SLACPSS: Secure Lightweight Authentication for Cyber–Physical–Social Systems
Abstract
:1. Introduction
2. Metaverse and Security Threats
2.1. Metaverse Architecture
2.1.1. Human Society
2.1.2. Physical Infrastructures
2.1.3. Interconnection of Virtual Worlds
2.1.4. Metaverse Engine
2.1.5. In-World Information Flow
- In the physical world, sensing and control infrastructure driven by IoT technologies is a key element in the digital transformation of the physical world, utilizing pervasive sensors and actuators. The resulting massive data from IoT devices are transmitted and processed through network and computing infrastructures.
- Within the digital realm, the metaverse engine efficiently processes and organizes digital information gathered from both the physical and human spheres, enabling the construction and presentation of vast metaverses while offering a selection of metaverse services.
2.1.6. Information Flow across Worlds
- By employing human–computer interface (HCI) technologies, humans can engage with physical objects, and XR technologies allow them to immerse themselves in virtually augmented reality, such as holographic telepresence.
- The connection between the human world and the digital world is facilitated by the Internet, which is the largest computer network globally. Through smart devices like smartphones, wearable sensors, and VR helmets, users can engage with the digital realm for purposes such as knowledge creation, sharing, and acquisition.
- The interconnection of smart devices in the IoT infrastructure facilitates the seamless exchange of information between the physical and digital realms, enabling effective digitalization [26].
2.2. Security Threats to the Metaverse
2.2.1. Threats to Authentication in the Metaverse
- Identity Theft: If a user’s identity is stolen in the metaverse, their avatars, digital belongings, social connections, and digital life may be at risk of being exposed and lost, posing a more significant threat than in traditional information systems.
- Impersonation Attack: Within the metaverse, an impersonation attack can be executed when an attacker pretends to be an authorized entity, allowing the attacker to gain access to services or systems without proper authorization [28].
- Avatar Authentication Issue: Verifying the authenticity of avatars, such as confirming friends’ avatars, presents a more complex task in the metaverse than real-world identity authentication. This complexity arises from the necessity to validate facial features, voice, video recordings, and similar aspects.
- Trusted and Interoperable Authentication: To achieve the security, efficiency, and reliability of diverse service domains and virtual worlds in the metaverse, users and avatars must promptly establish a robust cross-platform and cross-domain identity verification system. This system should be able to operate seamlessly across various platforms, including blockchains.
2.2.2. Threats to Data Management in the Metaverse
- Data Tampering Attacks: Integrity characteristics play a crucial role in ensuring the efficient monitoring and identification of changes that occur during data exchange across ternary worlds and diverse sub-metaverses. Adversaries can manipulate, counterfeit, substitute, and eliminate unprocessed data throughout the metaverse data services’ lifecycle to disrupt the normal activities of users, avatars, or physical entities [29].
- False Data Injection Attacks: Attackers can inject falsified information, including false messages and incorrect instructions, to mislead metaverse systems [30]. For example, the use of AI-aided content creation can contribute to an enhanced user experience during the initial phase of the metaverse. However, adversaries can exploit this by injecting adversary training samples or poisoned gradients into centralized or distributed AI training, thereby generating biased AI models.
- Issues in Managing New Types of Metaverse Data: When examining the metaverse in relation to the existing Internet, it becomes evident that new hardware and devices are necessary to collect diverse forms of data (e.g., eye movement, facial expression, and head movement) that were previously uncollected. Data collection is vital for enabling fully immersive user experiences [31].
- Threats to the Data Quality of User-Generated Content (UGC) and Physical Input: In the metaverse, self-centered users or avatars might upload low-quality content in UGC mode to reduce expenses, consequently impacting user experience by creating an artificial environment.
- Threats to User-Generated Content (UGC) Ownership and Provenance: Contrary to the government’s regulated asset registration process in the physical realm, the metaverse exists as an open and fully autonomous domain with no centralized authority in place.
- Threats to Intellectual Property Protection: In contrast to the real world, the definition of intellectual property in the metaverse should be modified to establish clear licensing boundaries and usage rights for owners as the metaverse expands [32].
2.2.3. Privacy Threats in the Metaverse
- Pervasive Data Collection: For a truly immersive experience with an avatar, it is essential to conduct comprehensive user profiling at an exceedingly granular level [33], which includes facial expressions, eye and hand movements, speech patterns, biometric features, and even brainwave patterns.
- Privacy Leakage in Data Transmission: Personally identifiable information obtained from wearables such as Head-Mounted Displays (HMDs) is extensively gathered in metaverse systems and then transmitted through wired and wireless means, with strict measures in place to safeguard the confidentiality of these data from unauthorized parties [34].
- Privacy Leakage in Data Processing: Metaverse services rely on the collection and analysis of large amounts of data from people and their environments to develop avatars and virtual settings, posing a risk of sensitive information exposure [35].
- Privacy Leakage in Cloud/Edge Storage: Storing private and sensitive information, such as user profiling, for a significant number of users on cloud servers or edge devices can give rise to privacy disclosure concerns. Hackers can potentially deduce users’ privacy information by leveraging frequent queries through differential attacks [36].
- Rogue or Compromised End Devices: In the metaverse, an increased number of wearable sensors will be utilized on human bodies and their surroundings to enable avatars to establish natural eye contact, interpret hand gestures, mirror facial expressions, and more in real-time.
