Messaging (MAM) communication protocol has been used, which securely enables patients to communicate, share, and store data on Tangle. The MAM channel works in the restricted mode in the proposed architecture, which can be accessed using the patient’s gateway PUF key. Furthermore, the successful verification of PUF enables patients to securely send and share physiological sensor data from various wearable and implantable medical devices embedded with PUF. Finally, healthcare system entities like physicians, hospital admin networks, and remote monitoring systems can securely establish communication with patients using MAM and retrieve the patient’s BAN PUF keys from the blockchain securely. Our experimental analysis shows that the proposed approach successfully integrates three security primitives, PUF, blockchain, and Tangle, providing decentralized access control and security in H-CPS with minimal energy requirements, data storage, and response time. 

   more » « less
4. Dissecting Operational Cellular IoT Service Security: Attacks and Defenses

   https://doi.org/10.1109/TNET.2023.3313557  

   Wang, Sihan; Xie, Tian; Chen, Min-Yue; Tu, Guan-Hua; Li, Chi-Yu; Lei, Xinyu; Chou, Po-Yi; Hsieh, Fucheng; Hu, Yiwen; Xiao, Li; et al (January 2023, IEEE/ACM Transactions on Networking)

   More than 150 cellular networks worldwide have rolled out LTE-M (LTE-Machine Type Communication) and/or NB-IoT (Narrow Band Internet of Things) technologies to support massive IoT services such as smart metering and environmental monitoring. Such cellular IoT services share the existing cellular network architecture with non-IoT (e.g., smartphone) ones. When they are newly integrated into the cellular network, new security vulnerabilities may happen from imprudent integration. In this work, we explore the security vulnerabilities of the cellular IoT from both system-integrated and service-integrated aspects. We discover several vulnerabilities spanning cellular standard design defects, network operation slips, and IoT device implementation flaws. Threateningly, they allow an adversary to remotely identify IP addresses and phone numbers assigned to cellular IoT devices, interrupt their power saving services, and launch various attacks, including data/text spamming, battery draining, device hibernation against them. We validate these vulnerabilities over five major cellular IoT carriers in the U.S. and Taiwan using their certified cellular IoT devices. The attack evaluation result shows that the adversary can raise an IoT data bill by up to $226 with less than 120 MB spam traffic, increase an IoT text bill at a rate of $5 per second, and prevent an IoT device from entering/leaving power saving mode; moreover, cellular IoT devices may suffer from denial of IoT services. We finally propose, prototype, and evaluate recommended solutions. 

   more » « less
5. AEROKEY: Using Ambient Electromagnetic Radiation for Secure and Usable Wireless Device Authentication

   https://doi.org/10.1145/3517254  

   Lee, Kyuin; Yang, Yucheng; Prabhune, Omkar; Chithra, Aishwarya Lekshmi; West, Jack; Fawaz, Kassem; Klingensmith, Neil; Banerjee, Suman; Kim, Younghyun (March 2022, Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies)

   Wireless connectivity is becoming common in increasingly diverse personal devices, enabling various interoperation- and Internet-based applications and services. More and more interconnected devices are simultaneously operated by a single user with short-lived connections, making usable device authentication methods imperative to ensure both high security and seamless user experience. Unfortunately, current authentication methods that heavily require human involvement, in addition to form factor and mobility constraints, make this balance hard to achieve, often forcing users to choose between security and convenience. In this work, we present a novel over-the-air device authentication scheme named AEROKEY that achieves both high security and high usability. With virtually no hardware overhead, AEROKEY leverages ubiquitously observable ambient electromagnetic radiation to autonomously generate spatiotemporally unique secret that can be derived only by devices that are closely located to each other. Devices can make use of this unique secret to form the basis of a symmetric key, making the authentication procedure more practical, secure and usable with no active human involvement. We propose and implement essential techniques to overcome challenges in realizing AEROKEY on low-cost microcontroller units, such as poor time synchronization, lack of precision analog front-end, and inconsistent sampling rates. Our real-world experiments demonstrate reliable authentication as well as its robustness against various realistic adversaries with low equal-error rates of 3.4% or less and usable authentication time of as low as 24 s. 

   more » « less