Essential Security Research Articles

Cancelable palmprint: intelligent framework toward secure and privacy-aware recognition system

Cancelable template protection techniques are indispensable to provide essential security and privacy privileges in biometric systems. This paper introduces an efficient cancelable palmprint recognition technique based on multi-level transformations. Gabor filtering with feature remapping is introduced for extracting highly discriminative features. Histogram remapping is applied to nonlinearly transform the downsampled Gabor features to be normally distributed. This feature-remapping step is proposed to enhance the discriminatory power and alleviate the effect of feature variability and image artifacts. Comb filtering is applied to the mapped features as a first protection layer. To provide security guarantees against linkability attacks, index-based locality-sensitive hashing (LSH) is introduced as a second protection layer to transform the comb-filtered mapped real-valued features into maximum-ranked indices. Recognition is performed in the secured domain to accelerate matching and to preserve the user’s privacy. Results show that the proposed scheme provides a large re-issuance ability, protects templates from being inverted, and demonstrates strong unlinkability across different databases. In addition, favorable verification/identification accuracy is obtained and the system satisfies the needs for real-time applications. A global measure D↔sys\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$${D}_{\\leftrightarrow }^{sys}$$\\end{document} value of 0.01 is obtained, and thus, correlation attacks are mitigated. The recognition results for the legitimate scenario are 100% identification accuracy and 0% EER. For the worst case (same token scenario), the corresponding results are 99.752% and 0.31%, respectively.

Compliance and feedback based model to measure cloud trustworthiness for hosting digital twins

Cloud-based digital twins use real-time data from various data sources to simulate the behavior and performance of their physical counterparts, enabling monitoring and analysis. However, one restraining factor in the use of cloud computing for digital twins is its users’ concerns about the security of their data. This data may be located anywhere in the cloud, with very limited control of the user to ensure its security. Cloud-based digital twins provide opportunities for researchers to collaborate yet security of such digital twins requires measures specific to cloud computing. To overcome this shortcoming, we need to devise a mechanism that not only ensures essential security safeguards but also computes a Trustworthiness value for Cloud Service Providers (CSP). This would give confidence to cloud users and enable them to choose the right CSP for their data-related interaction. This research proposes a solution, whereby the Trustworthiness of CSPs is calculated based on their Compliance with data security controls, User Feedback, and Auditor Rating. Two additional factors, Accuracy of Compliance Measurement and Control Significance Factor have been built in, to cater for other nonstandard conditions. Our implementation of Data Security Compliance Monitor and Data Trust as a Service, along with three CSPs, each with ten different settings, has supported our proposition through the devised formula. Experimental outcomes show changes in the trustworthiness value with changes in compliance level, user feedback and auditor rating. CSPs with better compliance have better trustworthiness values. However, if the Accuracy of Compliance Measurement and Control Significance Factor are low the trustworthiness is also proportionately less. This creates a balance and realism in our calculations. This model is unique and will help in creating users’ trust in cloud-based digital twins.

Secured lightweight authentication for 6LoWPANs in machine-to-machine communications