- Threats to Digital Footprints: Avatars in the metaverse can exhibit behavior patterns, preferences, habits, and activities that mirror those of their physical counterparts, enabling attackers to gather digital footprints and exploit the similarity to real users for accurate user profiling and potentially illegal activities [37].
- Identity Linkability in Ternary Worlds: As the metaverse incorporates reality within itself, the seamless integration of the human, physical, and virtual worlds gives rise to concerns regarding identity linkability across these ternary realms [32].
- Threats to Accountability: XR and HCI devices inherently capture a higher degree of sensitive data, such as user locations, behavior patterns, and surroundings, than traditional smart devices.
- Threats to Customized Privacy: Different users within specific sub-metaverses [38] tend to have unique privacy preferences for various services or interaction objects, similar to what is seen on other service platforms on the Internet.
2.2.4. Threats to Metaverse Network
2.2.5. Threats to the Metaverse Economy
- Service Trust Issues in UGC and Virtual Object Trading: Avatars in the open metaverse marketplace can be considered untrustworthy entities due to the absence of prior interactions. This poses inherent risks of fraud, such as repudiation and refusal to pay, during user-generated content and virtual object trading among various stakeholders in the metaverse. Additionally, when constructing virtual objects using digital twin technologies, the metaverse must ensure the authenticity and trustworthiness of the produced and deployed digital copies [39].
- Threats to Digital Asset Ownership: The distributed metaverse system, lacking a central authority and featuring intricate circulation and ownership structures such as collective ownership and shared ownership [40], poses substantial challenges in the lifecycle of digital assets within the creator economy. These challenges encompass the generation, pricing, trusted trading, and ownership traceability of such assets.
2.2.6. Threats to the Physical World and Human Society
- Threats to Personal Safety: In the metaverse, hackers can exploit wearable devices, XR helmets, and indoor sensors like cameras to gather information on users’ daily routines and monitor their live locations, ultimately aiding in criminal activities such as burglary and endangering their safety [42].
- Threats to Infrastructure Safety: The identification of software or system vulnerabilities within the complex metaverse allows hackers to use compromised devices as entry points for launching APT attacks on critical national infrastructures like power grid systems and high-speed rail systems.
- Social Effects: Despite the appeal of the metaverse as a digital society, it can lead to severe side effects in human society, such as addiction, the spread of rumors, child exploitation, biased outcomes, extortion, cyberbullying, cyberstalking, and even simulated terrorist activities [43].
2.2.7. Threats to Metaverse Governance
3. Related Works
4. Preliminaries
4.1. Elliptic Curve Cryptography (ECC)
4.2. Biohashing
- A vector, V € Rn, is used to represent a biometric characteristic derived from the fingerprint.
- Using the Blum–Blum–Shub method, a set of ri € Rn (i = 1···n) pseudo-random numbers is generated.
- The Gram–Schmidt procedure is used to change the basis ri into an ori € Rn (i = 1, ···n) using generated pseudo-random numbers.
- The inner product between V and ori is obtained, followed by the calculation for the biohash code bi:
5. Proposed Secure Lightweight Authentication for Cyber–Physical–Social System (SLACPSS)
5.1. System Model
- Certificate authority (CA): The certificate authority is a completely reliable entity that sets the initial system parameters and shares public information. The certificate authority obtains the user’s pseudo-identity, public key, and personal details from the user, which will be used to verify the user’s identity and are then stored in the database. Moreover, the certificate authority generates user credentials that need to be authenticated by the user and the platform servers. These credentials are then delivered to the user.
- User: The user submits their pseudo-identity, public key, and personal details to the certificate authority for verification of their identity in order to join the metaverse. Subsequently, the user can interact with different platform servers by undergoing an authentication procedure that relies on the user’s pseudo-identity and credential information. Following that, the user can design an avatar and enter different virtual environments overseen by the platform servers. Moreover, the user can verify their identity with other avatars by utilizing the pseudo-identity and public key saved in the database, ensuring secure interactions between avatars in virtual spaces.
- Platform Server: Each platform server offers a range of immersive services, including education and gaming, to users within virtual spaces. When a user tries to log into the platform server, their credentials and pseudo-identity are verified using the database and the public key of the certificate authority.
- The certificate authority requires users to share their pseudo-identity, public key, and personal information to verify their identity and grant access credentials for interacting with metaverse environments.
- On each platform server, an avatar can be created using the user’s pseudo-identity, public key, and credential information. The user then sends an authentication message to the suitable platform server to gain access to the pertinent virtual spaces.
- If the authentication process goes well, the platform server will provide the user with a session key.
- The session key will then be used to establish a secure connection between the user and the platform server.
- A user can communicate with other avatars after entering a virtual environment using an avatar. The avatar authentication phase can be handled by the user for safe interactions between avatars.
5.1.1. Initialization Step
5.1.2. User Setup Step
- ID i, PW i, and B i are entered by the Ui into SDi, which then makes a random integer, RN i, and a private key, ki. The public key (PK i = k i · P) and pseudo-identity (PID i = h (ID i || RN i)) are then calculated by Ui. Then, the Ui transmits the message {PID i, PK i, info i } to CA across a trust line, where info (i) is the Ui’s private information.
- CA verifies the information and examines the database’s (PID I; PK i) uniqueness. If this process is finished successfully, CA makes a random number, xi, and calculates X i = x i · p, Sig i_ca = x i + h (PID i || PK i || X i) · k ca, where Sig i_ca is the signature value used to verify that Ui has been approved by the CA. Afterward, the CA transmits V i = (X i, Sig i-ca) and saves (PID i, PK i) in the database.
