Flexible Security Research Articles

Intrusion Detection Framework for the Internet of Things Using a Dense Random Neural Network

The Internet of Things (IoT) devices, networks, and applications have become an integral part of modern societies. Despite their social, economic, and industrial benefits, these devices and networks are frequently targeted by cybercriminals. Hence, IoT applications and networks demand lightweight, fast, and flexible security solutions to overcome these challenges. In this regard, artificial-intelligence-based solutions with Big Data analytics can produce promising results in the field of cybersecurity. This article proposes a lightweight dense random neural network (DnRaNN) for intrusion detection in the IoT. The proposed scheme is well suited for implementation in resource-constrained IoT networks due to its inherent improved generalization capabilities and distributed nature. The suggested model was evaluated by conducting extensive experiments on a new generation IoT security dataset ToN_IoT. All the experiments were conducted under different hyperparameters and the efficiency of the proposed DnRaNN was evaluated through multiple performance metrics. The findings of the proposed study provide recommendations and insights in binary class and multiclass scenarios. The proposed DnRaNN model attained attack detection accuracy of 99.14% and 99.05% for binary class and multiclass classifications, respectively.

Robustness of organic physically unclonable function with buskeeper circuit for flexible security devices

Flexible devices have been studied to realize IoT or novel wearable devices. The data that flexible devices deal with can include personal information when application areas further expand. A security system for flexible devices becomes more important in this case. In this study, we investigate the thermal stability of an organic flexible security system. The security system utilizes fabrication variation of a chip, and it is called a physically unclonable function (PUF). As a result, the bit error rate of the organic PUF is 1.8% and the index of ID uniqueness (i.e., randomness) has an almost theoretical value of 0.48. The generated ID remains even after annealing at 100 °C for 97 h by using CYTOP encapsulation. X-ray diffraction measurement implies that degradation of PUF characteristics partially derives from structure changes of the organic n-type semiconductor thin film after annealing.

The UNIDROIT Convention on International Interests in Mobile Equipment as the direction for security rights regulations in the COVID-19 economy

In this article some features of the Cape Town Convention security interest were juxtaposed with some features of the Polish registered pledge. The aim of such research was to answer the question which of these two instruments is better adjusted to the COVID-19 economy. On the basis of such analysis, a conclusion was made that the Cape Town Convention security interest constitutes a more flexible security right and therefore one which is better adjusted to the COVID-19 economy. In the opinion of the author, the Cape Town Convention security interest shall constitute the direction in which the Polish security rights, especially in B2B relations, should go. The research was based on an analysis of the laws in force and a comparative analysis.

A fine‐grained and traceable multidomain secure data‐sharing model for intelligent terminals in edge‐cloud collaboration scenarios

Secure data-sharing technology is a bridge for various collaborative operations among intelligent terminals in the edge-cloud collaborative application scenario. For the shared data involves different levels of confidentiality, intelligent terminals for collaborative operations may be distributed in multiple management domains, and the private information of intelligent terminals is easy to be leaked in edge-cloud collaboration scenarios, the security of data sharing is severely threatened. To solve these problems, this paper proposed a fine-grained and traceable multidomain secure data-sharing model for intelligent terminals. In this model, a key self-certification algorithm is proposed, which avoids potential security threats of key leakage during the key distribution process. The model combines attribute encryption and threshold function to achieve more fine-grained and more flexible secure data sharing; it uses blockchain technology to achieve integrity verification of stored data and traceability of shared data, and it combines on-chain and off-chain databases to achieve rapid retrieval and positioning of shared data distributed among multiple domains, which improves the efficiency of data sharing among domains. The security of the model proposed by us is proved, and compared with the cited literature, it is shown that the proposed model has certain advantages in terms of computational complexity and time consumption.

