Authentication Infrastructure Research Articles

Using smart grid infrastructure for authentication and data management in Internet of Medical Things

AbstractThe Internet of Medical Things (IoMT) has recently become the norm in medical operations and emergency situations. A physician or a medical personnel is interested in accessing the patients' data from remote locations using IoMT. The patients' medical management system should allow their doctors and family members to have access to the data, especially in emergency situations. Deploying sensor nodes and managing the large amount of medical data generated by these sensors require a system that provides protection against known security threats and a robust mechanism to recover when subjected to attacks. The proposed scheme that provides mutual authentication between user(s) and power generation nodes, and also mitigate against attacks by validating the identity during the authentication phase. Moreover, the proposed scheme, called Grid‐Based Authentication, uses the existing smart grid infrastructure for communications, which is a model of integrated infrastructure in a smart city. Furthermore, the simulation results show that our proposed scheme yields better performance in terms of average throughput, end to end delay, and computation and communication costs compared with other state‐of‐the‐art approaches.

Service life extension of strategic bridges

This article reports the process that allowed to check the condition of a steel railway bridge having a strategic position within the network. The framework representing the actions needed for the service life extension of the bridge is first described, then the conducted inspections are illustrated, together with the developed numerical analyses and the conception of specific tests on site. The conclusion, downstream of all these analyses and with the comparison of the real-life experiments, was to allow a limited extension of the useful life of the bridge, even with some reductions in the safety factor, respecting a reduction in the speed of railway trains and prescribing continuous monitoring of the bridge. In this context, all the test evaluations, combined with the surveillance/monitoring, and joined with an important numerical modelling activity, lead to the concept of “structural augmentation” of the bridge for service life extension purposes. The specific case of the examined bridge is supposed to be an example of good practice useful for infrastructure authorities.

Preventing Black Hole Attacks in AODV Using RREQ Packets

Ad hoc networks, formed by multiple wireless communication devices without any connection to wired or intermediary devices such as by access points, are widely used in various situations to construct flexible networks that are not restricted by communication facilities. Ad hoc networks can rarely use existing infrastructure, and no authentication infrastructure is included in these networks as a trusted third party. Hence, distinguishing between ordinary and malicious terminals can be challenging. As a result, black hole attacks are among the most serious security threats to Ad hoc On-demand Distance Vector (AODV) routing, which is one of the most popular routing protocols in mobile ad hoc networks. In this study, we propose a defense method against black hole attacks in which malicious nodes are actively detected to prevent attacks. We applied the proposed method to a network containing nodes engaging in black hole attacks, confirming that the network’s performance is dramatically improved compared to a network without the proposed method.

NSF Authentication and Authorization Infrastructure

NSF Authentication and Authorization Infrastructure

Blockchain-Based One-Time Authentication for Secure V2X Communication Against Insiders and Authority Compromise Attacks

One significant security challenge in vehicular networks is defending against malicious members’ attacks, including insiders and compromised authorities. Insiders are legitimate vehicles who have passed the registration process. Since they can exploit all the information related to the network and other members’ communication, it is easier to perform various attacks with a high impact. In addition, an authority takes charge of registering and managing legitimate vehicles. Thus, if the authority is compromised, it will cause significant damage to the system, including the leaking of private information, such as identity, location, and membership. Many authentication schemes have been proposed to protect vehicular communication from these security issues. However, most existing schemes still face the vulnerability of malicious members. Furthermore, most conventional schemes require additional interactions between the vehicles and infrastructure for authentication, which can cause communication overheads. To overcome these issues, we propose a novel blockchain-based one-time authentication scheme to protect vehicular communication against malicious members. One-time authentication provides higher security and efficiency as every message is authenticated with different proof at a time. We use publicly verifiable secret sharing with blockchain for this property, which brings two benefits. First, it prevents even an authority from obtaining members’ identities by distributing encrypted shares instead of their real identities. Second, it enables robust vehicular communication against insiders’ attacks by allowing a vehicle to send unique proof generated from its private information with messages. Receivers can authenticate the messages by comparing attached values to the information through the blockchain in a noninteractive manner. Security analysis shows that our scheme assures secure vehicle-to-everything communication against insider attacks, and efficiency analysis shows how both authentication and consensus delay change.

