# Secure Automatic Identification System (SecAIS): Proof-of-Concept Implementation
## 3 Maritime Identity-Based Cryptographic Infrastructure (mIBC)  
In [13], we proposed the deployment of a maritime identity-based cryptographic infrastructure (mIBC) that enhances the AIS with on-demand anonymity, authentication, and encryption capabilities. In [13; 14], the term \"mIBC-AIS\" was used instead of the term \"SecAIS\". To maintain consistency, all \"mIBC-AIS-\" terms in [13; 14] have been replaced by \"SecAIS-\" terms herein. In [14], we proposed the implementation of the mIBC infrastructure following the IEEE 1363.3-2013 standard for identity-based cryptography, and we defined five distinct usage modes; each of these can be used according to the needs of the SecAIS user at any time. These modes are:  
1. The **Typical-SecAIS (mode 1)** is the conventional AIS, for routine use;
2. The **Authenticated-SecAIS (mode 2)** offers source authentication via cryptographically signed AIS messages. An AIS device signs the transmitted AIS data with its mIBC private (secret) key, and the receivers authenticate the signed AIS messages by using only the MMSI of the transmitter vessel;
3. The **Anonymous-SecAIS (mode 3)** offers legitimate anonymous AIS-transmitted messages via \"pseudo-MMSIs\" that are cryptographically signed by an official mIBC agency. From a cryptographic point of view, the Anonymous-SecAIS (mode 3) is identical to the Authenticated-SecAIS (mode 2), although it uses a pseudo-MMSI instead of the real MMSI of the vessel;
4. The **SK-IBE-SecAIS (mode 4)** allows for the secure transmission of small encrypted AIS messages to a specific entity via an appropriate encryption scheme, such as the Sakai-Kasahara identity-based encryption scheme. It is proposed to be used, mainly, for the secure sharing (or distribution, if there is more than one recipient) of the symmetric keys in the AES-SecAIS (mode 5);
5. The **AES-SecAIS (mode 5)** allows for the transmission of encrypted AIS messages to a group of participants (e.g., trustworthy vessels in an insecure area) via symmetric cryptography (e.g., by means of the advanced encryption standard (AES) [41]). The advantage of our solution is that the keys for the encryption can be generated and disseminated ad hoc, upon request, unlike the current commercially available solutions, e.g., [42; 43], where the keys are pre-configured in predetermined users.  
This approach allows for the ad hoc creation of encrypted AISANETs, described in Section 5.  
To enhance the conventional AIS devices with SecAIS capabilities, in [14], we proposed the use of a special add-on application named \"SecAIS-App\". This is located between the conventional AIS devices and the AIS transmitter, and it implements the security modes of the SecAIS by acting as the cryptographic interface between current AIS devices. It works as follows:  
1. The SecAIS-App intercepts the original generated AIS message (e.g., an AIS class A ship static and voyage-related data ID5 [5]);
2. The SecAIS-App performs the appropriate cryptographic actions (e.g., signing, encrypting, etc.);
3. The SecAIS-App creates conventional AIS binary broadcast messages of types ID8 or ID 6 [5], and it encapsulates the SecAIS data into their \"application data payload\" section. The SecAIS-App forwards the newly created, conventional AIS binary broadcast messages to the AIS transmitter.  
Similar actions, in reverse order, are performed by the SecAIS-App of the receiver. Therefore, the SecAIS is entirely transparent to current AIS devices. Figure 1 depicts the use of the SecAIS-App and its interaction with the AIS devices when transmitting/receiving an authenticated SecAIS message (mode 2).  
Figure 1: Authenticated SecAIS (mode 2).