Source Authentication Research Articles

Medical Data Sharing Scheme Based on Attribute Cryptosystem and Blockchain Technology

Electronic medical data have significant advantages over paper-based patient records when it comes to storage and retrieval. However, most existing medical data sharing schemes have security risks, such as being prone to data tampering and forgery, and do not support the ability to verify the authenticity of the data source. To solve these problems, we propose a medical data sharing scheme based on attribute cryptosystem and blockchain technology in this paper. First, the encrypted medical data are stored in the cloud, and the storage address and medical-related information are written into the blockchain, which can ensure efficient storage and eliminate the possibility of irreversible modification of the data. Second, the proposed scheme combines attribute-based encryption (ABE) and attribute-based signature (ABS), which achieves the sharing of medical data in many-to-many communications. The ABE achieves data privacy and fine-grained access control, and the ABS verifies the authenticity of the source of the medical data while protecting the signer's identity. Moreover, the data user outsources most of the operations of medical data ciphertext decryption to the cloud service provider (CSP), which can greatly reduce the computational burden. Finally, results of the analysis show that our scheme satisfies the requirements for confidentiality and unforgeability in the random oracle model, and that the proposed scheme offers higher computational performance than other similar schemes.

Twitter Politics: The Effect of Language and Source Credibility on Public Perception

Social media sites are instrumental in influencing public perception (Lawson & Strange, 2015). Social media sites, such as Twitter, have provided millions with constant news coverage. Modern social media usage has allowed for public figures, such as President, Donald Trump, to influence public perception through his Twitter account. Because of the influx of information, coming from various sources on social media, it is imperative to consider the implications different types of information sources will have on individual perceptions. Individuals may be more influenced by high-credibility sources when searching for news. The current study attempts to investigate the relationship between language and authority and its effect on media viewer’s perception. Participants were shown one of four Tweets, varying by language used and account type. Participants were then asked questions to assess their views on the message. Results suggest a difference in perception based on language used, level of perceived intelligence, source authentication, and source’s level of knowledge on the topic.

Road Condition Monitoring with Source Authentication in VANET

In recent technologies, it has been said that, to improve the travel efficiency and safety of transportation systems, vehicular ad-hoc network (VANET) has been used as the promising technology where each vehicle is able to collect and communicate the information about current road or traffic condition at a particular location using an embedded on-board unit with the help of distributed roadside units. Examples are: While detection of some accident, congestion, jam, etc., vehicles broadcast warning signals to the nearby vehicles which would give a better awareness to every nearby vehicles about the driving environment and these nearby vehicles would change the driving plan if needed. The VANET technology has gained great attentions from both industry and academics in the recent days.

A metabolomics strategy for authentication of plant medicines with multiple botanical origins, a case study of Uncariae Rammulus Cum Uncis.

Source authentication of herbal medicines was essential for ensuring their safety, efficacy and quality consistency, especially those with multiple botanical origins. This study proposed a metabolomics strategy for species discrimination and source recognition. Uncariae Rammulus Cum Uncis, officially stipulating the stems with hooks of five Uncaria species as its origins, was taken as a case study. Firstly, an untargeted MSE method was developed by ultra-high performance liquid chromatography hyphenated with quadrupole time-of-flight mass spectrometry for global metabolite characterization. Subsequently, data pretreatment was conducted by using Progenesis QI software and screening rules. The obtained metabolite features were defined as variables for statistical analyses. Principal component analysis and chemical fingerprinting spectra suggested that five official species were differentiated from each other except for Uncaria hirsuta and Uncaria sinensis. Furthermore, orthogonal partial least squares discrimination analysis was performed to discriminate confused two species, and resulted in the discovery of nine contributing markers. Ultimately, a Support Vector Machine model was developed to recognize five species and predict origins of commercial materials. The study demonstrated that the developed strategy was effective in discrimination and recognition of confused species, and promising in tracking botanical origins of commercial materials.