The development of machine-to-machine (M2M) technologies is becoming increasingly important in the rapidly growing domain of wireless sensor networks (WSNs) and the Internet of Things (IoT). Adopting IPv6 over 6LoWPANs (Low-Power Wireless Personal Area Networks) is instrumental in communicating across diverse domains within WSNs, albeit with its challenges. Particularly, resource limitations and security vulnerabilities remain significant concerns. 6LoWPAN-based M2M protocols that rely on authentication and key establishment schemes (AKE) often fall short due to inadequate security issues and excessive resource requirements. This paper addresses these challenges by introducing a secure and resource-efficient framework—Lightweight AKE for 6LoWPAN Nodes (LAKE-6LN). LAKE-6LN capitalizes on the clustering architecture's merits and contrasts conventional router-centric approaches. To ensure lightweight and efficient operation, it uses hash functions, XOR functions, and symmetric encryption techniques. Pseudo-identity, sequence tracking numbers, and secure parameters ensure privacy and protection against attacks, including traceability, perfect forward secrecy, ephemeral secret leakage, and secure the session key. An informal analysis of LAKE-6LN's security confirms that compliance with all essential security properties has been achieved. In addition, the framework's logical robustness and security analysis are rigorously verified using BAN logic, AVISPA, and Scyther tools. LAKE-6LN has demonstrated superior performance over related schemes, demonstrating a reduction in storage costs (by 33.33 % to 85.71 %), computational overhead (by 14.28 % to 95.97 %), communication overhead (by 16.12 % to 51.85 %), and energy consumption (by 22.04 % to 99.40 %). In our comparative analysis, LAKE-6LN demonstrates its resilience against various security threats, demonstrating its potential to secure 6LoWPAN networks in M2M.

Sanctions against Individuals and Investment Law

Abstract The surge in international sanctions following Russia’s invasion of Ukraine in February 2022 marks a new development in international law in general and international investment law in particular. This article examines this recent development and the interplay between international sanctions and international investment law. Furthermore, the article discusses whether investment tribunals will rely on WTO jurisprudence when applying ‘essential security’ provisions in individual cases. By providing an examination of sanctions laws in the context of international investment law, the article highlights the complex dynamic between the right of states to limit investments on the basis of national security vis-á-vis the right of investors to enjoy investment protection as prescribed in numerous International Investment Agreements (IIAs).

Morpheus: An efficient timing-based attestation framework for safeguarding hypervisor integrity with dynamic trust

Hypervisor, the core software in cloud computing, is susceptible to malicious intrusions, potentially jeopardizing overall platform security. Physical hosts within the cloud computing environment constantly face persistent attacks, and not all hosts are equipped with essential security hardware. The prolonged latency of previous software-based detection methods could not comprehensively address these cloud threats. Furthermore, the widespread deployment of security hardware incurs substantial costs for hardware-based detection. To address these challenges, we introduce Morpheus, an efficient framework ensuring hypervisor integrity in the current cloud. This framework rapidly employs software-based methods to detect malicious hosts, utilizing a subset of hosts equipped with security hardware as the Root of Trust. Efficiency is augmented through a Neural Network scheduling module, and an embedded exponential aging mechanism fortifies time-aging trust against consistent cloud threats. Evaluation results demonstrate that it can promptly identify threatened hosts with acceptable system overhead loss, solidifying its position as a robust cloud security solution.

DICEguard: enhancing DICE security for IoT devices with periodic memory forensics

The number of Internet-of-Things (IoT) devices has been increasing rapidly every year. Most of these devices have access to important personal data such as health, daily activities, location, and finance. However, these devices have security problems since they have limited processing power and memory to implement complex security measures. Therefore, they possess weak authentication mechanisms and a lack of encryption. Additionally, there are no widely accepted standards for IoT security. Device Identifier Composition Engine (DICE) was proposed as a standard that enables adding a security layer to low-cost microcontrollers with minimal silicon overhead. However, previous studies show that DICE-based attestation is vulnerable to some remote attacks. In this study, we present a novel method called DICEguard to address the security problems of DICE. One of the key innovations of DICEguard is its incorporation of periodic memory forensics (PMF) technique, leveraging a hardware-based hash engine to detect and mitigate potential security breaches resulting from firmware vulnerabilities. DICEguard enhances the overall resilience of IoT devices against attacks by swiftly detecting alterations indicative of malicious activity through periodic calculation and comparison of firmware digests. Furthermore, DICEguard introduces a one-time programmable (OTP) memory component to safeguard critical security parameters, such as public keys used for signature verification, against tampering by adversaries. This ensures the integrity of essential security measures even in the face of sophisticated attacks. We implemented the enhanced DICE architecture using the open-source RISC-V platform Ibex and the mbedTLS library for cryptographic operations. We performed the hash operations required by DICE in a hardware-based manner on a commercial Field Programmable Gate Array (FPGA) platform rather than firmware, which is more vulnerable to attacks. Our test results show that with negligible area overhead to a standard microcontroller system, the proposed method can detect the simulated attacks.

