Application-specific Security Research Articles

A survey of image encryption algorithms for biomedical images

Biomedical imaging is a powerful tool for visualizing the body's internal organs and illnesses. Image protection is difficult in the field of biomedical imaging. Many studies have been conducted in the medical field to protect medical images. Encryption is the perfect solution for image privacy without data loss. Due to data size, redundancy, and performance limitations, traditional encryption methods cannot be directly applied to e-health medical data, especially when patient data is transferred through open channels. Thus, patients may experience a loss of confidentiality of the data content because images differ from text due to two different factors, such as loss of data and loss of privacy. Researchers have determined such protection risks and suggested several image encryption strategies for undesirable security difficulties. However, the study found that the currently offered approaches face application-specific security issues. Therefore, there is a growing demand to protect sensitive information in medical images. This paper presents a color and grayscale medical image encoding algorithm to preserve medical images. The compression and encoding performance of the proposed algorithm are analyzed and evaluated based on Mean Squared Error (MSE), Peak Signalto- Noise Ratio (PSNR), Structural Similarity Index Metric (SSIM), statistics, diversity, and entropy analysis. Matrix Laboratory (MATLAB) results show that the proposed algorithm provides high-quality reconstructed images with a good level of security during transmission.

ANT-Centric IoT Security Reference Architecture—Security-by-Design for Satellite-Enabled Smart Cities

Internet of Vehicles (IoV), a special form of Internet of Things (IoT), is an important enabler of intelligent transportation system, which is one of the most strategic applications in smart city initiatives. In order to achieve its intended functionalities, IoV requires anytime anywhere connectivity, which cannot be satisfied by traditional networking technologies. Space–air–ground-integrated network (SAGIN) is widely believed to be an ideal infrastructure for connecting IoV. In this article, we present an approach for understanding the security issues of complex IoT systems, and propose a security reference architecture for assessing security risks and addressing the security requirements. Specifically, we propose an activity-network-things (ANT)-centric security reference architecture, which is based on the three architectural perspectives in studying IoT systems, namely, device, Internet, and semantic. We discuss the limitations of existing IoT system architecture models, which are mainly evolved from the enterprise system architecture with some adaptation to the inherent features of IoT systems. Our approach can help manage the security risks by focusing on the critical activities performed in different microperimeters within an IoT system. The proposed architecture includes an organized process to understand the security requirements and select specific parameters for tailored security controls that are commensurate with organization-specific and application-specific security impacts of IoT. Our architecture is flexible enough to cater for any IoT application, and hence, can be easily applied to the case of SAGIN-enabled IoV.

REVIEW ON CONTEMPORARY SECURITY ISSUES IN CLOUD COMPUTING ARENA: AN APPLICATION-CENTRIC APPROACH

Cloud computing is the technology that produced an unprecedented impact in the information technology domain worldwide. Many versatile applications have been built around this technology with cloud hosting a broad spectrum of data generated from sources ranging from high-computationally intensive data applications to lightweight service applications. With the advent of Internet of Things (IoT), cloud services have reached pinnacle which made innovative ideas into technical reality. There are revolutionary changes in the way people interact among themselves as well as with the environment around them. Along with the innovations come the potential threats. The IoT devices installed across the world generates huge volumes of data and cloud provides storage infrastructure for this data. Sensitive data such as body vital parameters, a financial transaction or parameters from a control system are typically part of this IoT data. Data integrity and security is a need forever in these networks. Most of the security mechanisms developed are cloud-centric and no security standards are devised for the data in transit from data source to cloud. If the transit data is corrupted, there are hardly any mechanisms that detect this tamper. Cloud based security is a dynamic research area and there are always challenges posed to the security developers by the attackers. This paper presents a review on various security frameworks, and methods developed. Application-specific security requirements were analyzed and challenges encountered with the incorporation of these requirements were elucidated. Finally, the research concludes how the security of the cloud based infrastructure improves by the integration of blockchain technology.

E-HIP: An Energy-Efficient OpenHIP-Based Security in Internet of Things Networks.

