More Like this

1. P-HIP: A Lightweight and Privacy-Aware Host Identity Protocol for Internet of Things

   https://doi.org/10.1109/JIOT.2020.3009024  

   Hossain, Mahmud; Hasan, Ragib (July 2020, IEEE Internet of Things Journal)

   null (Ed.)

   The Host Identity Protocol (HIP) has emerged as the most suitable solution to uniquely identify smart devices in the mobile and distributed Internet of Things (IoT) systems, such as smart cities, homes, cars, and healthcare. The HIP provides authentication methods that enable secure communications between HIP peers. However, the authentication methods provided by the HIP cannot be adopted by the IoT devices with limited processing power because of the computation-intensive cryptographic operations involved in hash generation, signature validation, and session key establishment. Moreover, IoT devices cannot utilize the HIP as is to communicate securely in the low power and lossy networks as there is a considerable communication overhead, such as packet fragmentation and reassembly, for exchanging certificates over a lossy link. Additionally, the use of static host identifiers makes IoT devices vulnerable to cyber espionage and user-targeted attacks. In this article, we propose an authentication scheme, P-HIP, that protects the identity privacy of an IoT device by enabling the device to compute and use unique host identifiers from networks to networks and sessions to sessions. To make the HIP suitable for resource-constrained IoT devices, P-HIP provides methods that unburden IoT devices from computation-intensive operations, such as modular exponentiation, involved in authentication and session-key exchange. Additionally, P-HIP minimizes the communication overheads for exchanging certificates in lossy networks. We implement a prototype of P-HIP on Contiki enabled IoT that shows P-HIP can reduce computation costs, communication overheads, and the session-key establishment time when used by low-powered devices in a lossy network. 

   more » « less
2. PUFchain 3.0: Hardware-Assisted Distributed Ledger for Robust Authentication in Healthcare Cyber–Physical Systems

   https://doi.org/10.3390/s24030938  

   Bathalapalli, Venkata K.; Mohanty, Saraju P.; Kougianos, Elias; Iyer, Vasanth; Rout, Bibhudutta (February 2024, Sensors)

   This article presents a novel hardware-assisted distributed ledger-based solution for simultaneous device and data security in smart healthcare. This article presents a novel architecture that integrates PUF, blockchain, and Tangle for Security-by-Design (SbD) of healthcare cyber–physical systems (H-CPSs). Healthcare systems around the world have undergone massive technological transformation and have seen growing adoption with the advancement of Internet-of-Medical Things (IoMT). The technological transformation of healthcare systems to telemedicine, e-health, connected health, and remote health is being made possible with the sophisticated integration of IoMT with machine learning, big data, artificial intelligence (AI), and other technologies. As healthcare systems are becoming more accessible and advanced, security and privacy have become pivotal for the smooth integration and functioning of various systems in H-CPSs. In this work, we present a novel approach that integrates PUF with IOTA Tangle and blockchain and works by storing the PUF keys of a patient’s Body Area Network (BAN) inside blockchain to access, store, and share globally. Each patient has a network of smart wearables and a gateway to obtain the physiological sensor data securely. To facilitate communication among various stakeholders in healthcare systems, IOTA Tangle’s Masked Authentication Messaging (MAM) communication protocol has been used, which securely enables patients to communicate, share, and store data on Tangle. The MAM channel works in the restricted mode in the proposed architecture, which can be accessed using the patient’s gateway PUF key. Furthermore, the successful verification of PUF enables patients to securely send and share physiological sensor data from various wearable and implantable medical devices embedded with PUF. Finally, healthcare system entities like physicians, hospital admin networks, and remote monitoring systems can securely establish communication with patients using MAM and retrieve the patient’s BAN PUF keys from the blockchain securely. Our experimental analysis shows that the proposed approach successfully integrates three security primitives, PUF, blockchain, and Tangle, providing decentralized access control and security in H-CPS with minimal energy requirements, data storage, and response time. 

   more » « less
3. Learning-Based Secure Spectrum Sharing for Intelligent IoT Networks

   https://doi.org/10.1109/ISQED60706.2024.10528684  

   Alipour-Fanid, Amir; Dabaghchian, Monireh; Jiao, Long; Zeng, Kai (April 2024, IEEE)

