Security Architecture For Systems Research Articles

Associative Rules for Modeling International Security Decisions in the Context of the Ukrainian-Russian War. Preliminary Evaluations

Abstract Research background By launching a war against Ukraine, Russia changed the entire world system and demonstrated the ineffectiveness of the global security system. Today it is necessary to look for effective solutions to support the adoption of security decisions and develop effective strategies for the formation of a new architecture of the international security system. Purpose The paper aims to obtain preliminary approximate estimates of the state commitments of the countries of the world that support Ukraine in the war with Russia and to reveal non-obvious connections and regularities in the provision of various types of aid. Research methodology The data were collected on the rough refugee cost estimate, quantitative assessment of the government-to-government commitments, and preliminary data on non-bilateral aid transferred by governments to Ukraine of 40 countries. We used the FP-Growth algorithm to identify non-obvious connections and patterns between different types of support for Ukraine. Results We created an associative rules model to detect non-obvious patterns and relationships between the different types of bilateral commitments of the countries, that support Ukraine. Novelty Preliminary estimates were obtained between various types of international support for Ukraine in the war against Russia covering February 24 to November 20, 2022, the number of Ukrainian refugees accepted by the respective countries, and the sale of arms to Russia by some of them after the ban.

Prototyping a Hyperledger Fabric-Based Security Architecture for IoMT-Based Health Monitoring Systems

The Internet of Medical Things (IoMT) has risen significantly in recent years and has provided better quality of life by enabling IoMT-based health monitoring systems. Despite that fact, innovative security mechanisms are required to meet the security concerns of such systems effectively and efficiently. Additionally, the industry and the research community have anticipated that blockchain technology will be a disruptive technology that will be able to be integrated into innovative security solutions for IoMT networks since it has the potential to play a big role in: (a) enabling secure data transmission, (b) ensuring IoMT device security, and (c) enabling tamper-proof data storage. Therefore, the purpose of this research work is to design a novel lightweight blockchain-based security architecture for IoMT-based health monitoring systems leveraging the features of the Hyperledger Fabric (HF) Platform, its utilities. and its lightweight blockchain nature in order to: (i) ensure entity authentication, (ii) ensure data confidentiality, and (iii) enable a more energy-efficient blockchain-based security architecture for IoMT-based health monitoring systems while considering the limited resources of IoMT gateways. While security mechanisms for IoT utilizing HF do exist, to the best of our knowledge there is no specific HF-based architecture for IoMT-based health monitoring systems.

A Novel Approach to Load Balancing and Security using SSL in Cloud Computing Environment

Cloud computing has become an integral part of modern-day computing due to its numerous benefits, such as scalability, availability, and cost-effectiveness. However, load balancing and security remain significant challenges in cloud computing environments. In this paper, we propose a novel approach to load balancing and security using SSL in cloud computing environments. We designed a system architecture that consists of a load balancer, multiple servers, and SSL certificates. We developed a load balancing algorithm that considers the current workload of each server and the incoming traffic to distribute traffic among servers based on their current workload and available resources. We implemented SSL encryption to secure communication between the client and server, ensuring data confidentiality. We also implemented several security measures to prevent unauthorized access to the system and detect and prevent attacks on the system. Our performance evaluations demonstrate that our approach outperforms traditional load balancing and security approaches. Our approach provides a robust and secure system architecture that ensures optimal performance and data confidentiality in cloud computing environments.

Optimisation of Automation Devices Based on IOT Big Data Algorithms

With the continuous development of communication, sensor and caching technologies, IoT technology has gained rapid opportunities for growth and a huge digital revolution has taken place at all levels of society. Blockchain technology has emerged rapidly in recent years and can be seen as a distributed, time-based ledger of distributed data. It utilises technologies such as consensus protocols, modern cryptography, P2P and smart contracts, which can provide a secure, stable, transparent, auditable and low-consumption system architecture that has a traceable, stable and efficient security management capability, and can provide a new solution to identity security for the Internet of Things. This paper absorbs the existing blockchain-based access management approach and improves it, proposing a new private chain-based security management approach that solves the problems of access dynamics, low intelligence and high overhead in the traditional access management approach. This paper designs a new control management architecture, the Novel-Capability-Based Access Control (NCBAC), which draws on the microkernel and microservice ideas of operating systems. Firstly, this paper abstracts the concept of management node to solve the problem of weak computing power and low storage performance of IoT devices that cannot meet the difficulty of direct communication between IoT devices and blockchain, and at the same time can reduce the network operation overhead; secondly, it constructs a multi-level smart contract system and designs three kinds of smart contracts, AC, ACC and AMC, to build a trusted and reliable access control entity model; finally, it adopts radial basis based (RBF) neural network and combines with access policy to dynamically generate the credit degree threshold of access nodes to build an intelligent access authority management model for IoT mass sensors. The model proposed in this paper designs a token mechanism based on the fact that IoT systems have multiple requests within a short period of time in a real production environment, which, according to experimental results, improves the performance of the system to a certain extent.