The rapidly growing segment of the Internet of Things (IoT) makes the security threats more prominent than ever. The research around communication security and cybersecurity in such networks is still a challenge, mainly due to the typically limited energy and computation resources of IoT devices. The strong security mechanisms require significant power and thus the energy wastage must be minimized. Optimized application-specific security protocols are commonly used to make the data transfer more efficient, while still offering a high level of security. The supported security features, such as confidentiality, integrity or authenticity, should not be affected by the optimization. Our work is focused on optimizing one of the existing security protocols for the use in the IoT area, namely the Host Identity Protocol (HIP). Based on the analysis of related works, we have identified multiple possibilities for optimization and combined some of them into the proposed E-HIP optimized protocol. For verification purpose, it has been implemented as a modification of the open-source OpenHIP library and applied on a communication between real hardware devices. The secured communication worked correctly. The resulting effect of the proposed optimization has been evaluated experimentally and it represents an increase in energy efficiency by about 20%. Compared to other HIP optimizations, the achieved results are similar; however, the proposed optimizations are unique and can be further combined with some of the existing ones to achieve even higher efficiency.

Agile Network Access Control in the Container Age

Linux Containers, such as those managed by Docker, are an increasingly popular way to package and deploy complex applications. However, the fundamental security primitive of network access control for a distributed microservice deployment is often ignored or left to the network operations team. High-level application-specific security requirements are not appropriately enforced by low-level network access control lists. Apart from coarse-grained separation of virtual networks, Docker neither supports the application developer to specify nor the network operators to enforce fine-grained network access control between containers. In a fictional story, we follow DevOp engineer Alice through the lifecycle of a web application. From the initial design and software engineering through network operations and automation, we show the task expected of Alice and propose tool-support to help. As a full-stack DevOp, Alice is involved in high-level design decisions as well as low-level network troubleshooting. Focusing on network access control, we demonstrate shortcomings in today's policy management and sketch a tool-supported solution. We survey related academic work and show that many existing tools fail to bridge between the different levels of abstractions a full-stack engineer is operating on. Our toolset is formally verified using Isabell/HOL and is available as Open Source.

Exploring and enforcing security guarantees via program dependence graphs

We present PIDGIN, a program analysis and understanding tool that enables the specification and enforcement of precise application-specific information security guarantees. PIDGIN also allows developers to interactively explore the information flows in their applications to develop policies and investigate counter-examples. PIDGIN combines program dependence graphs (PDGs), which precisely capture the information flows in a whole application, with a custom PDG query language. Queries express properties about the paths in the PDG; because paths in the PDG correspond to information flows in the application, queries can be used to specify global security policies. PIDGIN is scalable. Generating a PDG for a 330k line Java application takes 90 seconds, and checking a policy on that PDG takes under 14 seconds. The query language is expressive, supporting a large class of precise, application-specific security guarantees. Policies are separate from the code and do not interfere with testing or development, and can be used for security regression testing. We describe the design and implementation of PIDGIN and report on using it: (1) to explore information security guarantees in legacy programs; (2) to develop and modify security policies concurrently with application development; and (3) to develop policies based on known vulnerabilities.

