Additional Security Mechanisms Research Articles

Technical, forensic and organisational aspects of work with Monero cryptocurrency

The forensic, organisational and technical features of law enforcement agencies' work with the Monero cryptocurrency in the context of pre-trial investigation and operational search activities are analysed. The development of the Monero system is described. The reasons and trends of Monero use by offenders are identified, and the scheme of operation of this payment system, which ensures its increased confidentiality, is shown. Examples of criminal offences in which Monero is used are presented. The functionality of OpenAlias to facilitate the work with Monero addresses is disclosed. The possibility of identifying participants in Monero transactions is studied. It is stated that there are currently no effective ways of such identification without knowledge of the public address and the corresponding keys, especially if users use additional security mechanisms such as connection to the TOR network.
 The features of forensic investigation of computer equipment used to work with Monero are revealed. It is established that the most effective is the study of traces of work with Monero, which are removed from the relevant computer equipment of the person of interest. Useful information can be stored in RAM, on a disc, and partially in network traffic. The article identifies artefacts that should be taken into account during inspection and search. Atomic Swaps of XMR are modelled to determine the trace pattern and identify artefacts of increased attention during forensic procedures. The fact that an atomic swap was carried out to obfuscate traces may be evidenced by the presence of specific software files on the disc used for this purpose.
 The algorithm for XMR withdrawal using multisig addresses has been proposed, from which funds can be withdrawn only when digital signatures of several persons are superimposed. The work of this algorithm in the test network Stagenet is modelled. It has been concluded that law enforcement agencies should focus on classical investigative measures to identify Monero users of interest. At the same time, there are effective mechanisms for documenting traces of work with the Monero payment system and proven methods for extracting passphrases to crypto-wallets and other sensitive information on the movement of funds in the Monero system from computer equipment.

Review Paper on Network Data Verification Using Machine Learning Classifiers Based On Reduced Feature Dimensions

Abstract: With the rapid development of network-based applications, new risks arise and additional security mechanisms require additional attention to improve speed and accuracy. Although many new security tools have been developed, the rapid rise of malicious activity is a serious problem and the ever-evolving attacks pose serious threats to network security. Network administrators rely heavily on intrusion detection systems to detect such network intrusion activity. A major approach is machine learning methods for intrusion detection, where we learn models from data to differentiate between abnormal and normal traffic. Although machine learning methods are often used, there are some shortcomings in the in-depth analysis of machine learning algorithms in terms of intrusion detection. In this work, we present a comprehensive analysis of some existing machine learning classifiers with respect to known intrusions into network traffic. Specifically, we analyze classification with different dimensions, that is, feature selection, sensitivity to hyper-parameter selection, and class imbalance problems that are involved in intrusion detection. We evaluate several classifications using the NSL-KDD dataset and summarize their effectiveness using detailed experimental evaluation. Keywords: IDS, Machine Learning, Classification Algorithms, NSL-KDD Dataset, Network Intrusion Detection, Data Mining, Feature Selection, WEKA, Hyperparameters, Hyperparameter Optimization.

Blockchain Document Forwarding and Proof Method Based on NDN Network

The digitization of the national economy and the development of the national network have rapidly increased the amount of data, and research in content storage and forwarding is significant. The existing methods of storing certificates and distributing file content entirely rely on the judgment made by the router, and the forwarding process does not consider the security and legality of the data; at the same time, the traditional peer-to-peer (P2P) forwarding network files cannot be effectively reused, and additional security mechanisms are introduced. It affects the performance of the network itself. To improve the overall network performance, optimize the file forwarding process, and ensure the security of content and the verification of historical information, this paper proposes a method for document content storage and distribution that integrates blockchain technology and Named Data Network (NDN). The advantages of data signature encryption, reverse path forwarding of content, and flexible routing improves the overall performance of the forwarding network. Combined with blockchain decentralization technology, the documents and transaction processes can be stored on the chain to ensure the actual security of the forwarding process. In addition, this paper restricts the forwarding process in the NDN network without making any judgments through smart contract rules to ensure the security of confidential files during the forwarding process and, at the same time, limit the forwarding scope of irrelevant junk files in the private network. Finally, experiments prove that the method proposed in this paper can effectively improve the network’s overall performance, optimize the forwarding process, and make rule judgments on the forwarding process of specific files to ensure the security of files.