A strontium isotope baseline of Cyprus. Assessing the use of soil leachates, plants, groundwater and surface water as proxies for the local range of bioavailable strontium isotope composition

In this study, a strontium isotope baseline for Cyprus is presented. The aim of the study was two-fold; first to provide an environmental multi-proxy-based baseline (water/plants/soil leachates) suitable for archaeological provenance and mobility studies, food source authentication, and forensic investigations; and second, to contribute to the debate around which proxy (or combination of proxies) might be most suitable to define bioavailable fractions of strontium in geologically complex areas also exposed to sea-spray and other Sr-bearing aerosols. Lowest bioavailable strontium isotope signatures range is found within terranes dominated by ophiolites, where 87Sr/86Sr ratios range from 0.7055 to 0.7081, however, results reveal a high degree of variability in bioavailable 87Sr/86Sr ratios, both spatially, along depth profiles and amongst the different proxies. A narrower range of bioavailable Sr isotope signatures is observed within the Circum Troodos Sedimentary Successions (C.T.S.S.), both in spatial distribution and between different proxies. Observed range is 87Sr/86Sr = 0.7079 to 0.7089 in areas dominated by pre-Quaternary C.T.S.S., and 87Sr/86Sr ratios = 0.7076 to 0.7086 in areas covered by Quaternary C.T.S.S., revealing the lithologies to be very homogenous with respect to bioavailable strontium ratios. Intra-site variations in three archaeological sites (multiple samples from each site from within a 500 m radius) within the pre-Quaternary and Quaternary C.T.S.S. are smaller than inter-site variations, suggesting that tracing studies inferred from baselines sampled within a limited spatial area could lead to erroneous conclusions regarding provenance. The study points to the necessity for conducting multi-proxy, spatially extensive sampling to adequately characterize complex geological areas, if these should serve as reliable reference areas in provenance studies.

Authentic Caller: Self-Enforcing Authentication in a Next-Generation Network

The Internet of Things (IoT) or the cyber-physical system (CPS) is the network of connected devices, things, and people that collect and exchange information using the emerging telecommunication networks (4G, 5G IP-based LTE). These emerging telecommunication networks can also be used to transfer critical information between the source and destination, informing the control system about the outage in the electrical grid, or providing information about the emergency at the national express highway. This sensitive information requires authorization and authentication of source and destination involved in the communication. To protect the network from unauthorized access and to provide authentication, the telecommunication operators have to adopt the mechanism for seamless verification and authorization of parties involved in the communication. Currently, the next-generation telecommunication networks use a digest-based authentication mechanism, where the call-processing engine of the telecommunication operator initiates the challenge to the request-initiating client or caller, which is being solved by the client to prove his credentials. However, the digest-based authentication mechanisms are vulnerable to many forms of known attacks, e.g., the man-in-the-middle (MITM) attack and the password guessing attack. Furthermore, the digest-based systems require extensive processing overheads. Several public-key infrastructure (PKI)-based and identity-based schemes have been proposed for the authentication and key agreements. However, these schemes generally require a smart card to hold long-term private keys and authentication credentials. In this article, we propose a novel self-enforcing authentication protocol for the session-initiation-protocol-based next-generation network, based on a low-entropy shared password without relying on any PKI or the trusted third party system. The proposed system shows effective resistance against various attacks, e.g., MITM, replay attack, password guessing attack, etc. We analyze the security properties of the proposed scheme in comparison to the state of the art.

Advanced Secure Energy Aware Trade-off Model to Control Data Communication in Wireless Networks

Secure data transmission in ad hoc related wireless networks is an aggressive concept in present node to node communication. Secure energy trade-off between different node communication is also major challenge in wireless ad hoc networks. To provide efficient communication with secure data aware between nodes in ad hoc wireless networks. So that in this paper proposes and introduces Advanced Secure Energy Aware Trade-off Model (ASEATM) for energy trade results in wireless ad hoc networks, also use Elliptic curve cryptography to describe/ provide source authentication with respect to efficient communication in wireless networks. Our experimental results show efficient secure communication in wireless ad hoc networks with comparison to existing approaches in real time scenario.

Spatio-Temporal Characterization of Synchrophasor Data Against Spoofing Attacks in Smart Grids

“Source ID Mix” has emerged as a new type of highly deceiving attack which can alter the source information of synchrophasor data measured by multiple phasor measurement units, thereby paralyzing many wide-area measurement systems applications. To address such sophisticated cyber attacks, we have exploited the spatio-temporal characteristics of synchrophasor data for authenticating measurements' source information. Specifically, the source authentication is performed when the measurements are subjected to three types of spoofing attacks. Some practical difficulties in applying the proposed method on real-time authentication caused by insufficient measurement data have also been solved. Experimental results with real synchrophasor measurements have validated the effectiveness of the proposed method in detecting such complicated data spoofing and improving power systems' cyber security.