Արտատարածաշրջանային «ուժային կենտրոնների» քաղաքականությունը Հարավային Կովկասի անվտանգային միջավայրի կերպափոխման պայմաններում / The policy of extra-regional “power centers” in the process of transformation of the security environment in the South Caucasus

After the 2020 war (the Second Nagorno-Karabakh War), the South Caucasus region entered a period of the collapse of the fragile regional security system architecture shaped while maintaining the status quo, and the serious transformation of the security environment in the region. This is stipulated by several factors ensuing, among other things, from the geopolitical and geostrategic processes taking place in other regions, in particular, the Russia – Ukraine conflict and the aggravation of relations between Russia and the West. Because of these processes, the West’s urge to weaken Russia has increased both in political (limiting Russia’s zone of influence, including in traditionally “pro–Russian” regions, such as the South Caucasus and Central Asia) and economical aspects, limiting Russia’s role as a supplier of hydrocarbon energy carriers and the East-West transit corridor. This has led to a significant decrease in the level of Russia’s limiting influence in the South Caucasus, and the emergence of serious opportunities to reinvigorate their policy in this region both for Turkey, and extra-regional global actors, such as the United States, the European Union, China and India. Each of those pursues its own geo­strategic and geo-economic interests here, and throughout the process is acting in their own traditional manner, which has been developed in the system of implementing their national foreign policy. According to the analysis carried out, if the activity of the United States’ and the European Union’s policies in the South Caucasus depends on the factors of geopolitical rivalry between the West and Russia, then the activation of China’s and India’s policies largely comes from the activation of the processes of unblocking regional communications, resulting in the occurrence of an alternative to the northern (Russian) corridor, the use of which in greatly restricted due to the Russia – Ukraine conflict. In addition, it becomes imperative for Armenia, in the process of transforming the security environment in the South Caucasus, to indemnify for the decrease in the efficiency of deterrents conditioned solely by the geopolitical presence of the Russian Federation, without changing the foreign policy.

Secure Web Application Technologies Implementation through Hardening Security Headers Using Automated Threat Modelling Techniques

This paper investigates whether security headers are enforced to mitigate cyber-attacks in web-based systems in cyberspace. The security headers examined include X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Referrer-Policy, Content-Security-Policy, and Permissions-Policy. The study employed a controlled experiment using a security header analysis tool. The web-based applications (websites) were analyzed to determine whether security headers have been correctly implemented. The experiment was iterated for 100 universities in Africa which are ranked high. The purposive sampling technique was employed to understand the status quo of the security headers implementations. The results revealed that 70% of the web-based applications in Africa have not enforced security headers in web-based applications. The study proposes a secure system architecture design for addressing web-based applications’ misconfiguration and insecure design. It presents security techniques for securing web-based applications through hardening security headers using automated threat modelling techniques. Furthermore, it recommends adopting the security headers in web-based applications using the proposed secure system architecture design.

Implementasi Arsitektur Firewall Sebagai Sistem Keamanan Jaringan Wifi 802.11ax Aruba Software Defined Wan (SD-Wan)

The concept of WLAN technology continues to evolve so as to be able to keep up with the increasing number of user densities, schemes with density Access Point (AP) and User Stations (STA), IEEE 802.11 creates an IEEE 802.11ax (TGax) to develop a set of physical layer specifications (PHY) and Media Access New Control (MAC). IEEE 802.11ax is called a high efficiency WLAN (HE). currently in the concept of its application in the implementation of the firewall architecture on the 802.11ax WIFI network security system. This study aims to determine the concept of an 802.11ax Wifi network security system architecture developed by Aruba with the latest Access Point system that is able to support the latest Wi-Fi standards and is a wireless Access Point product that may be the first to get Wi-Fi Alliance (WFA) certification in Indonesia. the field of the latest WPA3 and Enhanced Open security system standards, and can provide much stronger encryption services and have simpler IoT security configuration settings. This research uses the literature method where the researcher collects data - information data related to the subject of the research conducted by the researcher. As well as using the data analysis technique used is using content analysis in the form of written documentation and organizing data into categories, describing it into units, what is meant by data analysis techniques. The results of this study.

