Threat Model. Following Fig. 1, we assume that an
1. Considered Smart Metering Infrastructure. integrity. Therefore, it becomes necessary to establish a mutual authentication that can support dynamic key agreement to realize its efficiency while providing the adequate level of security functionalities.
Threat Model. Xxxxx-Xxx (DY) model is employed, which entails an insecure channel communication and an untrustworthy nature between the parties [56]. Thus, the malicious attacker can easily eavesdrop and tamper the exchanged messages. The worst-case scenario, for instance, might involve seizing a drone, that is hovering, and then compromising its data. The prevalent “Xxxxxxx and Xxxxxxxx’x adversary model (CK- adversary model)” is, reportedly, the de facto standard for modelling the authenticated key exchange protocols. The CK- adversary model entails that the adversary can also hack the secret credentials, secret keys and the session states. Therefore, it has become an essential requirement that “the leakage of some forms of secret credentials, such as session ephemeral secrets or secret key, should have the minimum possible consequence on the secrecy of other secret credentials of the communicating participants” [58].
Threat Model. Within the KSS, the KSMS, the CM and the PL are considered honest-but-curious entities. They will perform the protocol honestly, but they are curious to extract private information about users. Owners are passive adver- saries while consumers and outsiders may be malicious. The car’s OBU is trusted and equipped with a Hardware Security Module (HSM) [34, 45] that supports secure key storage and cryptographic operations such as symmetric and public- key encryption, following the EVITA [17] and PRESERVE [34] specifications. Users’ PDs are untrusted as they can get stolen, lost or broken.
Threat Model. A probabilistic polynomial-time adversary in the Dolev-Yao model [17] has full control over the parties involved. As a result, the adversary can read, capture, reply, delete, or modify the transmitted messages on the public channel. Furthermore, the adversary may obtain secret information stored in the devices' memory through explicit attacks [1]. Xxxxx et al. represented their protocol in Xxxxx-Xxx threat model and proved the security features of their scheme in their paper. In the CK-adversary model [18], the adversary, in addition to all the aforementioned abilities, possesses the ability to access the secret information stored in the parties' memories; Subsequently, it is the advanced version of Xxxxx-Xxx threat model. The data exposed to the adversary can be categorized as follows: • Session-state reveal: The adversary obtains the current internal state information of incomplete session (ephemeral secret parameters), except long-term private keys. • Session-key query: The adversary obtains the session key of specific completed session. • Party corruption: The attacker can decide at any point to corrupt a party, in which case the attacker learns all the internal memory of that party including long-term secrets (such as private keys or master shared keys used across different sessions) and session-specific information contained in the party’s memory (such as internal state of incomplete sessions and session-keys corresponding to completed sessions) [18]. As a result, the security protocol should guarantee that the • Upon receiving this message, the (𝐼𝑁) first checks the timestamp validity i.e. |𝑡1− 𝑡𝑐 | < 𝛥𝑇, where 𝑡𝑐 is the current timestamp of 𝐼𝑁. It also computes 𝑉∗= ℎ (𝑋𝑛−𝑖𝑛∣∣ 𝑡1) and checks the validity of 𝑉∗ by comparing to 𝑉𝑛. 𝑛 • If the statement is true, IN generates the current timestamp 𝑡2 to compute 𝑉𝑖 = ℎ(𝑖𝑑𝑖𝑛 ∣∣ 𝑡2) and sends the tuple ⟨𝑡𝑖𝑑𝑛, 𝑦𝑛, 𝑎𝑛, 𝑏𝑛, 𝑉𝑖, 𝑡1, 𝑡2⟩ to 𝐻𝑁. • The 𝐻𝑁 checks the timestamp validity i.e., |𝑡2 − 𝑡𝑐 | 𝑖 <𝛥𝑇, where 𝑡𝑐 is the current timestamp of 𝐻𝑁. It then computes 𝑉 ∗=ℎ (𝑖𝑑𝑖𝑛 ∣∣ 𝑡2) and checks the validity of 𝑖 𝑉 ∗ by comparing to 𝑉𝑖. • If the statement is true, HN computes 𝐾∗= 𝐾 ⊕ 𝑏 𝑛 ℎ𝑛 𝑛 𝑛 𝑛 𝑛 𝑛 𝑛 leakage of certain secret information, such as ephemeral secret parameters or long-term keys, would have the least possible ⊕ 𝑎𝑛, 𝑥∗ = ℎ(𝐾 ∣∣ 𝐾∗), 𝑖𝑑∗ = 𝑎 ⊕ 𝑥∗ , ��∗= 𝑦 ⊕ 𝑥∗ . Finally, it calculates 𝑡𝑖𝑑∗ =ℎ((𝑖𝑑∗ ⊕ 𝑡 ) ∣∣ �...