Modified Timed Efficient Stream Loss-tolerant Authentication to Secure Power Line Communication

<div class="page" title="Page 1"><div class="layoutArea"><div class="column"><p><span>This paper investigates the feasibility of Timed Efficient Stream Loss-tolerant Authentica- tion to serve security needs of Power Line Communication (PLC) system. PLC network has been identified as the ideal choice to function as the last mile network, deliver load management messages to smart meters. However, there is need to address the security concerns for load management messages delivered over power line communications. The ubiquitous nature of the power line communication infrastructure exposes load management systems (LMS) deployed over it to a security risk. Ordinarily, PLC network does not em- ploy any security measures on which the smart meters and data concentrators can depend on. Therefore, the need to provide a secure mechanism for communication of load man- agement system messages over a PLC network. In LMS, source authentication is of highest priority because we need to respond only to messages from an authenticated source. This is achieved by investigating suitable robust authentication protocols. In this paper we present modifications to Timed Efficient Stream Loss-tolerant Authentication for secure authentica- tion to secure messages for load management over PLC. We demonstrate that PLC can be used to securely and effectively deliver Load Management messages to smart meters, with minimal overhead. </span></p></div></div></div>

Preserving data security in distributed fog computing

In this paper, a novel cryptographic solution is proposed to secure data in fog computing. The solution combines the AES-GMAC operation mode with information dispersal over GF(2w) to provide data confidentiality, integrity, and availability along with source authentication. The value of w is flexible (8, 16, 32 or 64) and it could be configured according to the fog device features. Moreover, the proposed cryptographic solution is based on the dynamic key-dependent approach, which allows for a good compromise between the security level and computational complexity. In the proposed solution, the collected data at one fog node is encrypted, authenticated and dispersed in a pseudo-random manner to its n neighbor fog nodes. For data recovery, any k of the n fragments along with the corresponding dynamic key are required to retrieve the original data. This complicates the attackers task who needs to compromise at least k fog nodes to disclose the encrypted data. Additionally, attackers should seek the dynamic key, which is different for each input data. On the other hand, redundant fragments protect the stored data against up to (n−k) fog nodes’ failure or unavailability. The security and performance analysis tests show that the proposed security scheme exhibits a high level of efficiency and robustness.

Privacy Preserving Data Aggregation Scheme for Mobile Edge Computing Assisted IoT Applications

As the rapid development of 5G and Internet of Things (IoT) techniques, more and more mobile devices with specific sensing capabilities access to the network and large amounts of data. The traditional architecture of the cloud computing cannot satisfy the requirements, such as low latency, fast data access for IoT applications. Mobile edge computing (MEC) can solve these problems, and improve the execution efficiency of the system. In this paper, we propose a privacy preserving data aggregation scheme for MEC assisted IoT applications. In our model, there are three participants, i.e., terminal device (TD), edge server (ES), and public cloud center (PCC). The data generated by the TDs is encrypted and transmitted to the ES, then the ES aggregates the data of the TDs and submits the aggregated data to the PCC. At last, the aggregated plaintext data can be recovered by PCC through its private key. Our scheme not only guarantees data privacy of the TDs but also provides source authentication and integrity. Compared with traditional model, our scheme can save half of communication cost, and is very suitable for MEC assisted IoT applications.

A Novel Visual Medical Image Encryption for Secure Transmission of Authenticated Watermarked Medical Images

Secure medical data transmission is the important criteria in tele-medicine. It is helpful for getting the exact medical information at the remote specialist’s side from the local doctor. The medical image watermarking technique is used for secure medical data transmission. Electronic patient record (EPR) is embedded within the original medical image to produce the watermarked medical image for protecting the patient information. The watermarked medical image visually looks like the original medical image. Hence the attacker visually knows the medical image transmission and easily attacks the system. To avoid this situation, image encryption technique is used to change the visual structure of the watermarked medical image. Normal image encryption gives the noise-like or texture-like unknown image format which indicates an existence of some secret information as the encrypted image. To overcome this problem, this paper proposed a visual medical image encryption technique to protect the existence of the watermarked medical image. And to ensure the source authentication, a biometric based authentication is also proposed. The watermarked medical image is encrypted using the proposed visually meaning full image encryption along with the fingerprint image. Experimental results prove that the proposed method yields good results and mitigate the attacker challenges.

