This paper considers the problem of data access control when the subscribers are IoT devices with initialization that cannot be updated during the entire life cycle. A generic framework and a particular instance for conditional data access control within IoT are proposed. The generic framework is based on the employment of a dedicated secret key-based broadcast encryption scheme where encrypted credentials for conditional data access is available in the blockchain and encrypted data subject to conditional access are available in an off-chain source of streaming data. Reduction of the keys management overhead in comparison with a straightforward decryption keys delivery is experimentally illustrated. An instance of the proposed framework built over the Ethereum blockchain platform is developed and experimentally evaluated.

The CENDARI infrastructure is a research-supporting platform designed to provide tools for transnational historical research, focusing on two topics: medieval culture and World War I. It exposes to the end users modern Web-based tools relying on a sophisticated infrastructure to collect, enrich, annotate, and search through large document corpora. Supporting researchers in their daily work is a novel concern for infrastructures. We describe how we gathered requirements through multiple methods to understand historians’ needs and derive an abstract workflow to support them. We then outline the tools that we have built, tying their technical descriptions to the user requirements. The main tools are the note-taking environment and its faceted search capabilities; the data integration platform including the Data API, supporting semantic enrichment through entity recognition; and the environment supporting the software development processes throughout the project to keep both technical partners and researchers in the loop. The outcomes are technical together with new resources developed and gathered, and the research workflow that has been described and documented.

We address a class of authentication protocols called “HB” ones and the man-in-the-middle (MIM) attack, reported at the ASIACRYPT conference, called OOV-MIM (Ouafi-Overbeck-Vaudenay MIM). Analysis of the considered attack and its systematic experimental evaluation are given. It is shown that the main component of OOV-MIM, the algorithm for measuring the Hamming weight of noise vectors, outputs incorrect results as a consequence of the employed approximation of the probability distributions. The analysis reveals that, practically, the only scenario in which the OOV-MIM attack is effective is the one in which two incorrect estimations produced by the algorithm for measuring the Hamming weight, when coupled, give the correct result. This paper provides additional insights into the OOV-MIM and corrected claims about the performance/complexity showing that the performances of the considered attack have been overestimated, i.e., that the complexity of the attack has been underestimated. Particularly, the analysis points out the reasons for the incorrect claims and to the components of the attack that do not work as expected.

This paper proposes a variant of the recently reported pool mining approach and provides a reduction in the energy that is consumed by the blockchain consensus protocol. The novelty of the proposed architecture lies in the employment of an innovative cryptographic puzzle that is based on stream ciphering. This enables flexibility in setting the difficulty parameter of the protocol, and allows for the separation of the energy and memory resources that are required for the puzzle solving. The proposed approach provides high resistance against the following malicious activities of miners in public blockchain systems: (i) the submission of fake work and fictitious computation results; and (ii) some well-known attacks that target the blockchain incentive mechanism. We experimentally evaluate the power consumption of the proposed consensus protocol and compare it with the traditional proof-of-work protocol based on hashing. The obtained results point out the gain that the proposed pool mining provides compared with the traditional types.

In wireless medical sensor networks (WMSNs), wearable or implantable sensors are used to collect vital body parameters, allowing remote monitoring and advanced predictive and preventive healthcare. This involves transmitting patients’ physiological data, which are sensitive and should be confidential, over the network. Thus, ensuring the security and privacy of these data is one of the most important prerequisites for the successful development of healthcare systems based on WMSN. In this regard, reliable authentication protocols designed for this specific scenario are needed. In this article, we propose the most efficient attacks to date on the widely referenced lightweight authentication protocols for WMSNs—Wang et al.’s protocol (2022). This protocol relies on blockchain and smart contracts to address the issue of centralization and on physically unclonable functions (PUFs) to ensure advanced physical-layer security. Our attacks exploit the protocol’s vulnerabilities that stem from an inadequate use of the underlying blockchain component, unlike the previous attacks that require challenging conditions to meet, i.e., physical access to users’ mobile devices and specialized power analysis techniques. We introduce new attack scenarios and prove that Wang et al.’s protocol is vulnerable to impersonation, tracing, message replay, and session key disclosure. We validate these vulnerabilities using the ProVerif tool, thereby confirming the feasibility of the attack scenarios and refuting Wang et al.’s claims regarding the protocol’s security properties. In addition, we identify and discuss other design weaknesses in Wang et al.’s proposal that further undermine its overall security and practical applicability. Finally, we revisit the feasibility of previously published attacks on Wang et al.’s protocol.