Security Properties. Mutual Entity Authentication [8] between N and HN . Mutual “Implicit” Key Authentication [8] between N and HN . Key Randomness, meaning that any successful key agreement should output a uniformly distributed session key amongst the set of all possible session keys [9].
Security Properties. WKA is closely related to Non-Interactive Zero- Knowledge (NIZK) Proof System. The key difference is the outcome of NIZK is only a binary verification result while WKA’s outcome is a key upon suc- cess. Hence the security properties of WKA are also very similar to those of NIZK. Furthermore, we require WKA to be secure against MITM attack. (See
1. Security of witness key agreement scheme Appendix B of [34] for a trivial WKA generic construction that is insecure under MITM attack.) WKA Construction Roadmap. We base our WKA construction on the effi- cient construction of zk-SNARK from Non-Interactive Linear Proof (NILP) [24] for Quadratic Arithmetic Programs (QAP) [19] given by Xxxxx [24] and we uti- lize Linear-Only Encryption (LE) [6] to compile such NILP to a WKA scheme. Linear Interactive Proofs (LIP) [6] is an extension of interactive proofs [23] in which each prover’s message is an affine combination of the previous messages sent by the verifier. Xxxxx renamed the input-oblivious two-message LIPs into NILP [24] to clar- ify the connection between LIP and NIZK. XXXX considers only adversaries using affine prover strategies, i.e. a strategy which can be described by a tuple (Π, π0) where Π Fk×y represents a linear function and π0 Fk represents an affine shift. Then, on input a query vector σ Fy , the response vector π Fk is constructed by evaluating the affine relation π = Πσ + π0.
Security Properties. In GKA protocols, the fault tolerance property is very crucial since it is necessary to detect and eliminate malicious participants from the key agreement group. In other words, even if there are malicious participants in the group, they should not be able to affect the key computation of honest participants. Early protocol examples with this property are [24–26]. In this regard, in Xxxxx’x protocol [24], every participant keeps a verification matrix Xxx. After the secret key distribution step, each participant checks the signature of other participants. According to the result, the verification list is marked and submitted to other participants. Afterwards, in the fault detection step, participants re-validate the verification matrix and remove the faulty participants from the key agreement group. Finally, GKA protocol is started from scratch with the remaining participants. Forward secrecy (also stated as Perfect forward secrecy) is also a substantial property that protects against the computation of group keys by malicious actors even if private keys are compromised. Forward secrecy is utilized in protocols presented in [4, 27, 28]. Dynamic group key operations in group key agreement protocols must provide forward and backward confidentiality properties defined in Section 2.1.1. Introduced by Xxxxx et al., KAP-PBC [11] protocol provides these properties within its dynamic operations. In join and leave operations, last participants in the group re-compute the GKA parameters. Therefore, joined participants cannot compute the former group keys, and leaving participants cannot generate the subsequent keys. Moreover, KAP-PBC provides ‘Partial Backward Confiden- tiality’ property, which enables the participants to compute the group keys just before joining the group.
Security Properties. Mutual Entity Authentication. Entity authentication is the process by which one entity (the verifier) is assured of the identity of a second entity (the claimant) [27]. The PPKA should provision mutual entity authentication between N and HN. Mutual “Implicit” Key Authentication. The assurance that only a particularly identified other party may possibly know the negotiated key [27]. Mutual “implicit” key authentica- tion is required between N and HN.
Security Properties. Though Section 5 describes schemes that are robust against arbitrary active adversaries, we argue that such an adversarial model is too restrictive for the automotive scenarios. Operations of our protocol and the architecture of the CAN bus restrict the actions of the adversary in our system. We argue that an active adversary cannot successfully perform any operation, except eavesdrop- ping, without detection. Consider the following
1. Modification of a packet - The properties of the CAN bus allow only one type of modification to the messages transmitted by the nodes. An ad- versary can flip a recessive bit ‘1’ to a dominant bit ‘0’ by transmitting a voltage, however not vice-versa. It can be verified that this simply results in a mismatched key at both parties. This can easily be detected by any key verification method.
2. Inserting messages for active nodes - An active node, executing a pair- wise session of the protocol, only accepts outputs on the bus that result from superposition of its own signals with that of the partner. Thus consider an adversary that attempts to compromise a session between nodeN1 and nodeN2 by inserting a ‘specific’ message for nodeN2. However, this requires that the adversary initiate a transmission from nodeN2. Assume that the message transmitted by the adversary is madv, and that by nodeN2 is mN2 . Thus the message recorded by nodeN2 is the logical AND of these messages,
i. e. madv ∧ mN2 . However, as the adversary has no control over mN2 , it can- not insert a ‘specific’ packet. It can however choose and force bits to be 0. This can be detected by key verification.
