Perspective Chapter: Lightweight Ciphers for IoT Data Protection

Abstract

The book chapter highlights the importance of securing online identities using lightweight encryption in the Internet of Things (IoT). It explores how lightweight ciphers can enhance the security of digital personas by safeguarding user information and access credentials. The chapter recognizes the vulnerabilities in the digital landscape, emphasizing the need for strong security without overwhelming resource-constrained IoT devices. By integrating lightweight encryption techniques into identity management systems, the chapter proposes a comprehensive approach to protect online identities within the IoT framework. This strategy aims to establish robust security while enabling smooth user interactions. Overall, the chapter contributes to the discourse on online identity protection and IoT data security.

1. Introduction

Online identity refers to the digital representation of an individual or organization in the online world. It includes personal information, login credentials, and sensitive data associated with a person’s online presence. Ensuring the security and privacy of online identities heavily relies on the critical role played by lightweight cryptography. By encrypting sensitive data, such as login credentials and personal information, lightweight ciphers protect online identities from unauthorized access, interception, and tampering.

The proliferation of IoT devices has expanded the scope of online identity. IoT devices often collect and transmit personal data, making it essential to secure online identities associated with these devices. Employing lightweight cryptographic mechanisms enables robust protection of data confidentiality and integrity during transmission by IoT devices, thereby ensuring the utmost security of online identities linked to these devices [1].

Online identity management systems must exhibit efficient performance, especially in limited-resource settings, such as IoT devices with limited computational power, memory, and energy. Lightweight cryptographic algorithms are specifically designed to address the constraints of such environments. These algorithms provide efficient encryption with low computational and energy requirements, making them suitable for securing online identities in resource-limited settings [2].

Lightweight cryptography involves striking a balance between security and performance. While traditional cryptographic solutions prioritize high levels of security, they may not be the best fit for resource-constrained environments. Lightweight cryptographic techniques are designed to provide an adequate security level while optimizing performance in terms of computational capacity, resource utilization, and energy consumption. This balance is crucial in ensuring the secure management of online identities without compromising the performance of the systems [3].

Online identities are susceptible to various cybersecurity threats, such as identity theft, data breaches, and unauthorized access. Lightweight cryptography (LWC) helps mitigate these threats by providing secure encryption mechanisms. By employing lightweight cipher algorithms, online identity management systems can enhance the protection of sensitive information, preventing unauthorized access to online identities and reducing the risk of identity-related cybercrimes.

2. Lightweight cryptography

Lightweight cryptography, also known as Low-Cost Cryptography, is a system of protection that comes at a significantly reduced cost compared to traditional cryptography. It is derived from classical symmetric and asymmetric encryption techniques, but specifically tailored for devices with limited resources [4]. This type of encryption adheres to all the constraints of low-power computing devices, including considerations such as power consumption, hardware footprint, data size, and execution time, among others.

Lightweight cipher algorithms typically consist of several rounds, each of which involves a series of mathematical operations applied to the input message or data. These operations, such as substitution, permutation, and bitwise operations, are designed to transform the input data into a ciphertext that is difficult to decipher without the appropriate decryption key. The number of rounds and the specific operations used vary depending on the algorithm. Additionally, lightweight cipher algorithms often incorporate key management functions that generate subkeys from the main encryption key, which are used in each round to introduce additional randomness and security to the encryption process (See Figure 1).

Figure 1.

Principle of lightweight cipher algorithms.

The security of lightweight cipher algorithms is ensured by the key size and the number of iterations. The use of a larger key size requires an increase in hardware resources (such as logical operations, registers, etc.). Moreover, increasing the number of iterations results in longer execution times. Therefore, every algorithm designer must strike a balance among security, cost, and performance in order to design a secure and cost-effective hardware implementation with acceptable performance.

2.1 Lightweight cryptographic mechanisms

Various lightweight block cipher algorithms have been proposed to achieve better performance compared to traditional block cipher algorithms [5]. They are divided into two main families:

• Family built upon a substitution and permutation network (SPN) scheme.

• Family utilizing on a Feistel network scheme.

Subsequently, we present some lightweight block cipher algorithms for each family, highlighting their characteristics.