A secure and efficient authentication key agreement scheme for industrial internet of things based on edge computing

Industrial Internet of Things (IIoT) is a pivotal driving force behind the intelligent transformation of the global industrial system, bringing about a gradual shift in production methods. However, due to users completing remote access and data transmission through open channels, ensuring user legitimacy and data security has become an important factor in IIoT. In addition, resource limited users or devices need to collect and publish corresponding messages while also timely processing instant messages obtained from the network. Leveraging edge computing technology effectively mitigates the transmission time of messages, addressing the challenges of high computing pressure and prolonged response time associated with cloud server computing. Therefore, investigating authentication key agreement based on edge computing in the IIoT environment holds substantial theoretical significance and practical importance. This article introduces an IIoT authentication that ensures both security and efficiency by integrating elliptic curve cryptography and three-factor authentication. Within this scheme, the user and the edge server accomplish security authentication. Through security analysis, the proposed scheme is proven to meet the essential security requirements. Performance analysis shows that it achieves higher security, supports more functions, and achieves lower computational and communication costs compared to related schemes.

Cost-Effective Signcryption for Securing IoT: A Novel Signcryption Algorithm Based on Hyperelliptic Curves

Security and efficiency remain a serious concern for Internet of Things (IoT) environments due to the resource-constrained nature and wireless communication. Traditional schemes are based on the main mathematical operations, including pairing, pairing-based scalar multiplication, bilinear pairing, exponential operations, elliptic curve scalar multiplication, and point multiplication operations. These traditional operands are cost-intensive and require high computing power and bandwidth overload, thus affecting efficiency. Due to the cost-intensive nature and high resource requirements, traditional approaches are not feasible and are unsuitable for resource-limited IoT devices. Furthermore, the lack of essential security attributes in traditional schemes, such as unforgeability, public verifiability, non-repudiation, forward secrecy, and resistance to denial-of-service attacks, puts data security at high risk. To overcome these challenges, we have introduced a novel signcryption algorithm based on hyperelliptic curve divisor multiplication, which is much faster than other traditional mathematical operations. Hence, the proposed methodology is based on a hyperelliptic curve, due to which it has enhanced security with smaller key sizes that reduce computational complexity by 38.16% and communication complexity by 62.5%, providing a well-balanced solution by utilizing few resources while meeting the security and efficiency requirements of resource-constrained devices. The proposed strategy also involves formal security validation, which provides confidence for the proposed methodology in practical implementations.

A Decentralized Authenticated Key Agreement Scheme Based on Smart Contract for Securing Vehicular Ad-Hoc Networks

Since the communication channels in vehicular ad-hoc networks (VANETs) are wireless and open, malicious adversaries can monitor or fabricate messages transmitted across them. To secure vehicular communications, an authenticated key agreement (AKA) scheme needs to be designed for VNAETs. Traditional VANETs AKA schemes require the trusted authority (TA) to authenticate the legality of message and corresponding sender. However, the TA in these schemes is vulnerable to suffer from single-point-of-failure issues. Some blockchain-based VANETs AKA schemes have been proposed recently to address the deficiency. However, these schemes rely on the consortium or private blockchain in which TAs are still required for key generation, resulting that the practicality is limited. To solve the issue, we design a smart contract-based VANETs AKA scheme, where the AKA algorithm of our proposed scheme is implemented on smart contract deployed on a public blockchain system and the TA that is responsible for key generation will not be required. The security proof and analysis show that our proposed scheme satisfies the session-key semantic security and essential security and privacy requirements, respectively. The performance analysis demonstrates that our proposed scheme outperforms existing blockchain-based VANETs AKA schemes.