EFFECT: an efficient flexible privacy-preserving data aggregation scheme with authentication in smart grid

Smart grid is considered as a promising approach to solve the problems of carbon emission and energy crisis. In smart grid, the power consumption data are collected to optimize the energy utilization. However, security issues in communications still present practical concerns. To cope with these challenges, we propose EFFECT, an efficient flexible privacy-preserving aggregation scheme with authentication in smart grid. Specifically, in the proposed scheme, we achieve both data source authentication and data aggregation in high efficiency. Besides, in order to adapt to the dynamic smart grid system, the threshold for aggregation is adjusted according to the energy consumption information of each particular residential area and the time period, which can support fault-tolerance while ensuring individual data privacy during aggregation. Detailed security analysis shows that our scheme can satisfy the desired security requirements of smart grid. In addition, we compare our scheme with existing schemes to demonstrate the effectiveness of our proposed scheme in terms of low computational complexity and communication overhead.

A novel software-defined network packet security tunnel forwarding mechanism.

The OpenFlow protocol match field capacity is fixed and limited, and packet forwarding in software-defined network lacks valid authentication of data source, integrity verification, and confidentiality protection mechanism. OpenFlow only supports the MPLS label tunnel establishment, and therefore cannot establish a secure tunnel flexibly. In order to solve these problems, we propose P4Sec, a novel software-defined network packet security tunnel forwarding mechanism. As P4 allows the data plane to be reprogrammed to realize the characteristics of packet forwarding, we build a software-defined network security tunnel to prevent data malicious tampering, stealing, forgery and other malicious network behavior, implementing packet routing and forwarding based on gateway identity. Finally, we construct a P4Sec prototype system based on the software switch BMv2, verify the effectiveness of the mechanism through experimental analysis, and evaluate the overhead of the mechanism. The results demonstrate that P4Sec security mechanism ensure the authenticity, integrity, and confidentiality of forwarded data, and realize the secure forwarding requirements of data packets in software-defined network.

SLDP: A secure and lightweight link discovery protocol for software defined networking

In Software Defined Networks (SDNs), the global view of the underlying network topology is created and maintained at the logically centralized controller. SDN achieves it by decoupling the data plane from the control plane. The up-to-date global view at SDN controller enables the applications (running on top of it) to innovate through dynamic network programmability. To establish a global view, a controller needs to discover a physical topology of the underlying SDN network infrastructure, which is challenging due to various reasons such as the lack of SDN protocols standardization and authentication mechanisms, use of sub-optimal link discovery protocols (e.g., OFDP and LLDP), dynamic topology due to movement of virtualized data centers, switches, and multi-tenant cloud networks, and lack of integration of security schemes for the topology discovery.In this paper, we propose a SDN Link Discovery Protocol (SLDP) for efficient discovery and extraction of topology information in SDN networks. The design of SLDP is motivated from the need of a secure, lightweight, and efficient link discovery protocol in SDN. SLDP aims to prevent, detect, and mitigate various security threats such as poison, replay, and flooding attacks, which are due to lack of source authentication, lack of packet integrity checks, and reuse of static packets. SLDP creates and maintains the global network topology at SDN controller by using smaller size and lower number of SLDP packets during the topology discovery process. Thus, it significantly minimizes the topology discovery overhead in the network. We implemented SLDP on Mininet emulator, and the results show the effectiveness and correctness of SLDP concerning topology discovery time, CPU computational time, and bandwidth overheads, when compared with the traditional OpenFlow Link Discovery Protocol (OFDP). Additionally, SLDP successfully prevent, detect, and mitigate various attacks (e.g., poison, replay, and flooding) in different SDN scenarios.

Experimental Comparison of Multicast Authentication for Wide Area Monitoring Systems

Multicast is proposed as a preferred communication mechanism for many power grid applications. One of the biggest challenges for multicast in smart grid is ensuring source authentication without violating the stringent time requirement. The research community and standardization bodies have proposed several authentication mechanisms for smart grid multicast applications. In this paper, we evaluate different authentication schemes and identify the best candidates for phasor data communication in wide area monitoring systems (WAMS). We first do an extensive literature review of existing solutions and establish a short list of schemes to evaluate. Second, we make an experimental comparison of the chosen schemes in an operational smart grid pilot and evaluate the performance of these schemes by using the following metrics: computation, communication, and key management overheads. The best candidates we consider are two variants of ECDSA, TV-HORS and three variants of incomplete-key-set. We find ECDSA without pre-computed tokens and all the incomplete-key-set variants are inapplicable for WAMS due to their high computation overhead. The ECDSA variant that uses pre-computed tokens and TV-HORS perform well in all metrics; however, TV-HORS has potential drawbacks due to a large key management overhead as a result of the frequent distribution of a large public key per source.

New DoS Defense Method Based on Strong Designated Verifier Signatures.