2.1.1 Substitution and permutation network (SPN)

A SPN scheme is a cryptographic construction used in block ciphers, which are symmetric key algorithms that operate on fixed-size blocks of data. The SPN structure consists of two main operations: substitution and permutation (See Figure 2) [6, 7, 8].

Figure 2.

SPN scheme.

2.1.1.1 LED cipher

The Light Encryption Device (LED) is a lightweight block cipher algorithm presented at CHES in 2011 [9]. It has the capability to encrypt or decrypt data blocks of 64-bit size, employing two possible key sizes (64 or 128 bits). The encryption process is iterative, involving a certain number of operations applied over n rounds to produce a ciphertext or plaintext. The total rounds, denoted as n, varies according to the employed key size, with n = 32 for 64-bit keys and n = 48 for 128-bit keys.

The LED-128 encryption algorithm consists of a series of iterative rounds, with each round comprising four operations: AddConstants, Subcolumns, ShiftRows, and MixColumns (See Figure 3).

Figure 3.

LED cipher architecture.

These operations are applied in a specific order to the input data and the round key derived from the main key.

• AddRoundKey: This function combines the subkeys with the bytes of a data matrix using bitwise exclusive OR (XOR) operations.

• AddConstants: In this operation, a round constant is XORed with the input data. The round constant is derived from the initial key and is unique for each round.

• Subcolumns: This operation involves applying a substitution box (S-box) to each byte of the data, independently. The S-box is a fixed lookup table that replaces each byte with a corresponding value, typically determined by the algorithm’s design.

• ShiftRows: In this operation, the data’s bytes within each row are shifted by a specific number of positions. The number of positions is row-dependent and determined by the algorithm’s design.

• MixColumns: This operation involves mixing the bytes in each column of the data using a linear transformation. The transformation is typically based on matrix multiplication over a finite field, and it is designed to provide diffusion and confusion in the data.

These four operations are performed iteratively for a specific number of rounds, which is typically 48 in the case of LED-128. The resulting output after the last round is the ciphertext. Decryption using LED-128 follows a similar process, but with the operations applied in reverse order and with round keys derived in the reverse direction.

In this study, we employ the LED-128 cipher with an internal permutation consisting of 48 rounds. With the aim of minimizing the occupied area and, consequently, reducing energy consumption, a low-bandwidth serial architecture that processes 32-bits at a time has been proposed. In Figure 4, you can observe the serial hardware architecture of LED encryption employing a key size of 128 bits and a block size of 64 bits.

Figure 4.

Serial architecture of LED-128 with a 32-bit datapath.

The suggested design encompasses various components, including two registers for holding the 128-bit key and 64-bit message, several multiplexers (one 4-to-1 Mux and two 2-to-1 Mux), five XOR operations, each operating on 32 bits, an S-Box substitution function, and a ShiftRow function applied to a 64-bit data block.

The developed 32-bit architecture enables parallel loading of all data (Message and Key) in 32-bit blocks via two DATA_In and Key_in inputs. To load all initialization data, four clock cycles are required.

2.1.1.2 PRESENT cipher

PRESENT, proposed in 2007 by A. Bogdanov et al. [10], stands as a prominent lightweight encryption algorithm, and it has been incorporated into the ISO/IEC 29192 standard for lightweight cryptography, alongside CLEFIA [2]. It specializes in encrypting 64-bit messages using either 80 or 128-bit keys. The algorithm is built upon an SPN structure, comprising either 25 or 31 rounds, contingent upon the chosen key size. In each iteration of the algorithm’s processing loop, referred to as a round, a series of steps are involved: a sub-key is added successively, a 4-bit S-box operation is performed in parallel, and the bits undergo permutation. You can observe the PRESENT algorithm’s depiction in Figure 5.

Figure 5.

PRESENT cipher architecture.

The PRESENT cipher employs an SPN structure with 25 or 31 rounds, determined by the key size. In every round comprises three primary operations:

• Substitution (S-box): For every nibble (4 bits) of the data, a 4-bit S-box operation is executed in parallel.

• Permutation (P-box): A permutation of the bits is performed to further diffuse the data.

• Key Addition: To enhance security, the data is XORed with a sub-key, derived from the main key using a key schedule.

