External Adversaries Research Articles

Lightweight ring-neighbor-based user authentication and group-key agreement for internet of drones

As mobile internet and Internet of Things technologies continue to advance, the application scenarios of peer-to-peer Internet of Drones (IoD) are becoming increasingly diverse. However, the development of IoD also faces significant challenges, such as security, privacy protection, and limited computing power, which require technological innovation to overcome. For group secure communication, it is necessary to provide two basic services, user authentication and group key agreement. Due to the limited storage of IoD devices, group key negotiation requires lightweight calculations, and conventional schemes cannot satisfy the requirements of group communication in the IoD. To this end, a new lightweight communication scheme based on ring neighbors is presented in this paper for IoD, which not only realizes the identity verification of user and group key negotiation, but also improves computational efficiency on each group member side. A detailed security analysis substantiates that the designed scheme is capable of withstanding attacks from both internal and external adversaries while satisfying all defined security requirements. More importantly, in our proposal, the computational cost on the user side remains unaffected by the variability of the number of members participating in group communication, as members communicate in a non-interactive manner through broadcasting. As a result, the protocol proposed in this article demonstrates lower computational and communication costs in comparison to other cryptographic schemes. Hence, this proposal presents a more appealing approach to lightweight group key agreement protocol with user authentication for application in the IoD.

Approaches to Developing Key Distribution Protocols Based on Quantum Key Distribution

Quantum protocols for generating shared secret keys represent an effective method of ensuring secure information transmission using quantum communication channels. However, they are limited in scalability due to the physical constraints of quantum channels, which necessitates the use of classical communication channels for exchanging information between participants. This leads to the necessity of developing security threat models and network protection, especially in the case of hybrid networks, where quantum channels are used alongside classical ones. The peculiarity of constructing quantum key distribution protocols is associated with the costliness of implementation and implies the inevitable use of classical communication channels for key distribution. This paper addresses the task of ensuring the security of communication between subscribers not directly connected by quantum channels, through intermediary nodes, and analyzes threats from internal and external adversaries. Special attention is paid to situations where both types of adversaries have information about the processes and protocols in the network. The paper examines widely used key distribution protocols employed in practice. It describes the main security requirements applied to key distribution protocols, and presents the results of an analysis of the compliance of the discussed protocols with these requirements

An Efficient Lightweight Authentication Scheme for Smart Meter

With the rapid development of the information age, smart meters play an important role in the smart grid. However, there are more and more attacks on smart meters, which mainly focus on the identity authentication of smart meters and the security protection of electricity consumption data. In this paper, an efficient lightweight smart meter authentication scheme is proposed based on the Chinese Remainder Theorem (CRT), which can realize the revocation of a single smart meter user by publishing a secret random value bound to the smart meter identity. The proposed scheme not only protects the security of smart meter electricity consumption data by using encryption, but also resists identity attacks from both internal and external adversaries by using hash functions and timestamps. Experiment shows that the proposed scheme has lower computation overhead and communication overhead than other authentication schemes and is more suitable for smart meter authentication.

A lattice-based efficient certificateless public key encryption for big data security in clouds

With the advancement of technology and the development of digitization, big data has become an integral component of modern society. Due to the huge volume of big data, users generally upload data to the cloud for storage and computation. Because data in the cloud is beyond the control of users, it faces threats such as data security and personal privacy leakage. To address these concerns and achieve big data security and privacy protection in clouds, data encryption is crucial. Traditional public key encryption involves complex certificate management in a public key infrastructure (PKI). Although the identity-based encryption (IBE) scheme avoids the management of public key certificates, it has issues with key escrows and identity revocation. The certificateless public key encryption (CL-PKE) not only solves the key escrows problem in IBE, but also maintains its advantage of not requiring the use of certificate in PKI, making it suitable for the security protection of big data in clouds. However, most CL-PKE schemes are constructed based on large integer factorization and discrete logarithm problems, which cannot resist quantum computing attacks. Therefore, this paper proposes an efficient lattice-based CL-PKE scheme for big data security in clouds. In addition, the proposed scheme is extended to a lattice-based certificateless proxy re-encryption scheme, facilitating secure big data sharing in clouds. The proposed CL-PKE scheme can resist attacks from both internal and external adversaries, and has been proven to be IND-CPA secure under the learning with errors (LWE) assumption. Experiments have shown that the proposed CL-PKE scheme has lower computational and communication costs. The proposed lattice-based schemes can effectively provide post quantum security for the security and privacy protection of big data in clouds.