보안 위협위치에서 재사용 가능한 상태전이도를 이용한 보안요구사항 식별

소프트웨어 개발 과정에서 보안 요구사항 식별은 그 중요성으로 최근에 관심이 주목되고 있다. 그러나 기존 방법들은 보안 요구사항 식별 방법과 절차가 명확하지 않았다. 본 논문에서는 소프트웨어 개발자가 보안 위협 위치의 상태전이도로부터 보안 요구사항을 식별하는 절차를 제안한다. 이과정은 상태전이도를 작성하는 부분과 어플리케이션 의존적인 보안 요구사항을 식별하는 부분으로 구성된다. 상태전이도 작성은 1) 공격자가 소프트웨어 취약성을 이용하여 자산을 공격한다는 것에 기반하여 기존에 발생했던 보안 실패 자료를 이용하여 소프트웨어의 취약성을 위협하는 위치를 식별하고, 2) 식별된 위협 위치에 해당하는 소프트웨어 취약성을 방어, 완화시킬 수 있는 상태전이도를 작성하는 과정으로 이루어진다. 어플리케이션 의존적인 보안 요구사항 식별과정은 1) 기능 요구사항을 분석 한 후, 위협 위치를 파악하고, 각 위협 위치 에 해당하는 상태전이도를 적용하고, 2) 상태전이도를 어플리케이션 의존적인 형태로 수정한 후, 3) 보안 요구사항 추출 규칙을 적용하여 보안요구사항을 작성하는 과정으로 구성된다. 제안한 방법은 소프트웨어 개발자가 소프트웨어 개발 초기에 모델을 적용하여 쉽게 보안 요구사항을 식별하는데 도움을 준다. The security requirements identification in the software development has received some attention recently. However, previous methods do not provide clear method and process of security requirements identification. We propose a process that software developers can build application specific security requirements from state transition diagrams at the security threat location. The proposed process consists of building model and identifying application specific security requirements. The state transition diagram is constructed through subprocesses i) the identification of security threat locations using security failure data based on the point that attackers exploit software vulnerabilities and attack system assets, ii) the construction of a state transition diagram which is usable to protect, mitigate, and remove vulnerabilities of security threat locations. The identification Process of application specific security requirements consist of i) the analysis of the functional requirements of the software, which are decomposed into a DFD(Data Flow Diagram; the identification of the security threat location; and the appliance of the corresponding state transition diagram into the security threat locations, ii) the construction of the application specific state transition diagram, iii) the construction of security requirements based on the rule of the identification of security requirements. The proposed method is helpful to identify the security requirements easily at an early phase of software development.

Incommunicado

Executing computations in a single instance of safe language virtual machine can improve performance and overall platform scalability. It also poses various challenges. One of them is providing a fast inter-application communication mechanism. In addition to being efficient, such a mechanism should not violate any functional and non-functional properties of its environment, and should also support enforcement of application-specific security policies. This paper explores the design and implementation of a communication substrate for applications executing within a single Java virtual machine modified to enable safe and interference-free execution of isolated computations. Designing an efficient extension that does not break isolation properties and at the same time pragmatically offers an intuitive API has proven non-trivial. This paper demonstrates a set of techniques that lead to at least an eight-fold performance improvement over the in-process inter-application communication using standard mechanisms offered by the Java platform.

Remediation of Application-Specific Security Vulnerabilities at Runtime

Researchers at Telcordia Technologies and the State University of New York, Stony Brook, are working on an approach that gives computer users new capabilities for defending against exploitation of application security vulnerabilities by allowing rapid development and deployment of real-time defenses. Their solution involves monitoring and changing an application's behavior by intercepting the system calls it requests.

Flexible control of downloaded executable content

We present a security architecture that enables system and application a ccess control requirements to be enforced on applications composed from downloaded executable content. Downloaded executable content consists of messages downloaded from remote hosts that contain executables that run, upon receipt, on the downloading principal's machine. Unless restricted, this content can perform malicious actions, including accessing its downloading principal's private data and sending messages on this principal's behalf. Current security architectures for controlling downloaded executable content (e.g., JDK 1.2) enable specification of access control requirements for content based on its provider and identity. Since these access control requirements must cover every legal use of the class, they may include rights that are not necessary for a particular application of content. Therefore, using these systems, an application composed from downloaded executable content cannot enforce its access control requirements without the addition of application-specific security mechanisms. In this paper, we define an access control model with the following properties: (1) system administrators can define system access control requirements on applications and (2) application developers can use the same model to enforce application access control requirements without the need for ad hoc security mechanisms. This access control model uses features of role-based access control models to enable (1) specification of a single role that applies to multiple application instances; (2) selection of a content's access rights based on the content's application and role in the application; (3) consistency maintained between application state and content access rights; and (4) control of role administration. We detail a system architecture that uses this access control model to implement secure collaborative applications. Lastly, we describe an implementation of this architecture, called the Lava security architecture.