- The CA transmits {Vi} to U i by the trusted line.
- U i calculates Z = Vi ⊕ h (ID i || PW i|| RN i) and then saves Z in SD.
5.1.3. Creating an Avatar
- To enter the virtual environment managed by the St, the Ui creates an avatar using SDi during the creating an avatar stage, and the avatar making process is shown in Table 4, which is detailed below.
- ID i, PW i, and B i are entered by the U i into SDi and then they create and calculate a random number, RN I, and a private key (k i) and public key (PK i = k i · P). Then, Vi* = Z + h (IDi ||PWi||RNi) is calculated, and the user creates a random number (n i) and calculates Ni = ni · P and EM i = (N i||Sig i_ca) ⊕ h (avatar i||PID i||RN i).
- Through a secure channel, the Ui transmits {avatar i, PID i, EM i } to the St.
- The St retrieves PK i after checking PID i in the database, the St confirms the database’s uniqueness of (avatar i, PK i), and the St calculates (Ni ||Sig i_ca) = EMi ⊕ h (avatar i || PID i|| RN i) and Sig i_ca · P = x i · P + h (PID i ||PK i || X i) · PK ca.
- The St saves (avatar i, PK i) in the database and publishes (avatar i, PK i).
5.1.4. Login and Authentication Step
- ID i, PW i, and B i are entered by the U i into SDi, and then a random number (n 1 and T1) is created and calculated.
- The U i calculates N 1 = n 1 · P, Ver i - st = h (avatar i||PID i||T1) · K i, and EM 1 = (avatar i|| PID i|| Ver i - st) + h (N1||T1).
- The U i transmits {EM 1, T 1} to St by a public channel.
- Then, St receives {EM 1, T 1} from U i.
- T1 is checked by the condition |T1* − T1|.
- St calculates Ver i - st · P = ? h (avatar i|| PID i||T1) · PK i.
- St creates T2 and n 2 and calculates N 2 = n 2 ·P.
- SKi- st = h (avatar i||N2||T2) ·K st.
- St calculates EM 2 = h (avatar i||PID i||N 2||T 2) ⊕ (SKi- st||T 2).
- St transmits {EM 2, T 2} to U i by a public channel.
- As soon as the U i receives {EM 2, T 2} from St, T2 is checked by the condition |T2* − T2|, and the user calculates SKi- st · P = h (avatar i||N2||T2) · PK st and EM*2 = h (a vatar i||PID i || N2||T 2) ⊕ (SKi- st||T 2) and verifies EM*2 =? EM 2.
User (Ui) Platform Server (St) |
---|
Input ID i, PW i, B i Generate random number, n1 and T1 Compute N1 = P· n1 Compute Ver i – st = h (avatar i|| PID i||T1) · K i EM 1 = (avatar i|| PID i||Ver i - st) + h (N1 ||T1) { EM1, T 1} Check | T1* − T1| Ver i - st·P =? h (avatar i|| PID i|| T1) · PK i Generate T2 and n2 Compute N2 = P · n2 SKi - st = h (avatar i|| N2||T2) · K st EM 2 = h (avatar i || PID i || N2||T 2) ⊕ (Ski – st || T 2) { EM2, T 2} Check |T2* − T2| SKi - st · P = h (avatar i|| N2 || T2) · PK st EM*2 = h (avatar i||PID i||N2||T 2) ⊕ (SKi - st||T 2) Verifies EM*2 = ? EM 2 |
5.1.5. Avatar Authentication Step
- U i creates a random number (n 3 and T3) and calculates N 3 = n 3 · P.
- Ui calculates Ver i = h (avatar i|| avatar j || PID i|| PID j ||T3) · K i.
- EM 3 = (PID i|| Ver i) ⊕ h (N3|| T3) is calculated.
- U i calculates Req = SYE SKi-st (avatar j, EM 3, T3).
- U i transmits {Req} to St by a public channel.
- St calculates (avatar j, EM 3, T3) = SYD SKi-st (Req).
- St calculates Req i j = SYE SKj-st (EM 3, T3).
- St transmits {Req ij} to U j by a public channel.
- U j calculates (EM 3, T3) = SYD SKj-st (Req i j).
- PK i is retrieved by Uj after U j verifies PID in database.
- U j verifies Ver i · P = ? h (avatar i ||avatar j ||PID i || PID j ||T3) · PK i.
- U j creates T4 and n 4 and calculates N 4 = n 4 · P.
- ver j = h (avatar j||avatar i||PID j ||PID i||T4) · K j.
- EM 4 = (PID j || Ver j) h (N4|| T4).
- Res = SYE SK j – st (avatar i, EM 4, N4, T4).
- U j transmits {Res} to St by a public channel.
- St calculates (avatar i, EM 4, N4, T4) = SYD SK j – st (Res).
- Res i j = SYE SK i-st (EM 4, N4, T4).
- St transmits {Res i j} to U i.
- User i calculates (EM 4, N4, T4) = SYD SK i- st (Res i j).
- (PID j ||Ver j) = EM 4 ⊕ h (N4||T4).
- PK j is retrieved by Ui after Ui verifies PID j in database.
- ver j · P = ? h (avatar j ||avatar i ||PID j||PID i||T4) · PK j is verified.
- If every stage is successfully performed, the U i and U j can demonstrate their ownership of avatar i and avatar j.