Security for Machine Learning-based Software Systems: A Survey of Threats, Practices, and Challenges

The rapid development of Machine Learning (ML) has demonstrated superior performance in many areas, such as computer vision and video and speech recognition. It has now been increasingly leveraged in software systems to automate the core tasks. However, how to securely develop the machine learning-based modern software systems (MLBSS) remains a big challenge, for which the insufficient consideration will largely limit its application in safety-critical domains. One concern is that the present MLBSS development tends to be rushed, and the latent vulnerabilities and privacy issues exposed to external users and attackers will be largely neglected and hard to be identified. Additionally, machine learning-based software systems exhibit different liabilities towards novel vulnerabilities at different development stages from requirement analysis to system maintenance, due to its inherent limitations from the model and data and the external adversary capabilities. The successful generation of such intelligent systems will thus solicit dedicated efforts jointly from different research areas, i.e., software engineering, system security, and machine learning. Most of the recent works regarding the security issues for ML have a strong focus on the data and models, which has brought adversarial attacks into consideration. In this work, we consider that security for machine learning-based software systems may arise from inherent system defects or external adversarial attacks, and the secure development practices should be taken throughout the whole lifecycle. While machine learning has become a new threat domain for existing software engineering practices, there is no such review work covering the topic. Overall, we present a holistic review regarding the security for MLBSS, which covers a systematic understanding from a structure review of three distinct aspects in terms of security threats. Moreover, it provides a thorough state-of-the-practice for MLBSS secure development. Finally, we summarize the literature for system security assurance and motivate the future research directions with open challenges. We anticipate this work provides sufficient discussion and novel insights to incorporate system security engineering for future exploration.

A Blockchain-Enabled Group Covert Channel against Transaction Forgery

As a decentralized network infrastructure, the data sent to the blockchain are public and temper-evident. The cover of massive normal transactions in a blockchain network is ideal for constructing a stable and reliable covert channel to achieve one-to-many group covert communication. Existing blockchain-based covert communication schemes face challenges in balancing concealment, embedding rate and filtering efficiency, making them unsuitable for direct extension to group scenarios. Adopting a key-leakage scheme can increase the channel capacity while maintaining high concealment from external adversaries. However, it will also expose more knowledge to the receiver. A malicious receiver has the ability to steal a sender’s identity or replay historical transactions to control the entire channel. In this paper, we define the capabilities of malicious receivers in blockchain-based group covert communication scenarios and propose a group covert communication scheme resistant to transaction forgery attacks. Theoretical analysis and experiments prove that our covert transactions do not have any transaction correlativity, ensuring the unique authenticity of the sender’s identity while maintaining supreme concealment compared with the existing schemes. The precision and recall of machine learning detection results can reach 0.57–0.62 (0.5 is the ideal value).

MULTI-KEY FULLY HOMOMORPHIC ENCRYPTION FOR PRIVACY-PRESERVATION WITHIN FEDERATED LEARNING ENVIRONMENTS

Despite the need for data from multiple sources in machine learning, privacy constraints limit data sharing. Federated Learning (FL) addresses this by allowing clients to share locally trained model parameters without disclosing sensitive data, however, recent research highlights data leakage risks. This paper investigates multi-key fully homomorphic encryption, specifically MK-CKKS, to enhance data privacy in FL. The study demonstrates MK-CKKS’s effectiveness in protecting model parameters transmission and preventing external access to private information. Nonetheless, precautions are needed during decryption, as vulnerabilities may allow the aggregator server and external adversaries to infer personal data from shared partial descriptions, impacting the client’s data privacy and security.