Design of CSKAS-VANET model for stable clustering and authentication scheme using RBMA and signcryption

A public key infrastructure-enabled system authentication model is developed to provide essential security functions for Vehicular ad hoc networks (VANETs). An intelligent transportation system is provided by VANET, an emerging technology. Dedicated short-range communication is used to disseminate messages wirelessly. Communications may be hacked, and messages can be stolen or fabricated. Hence, authenticated communication is crucial in the VANET environment. Some parameters such as trust, authentication, privacy, and security are at high risk. This article suggests a VANET with secure authentication and trust-based clustering mechanisms to provide stable and secure communication. Initially, the Restricted Boltzmann Machine learning algorithm (RBMA) is used to select the cluster head, which depends upon trust, vehicle lifetime, and buffer level. Then, cluster members are formed, followed by grouping. Diffie–Hellman Hyperelliptic Curve Cryptography and cryptographic hash functions are used by signcryption for secure communication in VANET. Therefore, the essential component of the key agreement strategy that will give superior authentication is this signcryption mechanism. Over the medium access protocol layer, all of these security characteristics are updated. The proposed method of clustering signcryption key agreement scheme (CSKAS) approach reduces time complexity and increases packet delivery ratio which is vital in providing stable, secure communication.

Security Considerations in iOS App Development: Encryption, Authentication, and Secure Data Storage

Abstract: Security is a paramount concern in iOS app development, as sensitive user data must be protected from unauthorized access and breaches. This scholarly article explores essential security measures, focusing on encryption protocols, authentication mechanisms, and secure data storage techniques specific to iOS platforms. By examining industry-standard encryption algorithms, secure authentication methods, and best practices for data storage, this study aims to provide developers with the knowledge and tools necessary to build robust and resilient iOS applications. Real-world case studies and practical implementation guidelines are presented to illustrate the effective application of these security measures. The findings emphasize the importance of adopting a comprehensive security approach to foster user trust and confidence in mobile applications

DRL-GAN: A Hybrid Approach for Binary and Multiclass Network Intrusion Detection.

Our increasingly connected world continues to face an ever-growing number of network-based attacks. An Intrusion Detection System (IDS) is an essential security technology used for detecting these attacks. Although numerous Machine Learning-based IDSs have been proposed for the detection of malicious network traffic, the majority have difficulty properly detecting and classifying the more uncommon attack types. In this paper, we implement a novel hybrid technique using synthetic data produced by a Generative Adversarial Network (GAN) to use as input for training a Deep Reinforcement Learning (DRL) model. Our GAN model is trained on the NSL-KDD dataset, a publicly available collection of labeled network traffic data specifically designed to support the evaluation and benchmarking of IDSs. Ultimately, our findings demonstrate that training the DRL model on synthetic datasets generated by specific GAN models can result in better performance in correctly classifying minority classes over training on the true imbalanced dataset.

Minimizing Overhead through Blockchain for Establishing a Secure Smart City with IoT Model

Conventional safety measures are inconsistent with inexpensive technologies like the Internet of Things (IoT) due to their significant storage traces, which are prohibitive to their utilization. The blockchain (BC) framework maintains the five essential security primitives: genuineness, credibility, secrecy, accessibility, and non-renunciation. Most IoT gadgets have limited resources, so a traditional blockchain deployment is inappropriate. Traditional deployment of blockchain computing in the Internet of Things leads to significant power consumption, delay, and computational inefficiency. The proposed solution improves the blockchain's conception to serve IoT technologies better. This article proposes a blockchain-based intelligent city design for the IoT that keeps all encryption safety precautions in place. Adding blockchain to an IoT platform does not add much extra labour. After comparing all safety requirements to existing literature, it is clear that the proposed method achieves satisfactory safety effectiveness.