The role of trust in the adoption of cooperative arrangement types in e-credentials markets

The interest in digital identities has increased considerably in academia and practice in recent years. This can be seen by the many electronic identity projects worldwide and the numerous published studies that provide insightful narratives and descriptive case findings about success factors and barriers to the adoption of national authentication infrastructures. In this paper, we take a closer look to the role of trust on the design and implementation of a nation-wide e-credential market. We argue that trust in political and economic institutions can be an important factor to explain differences in the chosen cooperative arrangement which can range from monopolistic, purely state-controlled e-credential markets, to polypolistic, decentralized e-credential markets where also private vendors offer state recognized e-ID on their own or in partnership with the government. Following an inductive reasoning process, we develop three testable propositions which may inspire further empirical research and offer practitioners a new angle to rethink e-credential markets in the light of citizen trust in political and economic institutions.

An Examination of Household Size, Geographic Remoteness, and Population of First Nation Communities in Canada: The Impact on Selected Wellbeing Indicators

Those living in First Nation communities tend to experience a lower quality of life than non-Indigenous Canadians as evidenced by a broad array of indicators such as employment and residential overcrowding. This research focuses on the relationship between household size and wellbeing among First Nation communities in Canada with consideration of the impact of remoteness and population as well. The research objectives are addressed with empirical analysis consisting of three stepwise linear regressions with community level data from the 2016 Census and First Nation government financial statements. Wellbeing, the dependent variable, is assessed with selected wellbeing indices consisting of education, housing quality, and workforce participation. The explanatory variables consist of a set of demographic factors, which includes household size, and a set of financial indicators. Geographic remoteness and community population are each added to the regression models in a stepwise manner. The results reveal that household size has the largest marginal impact on all three measures of wellbeing, suggesting that communities with relatively larger households, often associated with residential overcrowding, are more likely to have lower levels of wellbeing. The stepwise regression results illustrate the significance of including geographical remoteness for all three measures of wellbeing, while the addition of community population is only significant for the workforce index. In regard to geographical remoteness, the empirical results reveal that both educational outcomes and housing quality are lower in more remote communities. Community size, as defined by population, is found to be negatively associated with the workforce index implying that communities with larger populations tend to have lower workforce participation and employment outcomes. Given the ongoing social, health and economic costs associated with residential crowding in First Nation communities, the results will be of interest to policy makers and First Nation leaders in Canada and other countries who seek strategies to raise the level of wellbeing for their Indigenous communities. Policy recommendations include an increase in housing supply coordinated through the creation of an Indigenous-led housing and infrastructure authority. Other recommendations include long-term approaches to supporting education and job training programs with community level initiatives.

Internet of Things and Blockchain-Based Framework for Coronavirus (COVID-19) Disease

The COVID-19 is a highly contagious infection which is already had a catastrophic effect on the most serious diseases, including death, around the world. Blockchain-based healthcare systems are being introduced to help simplify mobile and telehealth services, reducing patient stress and the cost of critical clinical services. shared the advantages of blockchain for building a cutting-edge authentication infrastructure and detecting COVID-19 suspicious cases. The authors presented a blockchain-based design for developing a real-time cellular health monitoring system for COVID-19 patients in this paper. This study identifies clinical problems and electronic diagnoses for people with COVID-19 infectious diseases and provides a framework for them. Any mobile application can be configured on digital devices such as smartphones. COVID-19 patients may benefit from such applications. Smartphone apps are designed to save time and money while increasing the efficiency of infectious patients. IoT and Blockchain strategies are presented in the four-layer structure.