3. Inserting messages for passive nodes - In the group protocols, nodes that have engaged in one pairwise session may update their local parame- ters based on the output of the future sessions. An adversary may falsely emulate such sessions. However, it can be demonstrated that the probability of ‘successfully’ inserting a n bit packet, i.e. a packet that is accepted as a . 4 valid input by the passive node, is less than 3 Theorem 3. Let the adversary activate the protocol of a passive node by inserting an arbitrary pair of strings b1, b2, where |b1| = |b2| = n, marked with the session identifier of the currently active nodes . T he passive nodes detect the adversary with a probability greater than 1 − 3
Security Properties. The key derived from the group key agreement protocol needs to meet the following security features:
2.6.4.1 Group key secrecy: It simply means that the derived secret should not be derivable by a non-participant.
2.6.4.2 Forward key secrecy: Xxxxxx knowing one of the current group keys, one should not be able to compute previous group keys.
Security Properties. Security properties for systems and system assets are less well defined as those for information assets. In fact, it is common to define security controls and mechanisms instead of the particular properties that need to be preserved. In this section, we have collected a set of system security properties that are relevant in the context of Smart Grids. The properties availability and integrity have a slightly different meaning, if they are considered in the context of a system or system asset. A good definition for availability in the context of a system is given in IEEE Standard Glossary of Software Engineering Terminology, i.e. IEEE Std 610.12-1990 [12]: Note that the definition refers to a degree. This is relevant as the impact of the duration of unavailability can vary significantly. As security goals are defined at an early stage of the design phase it may be difficult to specifically quantify the degree of the desired system availability. In this document, we will therefor will only specify security goals on the system availability of a system or system assets if its disturbance has a direct severe impact on a certain interest of a stakeholder. System Availability is directly related to the properties robustness, and resilience that have been defined in SEGRID deliverable D4.1 [14]: As the latter two are more specific regarding the particular behaviour of the system or system asset during a cyber-attack (or disturbance), it is relevant to consider these properties in the context of the SEGRID project. As we define security goals based on the need to protect a certain interest of a stakeholder, it might however be difficult to distinguish whether a system (asset) needs to be robust or resilient. Regarding integrity in the context of a system, IEEE Std 610.12-1990 [12] also has a definition. This definition, however, is a slightly outdated as it focuses only on the prevention of unauthorized access. With integrity of a system, we currently mean that the system performs its intended function correctly. We will therefor use the definition from [15] and [16]: This definition does seem similar to what is typically meant with reliability. The definition of information security in the previous section also mentioned reliability as an additional property of information security. In ISO/IEC27000:2014 reliability is defined as: property of consistent intended behaviour and results. In IETF RFC 4949 a more specific definition is given [17]: We will typically refe...
Security Properties. We discuss the security properties provided by Du et al. [7], Liu et al. [13], Xxxxx et al. [4], and TLPKA. These security properties include mutual authentication, explicit key authentication, resistance to the replay attack, resistance to the man in the middle attack, and resistance to the insider attack. The results of these security properties comparisons are shown in Table 1. From Table 1, we can see that TLPKA achieves all of these security properties while Du et al.’s scheme and Liu et al.’s scheme can not realize the security property of explicit key authentication. Furthermore, Xxxxx et al.’s scheme does not have most of these security properties.
Security Properties. Intuitively, Ffr-cgka captures the security properties of Sec. 3, as follows. Regarding Agreement, observe that for each epoch Ffr-cgka stores and returns to the caller the
Security Properties. In Table 6, we present the results of protocols related to security comparisons and our proposed protocol based on batch verification. The suggested protocol prevents more attacks than other related previous studies, and also provide privacy-preserving and mutual authentication. Therefore, our proposed protocol is significantly safer than the considered related protocols. The system consumes some energy during implementation, depending on the real time and communication overhead of the system. Table 6. Security Properties. Security Properties Jianhong et al. [13] Xxxxx et al. [16] Xxxxxxxxx et al. [4] Ours Impersonation attack x x x o Side channel attack over OBU or TPD - x x o Trace attack o o o o Replay attack x o o o Man-in-the-middle attack x x o o Privacy-preserving o o o o Mutual authentication x x x o