Implementing Location-Based Cryptography on Mobile Application Design to Secure Data in Cloud Storage

This paper aims to identify security issues and existing solutions for cloud storage protection and to propose a mobile application design for securing data in cloud storage using the location-based cryptographic technique. In the proposed mobile application design, the user is required to perform the encryption before sending the data into the cloud storage. This paper provides a novel technique using location-based cryptography, secret keyword and hash function in order to further enhance the security of data in cloud storage that is currently only using either asymmetric or symmetric encryption algorithm. Asymmetric encryption’s has high security but due to the complexity in its computing, the performance rate is low while symmetric encryption’s performance is much faster as its implementation is easy. However, the attacker can still hack the data in cloud storage when either one of this encryption methods being used alone without any additional security layer. In this paper, location-based cryptography technique used consists of Advanced Encryption Standard (AES) algorithm and location information which are longitude and latitude coordinates. Those coordinates will be employed in the encryption and decryption process as additional security mechanism on top of existing cryptography method by generating supplementary encryption key called geo-lock key. Dynamic Toleration Distance (DTD) protocol will also be implemented with those coordinates to improve its practicality before it will be converted into the geo-lock key. AES algorithm will handle encryption and decryption process using the geo-lock key while secret keyword which defined by the user before starting the process will be used to authenticate the upload and downloading process. Both geo-lock key and secret keyword will be hashed using Secure Hash Algorithm 2 (SHA 2) and stored together with encrypted file in the cloud storage. The purpose of using location information is to ensure the encrypted file can be decrypted at intended location only while hash function is employed to protect the keys when they are stored in cloud storage. As a result, any unauthorized access to the file in cloud storage will not be allowed since each stored file was encrypted by the high performance of AES algorithm together with the decryption’s location restriction and the non-reversable hashed keys. The proposed mobile application design will serve an improvement in protecting stored data at cloud storage by using AES algorithm with location information as data encryption method and SHA 2 function for hashing the keys.

Blockchain and Internet of Things for Modern Business Process in Digital Economy—the State of the Art

In addition to functionalities, business process management (BPM) involves several key indicators such as openness, security, flexibility, and scalability. Optimizing system performance is becoming a great challenge for an ever-increasing large-scale distributed application system in the digital economy on the Internet of Things (IoT) era. In a centralized BPM, many indicators, such as security and openness, or cost and flexibility, are conflicting with each other. For example, inviting new partners across enterprises, domains, and regions to form a service workflow exposes new risks and needs additional security mechanisms for scrutiny; enhancing the flexibility of business workflow compositions increases the cost of security assurance. Blockchain technology (BCT) has thrown the light on the development of vital solutions to various BPM problems. BCT has to be integrated with other BPM system components that often involve IoT devices to implement specified functionalities related to the application. Currently, the potentials of using BCT have been explored although still at an early stage. In this paper, the states of the art are presented to identify emerging research topics, challenges, and promising applications in integrating BCT into the development of BPM.