100 Gb/s dynamically programmable SDN-enabled hardware encryptor for optical networks

We have successfully demonstrated an on-demand programmable hardware encryptor for optical networks enabled by the software-defined network (SDN) and tested its application in a quantum key distribution (QKD) use case. We believe our proposed encryptor is unique in the way that it combines on-demand programmable encryption algorithms with a 100G Ethernet network interface to provide a high-transmission capacity with flexible security. We have successfully formed an on-demand encryption library consisting of AES-256, AES-192, AES-128, Camellia-256, XOR, and no-encryption configurations. Our system has shown a network throughput of 91.3 Gb/s for AES variations and 90.2 Gb/s for Camellia-256, while theoretical encryption throughputs were 160 Gb/s. In addition, the goodputs of all the encryption schemes were measured as at least 90.4 Gb/s. For a faster reconfiguration of the field-programmable gate array (FPGA), partial reconfiguration technology has been used, and reconfiguration times of 2.6 s for encryption and 2 s for decryption have been achieved. The FPGA configuration rate was 3.35 MB/s. When our proposed design was tested in a QKD use case with 256-bit keys, the highest achieved key consumption rate was 27 keys/s, which corresponded to the minimum granularity of 474 MB per key. Thus, with a 256-bit key, up to a 6912 b/s key consumption rate was achieved. In addition, the encryptor’s end-to-end network latency has been tested using 300k standard Internet Control Message Protocol (ICMP) pings. For all encryption schemes, the latency was measured as 0.093 m s ± 0.028 m s on average, but the encryption/decryption processes did not have a meaningful latency impact with microsecond precision.

Low-Cost Nanostructured Thin Films as Covert Laser Readable Security Tags for Large-Scale Productions Tracking

We report here the feasibility study of anti-counterfeiting low-cost nanostructured flexible security tags for the tracking of large-scale fabrication products, such as pharmaceuticals or original equipment manufacturers. The fabrication process makes use of the mature nanotechnology called Template Synthesis to shape thin track-etched polymer film into covert laser readable tags, combining random self-organized structures with organized patterns. Techniques are developed to drastically limit the number of fabrication steps and keep fabrication costs low, while opening to numerous adjustment parameters. A dedicated, simple optical setup is presented, to capture speckle images of such tags lightened up by light emitting diodes or laser beams. Speckle images are analyzed in terms of encoding parameters, found here quite numerous to ensure a large coding range of large-scale production batches. We particularly highlight ultra-dark areas in speckle images, where nanowire structures completely inhibit speckle patterns. This unique, high-contrast optical feature addresses these low-cost nanostructured thin films to provide a very promising solution for large-scale security tags.

Hybrid 2D/0D SnSe2-SnO2 vertical junction based high performance broadband photodetector

Despite their high absorption coefficients, most two-Dimensional (2D) Transition Metal Dichalcogenides (TMDC) based photodetectors have a narrow range of light absorption and employ sophisticated fabrication methods. To overcome this, we propose a 2D–0D hybrid heterojunction-based broadband photodetector with Tin Diselenide (SnSe2)/Tin Oxide (SnO2) hybrid structure to enhance the range of detection and performance of the photodetector. The 2D and 0D nanoparticles were synthesized using a simple, cost-effective, one-step hydrothermal method. Detailed physicochemical characterization studies demonstrate the formation of 2D hexagonal layers of SnSe2 nanoflakes with absorption in visible and near IR regions and rutile tetragonal structure of SnO2 Quantum dots (QDs) with absorption in UV region. The fabricated photodetector shows superior responsivity of 47.9, 16.8, and 6.51 mA/W in UV, VIS, and NIR light with enhanced light-matter interaction. The SnSe2/SnO2 heterostructures demonstrated an efficient interlayer charge transfer due to the strong coupling. The superior performance of the photodetector can be attributed to the sizeable tuning of bandgap upon optical excitation in the bulk heterojunction wherein the photocarriers are injected into the SnSe2 nanoflakes for efficient light absorption in the broadband spectrum. The response time of this device was observed to be 0.5, 0.5, and 0.93 s under the illumination of UV, visible, and NIR lights, respectively. The flexibility studies display excellent robustness and mechanical stability for ~2000 bending cycles at ambient conditions. Hence, due to its flexibility, low power, and low cost, the strategy outlined here is ideal for applications like wearable electronics, flexible security, and surveillance systems.