• Update: The process of updating the key differs depending on the key size. In the 80-bit key version, the sub-keys (ks) are 64 bits in size and have high weight.

The PRESENT cipher with a 128-bit key size would be suitable for securing communications in applications such as IoT that require high levels of security. Additionally, given the substantial volume of data that necessitates processing and transmission, a high-throughput and efficient encryption design is required. The proposed design takes into consideration factors such as surface cost, power, and energy consumption, as illustrated in Figure 6.

Figure 6.

PRESENT cipher Architecture with a 32-bit datapath.

The PRESENT cipher architecture with a 32-bit data path consists of the following components:

• Key Register: Four registers reserved for the key.

• Message Register: Two 32-bits register reserved for the 64-bit message.

• Multiplexers and Demultiplexers (Mux 4/1 and 2/1, Demux 1/4 and 1/2): Used for selecting different input sources for data processing.

• XOR Gates: for bitwise XOR operations on 32-bit data.

• S-Box: A 4-bit S-Box used for substitution operation.

• ShiftRows: A function that applies a permutation on the bits of a 64-bit data block.

• Key Update: A process that updates the sub-keys based on the key size (bit128-bit).

• Clock: A clock signal that synchronizes the operations of the cipher.

The 32-bit data path architecture enables simultaneous loading of all data (message and key) in 32-bit blocks through two input ports, DATA_In and Key_in. Loading the inputs necessitates 4 clock cycles to load all initialization data.

2.1.2 Feistel scheme

The Feistel scheme is a cryptographic construction introduced by Horst Feistel in the early 1970s, used in many block ciphers. It is a well-known encryption model that has been used since the invention of DES in 1976. In the Feistel scheme, a plaintext block is divided into two halves denoted as L_i and R_i, and a series of rounds are applied to these halves alternately in a symmetric manner. One of the two blocks undergoes the round transformation, and the resulting output is then combined with the other block using an XOR operation. To complete these operations, a permutation function is applied to both blocks (L_i = R_i and R_i = L_i). This construction is applied multiple times until a encrypted/decrypted message is obtained (Figure 7).

Figure 7.

Feistel network structure.

Several prevailing lightweight block ciphers adopt the Feistel scheme. In this study, our attention will be directed towards the SIMON and SIMECK algorithms.

2.1.2.1 SIMON cipher

SIMON, a lightweight block cipher introduced by the NSA in 2013, follows the Feistel network structure [11]. To encrypt a message with a size of 32-bit, 48-bit, 64-bit, 96-bit, or 128-bit, a single round of SIMON is iteratively applied n times [12]. The required number of rounds varies depending on the chosen message size and key size. Once the final round is complete, the resulting ciphertext represents the output of the SIMON cipher (refer to Figures 8 and 9) [13]. SIMON supports key sizes of 64, 96, or 128 bits, and the number of rounds is contingent upon both the key size and block size.

Figure 8.

Simon round.

Figure 9.

Key generation function of SIMON cipher.

The SIMON cipher is specifically engineered to optimize hardware implementation of encryption, incorporating circular left shifts of 1-bit, 2-bits, and 8-bits, along with bitwise exclusive OR (XOR) operations (see Figure 8). The fundamental round function of SIMON comprises three primary operations:

• Substitution: SIMON uses bitwise XOR and bitwise AND operations to substitute the input data with values from the secret key. The XOR and AND operations are performed on different parts of the input data, such as the left and right halves, or different bit positions, depending on the key size.

• Permutation: SIMON uses circular left shifts of different bit lengths to permute the input data. The shift amounts are determined by the key size and block size, and they are applied to different parts of the input data.

• Mixing: SIMON uses bitwise XOR operations to mix the permuted input data with other parts of the input data, such as the left and right halves, or different bit positions.

SIMON is tailored for efficient hardware implementations, making it suitable for IoT devices, where high security, low power consumption, and small footprint are important considerations.

In this study, a parallel architecture for SIMON has been developed (see Figure 10). The proposed architecture comprises a round function consisting of two 32-bit data registers, a 2-to-1 multiplexer with a single output, and a combinational circuit featuring three cyclic shift registers of 1-bit, 2-bits, and 8-bits, along with an AND gate and three XOR gates. The outputs of this circuit serve as one of the inputs to the 2-to-1 multiplexer.