Color Visual Secret Sharing for QR Code with Perfect Module Reconstruction

Visual secret sharing is a secret sharing scheme where the decryption requires no computation. It has found many applications in online transaction security, privacy protection, and bar code security, etc. Recently, researches have indicated that combining visual secret sharing with the widely used Quick Response code may provide additional security mechanism to online transaction. However, current methods are either pixel-based, which requires high computational complexity or module-based, which sacrifices error correction capability of the original Quick Response code. Designing module-based visual secret sharing for the Quick Response code without sacrificing error correction capability is a challenging problem. To solve this problem, this paper proposes a (3, 3)-threshold visual secret sharing for Quick Response code scheme that fully explores the extra freedom provided by color visual secret sharing and color stacking. The binary secret Quick Response code is encoded into color shares. By stacking all the three shares, a binary color Quick Response code can be reconstructed. After the inherent pre-processing steps in a standard Quick Response code decoder, the original binary secret Quick Response code can be completely reconstructed. Thus, the original error correction capability of the Quick Response code is fully preserved. Theoretical analysis shows that the visual secret sharing for Quick Response code is secure under the condition that the computational device available to the attacker is limited to a decoder for standard Quick Response code. Experimental results verify that the secret Quick Response code cannot be reconstructed from just one share or any two shares. However, it can be 100% reconstructed once the three shares are stacked. The proposed visual secret sharing for Quick Response code is module-based, and it does not sacrifice the error correction capability. Furthermore, No extra pre-processing steps other than the standard Quick Response code decoder are required.

Actual Questions of the Hungarian Private Security Market

Security implies a stable and relatively predictable environment, in which an individual or group may pursue its ends without disruption or harm and without fear or injury. This paper intends to summarize the place of private security in the Hungarian law enforcement system, arguing that it is a very important complementary element of the security mechanism. In our view, law enforcement is not only police administration; it covers a more complex activity, the implementation of which is shared between police service and other complementary law enforcement services. As such, private security is an important additional security mechanism in society and, together with other public and private policing/security organisations, part of contemporary plural policing family. However, despite the growing importance and need for prosperity and high-quality private security, the market suffers from several anomalies. First of all, the legislation suffers a considerable drawback, making it impossible for those in the trade to fulfil their duty. The Hungarian Chamber of Bodyguards, Property Protection and Private Detectives is supposed to play an important role in the private security as a professional representative organisation. However, since the cancellation of mandatory membership, it has lost significance. Another difficulty for private security companies and the whole sector is labor shortage. The number of certified agents is decreasing dramatically. Finally, we present how the current harmonization of the Act of Private Security with the GDPR might lead to legal uncertainty with regard to the use of electronic surveillance system.

PROLEMus: A Proactive Learning-Based MAC Protocol Against PUEA and SSDF Attacks in Energy Constrained Cognitive Radio Networks

Malicious users can exploit vulnerabilities in cognitive radio networks (CRNs) and cause heavy performance degradation by denial of service (DoS) attacks. During operation, cognitive radios (CRs) spend a considerable amount of time to identify idle (free) channels for transmission. In addition, CRs also need additional security mechanisms to prevent malicious attacks. Proactive model predictive control (MPC)-based medium access control (MAC) protocols for CRs can quicken the idle channel identification by predicting future states of channels in advance. This provides enough time for CRs to carry out other calculations like DoS attack detection. However, such external detection techniques use additional power that makes them inappropriate for energy constrained applications. As a solution, this paper proposes a proactive learning-based MAC protocol (PROLEMus) that shows immunity to two prominent CR-based DoS attacks, namely, primary user emulation attack (PUEA) and spectrum sensing data falsification (SSDF) attack, without any external detection mechanism. PROLEMus shows an average of 6.2%, 8.9%, and 12.4% improvement in channel utilization, backoff rate, and sensing delay, respectively, with low prediction errors (≤1.8%) saving 19.65% energy, when compared to recently proposed MAC protocols like ProMAC aided with additional DoS attack detection mechanism.

Design and Implementation of a Centralized University Result Processing and Transcript System: Case study of University of Ibadan

