Insider Attacks Research Articles

Efficient identity-based traceable cloud data broadcasting with outsider anonymity and simultaneous individual transmission

In recent years, cloud data broadcasting system has attracted intensive attention due to its universal applicability in various Internet-of-Things enabled real-life scenarios. Cloud data broadcasting with simultaneous individual transmission is an exciting data broadcasting variant that empowers any data broadcaster to distribute encrypted broadcast data to a subscribed consumer group and the personalized transmission to each group member simultaneously. Recently [IEEE Transactions on Broadcasting (2020)], a certificate-based data broadcasting with simultaneous individual transmission scheme (Chen et al., 2020) is proposed with the aim to solve both key-escrow problem and certificate management problem, and it is claimed to provide subscriber’s outsider anonymity under the nonstandard q-type security assumption with the existence of random oracles. Unfortunately, we can show that this most recent work of Chen et al. (2020) is not secure against insider attacks, meaning that their protocol cannot trace the system’s traitor consumers who can resell the sensitive information for their own profit without valid authorization. Besides, the design of Chen et al. (2020) has significantly high communication bandwidth that is approvingly inconvenient for the Internet-of-Things facilitated low-powerful multimedia devices to reduce unnecessary burden on the encryption costs. We design a provably secure adaptive identity-based data broadcasting technique having simultaneous individual transmission with unbounded number of consumers that can concatenate two mutually orthogonal functionalities, namely consumer’s outsider anonymity and traitor consumer traceability, in a cost-efficient way. Our framework exploits the most secure and advanced asymmetric Type-3 bilinear maps to defend against fault attacks and realizes security in the standard provable security model without the existence of any random oracle. On a positive note, our construction eliminates the q-type security assumption that is so far a plausible achievement compared to all the existing schemes in this area.

Trust in Vehicles: Toward Context-Aware Trust and Attack Resistance for the Internet of Vehicles

Trust evaluation and management schemes have been extensively employed in a bid to alleviate diverse insider attacks. These trust values are often ascertained by taking into consideration trust parameters to determine the honesty and reliability of a vehicle and evaluating a weighted sum of the said parameters. To achieve precision and to reflect a reasonable impact of these parameters, rational weight values are imperative. Accordingly, this research primarily emphasizes on the quantification of weights associated with the contributing trust attributes by proposing a novel trust management mechanism that utilizes contextual information in addition to employing relevant impacting quantities as weights to formulate trust evaluations. Moreover, the envisaged trust management model incorporates 1) attack resilience while constituting certain parameters and 2) an adaptive and flexible threshold to mitigate malevolent behaviors. The simulation results depict that the devised parameters and the formulated trust aggregation cater to the dynamic nature of vehicular networks demonstrating the rationality of the weights’ quantification, and the introduction of the adaptive threshold for misbehavior detection aligns well with the requirements of the ever-changing vehicular networks.

Enhancing the Security: A Lightweight Authentication and Key Agreement Protocol for Smart Medical Services in the IoHT

The Internet of Things (IoT) has witnessed significant growth with advancements in Internet and wireless technologies. In the medical field, the Internet of Health Things (IoHT) has emerged as an extension of the IoT, enabling the exchange of remote data and real-time monitoring of patients’ health conditions. Through the IoHT, doctors can promptly provide diagnoses and treatment for patients. As patient data are transmitted over public channels, security issues may arise, necessitating security mechanisms. Recently, Amintoosi et al. proposed an authentication protocol for smart medical services in the IoHT. However, their protocol exhibited security weaknesses, including vulnerabilities to privileged insider attacks. To address the security concerns, we propose an enhanced authentication and key agreement protocol. The security of our protocol is rigorously analyzed using the Real-Or-Random model, informal security analysis, and the AVISPA tool. Finally, the results of our analysis demonstrate that our proposed protocol ensures sufficient security while maintaining a performance level similar to existing protocols.