Charge Based Power Side-Channel Attack Methodology for an Adiabatic Cipher

SIMON is a block cipher developed to provide flexible security options for lightweight hardware applications such as the Internet-of-things (IoT). Safeguarding such resource-constrained hardware from side-channel attacks poses a significant challenge. Adiabatic circuit operation has recently received attention for such applications due to ultra-low power consumption. In this work, a charge-based methodology is developed to mount a correlation power analysis (CPA) based side-channel attack to an adiabatic SIMON core. The charge-based method significantly reduces the attack complexity by reducing the required number of power samples by two orders of magnitude. The CPA results demonstrate that the required measurements-to-disclosure (MTD) to retrieve the secret key of an adiabatic SIMON core is 4× higher compared to a conventional static CMOS based implementation. The effect of increase in the target signal load capacitance on the MTD is also investigated. It is observed that the MTD can be reduced by half if the load driven by the target signal is increased by 2× for an adiabatic SIMON, and by 5× for a static CMOS based SIMON. This sensitivity to target signal capacitance of the adiabatic SIMON can pose a serious concern by facilitating a more efficient CPA attack.

High-throughput configurable SIMON architecture for flexible security

As the Internet of Things applications become mission-critical and their data more valuable, it becomes more and more essential to paramount their security. The security can be improved by using emerging light-weight ciphers. SIMON is a relatively recent family of light-weight ciphers which is proposed by the National Security Agency optimized for hardware platforms. In this paper, we propose an optimized hardware architecture for SIMON for high-throughput resource-constrained applications with multiple levels of security. Moreover, a configurable architecture with different operating modes is introduced for utilizing in applications requiring higher resistance to fault and power attacks. This architecture also supports an ultra-high-throughput mode for different key sizes. Implementation results of the proposed architectures on both ASIC and FPGA are reported. The comparison results show that our proposals outperform similar architectures in terms of some design metrics, e.g. throughput, which make it suitable for IoT applications. Finally, we implement practically our architecture on the Digilent-ZYBO board and report the experimental results.

A Composable Multifactor Identity Authentication and Authorization Scheme for 5G Services

The fifth-generation (5G) mobile communication technology has already deployed commercially and become a global research focus. The new features of 5G include unlimited information exchange, a large variety of connections with independent energy, and diversified high transmission rate services. Collective synergy of services is expected to change the way of life and future generations and introduce new converged services to the ICT industry. Different application services have to meet differentiated security demands. From the perspective of security, in order to support the multiservice of 5G services, it is necessary to consider the new security mechanism driven by the service. Based on 5G massive data stream, the 5G system can provide customized real-world services for potential users and reduce the user experience gap in different scenarios. However, 3GPP Extensible Authentication Protocol (EAP), which is the present entity authentication mechanism for the 5G service layer, is only an individual authentication architecture and unable to fulfill the flexible security objectives of differentiated services. In this paper, we present a new hierarchical identity management framework as well as an adaptable and composable three-factor authentication and session key agreement protocol for different applications in 5G multiservice systems. Finally, we propose an authorization process by combining with the proposed three-factor authentication mechanism and Service-Based Architecture (SBA) proposed by the 3GPP committee. The proposed mechanism can concurrently provide diverse identity authentication schemes corresponding to four different security levels by easily splitting or assembling three-factor authentication protocol blocks. The proposed scheme can be simultaneously applied to a variety of applications to improve the efficiency and quality of service and reduce the complexity of the whole 5G multiservice system, instead of designing or adopting several different authentication protocols. The performance evaluation results indicate that the proposed scheme can guarantee the multiple security of the system with ideal efficiency.