Purpose – Result processing and Transcript generation are academic and administrative asks which universities are engaged in on a regular basis. Results inform students of their academic progress while transcript is a record of a student's academic performance. In most tertiary institutions the two tasks are handled separately with manual operations linking the two tasks. The manual operations and interconnections lead to errors in calculations and delay the production of results or transcript. The delay has caused many students or graduates to lose opportunities. Method – In this work, a combined and centralized result processing and transcript generation system was developed for a tertiary institution. The implementation was done using a Faculty as pilot study before extending to other faculties.Findings – The output shows the results were calculated correctly, graduation parameters applied correctly and reports such as transcript easily generated from the web-based application.Conclusions – The developed transcript and result processing system is functional and operational at the University of Ibadan. It has been used for over 4 academic sessions. The system is compatible with all Nigeria Universities Commission (NUC) regulations. The cooperative result processing technique that ensures results are provided for all registered students and documented permission for result changes are some of the features that users have appreciated.Recommendations – Tertiary institutions in Nigeria are encouraged to customize the developed system to eliminate repetition. Additional security mechanisms such as biometrics may be added as another layer. The system may be hosted in the cloud if there is adequate technical support.Practical Implications – This implies that student academic records are stored digitally and requests for reports such as transcripts and statement of results are efficiently produced. The need for result requests for individual student is over as all results for registered students must be submitted for computation as at when due. Manipulation of results is eliminated due to the multi-layered security built into the operation of the system.

Reactive security for SDN/NFV‐enabled industrial networks leveraging service function chaining

AbstractThe innovative application of fifth‐generation core technologies, ie, software‐defined networking (SDN) and network function virtualization, can help reduce capital and operational expenditures in industrial networks. Nevertheless, SDN expands the attack surface of the communication infrastructure, thus necessitating the introduction of additional security mechanisms. These major changes could not leave the industrial environment unaffected, with smart industrial deployments gradually becoming a reality, a trend that is often referred to as the Fourth Industrial Revolution or Industry 4.0. A wind park is a good example of an industrial application relying on a network with strict performance, security, and reliability requirements and was chosen as a representative example of industrial systems. This work highlights the benefit of leveraging the flexibility of SDN/network function virtualization–enabled networks to deploy enhanced reactive security mechanisms for the protection of the industrial network via the use of service function chaining. Moreover, the implementation of a proof‐of‐concept reactive security framework for an industrial‐grade wind park network is presented, along with a performance evaluation of the proposed approach. The framework is equipped with SDN and supervisory control and data acquisition honeypots, modeled on and deployable to the wind park, allowing continuous monitoring of the industrial network and detailed analysis of potential attacks, thus isolating attackers and enabling the assessment of their level of sophistication. Moreover, the applicability of the proposed solutions is assessed in the context of the specific industrial application based on the analysis of the network characteristics and requirements of an actual operating wind park.

A Smart Meter and Smart House Integrated to an IdM and Key-based Scheme for Providing Integral Security for a Smart Grid ICT

The literature does not present integral solutions to allow using the same credential to access the smart meter and smart house from an electric utility and vice-versa. The main reason being the technology gap in the communication between the Advanced Metering Infrastructure (AMI) and the Internet. The technology used in the Internet domain to communicate with Data Concentrators (DC) and the electric utility is more powerful than the technology used in the communication between smart meters and the DC, which is bandwidth limited and better suited to the Internet of Things (IoT) domain. Therefore, we are proposing the use of Identity Management (IdM) and a key-based scheme to enable the integration of IoT and the Internet using the same credentials, without creating a security bottleneck in the communication. An additional security mechanism is provided in the smart house context to isolate the house from direct accesses from the Internet, though allowing the utility to reconfigure the electric power consumption profile to avoid a potential blackout, for instance. Our proposal includes multi-sensor anti-tampering techniques to provide physical protection to a smart meter, in conjunction with a multilevel integrity mechanism to provide logical protection to its resource-constrained microcontroller, given the smart meter is a key component to mitigate electricity consumption fraud. The prototype has shown that our proposal is feasible for protecting the smart house, smart meter and the end-to-end communication between smart meter or house and the utility.