Threat Model. A threat model is an imperative module of the designing of an AKA protocol. The threat model is a process for enhancing security by classifying vulnerabilities and objectives and then defining preventive measures of threats to the system. In this framework, a threat is a potential malicious attack from an adversary that can cause damage to the assets. We base the threat model on the following assumptions; - Any IoT device may be corrupted and turned into a device controlled by the adversary. We refer to this as a malicious device. We assume that all cryptographic keys of the malicious device are known to the adversary - An adversary can extract the information from MC or any device by examining power consumption and leaked information - An adversary is able to eavesdrop on all the communications between the entities involved in the communication chancel over a public channel - An adversary has the potential to modify a message, delete, redirect and resend the eavesdropped transmitted messages - An adversary can be a legal user or an outsider in any system - An adversary can guess low entropy secret and identity individually easily but guessing two secret parameters is computationally infeasible in polynomial time - It is assumed that the protocol used in the AKA system is known to the attacker - Kerckhoffs’s principle: A cryptosystem should be secure even if everything about the system, except the session key, is public knowledge [14].
Threat Model. In our model, IoT devices communicate through a public channel. The following security issues are concerned with the adversary:
I) The adversary 𝒜 cannot distinguish 𝑥𝐺 and 𝑥𝑦𝐺.
II) The adversary is unlikely to retrieve 𝑥 from ℎ(𝑥).
III) The adversary can eavesdrop, modify, remove, and duplicate messages transmitted in the public channel.
IV) The adversary can act as an insider to obtain secret parameters of other members in order to implement attacks.
V) The adversary can compromise all network entities and obtain all temporary as well as permanent credentials.
Threat Model. In our scenario, we assume mutually-distrusting, rational parties using a payment channel to exchange payments. The threat model includes two potential threats and focuses on the inability of nodes to revoke previous states of the pay- ment channel. Notably, the node that receives the payment faces the threat of the inability to report a misbehaving peer before the contest period expires. On the other hand, the node sending the payment faces the threat of the inability to unlock her money from the channel. The receiver expects a non-repudiation property of the system. After several payments, none of the parties will be Parking Sensor Smart Car Ethereum Register Template Smart Contract Local Copy Sensor Data Public Address 0x00 Off-Chain Execution New Payment Channel Sign Final State Side-Chain On-Chain Commit(s) Side-Chain(s) Side-Chain(s) Icons by flaticon (CC 3.0 BY) Challenge Period
Threat Model. Network framework
Threat Model. Quest’s threat security model is based on the following general characteristics: Confidentiality - The information contained in the Colorado Campaign Finance Database should remain private until the filings are completed by the committees and candidates. Certain document images must be flagged as confidential and not available for public viewing (i.e. Candidate Personal Financial Disclosure Statement). Integrity - The application and supporting architecture should ensure only authorized users are able to add and update records. Availability – The system and resulting data must be available. Committees and candidates must maintain the ability to file reports on a tight schedule. The public must have access to the data in a timely manner. Based on these characteristics, the following security threats will be managed as part of this Agreement: Category Risk Mitigation Confidentiality Data could be viewed by public prior to being filed by the candidate or committee. Implement application security measures to ensure application design does not allow public to see data until the associated reports are filed. Integrity Unauthorized users could access and update records for committees and candidates. Implement application security to address data access, web site security, login security, session timeout, page rendering, user account and permission management, user ID and password management and event logging. Also ensure data security through audit logging and data backup procedures. Integrity Unauthorized users may access the servers remotely via network vulnerabilities and manipulate the application data. Maintain remote access to servers on a secure, limited and as needed basis. Category Risk Mitigation Availability Unauthorized persons may access the physical servers. Enforce physical security measures, including: Only Terremark employees may enter the data center floor Card access, hand geometry scanners & audible alarms Multi-zoned, 24/7 monitored access areas w/CCTV surveillance on all external & internal doors Badge access into gateway Badge plus biometrics into server suite Availability Power outage, cooling system failure, or fire may result in the system being unavailable. Maintain environmental measures, including: HVAC closed loop drycooler system (not chilled water) Total cooling capacity > 1,360 tons 56/20 ton Liebert Air Handlers & 17 drycooler units on roof 24/7 environmental monitoring 18” raised flooring dedicated for ...
Threat Model. The attacker’s main aim is two fold:
(i) to impersonate a genuine user, and (ii) to learn the key between the server and any victim user for eavesdropping purposes. We do not assume a secure channel. Thus, the attacker can obtain all protocol messages including the hash values and HMACs exchanged between the user and the server. Consequently, the attacker learns the number of minutiae used for the key agreement. The attacker may apply brute-force attack in passive mode by making use of the exchanged messages and try to guess the key. Similarly, in order to impersonate a genuine user, the attacker may apply a replay attack in active mode. However, our protocol resists these type of attacks to some extend as discussed in the upcoming subsections.