GAIN: Decentralized Privacy-Preserving Federated Learning

Federated learning enables multiple participants to cooperatively train a model, where each participant computes gradients on its data and a coordinator aggregates gradients from participants to orchestrate training. To preserve data privacy, gradients need to be protected during training. Pairwise masking satisfies the requirement, which allows participants to blind gradients with masks and the coordinator to perform aggregation in the blinded field. However, the solution would leak aggregated results to external adversaries (e.g., an adversarial coordinator), which suffers from quantity inference attacks. Additionally, existing pairwise masking-based schemes rely on a central coordinator and are vulnerable to the single-point-of-failure problem. To address these issues, we propose a decentralized privacy-preserving federated learning scheme called GAIN. GAIN blinds gradients with masks and encrypts blinded gradients using additively homomorphic encryption, which ensures the confidentiality of gradients, and discloses nothing about aggregated results to external adversaries to resist quantity inference attacks. In GAIN, we design a derivation mechanism for generation of masks, where masks are derived from shared keys established by a single key agreement. The mechanism reduces the computation and communication costs of existing schemes. Furthermore, GAIN introduces smart contracts over blockchains to aggregate gradients in a decentralized manner, which addresses the single-point-of-failure problem. Smart contracts also provide verifiability for model training. We present security analysis to demonstrate the security of GAIN, and conduct comprehensive experiments to evaluate its performance.

BLA2C2: Design of a Novel Blockchain-based Light-Weight Authentication & Access Control Layer for Cloud Deployments

Cloud deployments are consistently under attack, from both internal and external adversaries. These attacks include, but are not limited to brute force, masquerading, improper access, session hijacking, cross site scripting (XSS), etc. To mitigate these attacks, a wide variety of authentication & access control models are proposed by researchers, and each of them vary in terms of their internal implementation characteristics. It was observed that these models are either highly complex, or lack in terms of security under multiple attacks, which limits their applicability for real-time deployments. Moreover, some of these models are not flexible and cannot be deployed under dynamic cloud scenarios (like constant reconfigurations of Virtual Machines, dynamic authentication use-cases, etc.). To overcome these issues, this text proposes design of a novel blockchain-based Light-weight authentication & access control layer that can be used for dynamic cloud deployments. The proposed model initially applies a header-level light-weight sanitization layer that removes Cross Site Scripting, SQL Injection, and other data-level attacks. This is followed by a light-weight authentication layer, that assists in improving login-level security for external attacks. The authentication layer uses IP matching with reverse geolocation mapping in order to estimate outlier login attempts. This layer is cascaded with an efficient blockchain-based access control model, which assists in mitigating session hijacking, masquerading, sybil and other control-level attacks. The blockchain model is developed via integration of Grey Wolf Optimization (GWO) to reduce unnecessary complexities, and provides faster response when compared with existing blockchain-based security deployments. Efficiency of the model was estimated in terms of accuracy of detection for different attack types, delay needed for detection of these attacks, and computational complexity during attack mitigation operations. This performance was compared with existing models, and it was observed that the proposed model showcases 8.3% higher accuracy, with 10.5% lower delay, and 5.9% lower complexity w.r.t. standard blockchain-based & other security models. Due to these enhancements, the proposed model was capable of deployment for a wide variety of large-scale scenarios.