Insider Threat Prevention in the US Banking System

Insider threats have been a major problem for the US banking sector in recent years, costing billions of dollars in damages. To combat this, the implementation of effective cybersecurity measures is essential. This paper investigates the current state of insider threats to banks in the U.S., the associated costs, and the potential measures that can be taken to mitigate this risk. The development of a framework for the adoption of cybersecurity measures within the banking industry is the primary emphasis in order to stop fraud and lessen financial losses. Through a detailed examination of the literature, in-depth interviews with experts in the banking sector, and case studies of existing cybersecurity measures, this paper provides a comprehensive overview of the problem and potential remedies. Analysis of the research reveals that identity and access management, data encryption, and secure authentication are key components of any cybersecurity strategy. Furthermore, it is recommended that banks increase their technical capabilities and improve their employee awareness and training. The study concludes with a series of suggestions for enhancing banking industry cybersecurity and eventually reducing the danger of insider attacks. This paper explores the topic of insider threats in the US banking industry and presents cybersecurity measures to prevent fraud. Insider threats from people with access to sensitive data and systems present serious hazards to the banking industry, resulting in monetary losses, reputational harm, and compromised data integrity.

An Improved Secure Authentication in Lightweight IoT

Internet of Things (IoT) has been widely accepted by users and with rapid development of cloud computing, users are able to access the IoT services in various environment, including smart home, healthcare and smart factory. However, users are insecure as their data is being transmitted via open communication channel. The previous research protocol does not resist insider attack which leads to insecure scheme. In this proposal, we propose an enhanced security measurement to resist insider attack. The proposed scheme expected to achieve security requirements and resist insider attack. The proposed scheme will be validated using the automated validation of internet security protocols and applications (AVISPA) simulation tool and we will compare the performance and security features of the existing scheme and the proposed scheme.

Scalable and Secure Virtualization of HSM With ScaleTrust

Hardware security modules (HSMs) have been utilized as a trustworthy foundation for cloud services. Unfortunately, existing systems using HSMs fail to meet multi-tenant scalability arising from the emerging trends such as microservices, which utilize frequent cryptographic operations. As an alternative, cloud vendors provide HSMs as a service. However, such cloud-managed HSM usage models raise security concerns due to their untrusted and shared operating environment. We propose ScaleTrust, a scalable and secure system for key management. ScaleTrust allows us to scale the number of virtual HSM partitions, each of which is isolated with respect to each other and is robust against cloud insider attacks, while preserving physical isolation of the root of trust. To enable this, ScaleTrust uses Intel SGX and multiple HSM features, such as restricting key usage by controlling key attributes of in-HSM keys and establishing a secure channel using only HSM commands. Finally, we apply ScaleTrust to four real-world systems: Keyless SSL for TLS private key offloading, JSON Web Token authentication for microservices, key provisioning, and encryption in database systems. Our evaluation shows that ScaleTrust achieves multi-tenancy in a scalable way by providing multiple virtual HSMs with legacy HSM devices that are designed to support a single tenant. ScaleTrust provides security against insider threats while incurring 11.9% and 39.0% of end-to-end throughput and latency overhead for Keyless SSL compared to stand-alone HSMs.

On the Security of a PUF-Based Authentication and Key Exchange Protocol for IoT Devices.

Recently, Roy et al. proposed a physically unclonable function (PUF)-based authentication and key exchange protocol for Internet of Things (IoT) devices. The PUF protocol is efficient, because it integrates both the Node-to-Node (N2N) authentication and the Node-to-Server (N2S) authentication into a standalone protocol. In this paper, we therefore examine the security of the PUF protocol under the assumption of an insider attack. Our cryptanalysis findings are the following. (1) A legitimate but malicious IoT node can monitor the secure communication among the server and any other IoT nodes in both N2N authentication and N2S authentication. (2) A legitimate but malicious IoT node is able to impersonate a target IoT node to cheat the server and any other IoT nodes in N2N authentication and the server in N2S authentication, respectively. (3) A legitimate but malicious IoT node can masquerade as the server to cheat any other target IoT nodes in both N2N authentication and N2S authentication. To the best of our knowledge, our work gives the first non-trivial concrete security analysis for the PUF protocol. In addition, we employ the automatic verification tool of security protocols, i.e., Scyther, to confirm the weaknesses found in the PUF protocol. We finally consider how to prevent weaknesses in the PUF protocol.