NDN Security: Cryptographic Approaches for Safeguarding Content-Centric Networking against Threats

The future of the internet demands innovative approaches to communication paradigms and security mechanisms. Named Data Networking (NDN) introduces a ground breaking data-centric communication paradigm, shifting the focus from host-centric networking to efficient content retrieval. This novel framework relies on the dynamic interplay of Interest and Data packets to enable seamless content dissemination and caching. NDN's security framework, built upon digital keys, certificates, and trust policies, ensures the integrity and confidentiality of data transactions within its ecosystem. Cryptographic keys exchanged in real-time through Interest and Data packets, forming the bedrock of secure interactions within NDN. This dynamic key exchange mechanism bolsters security and facilitates controlled data generation. Certificates play a pivotal role in establishing trust, solidifying the connection between names and public keys, while trust policies align with application-defined guidelines to govern key-data entity associations. This paper delves into the security challenges that NDN effectively addresses. By investigating vulnerabilities and assessing the susceptibility of common attacks, it underscores the resolute defense mechanisms inherent in the NDN framework. The inherently anonymous and non-identifying nature of NDN renders eavesdropping and traffic analysis infeasible, bolstering confidentiality. Digital signatures provide robust data integrity, thwarting any attempts at unauthorized modification. The comprehensive data signing mechanism effectively prevents masquerade attacks, and the integration of unique naming and nonce in Interest packets averts replay attacks. In essence, this research not only sheds light on the essential security components of NDN but also illuminates how this paradigm addresses a multitude of security challenges. NDN's forward-thinking content-centric approach and its robust security mechanisms hold the potential to reshape networking paradigms. As we look to the future of the internet, NDN stands as a promising contender for advancing secure, efficient, and transformative networking models.

Hybrid CNN Approach for Unknown Attack Detection in Edge-Based IoT Networks

INTRODUCTION: In the constantly growing Internet of Things (IoT), device security is crucial. As IoT gadgets pervade our lives, detecting unforeseen assaults is crucial to protecting them. Behavioral analysis, machine learning, and collaborative intelligence may be needed to protect against new dangers. This short discusses the need of detecting unexpected IoT attacks and essential security strategies for these interconnected environments.OBJECTIVES: This research uses the BoT-IoT dataset to create an enhanced IoT intrusion detection system. The goals are to optimize a CNN architecture for effective pattern recognition, address imbalanced data, and evaluate model performance using precision, recall, F1-score, and AUC-ROC measures. Improving IoT ecosystem reliability and security against unknown assaults is the ultimate goal.METHODS: The proposed methods use the BoT-IoT dataset to create a comprehensive IoT intrusion detection system. This involves tuning a Convolutional Neural Network (CNN) architecture to improve pattern recognition. Oversampling and class weighting address imbalanced data issues. RESULTS: The comprehensive evaluation of our innovative unknown attack detection method shows promise, suggesting it may be better than existing methods. A high accuracy, precision, recall, and f-measure of 98.23% were attained using an advanced model and feature selection methods. This achievement was achieved by using features designed to identify unknown attacks in the dataset, proving the proposed methodology works.CONCLUSION: This research presents an improved IoT Intrusion Detection System using the BoT-IoT dataset. The optimised Convolutional Neural Network architecture and imbalanced data handling approaches achieved 98.23% accuracy.

Trade Sanctions against Russia and their WTO Consistency: Focusing on Justification under National Security Exceptions

Abstract In the wake of Russia’s 2022 invasion of Ukraine, around 40 countries/economies, including G7 members, responded to impose a wide range of economic, including trade-related, sanctions on Russia. The question immediately arises as to whether such sanctions violate the WTO agreements or are justified under the relevant national security exceptions. After introducing the material facts of the economic sanctions against Russia as well as the development of WTO jurisprudence on national security exceptions – particularly Article XXI(b)(iii) of the GATT –, this article goes on to analyse the WTO consistency of these trade sanctions against Russia, on a country-by-country and a measure-by-measure basis. From the standpoint of the “war or other emergency in international relations” and “its essential security interests” requirements, countries are categorised according to their geographic proximity and relationship (e.g., military alliances, customs unions, etc) to the belligerents, while measures are categorised by their nature and aim from the standpoint of the “necessary to protect” requirement.