Figure 10.

32-bit data path parallel architecture for SIMON 64/128. (a) Round function (b) Key generation function.

For the 128-bit key generation, the architecture includes four 32-bit subkey blocks (key_a, key_b, key_c, and key_d), a 2-to-1 multiplexer for input selection, and a combinational circuit comprising (2n + 1) XOR gates and (n - 1) XNOR gates

2.1.2.2 SIMECK cipher

SIMECK, introduced by the National Security Agency (NSA) in 2015, is a lightweight block cipher algorithm meticulously designed to offer efficient and secure encryption for resource-constrained environments, such as IoT devices, with a focus on low-power consumption and small code footprint. SIMECK [14, 15] cipher operates on blocks of data with sizes of 32-bits, 48-bits, 64-bits, or 128 bits, and uses a Feistel network structure similar to that of SIMON. It employs bitwise XOR and circular shift operations to achieve high encryption performance with minimal hardware requirements.

The round function in SIMECK is comprised of bitwise XOR and AND operations, in addition to left and right circular shifts of the data. The key generation function is simple and efficient, involving bitwise XOR and circular shift operations on the key.

Extensive security analysis of SIMECK has demonstrated its robustness, as it exhibits a high level of resistance against a variety of attacks, including differential and linear attacks. It is widely recognized as a secure and efficient lightweight encryption algorithm for constrained environments (see Figures 11 and 12).

Figure 11.

SIMECK round.

Figure 12.

Key generation function of SIMECK cipher.

In this work, we focused on the SIMECK 64/128 algorithm. Figures 13 and 14 illustrate a parallel architecture of SIMECK featuring a 128-bit key and a 64-bit block size.

Figure 13.

Parallel architecture of SIMECK 64/128 with 32-bit data path.

Figure 14.

Key generation function of SIMECK cipher with a 32-bit datapath.

The proposed architecture accomplishes one round of the message and one subkey update within a single clock cycle. It comprises two internal blocks: a left block dedicated to the round function and another block reserved for the parallel architecture of the key generation function. The round function block incorporates two data registers, message “a” and message “b,” while a 2-to-1 multiplexer is employed to select either Data_in or the results from the combinational circuit for message “b.” This combinational circuit encompasses an AND gate, three XOR gates, and two left cyclic shift registers—one with a shift of 5-bits and the other with a shift of 1-bit. During encryption, the 32-bit data from the message “b” block is passed to the message “a” block, and concurrently, the message “b” block loads a new 32-bit data from the multiplexer until the encryption process is completed.

The round key ki in the combinational circuit for each round is derived from the key scheduling function, generating a unique key for each round until the encryption process is complete. The key generation architecture comprises four subkey registers (a, b, c, d) of size 32-bits, as depicted in Figure 14.

The proposed solution is anticipated to demonstrate outstanding performance in both hardware and software domains. The alterations in rotations and key scheduling contribute to an enhanced hardware implementation.

3. Experimental results

Table 1 outlines the specifications and characteristics of the developed lightweight cryptographic ciphers.

Algorithm	Bloc size [bits]	Key size [bits]	Datapath [bits]	Round
LED	64	128	32	48
PRESENT	64	128	32	31
SIMON	64	128	32	44
SIMECK	64	128	32	44

Table 1.

Specifications of the lightweight cryptographic mechanisms.

3.1 Hardware metrics evaluation

In this section, we present an overview of the hardware implementation results for our developed lightweight cryptographic designs. Our VHDL code is utilized to obtain these results through implementation using Mentor Graphics ModelSim 6.6d with Xilinx ISE Design Suite 14.7 [16]. The main emphasis is on achieving cost-effective hardware implementations that optimize performance and ensure a high level of security.