Secure Telemedicine System Design for COVID-19 Patients Treatment Using Service Oriented Architecture.

The coronavirus pandemic, also known as the COVID-19 pandemic, is an ongoing virus. It was first identified on December 2019 in Wuhan, China, and later spread to 192 countries. As of now, 251,266,207 people have been affected, and 5,070,244 deaths are reported. Due to the growing number of COVID-19 patients, the demand for COVID wards is increasing. Telemedicine applications are increasing drastically because of convenient treatment options. The healthcare sector is rapidly adopting telemedicine applications for the treatment of COVID-19 patients. Most telemedicine applications are developed for heterogeneous environments and due to their diverse nature, data transmission between similar and dissimilar telemedicine applications is a difficult task. In this paper, we propose a Tele-COVID system architecture design along with its security aspects to provide the treatment for COVID-19 patients from distance. Tele-COVID secure system architecture is designed to resolve the problem of data interchange between two different telemedicine applications, interoperability, and vendor lock-in. Tele-COVID is a web-based and Android telemedicine application that provides suitable treatment to COVID-19 patients. With the help of Tele-COVID, the treatment of patients at a distance is possible without the need for them to visit hospitals; in case of emergency, necessary services can also be provided. The application is tested on COVID-19 patients in the county hospital and shows the initial results.

A New Tracking-Attack Scenario Based on the Vulnerability and Privacy Violation of 5G AKA Protocol

The security architecture and procedure for 5G systems (TS 33.501) is based on the 3rd Generation Partner Project (3GPP) security specification draft that is released in 2018. Since its debut, the security violations in the 5G security protocol have been intensively studied and discussed. Based on the 5G security protocol, this paper illustrates a new tracking-attack scenario that feasibly makes subscribers suffer in a breakdown of personal privacy. Specifically, it is shown in this paper that patterns of personal behavior are leaked without any awareness during the synchronization procedures in the 5G protocol. An in-depth analysis of the privacy violations is presented in this paper and potential countermeasures for protecting the sensitive information of genuine subscribers are given. A lemma model based on the TAMARIN Prover is illustrated to analyze the privacy vulnerabilities in the depicted attack scenario. Furthermore, a practical experiment based on the srsLTE framework is setup to demonstrate how the privacy information of genuine subscribers are violated based on the scenario that is reported in this paper.

C4I System Security Architecture: A Perspective on Big Data Lifecycle in a Military Environment

Although the defense field is also one of the key areas that use big data for security reasons, there is a lack of study that designs system frameworks and presents security requirements to implement big data in defense. However, we overcome the security matters by examining the battlefield environment and the system through the flow of data in the battlefield. As such, this research was conducted to apply big data in the defense domain, which is a unique field. In particular, a three-layered system framework was designed to apply big data in the C4I system, which collects, manages, and analyzes data generated from the battlefield, and the security measures required for each layer were developed. First, to enhance the general understanding of big data and the military environment, an overview of the C4I system, the characteristics of the 6V’s, and the five-phase big data lifecycle were described. While presenting a framework that divides the C4I system into three layers, the roles and components of each layer are described in detail, considering the big data lifecycle and system framework. A security architecture is finally proposed by specifying security requirements for each field in the three-layered C4I system. The proposed system framework and security architecture more accurately explain the unique nature of the military domain than those studied in healthcare, smart grids, and smart cities; development directions requiring further research are described.

Ensuring the resilience of the national security of the Republic of Moldova in the context of increasing the geopolitical coordinate of covid-19 pandemic phenomenon

The research of the fundamental problem for ensuring the institutional resilience of the national security of the Republic of Moldova during the COVID-19 pandemic consists of the analysis of the geopolitical coordinate of the international events that determines the process of transforming the regional and international security environment. COVID-19 pandemic phenomenon can be considered a multi-dimensional global crisis in which the foreign policy actions of the great powers and regional powers have intensified in order to influence the reconfiguration of the geopolitical architecture of the international security system and the security complex structure in different regions of the world. The main idea of the subject proposed for scientific examination consists of investigating the impact of the geopolitical context of the regional security environment during the global pandemic generated by the new type of COVID-19 Coronavirus on the process of ensuring national security of the Republic of Moldova. Profifi ling fifi rst the examination of the political-military cooperation relations between the Republic Moldova and the North Atlantic Alliance, especially during the COVID-19 pandemic, contributed to the elucidation of the opportunities provided by the Alliance to increase the level of the institutional resilience of the national security and defense system of the Republic of Moldova, which needs further substantial support of the development partners, by ensuring the adjustment of the national security components to the Euro-Atlantic standards that will strengthen the capability and interoperability degree in the national security and defense field, thus discouraging possible menaces and counteracting current risks and threats.