6. Security Analysis
6.1. The Theft of a Smart Device
6.2. Offline Guessing of Passwords
6.3. Impersonation Attacks
6.4. Platform Server Spoofing Attacks
6.5. Attacks by Replay and MITM
6.6. Forward Secrecy
6.7. Insider Attacks
6.8. Superior Insiders Attacks
6.9. Temporary or Ephemeral Secret Leakage Attack
- An adversary obtains the ephemeral secret values n1 and n2 to compute SKi-st.
- Assume that the adversary captures the long-part secret values Xi, ki, and K st to compute SKi-st.
- Without knowing the ephemeral numbers n1 and n2, S1 cannot be obtained.
6.10. User Anonymity
6.11. Mutual Authentication
7. Conclusions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
- Zhu, Y.; Tan, Y.; Li, R.; Luo, X. Cyber-physical-social-thinking modeling and computing for geological information service system. In Proceedings of the International Conference on Identification, Information, and Knowledge in the Internet of Things (IIKI), Beijing, China, 22–23 October 2015. [Google Scholar]
- Xiong, G.; Zhu, F.; Liu, X.; Dong, X.; Huang, W.; Chen, S.; Zhao, K. Cyber-physical-social system in intelligent transportation. IEEE CAA J. Autom. Sin. 2015, 2, 320–333. [Google Scholar] [CrossRef]
- Cassandras, C.G. Smart cities as cyber-physical social systems. Engineering 2016, 2, 156–158. [Google Scholar] [CrossRef]
- Gharib, M.; Lollini, P.; Bondavalli, A. Towards an Approach for Analyzing Trust in Cyber-Physical-Social Systems. In Proceedings of the 12th System of Systems Engineering Conference (SoSE), Waikoloa, HI, USA, 18–21 June 2017; pp. 18–21. [Google Scholar]
- Ashari, I.F. Implementation of cyber-physical-social system based on service oriented architecture in smart tourism. J. Appl. Inform. Comput. 2020, 4, 66–73. [Google Scholar] [CrossRef]
- Perno, J.; Probst, C.W. Behavioural profiling in cyber-social systems. In Human Aspects of Information Security, Privacy and Trust; Springer: Cham, Switzerland, 2017; pp. 507–517. [Google Scholar]
- Camtepe, S.A.; Yener, B. Modeling and detection of complex attacks. In Proceedings of the Third International Conference on Security and Privacy in Communications Networks and the Workshops—Secure Comm, Nice, France, 17–21 September 2007; pp. 234–243. [Google Scholar]
- Pasandideh, S.; Pereira, P.; Gomes, L. Cyber-Physical-Social Systems: Taxonomy, Challenges, and Opportunities. IEEE Access 2022, 10, 42404–42419. [Google Scholar] [CrossRef]
- Ayiter, E. Integrative art education in a metaverse: Ground. Technoetic Arts 2008, 6, 41–53. [Google Scholar] [CrossRef]
- Collins, C. Looking to the future: Higher education in the Metaverse. Educ. Rev. 2008, 43, 50–52. [Google Scholar]
- Díaz, J.; Saldaña, C.; Avila, C. Virtual world as a resource for hybrid education. Int. J. Emerg. Technol. Learn. 2020, 15, 94–109. [Google Scholar] [CrossRef]
- Suh, W.; Ahn, S. Utilizing the metaverse for learner-centered constructivist education in the postpandemicera: An analysis of elementary school students. J. Intell. 2022, 10, 17. [Google Scholar] [CrossRef]
- Miks, J.; McIlwaine, J. Keeping the World’s Children Learning through COVID-19. Available online: https://www.unicef.org/coronavirus/keeping-worlds-children-learning-through-covid-19 (accessed on 20 December 2023).
- Maharg, P.; Owen, M. Simulations, learning and the metaverse: Changing cultures in legal education. J. Inf. Law Technol. 2007, 5, 1–19. [Google Scholar]
- Kanematsu, H.; Fukumura, Y.; Ogawa, N.; Okuda, A.; Taguchi, R.; Nagai, H. Practice and Evaluation of Problem Based Learning in Metaverse. In Proceedings of the ED-MEDIA 2009 (World Conference on Educational Multimedia, Hypermedia & Telecommunications), Honolulu, HI, USA, 22–26 June 2009; Association for the Advancement of Computing in Education: Waynesville, NC, USA, 2009; pp. 2862–2870. [Google Scholar]
- Mystakidis, S. Metaverse. Encyclopedia 2022, 2, 486–497. [Google Scholar] [CrossRef]
- Skalidis, I.; Muller, O.; Fournier, S. Cardioverse: The cardiovascular medicine in the era of metaverse. Trends Cardiovasc. Med. 2022, 33, 471–476. [Google Scholar] [CrossRef]
- Smith, A.H.; Milton, R.; Dearden, J.; Batty, M. Virtual Cities: Digital Mirrors into a Recursive World; Centre for Advanced Spatial Analysis: London, UK, 2008. [Google Scholar]
- Aurigi, A. Smart cities, metaverses, and the relevance of place. IET Smart Cities 2022, 4, 157–159. [Google Scholar] [CrossRef]
- Duan, H.; Li, J.; Fan, S. Metaverse for Social Good: A University Campus Prototype. In Proceedings of the Association for Computing Machinery, Virtual, 20–24 October 2021; pp. 153–161. [Google Scholar]
- Heller, L.; Goodman, L. What do avatars want now? Posthuman embodiment and the technological sublime. In Proceedings of the 22nd International Conference on Virtual System & Multimedia (VSMM), Kuala Lumpur, Malaysia, 17–21 October 2016; pp. 1–4. [Google Scholar]
- Genay, A.C.S.; Lecuyer, A.; Hachet, M. Being an avatar for real: A survey on virtual embodiment in augmented reality. IEEE Trans. Vis. Comput. Graph. 2021, 28, 5071–5090. [Google Scholar] [CrossRef] [PubMed]
- ISO/IEC 23005 (MPEG-V) Standards. Available online: https://mpeg.chiariglione.org/standards/mpeg-v.html (accessed on 20 December 2023).