DefQ: Defensive Quantization Against Inference Slow-Down Attack for Edge Computing

The novel multiexit deep neural network (DNN) architectures provide a new optimization solution for efficient model inference in edge systems. Inference of most samples can be completed within the first few layers on an edge device without the need to transmit them to a remote server. This can significantly increase the inference speed and system throughput, which is particularly beneficial to the resource-constrained scenarios. Unfortunately, researchers proposed an inference slow-down attack against this technique, where an external adversary can add imperceptible perturbations on clean samples to invalidate the multiexit mechanism. In this article, we propose a defensive quantization ( <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DefQ</monospace> ) method as the first defense against the inference slow-down attack. It is designed to be lightweight and can be easily implemented in off-the-shelf camera sensors. Particularly, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DefQ</monospace> introduces a novel quantization operation to preprocess the input images. It is capable of removing the perturbations from the malicious samples and preserving the correct inference exit points and prediction accuracy. Meanwhile, it has little impact on the clean samples. Extensive evaluations show that <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DefQ</monospace> can effectively defeat the inference slow-down attack and well protect the efficiency of edge systems.

The Security of “2FLIP” Authentication Scheme for VANETs: Attacks and Rectifications

Wireless broadcast transmission enables Inter-vehicle or Vehicle-to-Vehicle (V2V) communication among nearby vehicles and with nearby fixed equipment, referred to as Road Side Units (RSUs). The vehicles and RSUs within transmission range establish a self-organizing network called Vehicular Ad-hoc Network (VANET). The V2V communication in VANETs is vulnerable to cyber-attacks involving message manipulation. Thus, mechanisms should be applied to ensure both the authenticity and integrity of the data broadcast. However, due to privacy concerns, it is important to avoid the use of identifiers that may aid tracking and surveillance of drivers. This is a serious constraint on authentication mechanisms. Recently, Wang et al. [1] proposed <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">A Two-Factor Lightweight Privacy Preserving Authentication Scheme for VANET</i> named 2FLIP. They claim that their scheme includes a secure systemkey update protocol to restore the whole system when necessary. In this paper, we show that this is incorrect: 2FLIP does not provide perfect forward secrecy. This results in a known-key attack, as well as message forgery attack by an external adversary who may be an unregistered vehicle user. This external adversary can generate valid anonymous messages and further, they cannot be traced. The 2FLIP scheme is efficient, so we propose a modification to improve the security. We provide a formal security proof to show that our proposal is indeed provably secure. We demonstrate the efficiency of our proposal by conducting extensive performance analysis. We believe the enhanced system-key update protocol will be useful for application by researchers and designers in current and future VANET authentication schemes.

Privacy-Preserving Data Mining on Blockchain-Based WSNs

Currently, the computational power present in the sensors forming a wireless sensor network (WSN) allows for implementing most of the data processing and analysis directly on the sensors in a decentralized way. This shift in paradigm introduces a shift in the privacy and security problems that need to be addressed. While a decentralized implementation avoids the single point of failure problem that typically applies to centralized approaches, it is subject to other threats, such as external monitoring, and new challenges, such as the complexity of providing decentralized implementations for data mining algorithms. In this paper, we present a solution for privacy-aware distributed data mining on wireless sensor networks. Our solution uses a permissioned blockchain to avoid a single point of failure in the system. Contracts are used to construct an onion-like structure encompassing the Hoeffding trees and a route. The onion-routed query conceals the network identity of the sensors from external adversaries, and obfuscates the actual computation to hide it from internally compromised nodes. We validate our solution on a use case related to an air quality-monitoring sensor network. We compare the quality of our model against traditional models to support the feasibility and viability of the solution.

Mitigating External Threats in Wireless Local Area Networks

As computer networks become more critical to enterprises, it is inevitable that efficient security policies are designed, case in point: wireless networks, in order to effectively ensure the confidentiality, availability, and integrity of the data traversing these networks. The primary objective of this paper is to appropriately simulate an enterprise network, and evaluate the threats, and possible mitigation approaches applicable. An analysis of an enterprise WLAN (Wireless Local Area Network) was carried out, to identify relevant vulnerabilities, and possible countermeasures against these threats. The primary threats analysed were those possible by an external adversary. Upon identification of said threats, a security model was developed, so as to improve enterprise network security, and ensure the levels are optimum. In addition, a number of the principles involved are applicable to non-wireless networks. Keywords: WLAN, Wireless, Security, WPA 2, IEEE 802.11.

