LiS: Lightweight Signature Schemes for Continuous Message Authentication in Cyber-Physical Systems

Abstract

Cyber-Physical Systems (CPS) provide the foundation of our critical infrastructures, which form the basis of emerging and future smart services and improve our quality of life in many areas. In such CPS, sensor data is transmitted over the network to the controller, which will make real-time control decisions according to the received sensor data. Due to the existence of spoofing attacks (more specifically to CPS, false data injection attacks), one has to protect the authenticity and integrity of the transmitted data. For example, a digital signature can be used to solve this issue. However, the resource-constrained field devices like sensors cannot afford conventional signature computation. Thus, we have to seek for an efficient signature mechanism that can support the fast and continuous message authentication in CPS, while being easy to compute on the devices. To this end, we introduce two Lightweight Signature schemes (LiS), which are suitable for continuous message authentication commonly seen in cyber-physical systems. In our constructions, we exploit the efficient hash collision generation property of a chameleon hash function to transform a chameleon hash function into signature schemes. In our schemes, the signature of a message m is the randomness r associated with m in a chameleon hash function, such that they can lead to a hash collision with a given message randomness pair (m ′ , r ′). Thus, the task of a signer is to generate the collision using the private key of the underlying chameleon hash function, and a verifier can verify the signature by checking the hash collision with a known message and randomness pair. We also specifically instantiate the chameleon hash function in such a way that it leads to a fast signing procedure and an optimal storage requirement on the signer side. The optimized signing algorithms are very efficient. Namely, our first scheme requires only three additions and two multiplications, and only one

Continuous Entity Authentication in the Internet of Things Scenario

“…In this paper, we first show that OM-UEA schemes can be implemented using digital signatures and that a weak form of unforgeability is sufficient to achieve security against active adversaries. Furthermore, we instantiate our construction with the lightweight signature scheme recently proposed by Yang et al [2] and show that it results in a onemessage unilateral entity authentication scheme that requires low computational effort, as well as low storage overhead, for the prover. Specifically, to compute each authentication message the prover only needs to perform two modular multiplications and three modular additions.…”

“…Yang et al [2] proposed a lightweight signature framework, called LiS, which is suitable for continuous message authentication in IoT applications. Such a framework includes two signature schemes, called LiS1 and LiS2.…”

Caching-based Multicast Message Authentication in Time-critical Industrial Control Systems

“…The first phases of El-Gamal [30], DSS [31], and precomputation enabled ECDSA [7] do not require the true message similar to our Tree Construction procedure. Online/offline signatures, either based on one-time signature schemes [32] or based on chameleon commitments [26], [33], [34] can transform any digital signature scheme to a one with such offloading feature. The idea is to perform expensive cryptographic operations in the offline phase and generate a meta-data, so that in the online phase the source can sign a message only using inexpensive computations.…”

“…Although the online signing in online/offline converted signature schemes can be fast, these schemes still fall short in meeting stringent latency requirements due to their offline phase or require a large volume of metadata to be stored by the source. Among these, Lis [34] is specifically designed for cyberphysical systems. However, it is optimized for the publisher, and thus, the verification cost is still high.…”

Group Time-based One-time Passwords and its Application to Efficient Privacy-Preserving Proof of Location

“…A,ASE (κ, q e ) denote the advantage of A in breaking the security of ASE, where q e is the number of encryption oracle queries that A can ask. Also, we let Adv CRHF A,H (κ) denote the advantage of A in breaking the collision-resistant property of H. We refer the reader to [23,28,51] for the formal definitions of these advantages. We omit them here to save space.…”