Building An Authentication Infrastructure — Designing a Two Factor Authentication Hardware Token with Form Factor that Encourages Engagement

Building An Authentication Infrastructure — Designing a Two Factor Authentication Hardware Token with Form Factor that Encourages Engagement

Built Infrastructure Conditions Mediate the Relationship between Stakeholders Attributes and Flood Damage: An Empirical Case Study

Most of the previous research has tended to focus on the impact of flood characteristics on built infrastructure damage rather than to investigate the condition of the infrastructure and stakeholders’ capacity to manage flood risks. The role of stakeholder attributes, such as the power, legitimacy, and urgency of local governments, in reducing the impact of disasters on built infrastructure remains ambiguous. Stakeholders’ organizational attributes, together with socio-economic and built infrastructure conditions, need to be considered to provide a better understanding of how to reduce disaster risk. The main aim of this research was to empirically investigate the mediating role of socio-economic and infrastructure conditions in the direct relationship between stakeholders’ attributes and economic damage to road infrastructure from flooding. Survey data collected from local governments in New South Wales, Australia and historical data for over 20 years from archive databases were analyzed using structural equation modeling with the partial least squares estimation approach. The results showed that socio-economic and infrastructure conditions have significant mediating effects on the direct relationship between stakeholders’ attributes and flood damage. Engaging stakeholders proactively empowers legitimate stakeholders in urgent conditions, and this is essential to reduce the economic impact of flood disasters and to better manage road infrastructure. Finally, to better manage flood risks, local governments need to improve their capacity of power, legitimacy, and urgency; state and federal governments need to improve the socio-economic conditions of the communities; and the transport infrastructure authorities need to develop long-term solutions for resilient roads and bridges.

Towards the Design of Efficient and Secure Architecture for Software-Defined Vehicular Networks.

Recently, by the rapid development of Vehicular Ad Hoc Networks (VANETs) and the advancement of Software Defined Networking (SDN) as an emerging technology, the Software-Defined Vehicular Network (SDVN) has a tremendous attraction in the academia and research community. SDN’s unique properties and features, such as its flexibility, programmability, and centralized control, make the network scalable and straightforward. In VANETs, traffic management and secure communication of vehicle information using the public network are the main research dimensions in the current era for the researchers to be considered while designing an efficient and secure VANETs architecture. This paper highlights the possible identified threat vectors and efficiently resolves the network vulnerabilities to design a novel and secure hierarchic architecture for SDVN. To solve the above problem, we proposed a Public Key Infrastructure-based digital signature model for efficient and secure communication from Vehicle to Vehicle. We also used the public key authority infrastructure for Vehicle to Infrastructure and the three-way handshake method for secure session creation and secure data communication in the SDN controller. The proposed security is validated through the well-known simulation tool AVISPA. Additionally, a formal security model is applied to validate the design hierarchic architecture’s fundamental security properties for SDVN in an efficient and desirable way. In a comparative analysis, we prove that our proposed scheme fulfills all the essential security properties compared to other states of the art schemes.

5G Authentication and Key Management for Applications

3GPP has finalized the publication of 5G specifications in Release 16, also called 5G phase 2 in 3GPP, which focuses on the enhancements of 5G basis to address more use cases in the 5G ecosystem. In Release 16, 3GPP took into account a variety of vertical markets in 5G, where security requirements and corresponding mechanisms are increasingly in focus. One of the important security features introduced in 3GPP Release 16 is the Authentication and Key Management for Applications (AKMA), which is similar to the Generic Bootstrapping Architecture (GBA) specified in earlier generations, leveraging an operator authentication infrastructure in order to secure the communication between the UE and an Application Function (AF). To help understand the origin and principles of AKMA better, this article first introduces mechanisms specified before 5G, including GBA and Battery Efficient Security for very low Throughput Machine (BEST), then presents the AKMA specification in more detail, and finally summarizes the enhancements of AKMA compared to preceding mechanisms.