- IEEE 2888 Standards. Available online: https://sagroups.ieee.org/2888/ (accessed on 20 December 2023).
- Xu, M.; Ng, W.C.; Lim, W.Y.B.; Kang, J.; Xiong, Z.; Niyato, D.; Yang, Q.; Shen, X.; Miao, C. A full dive into realizing the edge-enabled metaverse: Visions, enabling technologies, and challenges. IEEE Commun. Surv. Tutor. 2023, 25, 656–700. [Google Scholar] [CrossRef]
- Jayasinghe, U.; Lee, G.M.; Um, T.W.; Shi, Q. Machine learning based trust computational model for IoT services. IEEE Trans. Sustain. Comput. 2019, 4, 39–52. [Google Scholar] [CrossRef]
- Wang, Y.; Su, Z.; Zhang, N.; Xing, R.; Liu, D.; Luan, T.H.; Shen, X. A Survey on Metaverse: Fundamentals, Security, and Privacy. IEEE Commun. Surv. 2022, 25, 319–352. [Google Scholar] [CrossRef]
- Hu, P.; Li, H.; Fu, H.; Cansever, D.; Mohapatra, P. Dynamic defense strategy against advanced persistent threat with insiders. In Proceedings of the IEEE Conference on Computer Communications (INFOCOM), Hong Kong, China, 26 April–1 May 2015; pp. 747–755. [Google Scholar]
- Su, Z.; Wang, Y.; Xu, Q.; Zhang, N. LVBS: Lightweight vehicular blockchain for secure data sharing in disaster rescue. IEEE Trans. Dependable Secur. Comput. 2022, 19, 19–32. [Google Scholar] [CrossRef]
- Liang, G.; Weller, S.R.; Zhao, J.; Luo, F.; Dong, Z.Y. The 2015 Ukraine blackout: Implications for false data injection attacks. IEEE Trans. Power Syst. 2017, 32, 3317–3318. [Google Scholar] [CrossRef]
- Kumar, S.; Chhugani, J.; Kim, C.; Kim, D.; Nguyen, A.; Dubey, P.; Bienia, C.; Kim, Y. Second life and the new generation of virtual worlds. Computer 2008, 41, 46–53. [Google Scholar] [CrossRef]
- Hendaoui, A.; Limayem, M.; Thompson, C.W. 3D social virtual worlds: Research issues and challenges. IEEE Internet Comput. 2008, 12, 88–92. [Google Scholar] [CrossRef]
- Falchuk, B.; Loeb, S.; Neff, R. The social metaverse: Battle for privacy. IEEE Technol. Soc. Mag. 2018, 37, 52–61. [Google Scholar] [CrossRef]
- Ometov, A.; Bezzateev, S.V.; Kannisto, J.; Harju, J.; Andreev, S.; Koucheryavy, Y. Facilitating the delegation of use for private devices in the era of the internet of wearable things. IEEE Internet Things J. 2017, 4, 843–854. [Google Scholar] [CrossRef]
- Li, X.; He, J.; Vijayakumar, P.; Zhang, X.; Chang, V. A verifiable privacy-preserving machine learning prediction scheme for edge-enhanced HCPSs. IEEE Trans. Ind. Inform. 2021, 18, 5494–5503. [Google Scholar] [CrossRef]
- Wei, J.; Li, J.; Lin, Y.; Zhang, J. LDP-based social content protection for trending topic recommendation. IEEE Internet Things J. 2021, 8, 4353–4372. [Google Scholar] [CrossRef]
- Ning, H.; Wang, H.; Lin, Y.; Wang, W.; Dhelim, S.; Farha, F.; Ding, J.; Daneshmand, M. A survey on metaverse: The state-of-the-art, technologies, applications, and challenges. IEEE Internet Things J. 2021, 10, 14671–14688. [Google Scholar]
- Song, H.; Luo, T.; Wang, X.; Li, J. Multiple sensitive values-oriented personalized privacy preservation based on randomized response. IEEE Trans. Inf. Forensics Secur. 2020, 15, 2209–2224. [Google Scholar] [CrossRef]
- Liao, S.; Wu, J.; Bashir, A.K.; Yang, W.; Li, J.; Tariq, U. Digital twin consensus for blockchain-enabled intelligent transportation systems in smart cities. IEEE Trans. Intell. Transp. Syst. 2021, 23, 22619–22629. [Google Scholar] [CrossRef]
- Ritzdorf, H.; Soriente, C.; Karame, G.O.; Marinovic, S.; Gruber, D.; Capkun, S. Toward shared ownership in the cloud. IEEE Trans. Inf. Forensics Secur. 2018, 13, 3019–3034. [Google Scholar] [CrossRef]
- Zhou, Y.; Yu, F.R.; Chen, J.; Kuo, Y. Cyber-physical-social systems: A state-of-the-art survey, challenges and opportunities. IEEE Commun. Surv. Tutor. 2020, 22, 389–425. [Google Scholar] [CrossRef]
- Casey, P.; Baggili, I.; Yarramreddy, A. Immersive virtual reality attacks and the human joystick. IEEE Trans. Dependable Secur. Comput. 2021, 18, 550–562. [Google Scholar] [CrossRef]
- The Metaverse Offers a Future Full of Potential—For Terrorists and Extremists, Too. Available online: https://theconversation.com/the-metaverse-offers-a-future-full-of-potential-for-terrorists-and-extremists-too-173622 (accessed on 7 January 2024).