We present a novel technique for source authentication of a packet stream in a network, which intends to give guarantees that a specific network flow really comes from a claimed origin. This mechanism, named packet level authentication (PLA), can be an essential tool for addressing Denial of Service (DoS) attacks. Based on designated verifier signature schemes, our proposal is an appropriate and unprecedented solution applying digital signatures for DoS prevention. Our scheme does not rely on an expensive public-key infrastructure and makes use of light cryptography machinery that is suitable in the context of the Internet of Things (IoT). We analyze our proposed scheme as a defense measure considering known DoS attacks and present a formal proof of its resilience face to eventual adversaries. Furthermore, we compare our solution to already existent strategies, highlighting its advantages and drawbacks.

TILAK: A token‐based prevention approach for topology discovery threats in SDN

SummarySoftware‐defined networks (SDNs) decouple the data plane from the control plane. Thus, it provides logically centralized visibility of the entire networking infrastructure to the controller. It enables the applications running on top of the control plane to innovate through network management and programmability. To envision the centralized control and visibility, the controller needs to discover the networking topology of the entire SDN infrastructure. However, discovering and maintaining a global view of the underlying network topology is a challenging task because of (i) frequently changing network topology caused by migration of the virtual machines in the data centers, mobile, end hosts and change in the number of data plane switches because of technical faults or network upgrade; (ii) lack of authentication mechanisms and scarcity in SDN standards; and (iii) availability of security solutions during topology discovery process. To this end, the aim of this paper is threefold. First, we investigate the working methodologies used to achieve global view by different SDN controllers, specifically, POX, Ryu, OpenDaylight, Floodlight, Beacon, ONOS, and HPEVAN. Second, we identify vulnerabilities that affect the topology discovery process in the above controller implementation. In particular, we provide a detailed analysis of the threats namely link layer discovery protocol (LLDP) poisoning, LLDP flooding, and LLDP replay attack concerning these controllers. Finally, to countermeasure the identified risks, we propose a novel mechanism called TILAK which generates random MAC destination addresses for LLDP packets and use this randomness to create a flow entry for the LLDP packets. It is a periodic process to prevent LLDP packet‐based attacks that are caused only because of lack of verification of source authentication and integrity of LLDP packets. The implementation results for TILAK confirm that it covers targeted threats with lower resource penalty.

Resilient End-to-End Message Protection for Cyber-Physical System Communications

Cyber-physical system (CPS) communications for safely and effectively operating a mission-critical infrastructure must be securely protected to prevent the infrastructure from becoming vulnerable. The protection scheme used must be resilient and light-weighted for CPS field devices having constrained computing and communicating resources, and also scalable for control servers associating with a large number of the field devices. In addition, CPS applications such as smart metering require end-to-end privacy protection. However, as shown in this paper, none of conventional security schemes comprehensively meets the above requirements; group security schemes scale well for a massive number of devices but are weak in terms of privacy protection and resilience; point-to-point security schemes such as IPsec inherently have resilience but are limited to address scalability and thinness requirements. Motivated by the limitations of conventional security schemes, we design new group security scheme, resilient end-to-end message protection (REMP), exploiting the following notions: long-term keys per-node that are given by REMP authentication server, encryption keys per message sent that are probabilistically derived from a long-term key, and end-to-end authenticators per message sent that consist of a message sender's identity and a message authentication code. Compared with conventional group security schemes, we improve end-to-end security strength in terms of confidentiality, integrity, message source authentication, and key exposure resilience, while preserving scalability and extensibility.

A Lightweight Protocol for Secure Video Streaming.

The Internet of Things (IoT) introduces many new challenges which cannot be solved using traditional cloud and host computing models. A new architecture known as fog computing is emerging to address these technological and security gaps. Traditional security paradigms focused on providing perimeter-based protections and client/server point to point protocols (e.g., Transport Layer Security (TLS)) are no longer the best choices for addressing new security challenges in fog computing end devices, where energy and computational resources are limited. In this paper, we present a lightweight secure streaming protocol for the fog computing “Fog Node-End Device” layer. This protocol is lightweight, connectionless, supports broadcast and multicast operations, and is able to provide data source authentication, data integrity, and confidentiality. The protocol is based on simple and energy efficient cryptographic methods, such as Hash Message Authentication Codes (HMAC) and symmetrical ciphers, and uses modified User Datagram Protocol (UDP) packets to embed authentication data into streaming data. Data redundancy could be added to improve reliability in lossy networks. The experimental results summarized in this paper confirm that the proposed method efficiently uses energy and computational resources and at the same time provides security properties on par with the Datagram TLS (DTLS) standard.