Knowledge-driven stochastic reliable modeling for steel bridge deck condition rating prediction

ABSTRACT The structurally deficient bridges increased from 6.2% to 7% of total bridges in California state. With this percentage, 7%; California state occupies one of the top states for bridges in “poor„ condition. Steel bridges represent about 11% of its bridge networks, so determining the condition rating objectively instead of subjectively is crucial. This paper aims to help significantly optimize the maintenance process by providing a rational basis for making decisions. This paper has integrated knowledge, stochastic analysis, Regression technique, and modeling to help the highway agencies to make a more reliable decision for future maintenance based on predicted conditions. Stochastic Regression models have been built using a training dataset extracted from the National Bridge Inventory (NBI) database for California State steel bridges, considering structural and operational parameters. A validation test has been performed using a new real dataset to measure observed data's correspondence to the predicted values. The results of Average Validity Percentage (85.6%) and Coefficient of Determination (R2 = 91.5%) show that the models' accuracy, the power, and scalability of integrating the knowledge-driven models are acceptable. The integrated developed models provide the infrastructure authority with actionable insights for smarter planning and maintenance decisions as better future outcomes.

Security and Effectiveness Analysis of the Gateway Integrity Checking Protocol

Industrial Internet of Things (IIoT) gateways connected to the Internet are often based on conventional operating systems such as Linux and on conventional communication protocols such as HTTPS and therefore are valuable targets for malicious attackers. When compromised, a malicious IIoT gateway can interfere with data exchanged between IIoT devices and systems running on servers or the Cloud. The Gateway Integrity Checking Protocol (GIP), proposed in previous work, defines a gossip mechanism to collect data from sets of IIoT devices to respond to security challenges issued by an External Security Agent (ESA) to assess a gateway's trustworthiness. GIP relies on a secure channel between IIoT devices and the ESA, which is achieved using a Public Key Infrastructure (PKI) for message authentication and encryption. In this article, we perform an analysis of the security measures employed by GIP, using formal descriptions to demonstrate that GIP is no less secure than the hash algorithm and the public key infrastructure used. Additionally, we simulate different configurations of GIP to measure detection rate and time to detect integrity faults.

The on-premise data sharing infrastructure e!DAL: Foster FAIR data for faster data acquisition.

BackgroundThe FAIR data principle as a commitment to support long-term research data management is widely accepted in the scientific community. Although the ELIXIR Core Data Resources and other established infrastructures provide comprehensive and long-term stable services and platforms for FAIR data management, a large quantity of research data is still hidden or at risk of getting lost. Currently, high-throughput plant genomics and phenomics technologies are producing research data in abundance, the storage of which is not covered by established core databases. This concerns the data volume, e.g., time series of images or high-resolution hyper-spectral data; the quality of data formatting and annotation, e.g., with regard to structure and annotation specifications of core databases; uncovered data domains; or organizational constraints prohibiting primary data storage outside institional boundaries.ResultsTo share these potentially dark data in a FAIR way and master these challenges the ELIXIR Germany/de.NBI service Plant Genomic and Phenomics Research Data Repository (PGP) implements a “bring the infrastructure to the data” approach, which allows research data to be kept in place and wrapped in a FAIR-aware software infrastructure. This article presents new features of the e!DAL infrastructure software and the PGP repository as a best practice on how to easily set up FAIR-compliant and intuitive research data services. Furthermore, the integration of the ELIXIR Authentication and Authorization Infrastructure (AAI) and data discovery services are introduced as means to lower technical barriers and to increase the visibility of research data.ConclusionThe e!DAL software matured to a powerful and FAIR-compliant infrastructure, while keeping the focus on flexible setup and integration into existing infrastructures and into the daily research process.

Towards Deriving Freight Traffic Measures from Truck Movement Data for State Road Planning: A Proposed System Framework

To make the right decisions on investments, operations, and policies in the public road sector, decision makers need knowledge about traffic measures of trucks, such as average travel time and the frequency of trips among geographical zones. Private logistics companies daily collect a large amount of freight global positioning system (GPS) and shipment data. Processing such data can provide public decision makers with detailed freight traffic measures, which are necessary for making different planning decisions. The present paper proposes a system framework to be used in the research project “A new system for sharing data between logistics companies and public infrastructure authorities: improving infrastructure while maintaining competitive advantage”. Previous studies ignored the fact that the primary step for delivering valuable and usable data processing systems is to consider the final user’s needs when developing the system framework. Unlike existing studies, this paper develops the system framework through applying a user-centred design approach combining three main steps. The first step is to identify the specific traffic measures that satisfy the public decision makers’ planning needs. The second step aims to identify the different types of freight data required as inputs to the data processing system, while the third step illustrates the procedures needed to process the shared freight data. To do so, the current work employs methods of literature review and users’ need identification in applying a user-centralized approach. In addition, we develop a systematic assessment of the coverage and sufficiency of the currently acquired data. Finally, we illustrate the detailed functionality of the data processing system and provide an application case to illustrate its procedures.