БЕЗПЕКА БРЕНДУ В УМОВАХ КОРОНАВІРУСНОЇ ПАНДЕМІЇ: КОНТЕНТНІ ТА КОМУНІКАЦІЙНІ АСПЕКТИ

<p><em>One of the aspects of digital advertising ecosystem that attracted attention during the pandemic was the role of brand safety tools which block the display of advertising messages alongside certain types of content.</em></p><p><em>Advertisers do not want their products to be associated with such topic as COVID-19, and therefore are increasingly using lists of keywords to block. This has a direct impact on the news business.</em></p><p><strong><em>The aim </em></strong><em>of the study is to characterize the problem of brand safety during the coronavirus pandemic and to analyze strategies for its provision in the digital environment.</em></p><p><strong><em>Research methodology</em></strong><em>. To achieve the research objectives such general scientific methods as analysis and synthesis were used which allowed to single out the factors influencing safe functioning of the brand. The methods of comparison, induction and deduction were applied to predict the content and communication transformations of the concept of brand safety.</em></p><p><strong><em>Results</em></strong><em>. The research findings are based on the analysis of cases of well-known brands actively using «blacklists» to protect their advertising from inappropriate content.</em></p><p><em>It was proved that companies should develop a proactive and flexible brand security strategy not only focusing on blocking lists, but also using semantic analysis and taking into account cultural, social and political events at both local and global levels.</em></p><p><strong><em>Novelty. </em></strong><em>Despite the scholars’ active interest in the essence of branding, so far there have been no serious generalizing studies of digital environment security taking into account permanent global and technological changes. This creates a significant gap in the understanding of modern safe partnership (that between a brand and the mass media, between a brand and digital platforms, between a brand and consumers) and requires a search for relevant approaches and solutions.</em></p><p><strong><em>Practical significance. </em></strong><em>Theoretical conclusions of the study can be applied in further research of national branding, while digital experience and practical solutions of the world companies can be considered by Ukrainian businesses.</em></p><p><strong><em>Key words:</em></strong><em> brand safety, coronavirus, covid – 19, programmatic, platform, block list.</em></p>

Using statistical traffic analysis to calculate the confidential means of information transmission

The article considers the modeling of security problems in the Internet as stochastic systems. This allows you to find flaws in existing security systems and offer new solutions. Studying the vulnerabilities of existing security tools can prevent cyber-attacks from taking advantage of weak systems. New, flexible and adaptive security schemes are necessary for emerging security threats elimination. A hybrid network security scheme, including intrusion detection systems and baits, scattered throughout the network is proposed. This combines the advantages of two security technologies. Honeypot is an activity-based network security system that can be a logical addition to the passive detection policies used by the IDS. This integration forces us to balance the safety indicators compared to costs, planning the operation of the device for the proposed system. Formulation of planning problems as a decentralized partially observable Markov decision-making process (DEC-POMDP) allows to make decisions in a distributed manner on each device without the need of centralized management.

Flexible multipoint-to-multipoint communication in semiconductor laser networks using one-way isolation.

We propose a type of semiconductor laser (SL) network that supports flexible chaos synchronization and multipoint-to-multipoint communications by using one-way isolation (OWI). The properties of chaos synchronization, influences of coupling strength and time delay mismatches on the quality of chaos synchronization, and the performance as well as the security of the SL network-based chaotic communications are systematically discussed. The numerical results demonstrate that, with the introduction of OWI, flexible chaos synchronization can be easily achieved in arbitrary-size SL clusters over wide parameter spaces of coupling strength and current factor. Based on the high-quality flexible chaos synchronization, satisfactory performance for Gb/s chaotic communications can be achieved in arbitrary-size clusters in the SL networks. Moreover, it is also indicated that in the SL networks, the security of intra-cluster communications can be guaranteed in three aspects. Firstly, the eavesdroppers cannot intercept any useful information by using a typical illegal attack. Secondly, due to the OWI, the chaotic carriers are only transmitted in the corresponding clusters, not transmitted among clusters, as such the security can be further improved. Thirdly, the high sensitivity of cross-correlation coefficient to the injection delay mismatches indicates that the injection delays of idle SLs to communicating SLs can be regarded as the keys of the communication clusters. The proposed scheme offers an alternative solution to flexible secure network-type communications.