To provide a comprehensive analysis, we conduct a comparative study between our proposed architectures and the state-of-the-art solutions. The findings of this comparison are summarized in Tables 2 and 3. The parameters taken into consideration are the logical resources occupied (slices) on the target FPGA board, speed (number of cycles), maximum frequency (MHz), and throughput (Mbps); efficiency (throughput per area), dynamic power consumption (mW), and energy per bit (pJ/bit). Xilinx Zync-7000, Kintex-7, and Spartan-6 FPGA platforms were chosen for evaluating the lightweight encryption PRESENT cipher, while Spartan-3 and Spartan-6 FPGA boards were used for the LED, SIMON, and SIMECK lightweight ciphers. In addition, two data path widths of 32-bits and 64-bits for our architectures were developed. The choice of data path width and FPGA boards was made based on articles published in the literature for fair and just comparison.

Algorithm	Architecture	FPGA	Size I/O; [bit]	Area; [Slices]	Speed			Efficiency [Mbps/Slice]	Power; [W]	Energy/bit; [pJ/bit]
					Latency; [Cycles]	Max. Freq.; [MHz]	Throughput; [Mbps]
LED	This work	Spartan-3	32	229	192	133.76	44.59	0.19	2	44.8564
	[17]		64	219	528	128.73	15.6	0.07	–	–
	[17]		64	77	768	119.19	9.93	0.13	–	–
	Full Width; [18]		64	–	–	51.7	39.4	–	–	–
	Serial; [18]		64	–	–	106.3	4.3	–	–	–
	This work	Spartan-6	32	154	192	251.28	83.76	0.54	128	1,528*103
	Full Width; [19]		64	–	–	83.8	63.8	–	–	–
	Serial; [18]		64	–	–	142	5.75	–	–	–

Table 2.

Results of implementations on FPGA platforms.

Algorithm	Architecture	FPGA	Size I/O; [bit]	Area; [Slices]	Speed			Efficiency [Mbps/Slice]	Power; [W]	Energy/bit; [pJ/bit]
					Latency; [Cycles]	Max. Freq.; [MHz]	Throughput; [Mbps]
ESENT	This work	Zync-7000	32	616	7	26.21	239.63	0.389	0.22	918.065
	This work	Kintex-7	32	610	7	62.206	568,740	0.932	0.114	200.443
			64	950	1	39.26	2513	4.223	0.098	39.003
	[20]		64	151	-	100	206.45	1.367	-	-
	This work	Spartan-6	32	594	7	27.62	252.53	0.425	0.11	435.56
			64	858	1	17.88	1144.32	1.334	0.069	60.3
	[21]		64	121	-	13.56	3.47	0.0287	-	-
	C4 [22]		64	474	396	13.56	2.19	0.0046	23.45	10.7*106
SIMON	This work	Spartan-3	32	150	44	141.89	206.38	1.37	3	14.536
	[19]		64	36	-	136	3.60	0.10	-	-
	This work	Spartan-6	32	206	44	224.46	326.49	1.81	31	94.95
SIMECK	This work	Spartan-3	32	140	44	166.61	242.34	1.73	3	12.379
		Spartan-6	32	206	44	217.65	316.56	1.75	27	85.289

Table 3.

Results of implementations on FPGA platforms.

In our study, we developed fully unrolled PRESENT encryption architectures with a key size of 128-bits, enabling computation of all 31 rounds in parallel within a single cycle. Our design exhibits exceptional speed, being 12 times faster than the performance demonstrated in [17], albeit with an increase in hardware resources for a 64-bit data width on Kintex-7 FPGA. While the area cost approximately increases by 6 times the total number of slices on Kintex-7 FPGA due to the 128-bit key length used, we observe better efficiency (throughput per slice). Compared to C. A. Lara-Nino’s results for lightweight block cipher PRESENT in [19], our implementation showcases a throughput 330 times faster and a 64 times better efficiency (throughput per surface) on Spartan-6 FPGA.

Although energy consumption and energy per bit were not addressed in [17, 19], we outperform the proposed PRESENT architecture in terms of throughput, efficiency, power consumption, and energy per bit when compared to [18].

Our findings demonstrate that for FPGA implementation on Spartan-3, SIMECK occupies a reduced number of resources with only 399 LUT plus FF. This is attributed to the number of rounds and changes in rotations and key generation function. The proposed parallel architecture of SIMECK processes one round of the message and one round of key generation in the same clock cycle.