Toward a Distributed Trust Management System for Misbehavior Detection in the Internet of Vehicles

Recent considerable state-of-the-art advancements within the automotive sector, coupled with an evolution of the promising paradigms of vehicle-to-everything communication and the Internet of Vehicles (IoV), have facilitated vehicles to generate and, accordingly, disseminate an enormous amount of safety-critical and non-safety infotainment data in a bid to guarantee a highly safe, convenient, and congestion-aware road transport. These dynamic networks require intelligent security measures to ensure that the malicious messages, along with the vehicles that disseminate them, are identified and subsequently eliminated in a timely manner so that they are not in a position to harm other vehicles. Failing to do so could jeopardize the entire network, leading to fatalities and injuries amongst road users. Several researchers, over the years, have envisaged conventional cryptographic-based solutions employing certificates and the public key infrastructure for enhancing the security of vehicular networks. Nevertheless, cryptographic-based solutions are not optimum for an IoV network primarily, since the cryptographic schemes could be susceptible to compromised trust authorities and insider attacks that are highly deceptive in nature and cannot be noticed immediately and are, therefore, capable of causing catastrophic damage. Accordingly, in this article, a distributed trust management system has been proposed that ascertains the trust of all the reputation segments within an IoV network. The envisaged system takes into consideration the salient characteristics of familiarity, i.e., assessed via a subjective logic approach, similarity, and timeliness to ascertain the weights of all the reputation segments. Furthermore, an intelligent trust threshold mechanism has been developed for the identification and eviction of the misbehaving vehicles. The experimental results suggest the advantages of our proposed IoV-based trust management system in terms of optimizing the misbehavior detection and its resilience to various sorts of attacks.

A quantum resistant multi-user signcryption scheme featuring key invisibility for Internet of Things

With the advent of ubiquitous computing, multiple heterogeneous devices have evolved with increased connectivity, yielding the Internet of Things (IoT). For establishing secure communication, IoT has effectively become a primary security concern. The massive connectivity of the resource-constrained devices in IoT and enormous data on the air have made information vulnerable to several types of attacks. Although several resource-intensive cryptographic algorithms have been proposed to combat this security threat, signcryption has been identified as a sound solution for such an application.In this work, we propose an isogeny-based signcryption scheme by integrating HyPKE, an isogeny-based encryption scheme with an isogeny-based signature SeaSign based on Fiat Shamir with aborts. Apart from confidentiality and authenticity requirements, our scheme also achieves ciphertext anonymity and key invisibility, unlike the existing signcryption schemes in the post-quantum world. More positively, our security model considers insider attacks, supports multi-users setting and offers non-repudiation. Our work also studies the key privacy notion of the isogeny-based encryption scheme Hashed-PKE, which can be of independent interest in designing several anonymous channels or privacy-preserving protocols. More precisely, we showed Hashed-PKE achieves indistinguishability of keys against chosen-plaintext attack. This leads to the indistinguishability of keys against chosen-ciphertext attack security of HyPKE, a hybrid encryption scheme that is obtained by applying the Fujisaki Okamoto transformation to Hashed-PKE. We have proved our result in the standard model assuming the hardness of the Commutative Supersingular Decisional Diffie–Hellman assumption.