Malicious changeload for the resilience evaluation of self-adaptive authorisation infrastructures

Self-adaptive systems are able to modify their behaviour and/or structure in response to changes that occur to the system, its environment, or even its goals. In terms of authorisation infrastructures, self-adaptation has shown to be a promising solution for enforcing access control policies and subject access privileges when mitigating insider threat. This paper describes the resilience evaluation of a self-adaptive authorisation infrastructure by simulating a case study related to insider threats. As part of this evaluation, a malicious changeload has been formally defined in order to describe scenarios of abuse in access control. This malicious changeload was then used to stimulate self-adaptation within a federated authorisation infrastructure. The evaluation confirmed the resilience of a self-adaptive authorisation infrastructure in handling abuse of access under repeatable conditions by consistently mitigating abuse under normal and high loads. The evaluation has also shown that self-adaptation had a minimal impact on the authorisation infrastructure, even when adapting authorisation policies while mitigating abuse of access.

A Review on Identity and Access Management Server (KeyCloak)

KeyCloak is an open source identity and access management arrangement focused on present day applications and administrations. It makes it simple to protect applications and administrations with next to zero code. The identity and access management server component provides centralized user management, authentication, and single sign-on identity brokering user federation, social login, client adapters, an admin console, and an account management console for the applications. With KeyCloak, the user management and authentication functions may be integrated with an externally managed system, such as LDAP or active directory. KeyCloak provides single sign-on infrastructure for authentication and session management. In this paper, the authors present an overview of KeyCloak that gives the objectives and features of KeyCloak and comparisons between the servers. They also present protocols of KeyCloak. Finally, benefits of KeyCloak are defined.

Stream-Based Authentication Strategy Using IoT Sensor Data in Multi-homing Sub-aqueous Big Data Network

Big data analytics has addressed many in-place and remote network issues in a sub-aqueous distributed computing environment. Recently, a new phenomenon is introduced in the data analytics clusters that focus on multi-homing network connectivity procedures among off-ground multiple nodes of the large-scale on-running wireless industrial applications. In this way, the clusters perform multi-layer cross-connected task processing among various networks simultaneously and perform stream based data block placement over multiple nodes in a sequential order. This satisfies the procedural performance of the cluster; however, security remains an open issue in it because of unavailability of inter-network data block processing authorization. In this paper, we propose a stream based authentication mechanism, that specifically addresses security concerns of multi-homing sub-aqueous big data networks and presents a key authorization infrastructure that performs a proper handing taking among multiple off-ground Datanodes before an inter-network data block exchange. The simulation results depict that our approach increases multi-homing network compatibility and reliability while processing a data block in the sub-aqueous distributed computing environment.

CERN’s Identity and Access Management: A journey to Open Source

Until recently, CERN had been considered eligible for academic pricing of Microsoft products. Now, along with many other research institutes, CERN has been disqualified from this educational programme and faces a 20 fold increase in license costs. CERN’s current Authentication and Authorization Infrastructure, dating from 2008, comprises multiple Microsoft services from the web Single-Sign-On to the Accounts Database. Replacing these core components is an opportunity to rebuild the CERN infrastructure using the latest technologies and concepts and to respond to evolving requirements of the community. It is also the appropriate moment to consider the alignment of CERN’s and the Worldwide LHC Computing Grid’s approaches to identity management, to create a more consistent environment for operators, developers and users. 2019 saw the launch of an Alpha version of CERN’s next generation Authentication and Authorization Infrastructure, focusing on free and open source products and responding to the limitations experienced by the current system. We describe the new solution and focus on key changes.