HCI: Use in Cyber Security

This paper deals with the uses of HCI (Human-Computer Interaction) with Cyber Security and Information Security. Even though there have been efforts to strengthen the infrastructure of the security systems, there are many endemic problems which still exist and are a major source of vulnerabilities. The paper also aims to bridge the gap between the end-user and the technology of HCI. There have been many widespread security problems from the perspective of the security community, many of which arise due to the bad interaction between humans and systems. Developing on the Human-Computer Interaction is an important part of the security system architecture because even the most secure systems exist to serve human users and carry out human-oriented processes, and are designed and built by humans. HCI is concerned with the user interfaces and how they can be improved because most users' perceptions are based on their experience with these interfaces. There has been immense research on this field and many advances have been made in this arena of HCI. Speaking of Information Security on the other hand has been a major concern for the present world scenario where everything is done in the digital world.

Disrupting the power grid via EV charging: The impact of the SMS Phishing attacks

Abstract Electric vehicle (EV) is a paradigm shift for automotive, power industries, and people. EV penetration increases due to environmental concerns. Growing demand shows that reliable smart grid integration is essential to successful EV adoption. EV adds various stochastic processes to the smart grid management ranging from consumer behavior, the vehicle type to battery state of charge. As with every new technology, EVs introduce new security concerns both for the power grid and charging infrastructure. Having a holistic view and understanding consumer behavior is important to address security issues. Regulative bodies and researchers consider cyber-threats and provide security architecture for EV charging systems. However, phishing attacks and their impact on the system have been overlooked up to now. In this study, we investigate how people’s charging behavior can be guided to disturb EV connected grid with mobile phone SMSs, so-called SMiShing attacks. We demonstrated the attack on the IEEE European Low Voltage Feeder Test System. Simulation results show that SMiShing attacks targeting the EV system may result in disruptions on the power system and should not be overlooked for reliable EV transition.

Research on Network Security Protection of Application-Oriented Supercomputing Center Based on Multi-Level Defense and Moderate Principle

High Performance Computing (HPC), also known as Supercomputing, is widely applied in various fields, which have the advantage of high processing capability and mass storage. Various open business services bring great threat to the network and data security of HPC cluster. This paper proposes a feasible scheme to realize supercomputing information security through multi-layer defense and overheads control according to the experience of operation, management and maintenance of Supercomputer Center for many years. First, this paper puts forward the principle of moderate risk, and gives the principles of design and the implementation for the security protection of Supercomputing Center. Second, this paper presents a security system architecture in coordination with deep collaborative defense. Finally, this paper designs a 4-layer protection scheme on account of the latest network security solutions and the operation and maintenance characteristic of our own supercomputer. Experiments on multi-level defense and overheads control show that the designed scheme takes into account the cost and network security, and obtain prospective results., which is especially suitable for the network security protection of small-scale or medium-scale high-performance computing cluster for engineering application.

New infrastructure-oriented power network security supervision innovative mechanism and system architecture

Under the framework of latest digital infrastructure, the application of emerging technologies in the power system has become more in-depth, and the security of power networks has ushered the new challenges. Facing new challenges, power network security inspectors need to keep pace with the times and make innovations in response to the new circumstances. This paper summarizes and analyses the existing network security supervision specifications and practical experience of the State Grid Corporation of China, and combines the laws, regulations, standards and corporate document requirements such as the Cyber Security Law and the Classified Protection 2.0 National Standard, based on the new network security characteristics of the new power digital infrastructure, research the innovative mechanism and system architecture of the network security supervision of power grid enterprises from the aspects of management and technology. Based on the new requirements of Classified Protection 2.0, this paper proposes a network security inspection evaluation system to help grid companies build new lines of network security.

Integration of TOGAF 9.1 ADM in Enterprise Architecture Smart City Design in the Tourism Domain with ISO 27001

The purpose of this research is to create an enterprise architecture design smart city that has a high-security system in the tourism domain that includes smart experiences, smart destinations, and smart business ecosystems. The method used in this research was integrating ISO 27001 as an international information security standard on the TOGAF 9.1 ADM used as a framework for designing enterprise architecture. The result of design can improve Quality Assurance (QA) of the IT information security system, increase IT and business alignment and increase security awareness among government, tourists, industries, and the local community. Business Architecture focuses on centralized coordination by the board and evaluation of the performance of tourism stakeholders; Analysis results of data collection into information and useful on architecture or stakeholders; while application architecture has a focus on developing applications for tourists, business entities, and government monitoring; The technology architecture as the supports to the implementation of research with a data center, cloud service, and transaction interface that is given NFC technology. The result of this research is a smart city enterprise architecture design with a tourism domain that can be implemented in a smart city area and has a security system architecture after phase D of Requirements Management TOGAF 9.1 ADM with a higher security level.