A new cluster-based secure communication scheme for mobile ad hoc networks

Mobile ad hoc networks have attracted considerable interest because of their use by the military and emergency rescue personnel as well as in mining operations and vehicular networks. However, mobile ad hoc networks are more vulnerable to security attacks than other types of wireless networks, such as wireless local area network or 3G/LTE networks. As a countermeasure to attack, clustering is used, where each node must be authenticated with the corresponding clusterhead in the cluster, and all data must be encrypted. In this paper, a new cluster-based secure communication scheme is proposed in which mutual authentications are performed before data transmission. In contrast to conventional schemes that use public key infrastructure cryptosystems, resulting in serious overheads in terms of computation and communication, our authentication process uses a station-to-station protocol, which is in itself an extended version of the Diffie-Hellman key exchange protocol to establish authenticated context. Moreover, attacks like replay attacks and man-in-the-middle attacks can be prevented by additional security mechanisms in the authentication and communication processes such as hash-function message authentication codes. Our proposed scheme not only meets all the security requirements, but also supports efficient communication. Performance analysis demonstrates the superiority of our scheme to related schemes.

Digital Wiretap Warrant: Improving the security of ETSI Lawful Interception

Lawful Interception (LI) of data communications is an essential tool for Law Enforcement Agencies (LEA) in order to investigate criminal activities carried out or coordinated by means of Internet. However, the ability to secretly monitor the activities of citizens also has a great impact on civil rights. Therefore, democratic societies must prevent abuse and ensure that LI is only employed in specific cases with justifiable grounds or a probable cause. Nowadays, in many countries each interception must be authorized by a wiretap warrant, usually issued by a judge. However, this wiretap warrant is merely an administrative document that should be checked by the network or service operator before enabling the monitoring of its customers, whose communications are later handed over to a LEA in plaintext. This paper proposes the idea of employing a Digital Wiretap Warrant (DWW), which further protects the civil liberties, security and privacy of LI by ensuring that monitoring devices can only be enabled with a valid DWW, and by encrypting the captured data so only the authorized LEA is able to decrypt those communications. Moreover, in the proposed DWW framework all digital evidence is securely time-stamped and signed, thus guaranteeing that it has not been tampered with, and that a proper chain of custody has been met. In particular this paper proposes how to apply the DWW concept to the lawful interception framework defined by the ETSI LI Technical Committee, and evaluates how the additional security mechanisms could impact the performance and storage costs of a LI platform.

An Enhanced ATM Security System using Second-Level Authentication

increase of automated teller machine (ATM) frauds has actuated the development of new authentication mechanisms that can overcome the security problems associated with the personal identification numbers (PIN). The traditional PIN entry system has stood the test of time mainly because of its speed and memorability which are part of the metrics used to access the ATM authentication system. The third metric, which is security has often been compromised thence the need for a more secured authentication system for ATM operations. This paper therefore proposes an enhanced ATM security system using second level authentication process. The method adopted for this research is to develop an enhancement of the existing system by building an additional security mechanism on the existing systems security mechanism. The proposed system was found to be realistic and cost effective when compared to other proposed authentication mechanism for ATM transactions.

Security analysis and review of digital signature-based low-cost RFID tag authentication

BACKGROUND: In logistic processes, radio frequency identification (RFID) technology provides possibilities for improving the integrity of shipments, the performance of supply chains and for enabling leaner processes. RFID tags are used in logistics to identify and authenticate users, products or shipments. Especially cheap, passive long-range low-cost RFID tags are of interest, but these provide security-related challenges. In new implementations of this RFID technology the threats and risks must be carefully considered as they can result in system malfunctioning, revenue losses and illegal activities. Hence, there is a need for cryptography techniques for low-cost RFID tags. Various lightweight security mechanisms that take into account the limitations of the tags have been designed. The potentiality of using asymmetric cryptography and digital signatures in tags is one such mechanism that enables more secure tag authentication. RESULTS: This paper explores how asymmetric digital signatures have been used for RFID tag authentication. The paper provides a literature overview of the methods used in both research and in commercial products, and provides knowledge about gained and missing protection in such use cases. A method based on asymmetric Elliptic Curve Digital Signature Algorithm (ECDSA) digital signatures has been developed for the authentication of low-cost RFID tags. In addition to this, the paper categorizes RFID threats to categories as presented in IETF RFC 4949 and analyzes how using asymmetric cryptography-based digital signatures protects against described threats and attacks suitable for low-cost RFID tags that do not use additional security mechanisms. CONCLUSIONS: This paper finds that asymmetric cryptography and digital signatures are suitable for low-cost RFID tags and that usage of them gives additional security, especially against physical data modification and impersonation attacks. The research underlines that IETF RFC 4949 is suitable for categorization of threats and attacks towards RFID technology. In addition to this, systematic threat and attack categorization and analysis enables the specification of further threats.