- Almeida, V.; Filgueiras, F.; Doneda, D. The ecosystem of digital content governance. IEEE Internet Comput. 2021, 25, 13–17. [Google Scholar] [CrossRef]
- Bruun, A.; Stentoft, M.L. Lifelogging in the wild: Participant experiences of using lifelogging as a research tool. In Proceedings of the IFIP Conference on Human-Computer Interaction, Paphos, Cyprus, 2–6 September 2019; pp. 431–451. [Google Scholar]
- Lim, W.Y.B.; Xiong, Z.; Niyato, D.; Cao, X.; Miao, C.; Sun, S.; Yang, Q. Realizing the metaverse with edge intelligence: A match made in heaven. IEEE Wirel. Commun. 2023, 30, 64–71. [Google Scholar] [CrossRef]
- Facebook Inc. Rebrands as Meta to Stress “Metaverse” Plan; Facebook Inc.: Menlo Park, CA, USA, 2021. [Google Scholar]
- Leenes, R. Privacy in the metaverse: Regulating a complex social construct in a virtual world. In The Future of Identity in the Information Society; Springer: Berlin/Heidelberg, Germany, 2008; pp. 95–112. [Google Scholar]
- Shang, J.; Chen, S.; Wu, J.; Yin, S. ARSpy: Breaking location-based multi-player augmented reality application for user location tracking. IEEE Trans. Mob. Comput. 2022, 21, 433–447. [Google Scholar] [CrossRef]
- Nevelsteen, K.J. Virtual world, defined from a technological perspective and applied to video games, mixed reality, and the metaverse. Comput. Animat. Virtual Worlds 2018, 29, e1752. [Google Scholar] [CrossRef]
- Nguyen, C.T.; Hoang, D.T.; Nguyen, D.N.; Dutkiewicz, E. Metachain: A novel blockchain-based framework for metaverse applications. In Proceedings of the IEEE 95th Vehicular Technology Conference: (VTC2022-Spring), Helsinki, Finland, 19–22 June 2022. [Google Scholar]
- Sanchez, J. Second life: An interactive qualitative analysis. In Proceedings of the Society for Information Technology & Teacher Education International Conference, San Antonio, TX, USA, 26 March 2007; pp. 1240–1243. [Google Scholar]
- Gan, L.; Wang, D.; Wang, C.; Xiao, D.; Zhang, M.; Wang, Z.; Li, F. Design and implementation of multimedia teaching platform for situational teaching of music appreciation course based on virtual reality. Int. J. Electr. Eng. Educ. 2021, 60, 40–48. [Google Scholar] [CrossRef]
- Ryu, J.; Son, S.; Lee, J.; Park, Y.; Park, Y. Design of secure mutual authentication scheme for metaverse environments using blockchain. IEEE Access 2022, 10, 98944–98958. [Google Scholar] [CrossRef]
- Panda, P.K.; Chattopadhyay, S. A secure mutual authentication protocol for iot environment. J. Reliab. Intell. Environ. 2020, 6, 79–94. [Google Scholar] [CrossRef]
- Haq, I.U.; Wang, J.; Zhu, Y. Secure two-factor lightweight authentication protocol using self-certified public key cryptography for multi-server 5G networks. J. Netw. Comput. Appl. 2020, 161, 102660. [Google Scholar] [CrossRef]
- Li, Y.; Xu, M.; Xu, G. Blockchain-based mutual authentication protocol without CA. J. Supercomput. 2022, 78, 17261–17283. [Google Scholar] [CrossRef]
- Chen, F.; Xiao, Z.; Xiang, T.; Fan, J.; Truong, H.L. A Full Lifecycle Authentication Scheme for Large-scale Smart IoT Application. IEEE Trans. Dependable Secur. Comput. 2022, 20, 2221–2237. [Google Scholar] [CrossRef]
- Kumar, P.; Om, H. A secure and efficient authentication protocol for wireless applications in multi-server environment. Peer--Peer Netw. Appl. 2022, 15, 1939–1952. [Google Scholar] [CrossRef]
- Yang, Q.; Zhao, Y.; Huang, H.; Xiong, Z.; Kang, J.; Zheng, Z. Fusing blockchain and AI with metaverse: A survey. IEEE Open J. Comput. Soc. 2022, 3, 122–136. [Google Scholar] [CrossRef]
- Koblitz, N. Elliptic curve cryptosystems. Math. Comput. 1987, 48, 203–209. [Google Scholar] [CrossRef]
- Ryu, J.; Oh, J.; Kwon, D.; Son, S.; Lee, J.; Park, Y.; Park, Y. Secure ECC-based three-factor mutual authentication protocol for telecare medi1 cal information system. IEEE Access 2022, 10, 11511–11526. [Google Scholar] [CrossRef]
- Teoh, A.B.J.; Ngo, D.; Goh, A. BioHashing: Two factor authen1 tication featuring fingerprint data and tokenized random number. Pattern Recognit. 2004, 37, 2245–2255. [Google Scholar]
