In this paper, we propose a lightweight trust management system (TMS) for fog-enabled cyber physical systems (Fog-CPS). Trust computation is based on multi-factor and multi-dimensional parameters, and formulated as a statistical regression problem which is solved by employing random forest regression model. Additionally, as the Fog-CPS systems could be deployed in open and unprotected environments, the CPS devices and fog nodes are vulnerable to numerous attacks namely, collusion, self-promotion, badmouthing, ballot-stuffing, and opportunistic service. The compromised entities can impact the accuracy of trust computation model by increasing/decreasing the trust of other nodes. These challenges are addressed by designing a generic trust credibility model which can countermeasures the compromise of both CPS devices and fog nodes. The credibility of each newly computed trust value is evaluated and subsequently adjusted by correlating it with a standard deviation threshold. The standard deviation is quantified by computing the trust in two configurations of hostile environments and subsequently comparing it with the trust value in a legitimate/normal environment. Our results demonstrate that credibility model successfully countermeasures the malicious behaviour of all Fog-CPS entities i.e. CPS devices and fog nodes. The multi-factor trust assessment and credibility evaluation enable accurate and precise trust computation and guarantee a dependable Fog-CPS system.

In this paper, a lightweight attribute-based security scheme based on elliptic curve cryptography (ECC) is proposed for fog-enabled cyber physical systems (Fog-CPS). A novel aspect of the proposed scheme is that the communication between Fog-CPS entities is secure even when the certification authority (CA) is compromised. This is achieved by dividing the attributes into two sets, namely, secret and shared, and subsequently generating two key pairs, referred to as the partial and final key pairs, for each entity of the Fog-CPS system. Unlike existing attribute-based encryption (ABE) and identity-based encryption schemes, in the proposed scheme, each entity calculates the final public key of the communicating CPS devices without the need of generating and transmitting digital certificates. Moreover, the proposed security scheme considers an efficient and secure key pair update approach in which the calculation overhead is limited to one group element. To show the effectiveness of the proposed scheme, we have calculated and compared the memory and processing complexity with other bilinear and elliptic curve schemes. We have also implemented our scheme in a Raspberry Pi (3B+ model) for CPS simulations. The proposed scheme guarantees the confidentiality, integrity, privacy, and authenticity in Fog-CPS systems.

Fog-Assisted Internet of Things (Fog-IoT) systems are deployed in remote and unprotected environments, making them vulnerable to security, privacy, and trust challenges. Existing studies propose security schemes and trust models for these systems. However, mitigation of insider attacks, namely blackhole, sinkhole, sybil, collusion, self-promotion, and privilege escalation, has always been a challenge and mostly carried out by the legitimate nodes. Compared to other studies, this paper proposes a framework featuring attribute-based access control and trust-based behavioural monitoring to address the challenges mentioned above. The proposed framework consists of two components, the security component (SC) and the trust management component (TMC). SC ensures data confidentiality, integrity, authentication, and authorization. TMC evaluates Fog-IoT entities' performance using a trust model based on a set of QoS and network communication features. Subsequently, trust is embedded as an attribute within SC's access control policies, ensuring that only trusted entities are granted access to fog resources. Several attacking scenarios, namely DoS, DDoS, probing, and data theft are designed to elaborate on how the change in trust triggers the change in access rights and, therefore, validates the proposed integrated framework's design principles. The framework is evaluated on a Raspberry Pi 3 Model B to benchmark its performance in terms of time and memory complexity. Our results show that both SC and TMC are lightweight and suitable for resource-constrained devices.

No abstract

Physical layer security (PLS) schemes use the randomness of the channel parameters, namely, channel state information (CSI) and received signal strength indicator (RSSI), to generate the secret keys. There has been limited work in PLS schemes in long-range (LoRa) wide area networks (Lo-RaWANs), hindering their widespread application. Limitations observed in existing studies include the requirement of having a high correlation between channel parameter measurements and the evaluation in either fully indoor or outdoor environments. The real-world wireless sensor networks (WSNs) and LoRa use cases might not meet both requirements, thus making the current PLS schemes inappropriate for these systems. This paper proposes LoRA-LiSK, a practical and efficient shared secret key generation scheme for LoRa networks to address the limitations of existing PLS schemes. Our proposed LoRa-LiSK scheme consists of several preprocessing techniques (timestamp matching, two sample Kolmogorov Smirnov tests, and a Savitzky-Golay filter), multi-level quantization, information reconciliation using Bose-Chaudhuri-Hocquenghem (BCH) codes, and finally, privacy amplification using secure hash algorithm SHA-2. The LoRa-LiSK scheme is extensively evaluated on real WSN/IoT devices in practical application scenarios: 1) indoor to outdoor and 2) long range static and mobile outdoor links. It outperforms existing schemes by generating keys with channel parameter measurements of low correlation values (0.2 to 0.6) while still achieving high key generation rates and low key disagreement rates (10% − 20%). The scheme updates a key in one hour approximately using an application profile with a high transmission rate compared to three hours reported by existing works while still respecting the duty cycle regulation. It also incurs less communication overhead compared to the existing works.