Security Analysis of Android Automotive

<div class="section abstract"><div class="htmlview paragraph">In-vehicle infotainment (IVI) platforms are getting increasingly connected. Besides OEM apps and services, the next generation of IVI platforms are expected to offer integration of third-party apps. Under this anticipated business model, vehicular sensor and event data can be collected and shared with selected third-party apps. To accommodate this trend, Google has been pushing towards standardization among proprietary IVI operating systems with their <i>Android Automotive</i> platform which runs natively on the vehicle’s IVI platform. Unlike <i>Android Auto</i>’s limited functionality of display-projecting certain smartphone apps to the IVI screen, Android Automotive will have access to the in-vehicle network (IVN), and will be able to read and share various vehicular sensor data with third-party apps. This increased connectivity opens new business opportunities for both the car manufacturer as well as third-party businesses, but also introduces a new attack surface on the vehicle. Therefore, Android Automotive must have a secure system architecture to prevent any potential attacks that might compromise the security and privacy of the vehicle and the driver. In particular, malicious third-party entities could remotely compromise a vehicle’s functionalities and impact the vehicle safety, causing financial and operational damage to the vehicle, as well as compromise the driver’s privacy and safety.</div><div class="htmlview paragraph">This paper presents an Android Automotive system architecture and provides guidelines for conducting a high-level security analysis. It also describes what countermeasures have already been taken by Google to prevent potential attacks, and discusses what still needs to be done in order to offer a secure and privacy-preserving Android experience for next-generation IVI platforms.</div></div>

Security Requirements Engineering in Safety-Critical Railway Signalling Networks

Securing a safety-critical system is a challenging task, because safety requirements have to be considered alongside security controls. We report on our experience to develop a security architecture for railway signalling systems starting from the bare safety-critical system that requires protection. We use a threat-based approach to determine security risk acceptance criteria and derive security requirements. We discuss the executed process and make suggestions for improvements. Based on the security requirements, we develop a security architecture. The architecture is based on a hardware platform that provides the resources required for safety as well as security applications and is able to run these applications of mixed-criticality (safety-critical applications and other applications run on the same device). To achieve this, we apply the MILS approach, a separation-based high-assurance security architecture to simplify the safety case and security case of our approach. We describe the assurance requirements of the separation kernel subcomponent, which represents the key component of the MILS architecture. We further discuss the security measures of our architecture that are included to protect the safety-critical application from cyberattacks.

Research on Information Security Architecture of Aerospace Business Network for the Future

In view of the new network security situation, this paper analyses the present situation of the information security system of the aerospace business network, and puts forward the main problems that need to be improved and perfected. In view of these main problems, the overall consideration of the future-oriented information security system architecture design of aerospace business network is put forward.It includes building dynamic defense model, unified trust infrastructure, network-wide security situational awareness and early warning capabilities. A new generation of security architecture is designed.Measures and suggestion for follow-up construction are put forward.

Computer Security as an Engineering Practice: A System Engineering Discussion

Design principles gathered from over 20 years of experience in research, implementing and protecting mission critical flight systems used by the Navigation and Mission Design Section at the Jet Propulsion Laboratory are reviewed. The work of spacecraft navigation involves rigorous requirements for accuracy and completeness, often carried out under uncompromising critical time pressures. Robust and fault tolerant design for the ground data system is crucial for the numerous space missions we support, from the Mars rover Curiosity to Cassini in orbit around Saturn. We begin by examining the design principles learned from fault tolerant design efforts to protect against random failure, and consider computer security engineering as a derivative effort to protect against intelligent actors promoting malicious failure. Examples for best practices of reliable system design from computer and aviation industry are considered and security fault tolerance principles are derived from this effort. Computer security design approaches are reviewed, both as abstract principles (starting from cornerstones in Confidentiality, Integrity, and Availability) and from implementation. Strategic design principles such as defense in depth, least privilege, and vulnerability removal are used in this design. We evaluate system design from external access data flows, through internal host security mechanisms, and finally to user access controls. A complementary intersection - the balance between the protection of the system and promoting its ease of use by engineers (making their experience as user friendly and efficient as possible) is evaluated. Finally, we consider future refinements to secure system architecture.