- Siddhartha, V.; Gaba, G.S.; Kansal, L. A Lightweight Authentication Protocol using Implicit Certificates for Securing IoT Systems. In Proceedings of the International Conference on Computational Intelligence and Data Science (ICCIDS 2019), Punjab, India, 6–7 September 2019; pp. 85–96. [Google Scholar]
- Sciancalepore, S.; Capossele, A.; Piro, G.; Boggia, G.; Bianchi, G. Key Management Protocol with Implicit Certificates for IoT systems. In Proceedings of the 2015 Workshop on IoT challenges in Mobile and Industrial Systems, Florence, Italy, 18 May 2015; pp. 37–42. [Google Scholar]
- Porambage, P.; Kumar, P.; Schmitt, C.; Gurtov, A.; Ylianttila, M. Certificate-Based Pairwise Key Establishment Protocol for Wireless Sensor Networks. In Proceedings of the IEEE 16th International Conference on Computational Science and Engineering, Sydney, NSW, Australia, 3–5 December 2013; pp. 667–674. [Google Scholar]
- Kumar, P.; Gurtov, A.; Iinatti, J.; Ylianttila, M.; Sain, M. Lightweight and Secure Session-Key Establishment Scheme in Smart Home Environments. IEEE Sens. J. 2016, 16, 254–264. [Google Scholar] [CrossRef]
- Kumar, P.; Braeken, A.; Gurtov, A.; Iinatti, J.; Ha, P.H. Anonymous Secure Framework in Connected Smart Home Environments. IEEE Trans. Inf. Forensics Secur. 2017, 12, 968–979. [Google Scholar] [CrossRef]
- Li, Y. Design of a Key Establishment Protocol for Smart Home Energy Management System. In Proceedings of the Fifth International Conference on Computational Intelligence, Communication Systems and Networks, Madrid, Spain, 5–7 June 2013; pp. 88–93. [Google Scholar]
- Vaidya, B.; Makrakis, D.; Mouftah, H. Device Authentication mechanism for smart energy home area networks. In Proceeding of the IEEE, International Conference on Consumer Electronics (ICCE), Las Vegas, NV, USA, 9–12 January 2011; pp. 787–788. [Google Scholar]
- Han, K.; Kim, J.; Shon, T.; Ko, D. A novel secure key paring protocol for rf4ce ubiquitous smart home systems. Pers. Ubiquitous Comput. 2013, 17, 945–949. [Google Scholar] [CrossRef]
- Sciancalepore, S.; Piro, G.; Boggia, G.; Bianchi, G. Public Key Authentication and Key Agreement in IoT Devices with Minimal Airtime Consumption. IEEE Embed. Syst. Lett. 2017, 9, 1–4. [Google Scholar] [CrossRef]
- Patel, S.; Patel, D.R.; Navik, A.P. Energy efficient integrated authentication and access control mechanisms for Internet of Things. In Proceedings of the IEEE International Conference on Internet of Things and Applications (IOTA), Pune, India, 22–24 January 2016; pp. 304–309. [Google Scholar]
- Hossain, M.; Noor, S.; Hasan, R. HSC-IoT: A Hardware and Software Co-Verification Based Authentication Scheme for Internet of Thing. In Proceedings of the 5th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud), San Francisco, CA, USA, 6–8 April 2017; pp. 109–116. [Google Scholar]
No. | Notation | Description |
---|---|---|
1 | UGC | User-Generated Content |
2 | MITM | Man in the Middle |
3 | HMDs | Head-Mounted Displays |
4 | CA | Certificate Authority |
5 | U i | User |
6 | St | Platform Server |
7 | ID i | Identity of Ui |
8 | PIDi | Pseudo-Identity of Ui |
9 | PWi | Password of Ui |
10 | B i | Biometric Information of Ui |
11 | SD i | Smart Device of Ui |
12 | Avatari | Avatar Identity of U i |
13 | info i | Personal Information of U i |
14 | PK ca, PK i, PK st | Public Key of CA, U i, and St |
15 | K ca, K i, K st | Private Key of CA, U i, and St |
16 | Sig i_ca | Signature Value Generated by CA |
17 | RNi, xi, ni, n1, n2, n3, n4 | Random Numbers |
18 | T1, T2, T3, T4 | Timestamp |
19 | SK | Session Key |
20 | SYE K, SYD K | Symmetric Encryption and Dec |
21 | h (·) | One-Side Hashing Method |
22 | h b (·) | Biohash Function |
23 | ⊕ | Exclusive OR Operation |
24 | || | Concatenation |
Certificate Authority (CA) |
---|
Over Fp, CA chooses a nonsingular Elliptic Curve EP (u, r). A base point is chosen using CA (P on EP (u, r)). CA chooses a secret key, k ca PK ca = kca + P is created by CA. The following system parameters are published by CA: EP (u, r); P; PK ca; h (•); h b (•) |
User (Ui) Certificate Authority (CA) |
---|