An improved authentication and key management scheme in context of IoT-based wireless sensor network using ECC

Wireless sensor network (WSN) is used for sensing data/information from the nearby environment with the help of various spatially dispersed miniature sensor devices/nodes and forwarding the data to the direction of the base station which is connected to the network through the Internet for processing the collected data. Currently, Internet of Things (IoT) based smart computing applications are becoming popular in which WSN is used to run a process to output information from sensed data or events. However, these sensor nodes have less computation ability and low power capacity. In these resource-constrained WSNs, remote user authentication is a serious challenge that demands the attention of the researchers’ community. Several authentication protocols which address a variety of security concerns are present in the literature. Ghani et al. proposed an efficient authentication and key management scheme that claims to be resistant to known attacks. During the study of their scheme, we found that it is efficient and effective for protecting against a few attacks. However, it does not have the ability to counter several security threats like user impersonation attack, insider attack, database attack, and stolen smart card attack. To counter these aforesaid security loopholes, in this paper a new ECC integrated scheme suitable for IoT-based WSN with a higher level of protection is proposed. The informal security analysis using mathematical approaches and the formal security analysis using a well-accepted AVISPA simulator and BAN logic ensures that the suggested work is highly secure from all the relevant threats. Moreover, the performance analysis and comparison of the proposed scheme with the most recent relevant schemes proves that our scheme is much more efficient in terms of computation, communication, and storage overheads than all the available schemes in the literature.

A User and Entity Behavior Analysis for SIEM Systems: Preprocessing of The Computer Emergency and Response Team Dataset

A lot of work has been done to prevent attacks from external sources and a great deal of success has been achieved. However, studies to detect internal attacks aren’t sufficient today. One of the most important studies for the detection of insider attacks is User and Entity Behavior Analysis (UEBA). In this letter, UEBA studies in the literature were reviewed and The Computer Emergency and Response Team Dataset was analyzed (CERT). For this purpose, preprocessing and feature extraction steps were applied on CERT datasets. Several log files combined with respect to user and for each user the number of activities in the specified time interval were obtained. The python code of these preprocessing and feature extraction steps were shared as open source in GitHub platform. In the final phase, future analysis was described and UEBA system planned to be designed was explained.

Preventing Insider Attacks in Databases

Preventing Insider Attacks in Databases

Guest Editorial: Privacy, Trust and Reputation Management in Internet of Vehicles (IoV)

The emergence of the Internet of vehicles (IoV) in recent years holds great potential for enhancing the user experience by introducing more sophisticated services that do everything from guaranteeing the user's safety to enhancing their comfort. Vehicles, people, and roadside infrastructure all play important roles in building I0V ecosystem. In addition, a wide variety of communication methods coexist to guarantee the IoV's connectivity and stability. This multiplies the attack surface of the ecosystem and introduces new privacy, trust, and reputation concerns as a direct result of its variety. Due to the widespread nature of the IoV, it is imperative that services be privy to and able to incorporate concerns over user privacy. To protect passengers, drivers, and pedestrians from the dangers of insider attacks—in which communications from authorized users are tampered with or manufactured by malevolent organizations. Multiple variables are utilized to define peer-to-peer exchanges, and this information is then used to make a well-informed decision about whether or not to trust the vehicle in question. One typical method of indicating how much certain characteristics matter is to use a weighting factor. The quantities of the weighting factors are often set manually because there are no influencing variables taken into consideration when doing so. In accordance with this computed criterion, the peer vehicles are then categorized as either trustworthy or not. The use of adversary models in conjunction with trust management models to counter different kinds of insider attacks has been the subject of study. Adversary models help in identifying potential attackers, while trust management models help in determining the level of access and privileges that an individual should have based on their trustworthiness. The combination of these two models can improve the security of a system against insider attacks. This Special Issue (SI) is an effort to tackle some of these issues. The SI includes contributions from experts in the field and aims to provide insights and solutions to the challenges faced in the area of privacy, trust and reputation in IoV. It also highlights potential solutions and areas for future research.