Aggregation and probabilistic verification for data authentication in VANETs

Vehicular ad hoc networks are wireless networks in which traffic information is distributed from many sources to many destinations. Thus, their deployment requires data authentication mechanisms to detect any malicious behavior of users, such as modification or replay attacks. In this work we describe a new data aggregation protocol for such networks, which uses probabilistic verification to detect those attacks efficiently with minimal overhead and delay. The proposed algorithm also contains an additional security mechanism based on reactive groups created on demand, which ensures a priori that vehicles generate trustworthy information. This paper also provides a comprehensive analysis that includes NS2 simulations and a small-scale implementation with real devices, which show that the proposed protocol is robust.

Optimal Tradeoff Between Performance and Security in Networked Control Systems Based on Coevolutionary Algorithms

Networked control systems (NCS) have to be well protected with security mechanisms from malicious attackers on the network (e.g., Internet). However, the additional security mechanism might sacrifice the performance of the NCS due to limited system resources. This paper addresses the issue of the tradeoff between NCS security and the NCS real-time performance. Using a networked DC motor system as an example, a tradeoff model for performance and security on NCS is presented. This paper also presents a framework of performance-security tradeoff optimization based on coevolutionary genetic algorithm (CGA) for the networked DC motor system. Experiments show that CGA is highly efficient in finding the Nash equilibrium for the tradeoff model on NCS. The framework presented in this paper is also demonstrated to be an effective approach for performance-security tradeoff analysis and optimization on NCS.

An overview of anonymous communications in mobile ad hoc networks

AbstractSecurity is an important topic in the context of mobile ad hoc networks (MANETs). The particular features of these networks, such as the use of open air as the transmission medium or computational constraints, make them vulnerable. One of the mechanisms to protect the communication is to provide anonymity, that aims at hiding the participants' identities, as well as the message contents and any kind of information about the transaction. For this purpose, some additional security mechanisms are required, usually based on cryptographic techniques. In this paper, we review the most relevant anonymity studies in the literature, starting with an analysis of proposals for wired networks, and then moving on to MANET environments. We also present a taxonomy to differentiate proposals according to the degree of anonymity offered. Copyright © 2010 John Wiley & Sons, Ltd.

Security Design for Industrial Sensor Networks

Abstract The industrial application of wireless sensor-actuator networks is attractive due to their flexibility, saving potential and ease of use. However, weak or missing security would restrain the acceptance and hinder a wide-spread use. This paper presents a security design for wireless sensor-actuator networks in industrial settings. The security design provides mandatory frame protection as well as end-to-end communication protection, authentication, and access control. Additional security mechanisms for MIMO transmission and node wake-up are described.

Politiques de contrôle d'accès dynamiques sur des données XML chiffrées

The erosion of trust put in traditional database servers and in Database Service Providers, the growing interest for different forms of data dissemination and the concern for protecting children from suspicious Internet content are different factors that lead to move the access control from servers to clients. Several encryption schemes can be used to serve this purpose but all suffer from a static way of sharing data. With the emergence of hardware and software security elements on client devices, more dynamic client-based access control schemes can be devised. This paper proposes an efficient client-based evaluator of access control rules for regulating access to XML documents. This evaluator takes benefit from a dedicated index to quickly converge towards the authorized parts of a - potentially streaming - document. Additional security mechanisms guarantee that prohibited data can never be disclosed during the processing and that the input document is protected from any form of tampering. Experiments on synthetic and real datasets demonstrate the effectiveness of the approach.