Input ID i, PW i, B i Generate random number, RN i Generate private key, k i PK i = k i·P Compute PID i = h (ID i|| RN i) { PIDi, PK i, info i} Check the uniqueness (PID i, PK i) in database Verify info i Generate random number x i Compute X i = x i·p Sig i_ca = x i + h (PID i || PK i||X i) · kca V i = (Xi, Sig i_ca) saves (PID i, PK i) in database {Vi} Compute Z = Vi ⊕ h (IDi || PW i || RN i) save {Z} in SD i |
User (Ui) Platform Server (St) |
---|
Input ID i, PW i, B i Compute Vi* = Z + h (ID i|| PW i|| RN i) Verify Vi* = Vi Generate avatar i and random number, n i Compute Ni = n i · P EM i = (N i||Sig i_ca) ⊕ h (avatar i || PID i || RN i) { avatari, PID i, EM i} Check PID in database and retrieve PK i Check uniqueness (avatar i, PK i) in database Compute (N i|| Sig i_ca) = EM i ⊕ h (avatar i|| PIDi ||RNi) Sig i – ca · P = x i · P + h (PID i|| PK i ||Xi) · k ca · P Sig i_ca·P =X i + h (PID i || PK i|| X i) · Pk ca save {avatar i, PK i} in database Publish { avatar i, PK i } in virtual space |
User (U) Platform Server (St) User (Uj) |
---|
Generate n3 and T3 Compute N3 = P · n3 Compute Ver i = h (avatar i|| avatar j || PID i|| PID j||T3) · K i EM 3 = (PID i||Ver i) ⊕ h (N3 ||T3) Req = SYE SK i-st (avatar j, EM 3, T3) { Req } Computes (avatar j, EM 3,T3) = SYD SK i-st (Req) Req i j = SYE SKj-st (EM 3,T3) { Req i j} Compute (EM 3, T3) = SYD SK j-st(Reqi j) Check PID in database and retrieve PKi Verify Ver i · P = ? h (avatar i||avatar j ||PID i||PID j||T3) ·PK i Generate n 4 and T4 Compute N4 = P· n4 ver j = h (avatar j || avatar i|| PID j || PID i||T4) · K j EM 4 = (PID j|| Ver j) ⊕ h (N4||T4) {Res } Res = SYE SK j-st(avatar i, EM 4, N4, T4) Compute (avatar i, EM 4, N4, T4) = SYD SK j-st(Res) Res i j = SYE SKi-st (EM 4, N4, T4) { Resij} Compute (EM 4, N4, T4) = SYD SK i-st(Res i j) (PID j|| Ver j) = EM 4 ⊕ h (N4||T4) Check PID j in database and retrieves PK j Verifies ver j · P = ?h (avatar j || avatar i|| PID j || PID i||T4) · PK j If okay, U i and U j can demonstrate that avatars i and j are authenticated |
Protocols | Theft of a Smart Device | Offline Guessing of Passwords | Impersonation | Platform Server Spoofing Attacks | Ephemeral Secret Leakage Attack | Insider Attack |
---|---|---|---|---|---|---|
Sciancalepore et al. [65], 2015 | × | √ | × | × | × | √ |
Porambage et al. [66], 2013 | × | √ | √ | √ | × | √ |
Kumar et al. [67], 2016 | √ | √ | × | √ | × | √ |
Kumar et al. [68], 2017 | × | √ | √ | × | × | √ |
Li et al. [69], 2013 | × | √ | √ | × | × | × |
Vaidya et al. [70], 2011 | √ | √ | √ | × | √ | × |
Han et al. [71], 2013 | × | × | × | √ | × | √ |
Sciancalepore et al. [72], 2017 | × | √ | √ | × | × | √ |
Patel et al. [73], 2016 | × | × | × | √ | × | × |
Hossain et al. [74], 2017 | × | × | × | × | × | × |
Siddhartha et al. [64], 2019 | √ | √ | √ | √ | × | √ |
RYU et al. [54], 2022 | √ | √ | √ | √ | √ | √ |
Proposed protocol (SLACPSS) | √ | √ | √ | √ | √ | √ |
Protocols | Superior Insiders Attacks | Forward Secrecy | User Anonymity | Mutual Authentication | ||
Sciancalepore et al. [65], 2015 | × | × | √ | √ | ||
Porambage et al. [66], 2013 | × | √ | √ | √ | ||
Kumar et al. [67], 2016 | √ | √ | √ | √ | ||
Kumar et al. [68], 2017 | × | √ | √ | √ | ||
Li et al. [69], 2013 | × | × | √ | √ | ||
Vaidya et al. [70], 2011 | × | × | √ | √ | ||
Han et al. [71], 2013 | √ | √ | × | √ | ||
Sciancalepore et al. [72], 2017 | × | × | √ | √ | ||
Patel et al. [73], 2016 | × | √ | √ | √ | ||
Hossain et al. [74], 2017 | × | × | √ | √ | ||
Siddhartha et al. [64], 2019 | √ | √ | × | √ | ||
RYU et al. [54], 2022 | √ | √ | √ | √ | ||
Proposed protocol (SLACPSS) | √ | √ | √ | √ |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Abed, A.Z.M.; Abdelkader, T.; Hashem, M. SLACPSS: Secure Lightweight Authentication for Cyber–Physical–Social Systems. Computers 2024, 13, 225. https://doi.org/10.3390/computers13090225
Abed AZM, Abdelkader T, Hashem M. SLACPSS: Secure Lightweight Authentication for Cyber–Physical–Social Systems. Computers. 2024; 13(9):225. https://doi.org/10.3390/computers13090225
Chicago/Turabian StyleAbed, Ahmed Zedaan M., Tamer Abdelkader, and Mohamed Hashem. 2024. "SLACPSS: Secure Lightweight Authentication for Cyber–Physical–Social Systems" Computers 13, no. 9: 225. https://doi.org/10.3390/computers13090225