Wireless sensor networks (WSNs) have played an important role in the Internet of Things (IoT), and the 5G network is being considered as a major candidate for IoT’s communication network with the advent of 5G commercialization. The potential of integrating WSNs and 5G in the IoT is expected to allow IoT to penetrate deeply into our daily lives and to provide various services that are convenient, but at the same time, it also brings new security threats. From this aspect, user authentication and key agreement are essential for secure end-to-end communication. As IoT devices, including sensors, collect and process more and more personal information, both anonymous authentication and authorization are also required to protect the privacy and to prevent anyone without privileges from accessing private data. Recently, Adavoudi-Jolfaei et al. proposed an anonymous three-factor authentication and access control scheme for real-time applications in WSNs. However, we found that this scheme does not provide sensor-node anonymity and suffers from user collusion and desynchronization attacks. In this paper, we introduce a system architecture by considering the integration of WSNs and 5G for IoT. Based on a cryptanalysis of Adavoudi-Jolfaei et al.’s scheme and the system architecture, we propose an elliptic curve cryptography (ECC)-based privacy-preserving authentication, authorization, and key agreement scheme for WSNs in 5G-integrated IoT. We conduct a formal and informal security analysis in order to demonstrate that the proposed scheme withstands various security attacks and guarantees all desired security features, overcoming the drawbacks of Adavoudi-Jolfaei et al.’s scheme. Finally, a performance and comparative analysis with the related schemes indicate that the proposed scheme is both efficient and more secure.

A wireless sensor network (WSN) is used for a smart home system’s backbone that monitors home environment and controls smart home devices to manage lighting, heating, security and surveillance. However, despite its convenience and potential benefits, there are concerns about various security threats that may infringe on privacy and threaten our home life. For protecting WSNs for smart homes from those threats, authentication and key agreement are basic security requirements. There have been a large number of proposed authentication and key agreement scheme for WSNs. In 2017, Jung et al. proposed an efficient and security enhanced anonymous authentication with key agreement scheme by employing biometrics information as the third authentication factor. They claimed that their scheme resists on various security attacks and satisfies basic security requirements. However, we have discovered that Jung et al.’s scheme possesses some security weaknesses. Their scheme cannot guarantee security of the secret key of gateway node and security of session key and protection against user tracking attack, information leakage attack, and user impersonation attack. In this paper, we describe how those security weaknesses occur and propose a lightweight three-factor authentication and key agreement scheme in WSNs for smart homes, as an improved version of Jung et al.’s scheme. We then present a detailed analysis of the security and performance of the proposed scheme and compare the analysis results with other related schemes.

The integration of 5G networks and wireless sensor networks (WSNs) is critical in the new era of the Internet of Things (IoT), for a wide range of applications. However, despite the potential advantages of this integration, there are concerns about unforeseen security threats that may impact our daily lives. Authenticated key agreement is an essential security feature for secure communication between users and IoT devices and for protecting IoT applications from security threats. An IoT notion-based authentication and key agreement scheme was recently proposed for heterogeneous WSNs, claiming to provide user anonymity and mutual authentication, as well as the ability to withstand several types of attacks. In this paper, we examine several security weaknesses of the aforementioned scheme. Next, we design a network architecture suitable for the integration of 5G networks and WSNs. Based on the network architecture, we propose a two-factor authentication and key agreement scheme in 5G-integrated WSNs for the IoT that can resist various attacks, including those identified earlier, and that can preserve security requirements, including unlinkability. Lastly, we evaluate the security and performance of the proposed scheme and compare our scheme with other related schemes.

JavaScript interpreters, crucial for modern web browsers, require an effective fuzzing method to identify security-related bugs. However, the strict grammatical requirements for input present significant challenges. Recent efforts to integrate language models for context- aware mutation in fuzzing are promising but lack the necessary coverage guidance to be fully effective. This paper presents a novel technique called CovRL (Coverage-guided Reinforcement Learning) that combines Large Language Models (LLMs) with Reinforcement Learning (RL) from coverage feedback. Our fuzzer, CovRL-Fuzz, integrates coverage feedback directly into the LLM by leveraging the Term Frequency-Inverse Document Frequency (TF-IDF) method to construct a weighted coverage map. This map is key in calculating the fuzzing reward, which is then applied to the LLM-based mutator through reinforcement learning. CovRL-Fuzz, through this approach, enables the generation of test cases that are more likely to discover new coverage areas, thus improving bug detection while minimizing syntax and semantic errors, all without needing extra post-processing. Our evaluation results show that CovRL-Fuzz outperforms the state-of-the-art fuzzers in enhancing code coverage and identifying bugs in JavaScript interpreters: CovRL-Fuzz identified 58 real-world security-related bugs in the latest JavaScript interpreters, including 50 previously unknown bugs and 15 CVEs.

Android pattern lock is still popularly used for mobile user authentication. Unfortunately, however, many concerns have been raised regarding its security and usability. User-created patterns tend to be simply structured or reduced to a small set. Complex patterns are hard to memorize. Input patterns are susceptible to various attacks, such as guessing attacks, smudge attacks, and shoulder surfing attacks. This paper presents a novel mechanism based on the pattern lock, in which behavioral biometrics are employed to address these problems. Our basic idea starts from turning the lock pattern into public knowledge rather than a secret, and leveraging touch dynamics. Users do not need to create their own lock patterns or memorize them. Instead, our system shows a public pattern along with guidance on how to draw it. All the user needs to do for authentication is to draw the pattern as shown. For adversaries, the abovementioned attacks are rendered useless by this new mechanism. Specifically, we study how to generate public patterns and how to perform authentication. We considered segments, angles, directions, and turns as units for constructing the lock patterns, and established the public pattern criteria. The results are utilized to generate four public patterns in our experiment. For authentication, we achieved equal error rates (EERs) as low as 2.66% (sitting), 3.53% (walking), and 5.83% (combined). Furthermore, the results of our additional experiments demonstrated that our system preserved performance over time (F1-score = 89.88%, SD = 4.60%), and was sufficiently secure against camera-based recording attacks (FAR = 3.25%).

When a wearable device such as a smartwatch is paired with a host device, e.g., a smartphone, it is inevitable that a certain amount of data stored in the host device will be copied to the wearable device for initialization and personalization purposes. This incident may frequently occur with the Internet of Things. However, it is not well known, particularly among users, what type of data and how much of it is actually being copied or retained as a result of device pairing. Thus, it is unclear whether users are properly managing smartphones and smartwatches based on their stored data. In this regard, we coined a new term called data transfusion to describe the phenomenon in which a user experiences data transfer while pairing but without having any knowledge regarding the data. To the best of our knowledge, there are no previous studies that deal with how much sensitive data are transfused regardless of user consent, and how users perceive and behave toward such a phenomenon for smartwatches. As this is a significant issue with the Internet of Things, we tackle this problem in two ways. We first conduct an experimental study of data extraction from commodity devices such as in Android Wear, watchOS, and Tizen platforms, followed by a survey of 205 smartwatch users. The experimental study reveals that large amounts of sensitive data are being transfused without sufficient user notification. The survey demonstrates that users have lower risk perceptions for smartwatches than for smartphones in terms of security and privacy, but they tend to set the same passcode on both devices when needed. Based on the results, we perform risk assessment and discuss possible mitigation measures that involve volatile transfusion for securing the Internet of Things.