Local-Encoding-Preserving Secure Network Coding

Information-theoretic security is considered in the paradigm of network coding in the presence of wiretappers, who can access one arbitrary edge subset up to a certain size, also referred to as the security level . Secure network coding is applied to prevent the leakage of the source information to the wiretappers. In this paper, we consider the problem of secure network coding when the information rate and the security level can change over time. To efficiently solve this problem, we put forward local-encoding-preserving secure network coding, where a family of secure linear network codes (SLNCs) is called local-encoding-preserving if all the SLNCs in this family share a common local encoding kernel at each intermediate node in the network. We first consider the design of a family of local-encoding-preserving SLNCs for a fixed security level and a flexible rate. A simple approach is presented for efficiently constructing upon an SLNC that exists a local-encoding-preserving SLNC with the same security level and the rate reduced by one. By applying this approach repeatedly, we can obtain a family of local-encoding-preserving SLNCs with a fixed security level and multiple rates. We further consider the design of a family of local-encoding-preserving SLNCs for a fixed rate and a flexible security level. We present a novel and efficient approach for constructing upon an SLNC that exists a local-encoding-preserving SLNC with the same rate and the security level increased by one. Next, we consider the design of a family of local-encoding-preserving SLNCs for a fixed dimension (equal to the sum of rate and security level) and a flexible pair of rate and security level. We propose another novel approach for designing an SLNC such that the same SLNC can be applied for all the rate and security-level pairs with the fixed dimension. Also, two polynomial-time algorithms are developed for efficient implementations of the later two proposed approaches, respectively. Furthermore, we prove that all our three approaches do not incur any penalty on the required field size for the existence of SLNCs in terms of the best known lower bound by Guang and Yeung. Finally, we consider the ultimate problem of designing a family of local-encoding-preserving SLNCs that can be applied to all possible pairs of rate and security level. By combining the constructions of the three families of local-encoding-preserving SLNCs in the paper in suitable ways, we can obtain a family of local-encoding-preserving SLNCs that can be applied for all possible pairs of rate and security level. Three possible such constructions are presented.

Packet Preprocessing in CNN-Based Network Intrusion Detection System

The proliferation of various connected platforms, including Internet of things, industrial control systems (ICSs), connected cars, and in-vehicle networks, has resulted in the simultaneous use of multiple protocols and devices. Chaotic situations caused by the usage of different protocols and various types of devices, such as heterogeneous networks, implemented differently by vendors renders the adoption of a flexible security solution difficult, such as recent deep learning-based intrusion detection system (IDS) studies. These studies optimized the deep learning model for their environment to improve performance, but the basic principle of the deep learning model used was not changed, so this can be called a next-generation IDS with a model that has little or no requirements. Some studies proposed IDS based on unsupervised learning technology that does not require labeled data. However, not using available assets, such as network packet data, is a waste of resources. If the security solution considers the role and importance of the devices constituting the network and the security area of the protocol standard by experts, the assets can be well used, but it will no longer be flexible. Most deep learning model-based IDS studies used recurrent neural network (RNN), which is a supervised learning model, because the characteristics of the RNN model, especially when the long-short term memory (LSTM) is incorporated, are better configured to reflect the flow of the packet data stream over time, and thus perform better than other supervised learning models such as convolutional neural network (CNN). However, if the input data induce the CNN’s kernel to sufficiently reflect the network characteristics through proper preprocessing, it could perform better than other deep learning models in the network IDS. Hence, we propose the first preprocessing method, called “direct”, for network IDS that can use the characteristics of the kernel by using the minimum protocol information, field size, and offset. In addition to direct, we propose two more preprocessing techniques called “weighted” and “compressed”. Each requires additional network information; therefore, direct conversion was compared with related studies. Including direct, the proposed preprocessing methods are based on field-to-pixel philosophy, which can reflect the advantages of CNN by extracting the convolutional features of each pixel. Direct is the most intuitive method of applying field-to-pixel conversion to reflect an image’s convolutional characteristics in the CNN. Weighted and compressed are conversion methods used to evaluate the direct method. Consequently, the IDS constructed using a CNN with the proposed direct preprocessing method demonstrated meaningful performance in the NSL-KDD dataset.