Cryptanalysis of an Efficient and Secure Certificateless Aggregate Signature-Based Authentication Scheme for Vehicular Ad Hoc Networks

Vehicular ad hoc networks (VANETs) apply the Internet of Things technology to provide secure communication among the vehicles, thereby improving the safe driving of vehicles, the utilization of traffic resources, and the efficiency of information services. Due to the openness and vulnerability of wireless networks in VANETs, messages in sharing and transmission are easily attacked and destroyed. Therefore, a large number of schemes for VANETs were proposed to protect the privacy of vehicles and ensure the authentication, integrity, and nonrepudiation of messages. However, most of these schemes have serious security flaws or poor performance issues. Recently, Thumbur et al. presented an efficient certificateless aggregate signature-based authentication scheme for VANETs and then gave the detailed security proof (IEEE Internet of Things Journal, vol. 8, no. 3, pp. 1908–1920, 2021). In this article, we analyze the security of Thumbur et al.’s scheme and demonstrate that it has significant security problems. Specifically, their scheme cannot resist public key replacement attacks from external adversaries, and it is not secure against coalition attacks from malicious vehicles. Then, we improve Thumbur et al.’s scheme to address the security weaknesses. According to the security and performance analysis, the improved scheme enhances the security while maintaining the performance of the original scheme.

Purposeful play: exploring a bar-based, anti-tobacco intervention for young adults

Social smoking is increasingly prevalent among young Americans and often takes place in nightlife social settings. Yet, few smoking interventions are embedded in these settings. This paper focuses on space, embodiment, and practice to explore young adults’ experiences of COMMUNE, a bar-based anti-tobacco intervention for ‘Hipster’ young adults; a group with shared aesthetics and interests, and high smoking rates. We conducted in-depth interviews (n = 21) with young adults involved with COMMUNE (event organizers, artists/brand ambassadors, event attendees) and observed two COMMUNE events. We analyzed the data thematically and identified three prominent affective registers: (1) ‘Fun and flow’—Messaging did not disrupt essential elements of nightlife assemblages; (2) ‘Openness and receptivity’—Playful bar settings encouraged openness and receptivity, allowing event attendees to learn about COMMUNE without feeling taught or patronized; and (3) ‘Belonging and purpose’—Events focused on an external adversary (Big Tobacco) rather than individual smoking behavior and offered a role in supporting community. This anti-tobacco intervention leveraged the capacity-enhancing elements of nightlife settings where social smoking often takes place and emphasized access to a desired experience rather than the loss of smoking. More playful, capacity-enhancing approaches can engage with smoking and other health-related behaviors. Highlights Young adult social smoking is often practiced in nightlife settings Few smoking interventions are embedded in nightlife settings We explored young adults’ experiences of a bar-based, anti-tobacco intervention Fun, flow, openness, receptivity, belonging, and purpose were prominent Smoking interventions can offer playful, capacity-enhancing experiences

Deciphering a Timeline of Demise at Medieval Angkor, Cambodia Using Remote Sensing

The Greater Angkor Region was the center of the Khmer Empire from the 9th until the 13th to the 14th centuries CE, when it entered a period of decline. Many studies have suggested that the decline of Angkor was precipitated by several factors, including severe monsoons, geopolitical shifts, and invasions. In this paper, we use light detection and ranging and ground penetrating radar to investigate the possible intersection of two of these existential threats in one feature: the North Bank Wall. Our results indicate that this feature was designed with dual functionality of extending the urban area’s defenses to the east of Angkor Thom while maintaining the existing infrastructure for the distribution and disposal of water. These findings suggest that the North Bank Wall was built before the severe droughts in the mid-13th century. The timing of the construction indicates that the perceived need for additional security—whether from internal factional disputes or external adversaries—predated the final adaptations to the hydraulic network during the unprecedented monsoon variability of the 14th century. These results indicate that perceived political unrest may have played a more important role in the decline of the site than previously known.