The proposed architectures of SIMON and SIMECK exhibit similar performance in terms of throughput and efficiency. However, on Spartan-6 FPGA, the LED algorithm architecture is the least resource-intensive, utilizing only 452 LUT plus FF. Both SIMON and SIMECK offer superior performance concerning throughput, efficiency, and energy dissipation on Spartan-3 and Spartan-6 FPGA platforms when compared to the state-of-the-art [17, 18, 19].

3.2 Security analysis

Security analysis has been conducted to assess the level of security provided by the proposed lightweight cryptographic cipher designs. By analyzing histograms, correlations, and entropy measures, security experts can gain a deeper understanding of the data’s statistical properties, distribution, and relationships, which can aid in detecting patterns indicative of security threats or breaches [23]. These analysis techniques play a crucial role in identifying and mitigating security risks, protecting systems and data, and ensuring the confidentiality, integrity, and availability of sensitive information.

3.2.1 Histograms of ciphered images

The histogram is a graphical representation that aids in understanding the distribution of brightness intensities of pixels within an image, effectively illustrating the distribution of grayscale levels [24]. An image with relatively uniform distribution in the ciphered form indicates good encryption quality. Figure 15 presents the results obtained for Lena, an image of size 256x256.

Figure 15.

Image and associated histograms of Lena image. (a) Plain, (b) Histogram of plain, (c) LED ciphered, (d) Hist. of LED ciphered, (e) PRESENT ciphered, (f) Hist. of PRESENT ciphered, (g) SIMON ciphered, (h) Hist. of SIMON Ciphered, (i) SIMECK ciphered and (j) Hist. of SIMECK ciphered.

The observed outcomes demonstrate that the histograms of the encrypted images closely resemble a uniform distribution, which is distinct from the original image. This observation points to the excellent diffusion properties achieved through the encryption process.

3.2.2 Correlation analysis

In the statistical test of correlation analysis, the correlation between adjacent pixels in an image is calculated [25]. The correlation coefficient for each pair is obtained using the following formula:

$$\rho \left(X,Y\right)=\frac{\sum \left(X-\overline{X}\right)\left(Y-\overline{Y}\right)}{\sqrt{{\left(X-\overline{X}\right)}^2}\sqrt{{\left(Y-\overline{Y}\right)}^2}}=\frac{\mathit{Cov}\left(X,Y\right)}{\sqrt{V\left(X\right)}.\sqrt{V\left(Y\right)}}$$E1

In the formula, X and Y represent the grayscale values of any two adjacent pixels in the image. V(.) denotes the sample mean of X and Y, while Cov(.) represents the covariance.

In this approach, adjacent pixels (horizontal, vertical, and diagonal) are randomly selected from both the original and encrypted images. The correlation coefficients are then computed separately for these selected pairs. In an ideal situation, the correlation coefficient of the original image would be one, and the correlation coefficient of the encrypted image would tend towards zero in the best-case scenario. Table 4 presents the computed correlation coefficients for horizontal, vertical, and diagonal adjacent pixels in both the original and corresponding encrypted images.

Plain	LED	PRESENT	SIMON	SIMECK
7.4440	7.9565	7.9537	7.9562	7.9549

Table 4.

Entropy of Plain and ciphered Lena’s image.

3.2.3 Entropy analysis

The entropy values of the ciphered images are remarkably close to 8, indicating a high degree of random behavior. Based on this observation, we can confidently assert that the proposed lightweight cryptographic designs demonstrate resistance to entropy-based attacks [26].

4. Conclusion

In conclusion, the chapter presents a comprehensive overview of lightweight cryptographic mechanisms for enhancing data security within the Internet of Things (IoT) framework. This chapter focuses on two families of ciphers, namely substitution-permutation networks and Feistel networks, and discusses their suitability for IoT data protection. The chapter highlights the necessity for cryptographic solutions that are efficient and suitable for resource-constrained IoT environments where devices often have limited computational capabilities and energy constraints.

Furthermore, the chapter evaluates the security of the proposed solutions using statistical tests. The chapter concludes that the proposed lightweight cryptographic mechanisms are suitable for securing data in IoT environments, offering a good balance between security and resource efficiency. The conclusions drawn from this chapter offer valuable insights for researchers and practitioners who seek to safeguard data in IoT applications. Moreover, these findings can serve as a solid groundwork for future research and advancements in this domain.