   In intelligent IoT networks, an IoT user is capable of sensing the spectrum and learning from its observation to dynamically access the wireless channels without interfering with the primary user’s signal. The network, however, is potentially subject to primary user emulation and jamming attacks. In the existing works, various attacks and defense mechanisms for spectrum sharing in IoT networks have been proposed. This paper systematically conducts a targeted survey of these efforts and proposes new approaches for future studies to strengthen the communication of IoT users. Our proposed methods involve the development of intelligent IoT devices that go beyond existing solutions, enabling them not only to share the spectrum with licensed users but also to effectively thwart potential attackers. First, considering practical aspects of imperfect spectrum sensing and delay, we propose to utilize online machine learning-based approaches to design spectrum sharing attack policies. We also investigate the attacker’s channel observation/sensing capabilities to design attack policies using time-varying feedback graph models. Second, taking into account the IoT devices’ practical characteristics of channel switching delay, we propose online learning-based channel access policies for optimal defense by the IoT device to guarantee the maximum network capacity. We then highlight future research directions, focusing on the defense of IoT devices against adaptive attackers. Finally, aided by concepts from intelligence and statistical factor analysis tools, we provide a workflow which can be utilized for devices’ intelligence factors impact analysis on the defense performance. 

   more » « less
4. The PIT-Cerberus Framework: Preventing Device Tampering During Transit

   https://doi.org/10.1109/QRS62785.2024.00064  

   Podder, Rakesh; Sovereign, Jack; Ray, Indrajit; Santharam, Madhan B; Righi, Stefano (July 2024, IEEE)

   When a computing device, such as a server, workstation, laptop, tablet, etc. is shipped from one site to another (for example, from a vendor to a customer or from one branch location of an organization to another) it can potentially be subjected to unauthorized firmware modifications. The industry has sought to partially address this issue by focusing on securing the boot process. Secure boot provides attestation methods by a hardware root-of-trust to confirm the integrity of the device’s BIOS/UEFI firmware. However, once a device boots up, it is relatively easy for a malicious adversary to tamper with the firmware. In this paper, we address this problem by preventing a secure boot unless done by an authorized user. We extend a hardware root of trust (HRoT) processor’s ability to perform secure attestation by implementing a new functionality to securely lock and unlock the BIOS/UEFI or the BMC (Baseboard Management Controller) and implementing an authentication mechanism in the HRoT for determining authorized users. This ensures that the secure boot process won’t commence unless authorized appropriately and provides a robust mechanism for securing the device’s firmware during transit. The proposed PIT-Cerberus framework (PIT = Protection In Transit) leverages strong cryptographic techniques and has been implemented within a trusted microcontroller. We have contributed the PIT-Cerberus framework’s libraries to Project Cerberus, an open-source project that offers a security platform for server hardware. 

   more » « less
5. AEROKEY: Using Ambient Electromagnetic Radiation for Secure and Usable Wireless Device Authentication

   https://doi.org/10.1145/3517254  

   Lee, Kyuin; Yang, Yucheng; Prabhune, Omkar; Chithra, Aishwarya Lekshmi; West, Jack; Fawaz, Kassem; Klingensmith, Neil; Banerjee, Suman; Kim, Younghyun (March 2022, Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies)

   Wireless connectivity is becoming common in increasingly diverse personal devices, enabling various interoperation- and Internet-based applications and services. More and more interconnected devices are simultaneously operated by a single user with short-lived connections, making usable device authentication methods imperative to ensure both high security and seamless user experience. Unfortunately, current authentication methods that heavily require human involvement, in addition to form factor and mobility constraints, make this balance hard to achieve, often forcing users to choose between security and convenience. In this work, we present a novel over-the-air device authentication scheme named AEROKEY that achieves both high security and high usability. With virtually no hardware overhead, AEROKEY leverages ubiquitously observable ambient electromagnetic radiation to autonomously generate spatiotemporally unique secret that can be derived only by devices that are closely located to each other. Devices can make use of this unique secret to form the basis of a symmetric key, making the authentication procedure more practical, secure and usable with no active human involvement. We propose and implement essential techniques to overcome challenges in realizing AEROKEY on low-cost microcontroller units, such as poor time synchronization, lack of precision analog front-end, and inconsistent sampling rates. Our real-world experiments demonstrate reliable authentication as well as its robustness against various realistic adversaries with low equal-error rates of 3.4% or less and usable authentication time of as low as 24 s. 

   more » « less