A confirmatory analysis of the prevention insider threat in organization information system

Many issues related to insider threat in organization had been debated ever since. Although insider attacks may not occur as frequently as external attacks, they have a higher rate of success, go undetected, and pose a much greater risk than external adversaries. In relation to that, it is undeniably the fact that many mechanisms have been proposed to be an initiative to protect data from outside attacks. However, those mechanisms could not protect data from authorized users who may misuse their privileges. Due to that circumstances, the development of mechanisms that protect sensitive data from insiders somehow become pitch demand as in method to prevent harm caused by malicious insiders. The method of this research is the quantitative method using a questionnaire. The findings have contributed to developing a framework that will be used to prevent insider threat in an organization in the future.

Bennett-Brassard 1984 quantum key distribution using conjugate homodyne detection

Optical homodyne detection has been widely used in continuous-variable (CV) quantum information processing for measuring field quadrature values. In this paper we explore the possibility of operating a conjugate homodyne detection system in "photon counting" mode to implement discrete-variable (DV) quantum key distribution (QKD) protocols. A conjugate homodyne detection system, which consists of a beam splitter followed by two optical homodyne detectors, can simultaneously measure a pair of conjugate quadratures X and P of the incoming quantum state. In classical electrodynamics, X^2 + P^2 is proportional to the energy (the photon number) of the input light. In quantum optics, X and P do not commute and thus the above photon-number measurement is intrinsically noisy. This suggests that a blind application of the standard security proof could result pessimistic QKD performance. We overcome this obstacle by taking advantage of two special features of the proposed detection scheme. First, the fundamental detection noise associated with vacuum fluctuation cannot be manipulated by an external adversary. Second, the ability to reconstruct the photon number statistics at the receiver's end can place additional constraints on possible attacks from the adversary. As an example, we study the security of the BB84 QKD using conjugate homodyne detection and evaluate its performance through numerical simulations. This study may open the door to a new family of QKD protocols, in complementary to the well-established DV-QKD based on single photon detection and CV-QKD based on coherent detection.

LightFed: An Efficient and Secure Federated Edge Learning System on Model Splitting

With the integration of Artificial Intelligence (AI) and Internet of Things (IoT), the Federated Edge Learning (FEL), a promising computing framework is developing. However, there are still unsolved issues on communication efficiency and data security due to the huge models and unreliable transmission links. To address these issues, this paper proposes a novel federated edge learning system, called LightFed, where the edge nodes upload only vital partial local models, and successfully achieve lightweight communication and model aggregation. First, a novel model aggregation method Model Splitting and Splicing (MSS) and a Selective Parameter Transmission (SPT) scheme are proposed. By detecting the updating gradients of local parameters and filtering significant parameters, selective rotated transmission and efficient aggregation of local models are achieved. Second, a Training Filling Model (TFM) is proposed to infer the total data distribution of edge nodes, and train a filling model to mitigate the unbalanced training data without violating the data privacy of individual users. Moreover, a blockchain-powered confusion transmission mechanism is proposed for defending the attacks from external adversaries and protecting the model information. Finally, extensive experimental results demonstrate that our LightFed significantly outperforms the existing FEL systems in terms of communication efficiency and privacy security.

Defending the state from digital Deceit: the reflexive securitization of deepfake

ABSTRACT Recent revelation of disinformation campaigns conducted by external adversaries on social media platforms has triggered anxiety among western liberal democracies. One focus of this anxiety has been the emerging technology known as deepfake. In examining related controversy, I use the theoretical lens of securitization to establish how communicative reflexivity shapes the attribution of threat to digital media. Next, focusing on the case of the U.S. government, I critique deepfake’s securitization by applying two theories of media and state (in-) security. I argue that deepfake sustains the liberal state’s conventional dread of mimetic threats posed to its ontological security. I then challenge this narrative by exploring satire as an alternate configuration of deepfake’s capabilities. I conclude by summarizing the implications of this case for ongoing study of digital media, conflict, and politics.