Mitigation of Black Hole and Selective Forwarding Attacks through Active Trust Mechanisms in Wireless Sensor Networks

In modern times, security remains a significant concern in wireless networks. Wireless sensor networks are widely employed in different practical situations. WSNs struggle with numerous internal and external threats, and detecting and defending against insider attacks is difficult. Insider attacks, in which intruders discard received data packets selectively, pose a significant risk to WSNs. The presence of black hole nodes within the network causes this issue. This research paper presents a secure and reliable route management methodology for WSNs that selects nodes and routing paths based on trust metrics. The proposed mechanism employs intelligent routing and node selection to defend against various types of assaults encountered during the routing process, including selective forwarding and black hole attacks. As a result, the paper identifies secure routes and establishes secure network routing. This scheme uses throughput, latency, and packet drop ratio as performance metrics. Experimentation demonstrates that the proposed system effectively increases the probability of secure network routing paths while extending the network lifecycle.

A Privacy-Preserving Symptoms Retrieval System with the Aid of Homomorphic Encryption and Private Set Intersection Schemes

This work presents an efficient and effective system allowing hospitals to share patients’ private information while ensuring that each hospital database’s medical records will not be leaked; moreover, the privacy of patients who access the data will also be protected. We assume that the thread model of the hospital’s security is semi-honest (i.e., curious but honest), and each hospital hired a trusted medical records department administrator to manage patients’ private information from other hospitals. With the help of Homomorphic Encryption- and Private Set Intersection -related algorithms, our proposed system protects patient privacy, allows physicians to obtain patient information across hospitals, and prevents threats such as troublesome insider attacks and man-in-the-middle attacks.

A Hybrid Trust Model against Insider Packet Drop Attacks in Wireless Sensor Networks.

Quick and accurate detection of inside packet drop attackers is of critical importance to reduce the damage they can have on the network. Trust mechanisms have been widely used in wireless sensor networks for this purpose. However, existing trust models are not effective because they cannot distinguish between packet drops caused by an attack and those caused by normal network failure. We observe that insider packet drop attacks will cause more consecutive packet drops than a network abnormality. Therefore, we propose the use of consecutive packet drops to speed up the detection of inside packet drop attackers. In this article, we describe a new trust model based on consecutive drops and develop a hybrid trust mechanism to seamlessly integrate the new trust model with existing trust models. We perform extensive OPNET (Optimized Network Engineering Tool) simulations using a geographic greedy routing protocol to validate the effectiveness of our new model. The simulation results show that our hybrid trust model outperforms existing trust models for all types of inside packet drop attacks, not only in terms of detection speed and accuracy as it is designed for, but also in terms of other important network performance metrics, such as packet delivery rate, routing reliability, and energy efficiency.

A Lightweight, Secure Big Data-Based Authentication and Key-Agreement Scheme for IoT with Revocability

With the rapid development of Internet of Things (IoT), designing a secure two-factor authentication scheme for IoT is becoming increasingly demanding. Two-factor protocols are deployed to achieve a higher security level than single-factor protocols. Given the resource constraints of IoT devices, other factors such as biometrics are ruled out as additional authentication factors due to their large overhead. Smart cards are also prone to side-channel attacks. Therefore, historical big data have gained interest recently as a novel authentication factor in IoT. In this paper, we show that existing big data-based schemes fail to achieve their claimed security properties such as perfect forward secrecy (PFS), key compromise impersonation (KCI) resilience, and server compromise impersonation (SCI) resilience. Assuming a real strong attacker rather than a weak one, we show that previous schemes not only fail to provide KCI and SCI but also do not provide real two-factor security and revocability and suffer inside attack. Then, we propose our novel scheme which can indeed provide real two-factor security, PFS, KCI, and inside attack resilience and revocability of the client. Furthermore, our performance analysis shows that our scheme has reduced modular exponentiation operation and multiplication for both the client and the server compared to Liu et al.’s scheme which reduces the execution time by one third for security levels of λ = 128 . Moreover, in order to cope with the potential threat of quantum computers, we suggest using lightweight XMSS signature schemes which provide the desired security properties with λ = 128 bit postquantum security. Finally, we prove the security of our proposed scheme formally using both the real-or-random model and the ProVerif analysis tool.

