Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Lightweight and Breach-Resilient Authenticated Encryption Framework for Internet of Things

Saif E. Nouma, Attila A. Yavuz

TL;DR

This paper tackles secure IoT communications for resource-constrained devices by introducing Graphene, a symmetric Forward-secure and Aggregate Authenticated Encryption (FAAE) framework that supports offline-online processing and tag aggregation. By blending key evolution with Universal MACs, Graphene achieves breach resilience and low online latency, while remaining extensible through multiple instantiations. The two instantiations, Graphene-AE (AES-GCM with OO) and Graphene-Poly (AES-CTR-128 with Poly1305), illustrate trade-offs between standard compliance, performance, and security levels, and the framework is analyzed under forward-secure $F$-IND-CPA confidentiality and $F$-EU-CMA MAC security, including mix-and-match resistance. Empirical evaluation on commodity hardware and 32-bit Cortex-M4 devices demonstrates substantial performance gains over existing FAAE solutions, with modest storage overhead, and the authors release a full open-source implementation to facilitate adoption and further research.

Abstract

The Internet of Things (IoT) relies heavily on resource-limited devices to communicate critical (e.g., military data) information under low-energy adversarial environments and low-latency wireless channels. Authenticated Encryption (AE) guarantees confidentiality, authenticity, and integrity, making it a vital security service for IoT. However, current deployed (lightweight) AE standards lack essential features like key compromise resiliency and compact authentication tags, as well as performance enhancements such as offline-online cryptography. To address these gaps, we propose Graphene, the first (to our knowledge) symmetric Forward-secure and Aggregate Authenticated Encryption (FAAE) framework designed for the performance and security demands of low-end IoT infrastructures. Graphene innovates by synergizing key evolution strategies and offline-online cryptographic processing with Universal Message Authentication Codes (UMACs) to guarantee breach-resiliency, near-optimal online latency, and compactness. We demonstrate Graphene efficiency through two distinct instantiations, each balancing unique performance trade-offs with extensibility for diverse MACs. Our experimental evaluation on commodity hardware and 32-bit ARM Cortex-M4 microcontroller shows Graphene significant performance gains over existing alternatives. Graphene is also backward compatible with standard-compliant cryptographic implementations. We release our implementation as open source for public testing and adaptation.

Lightweight and Breach-Resilient Authenticated Encryption Framework for Internet of Things

TL;DR

This paper tackles secure IoT communications for resource-constrained devices by introducing Graphene, a symmetric Forward-secure and Aggregate Authenticated Encryption (FAAE) framework that supports offline-online processing and tag aggregation. By blending key evolution with Universal MACs, Graphene achieves breach resilience and low online latency, while remaining extensible through multiple instantiations. The two instantiations, Graphene-AE (AES-GCM with OO) and Graphene-Poly (AES-CTR-128 with Poly1305), illustrate trade-offs between standard compliance, performance, and security levels, and the framework is analyzed under forward-secure -IND-CPA confidentiality and -EU-CMA MAC security, including mix-and-match resistance. Empirical evaluation on commodity hardware and 32-bit Cortex-M4 devices demonstrates substantial performance gains over existing FAAE solutions, with modest storage overhead, and the authors release a full open-source implementation to facilitate adoption and further research.

Abstract

The Internet of Things (IoT) relies heavily on resource-limited devices to communicate critical (e.g., military data) information under low-energy adversarial environments and low-latency wireless channels. Authenticated Encryption (AE) guarantees confidentiality, authenticity, and integrity, making it a vital security service for IoT. However, current deployed (lightweight) AE standards lack essential features like key compromise resiliency and compact authentication tags, as well as performance enhancements such as offline-online cryptography. To address these gaps, we propose Graphene, the first (to our knowledge) symmetric Forward-secure and Aggregate Authenticated Encryption (FAAE) framework designed for the performance and security demands of low-end IoT infrastructures. Graphene innovates by synergizing key evolution strategies and offline-online cryptographic processing with Universal Message Authentication Codes (UMACs) to guarantee breach-resiliency, near-optimal online latency, and compactness. We demonstrate Graphene efficiency through two distinct instantiations, each balancing unique performance trade-offs with extensibility for diverse MACs. Our experimental evaluation on commodity hardware and 32-bit ARM Cortex-M4 microcontroller shows Graphene significant performance gains over existing alternatives. Graphene is also backward compatible with standard-compliant cryptographic implementations. We release our implementation as open source for public testing and adaptation.
Paper Structure (11 sections, 2 theorems, 4 figures, 1 table)

This paper contains 11 sections, 2 theorems, 4 figures, 1 table.

Table of Contents

  1. INTRODUCTION
  2. Related Work and Limitations
  3. Our Contributions
  4. Preliminaries and Models
  5. PROPOSED SCHEMES
  6. Generic $$ Graphene Framework
  7. Graphene Instantiations
  8. Security Analysis
  9. PERFORMANCE EVALUATION
  10. Performance Analysis of Our Instantiations
  11. CONCLUSION

Key Result

Theorem 1

If $$A can $(t',\epsilon', q_G)$-break $$Graphene, then one can construct a PPT algorithm $\mathcal{B}$ to $(t,\epsilon,q_H)$-break $H$, or $(t,\epsilon,q_P)$-break F-IND-CPA-secure $$ENC, or $(t,\epsilon,q_S)$-break FA-EU-CMA-secure MAC, respectively, where $t' = t + \mathcal{O}(q_H+q_P+q_S)$ and $

Figures (4)

  • Figure 1: Our system and threat models
  • Figure 2: Generic $$Graphene Framework
  • Figure 3: Overview of $$Graphene Framework
  • Figure 4: OO running time and preprocessing storage overhead of $$Graphene variants on commodity hardware (x86/64: $\boldsymbol{1}^{\text{st}}$ row) and 32-bit ARM Cortex-M4 ($\boldsymbol{2}^{\text{nd}}$ and $\boldsymbol{3}^{\text{rd}}$ rows)

Theorems & Definitions (4)

  • Theorem 1
  • proof
  • Corollary 1
  • proof