Cybersecurity of Industrial Systems—A 2023 Report

The article explores the importance of cybersecurity in Industry 4.0, specifically focusing on safeguarding industrial automation systems from cyberattacks. It discusses essential security measures, network monitoring, and employee training, emphasizing the significance of risk management for ensuring industry stability. Adherence to industrial security standards, such as ISA/IEC 62443, is crucial (ISA—International Society of Automation, IEC—International Electrotechnical Commission). The article outlines cyberthreat challenges and their impact on various sectors, including healthcare and finance, as well as the risks faced by large industrial enterprises. Additionally, it elucidates evolving cybersecurity strategies and principles, underscoring the necessity for continuous, multi-layered protection. Collaboration with operators, strict information security policies, and robust incident response plans are emphasized. The importance of risk monitoring and adaptability to ever-changing threat landscapes is highlighted, emphasizing the collaborative and flexible nature of cybersecurity in the face of escalating digital threats.

EPREKM: ElGamal proxy re‐encryption‐based key management scheme with constant rekeying cost and linear public bulletin size

SummaryA vast body of literature is filled with many key management schemes constructed using different cryptographic primitives. They aim toward either security goals or improvement in performance efficiency. However, the key management schemes based on proxy re‐encryption suffer from massive communication and computational costs. We propose an ElGamal proxy re‐encryption‐based construction for the key management scheme to resolve this. The proposed scheme involves constant computational and communication costs in rekeying operations and linear public bulletin size. We achieve essential security requirements of forward and backward secrecy in this scheme. The scheme is also secure against the collusion attack. In addition, we address the importance of adequately managing missed rekeying updates for offline users. The existing schemes trivially keep track of each rekeying message on the public bulletin board, which increases the size of the public bulletin with every join/leave operation. However, the proposed scheme uses the public bulletin board so that the handling of offline users is built into the scheme itself, which manages it efficiently. Also, the public bulletin size in the proposed scheme is not dependent on the number of rekeying operations but linear in the number of users.

Securitizing high-technology industries: South Korea–Japan dispute over materials–parts–equipment products

Abstract The Japan–Korea whitelist dispute (2019–2023) embodies key features of interstate disputes related to economic statecraft ideas. Against the backdrop of the legal dispute over Japan’s “essential security interests” claim based on GATT Article 21 (Security Exceptions), this study analyzes South Korea’s response to the whitelist dispute, with a focus on its materials–parts–equipment localization policy. The findings indicate that the policy process and outcomes align with very few of the criteria suggested by the new industrial policy literature. Notably, the policy’s goals and tools were driven by ideology rather than by science, and the implementing agency—The Ministry of Trade, Industry, and Energy—while competent, was politically captured. In conclusion, this study suggests that policymakers should purposefully and consciously connect security with trade or implement industrial policies within a well-defined strategic framework.

The EU's Geoeconomic Turn: From Policy Laggard to Institutional Innovator

AbstractHeightened geopolitical tensions and the growing securitization of economic exchange over the past decade have prompted many countries to adopt new geoeconomic tools. Long resistant to this geoeconomic turn, the European Union (EU) has since 2017 created a panoply of innovative policy tools that blend trade and investment with essential security concerns. This article asks why and how the EU has been able to operate the doctrinal and policy changes necessary to put economic tools at the service of geopolitics. After introducing a typology of the defensive and offensive geoeconomic tools deployed by advanced industrial economies, we present the novel geoeconomic toolkit quickly assembled by the EU, which we explain by the confluence of external factors that triggered European leaders' beliefs that change was necessary and internal factors that made such change institutionally and politically possible, a trend reinforced by the pandemic and the Russian invasion of Ukraine.