P4TC—Provably-Secure yet Practical Privacy-Preserving Toll Collection

Abstract Electronic toll collection (ETC) is widely used all over the world not only to finance our road infrastructures, but also to realize advanced features like congestion management and pollution reduction by means of dynamic pricing. Unfortunately, existing systems rely on user identification and allow tracing a user’s movements. Several abuses of this personalized location data have already become public. In view of the planned Europeanwide interoperable tolling system EETS and the new EU General Data Protection Regulation, location privacy becomes of particular importance. In this paper, we propose a flexible security model and crypto protocol framework designed for privacy-preserving toll collection in the most dominant setting, i.e., Dedicated Short Range Communication (DSRC) ETC. A major challenge in designing the framework at hand was to combine provable security and practicality, where the latter includes practical performance figures and a suitable treatment of real-world issues, like broken onboard units etc. To the best of our knowledge, our work is the first in the DSRC setting with a rigorous security model and proof and arguably the most comprehensive formal treatment of ETC security and privacy overall. Additionally, we provide a prototypical implementation on realistic hardware which already features fairly practical performance figures. An interaction between an onboard unit and a road-side unit is estimated to take less than a second allowing for toll collection at full speed assuming one road-side unit per lane.

Countermeasures for Primary User Emulation Attack: A Comprehensive Review

Cognitive radio (CR) is a flexible wireless network that can solve the scarcity and underutilization problem of the spectrum by permitting unlicensed users to access licensed bands. The dynamic nature of CR makes it more vulnerable in terms of security. This paper’s emphasis is on the primary user emulation attack, which poses a severe threat to the spectrum sensing operation of CR. In this attack, a malicious user imitates the signal characteristics of a licensed user (primary user) to disguise its true identity. Although many survey papers enhance our knowledge of cognitive radio security, this paper is an attempt to culminate new findings with the old ones to keep up the pace of the research community. Finally, the paper summarizes with some recommendations and future strategies pertinent to energy-efficient and flexible security methods for next-generation wireless systems.

Efficient hardware implementations of QTL cipher for RFID applications

Extensive deployment of ubiquitous computing devices brings wide range of privacy and security issues in the low-resource domain. Various lightweight algorithms are proposed to solve security problem for these resource-constrained environments. In this work, optimised hardware implementations of lightweight block cipher QTL are proposed in order to provide security with optimum resource utilisation. In proposed reduced datapath architecture, resource utilisation is reduced and it gives good trade-off between area and performance. In proposed pipelined architecture, encryption round is divided into two sub-stages. This design methodology significantly improves the operating frequency. As a result, this design is apt for high-speed applications. Moreover, the proposed unified architecture combines three key scheduling designs into single design for QTL encryption and provides flexible security. All three architectures are extensively evaluated and compared on the basis of performance, area utilisation, energy requirement and power consumption for their implementations in different FPGA platforms.

МОДЕЛЬ БЕЗОПАСНОСТИ С «ЧАСОВЫМ» МЕХАНИЗМОМ СИСТЕМЫ ЗАЩИТЫ ИНФОРМАЦИИ

The main point of the new approach to security should be the development of effective security models that are adequate to the current level of development of software and hardware, as well as the possibility of flexible security management depending on the requirements, acceptable risk and resource consumption. The task of the kernel integrity control subsystem is to ensure the security of the system during its operation and detect incorrect interference of system subjects in its operation. The system integrity control subsystems are based on two main components: static and dynamic. The frequency of the kernel integrity control subsystem actuation determines the time that the system will be in the "information leak" state in the event of a violation of the system integrity. There are two approaches to determining the time interval T: the first approach is characterized by minimizing the loss of system performance due to the presence of the kernel integrity control subsystem in the system, the second approach is characterized by the fact that it provides a higher level of security in case of possible losses of system performance.

Smart Resilient Security Framework and Solutions for Cloud-driven Digital Supply Networks

The cloud-based logistics services allow cost reduction, higher elasticity, flexibility, and maximum utilization of resources for performing high computations and data analytics. Logistics and security are complex issues with the corporate entities when these are to be used for taking critical issues. To understand these, this paper discusses a conceptualized, flexible security framework for cloud-driven digital supply chain in Agricultural. Moreover, a security enhancement layer is included at each layer of the cloud with a feasibility study on protecting user information in the logistics services ambiance. Also, the Data Residency for cloud-based logistics services is elaborated with Data Security analysis. Further, the article discusses the possible solutions to handle the security concerns of the logistic model.