Rotating behind security: an enhanced authentication protocol for IoT-enabled devices in distributed cloud computing architecture

With the continuous progress of the Internet of Things (IoT) technology, IoT devices have gradually penetrated all aspects of life. However, due to rapid data growth, IoT devices with limited memory resources cannot store massive data. Cloud computing is an Internet-centric network that can provide security services and data storage. The combination of IoT devices with cloud computing considerably promotes resource sharing, facilitates users’ access to information at any time, and provides users with corresponding cloud computing services on time. Because the information transmitted through public channels is easily intercepted, tampered with, and eavesdropped on by malicious attackers. As a result, users’ and servers’ private information are disclosed. Numerous scholars have proposed different authentication protocols in this environment to protect the communications between users and servers. Amin et al. devised a smart card based authentication protocol. Unfortunately, Kang et al. demonstrated that their protocol was insecure. Huang et al. discovered Kang et al.’s improvement also has security flaws and then designed a protocol to enhance security. In this paper, we first show that Huang et al.’s protocol cannot resist privileged insider and temporary value disclosure attacks. Afterward, we propose an enhanced protocol based on their protocol. Finally, we use formal/informal security analysis to demonstrate the security of the improved protocol. The comparison results are indicated that our protocol has lower computational and communication costs under the same security level.

A Lightweight Authentication and Key Agreement Protocol for IoT-Enabled Smart Grid System.

The IoT-enabled Smart Grid uses IoT smart devices to collect the private electricity data of consumers and send it to service providers over the public network, which leads to some new security problems. To ensure the communication security in a smart grid, many researches are focusing on using authentication and key agreement protocols to protect against cyber attacks. Unfortunately, most of them are vulnerable to various attacks. In this paper, we analyze the security of an existent protocol by introducing an insider attacker, and show that their scheme cannot guarantee the claimed security requirements under their adversary model. Then, we present an improved lightweight authentication and key agreement protocol, which aims to enhance the security of IoT-enabled smart grid systems. Furthermore, we proved the security of the scheme under the real-or-random oracle model. The result shown that the improved scheme is secure in the presence of both internal attackers and external attackers. Compared with the original protocol, the new protocol is more secure, while keeping the same computation efficiency. Both of them are 0.0552 ms. The communication of the new protocol is 236 bytes, which is acceptable in smart grids. In other words, with similar communication and computation cost, we proposed a more secure protocol for smart grids.

Fog-enabled private blockchain-based identity authentication scheme for smart home

As the Internet of Things (IoT) technology continues to advance, it has found widespread application in various fields, including smart health, smart cities, and smart transportation. Among these applications, smart homes are particularly noteworthy due to their intimate connection to our daily lives. However, the use of smart devices in a home environment exposes users to various security threats, such as impersonation attacks and insider privilege attacks, as users must communicate with multiple devices through a public channel. Additionally, traditional authentication schemes that rely on trusted third-party present a single point of failure, as users and smart devices must be registered and authenticated by a central authority. Blockchain technology offers a decentralized, tamper-proof, and flexible solution for authentication and access control of data. By using blockchain, the single point of failure problem in traditional authentication schemes can be resolved. In the context of smart homes, the real-time nature of the environment necessitates the use of fog nodes to provide localized computing services. Fog nodes are closer to IoT devices than cloud nodes, making fog computing more efficient and faster than cloud computing. This paper proposes an authentication scheme for blockchain-enabled fog nodes in smart homes. The scheme involves registering all fog nodes and intelligent devices on a local private blockchain, and authentication is performed jointly by smart contracts on the blockchain and off-chain operations. The scheme provides comprehensive security and better performance, as demonstrated by security analysis and performance evaluation. Moreover, the proposed scheme offers a certain level of user privacy protection.