Quantitative Security Research Articles

CaSA: End-to-End Quantitative Security Analysis of Randomly Mapped Caches

CaSA: End-to-End Quantitative Security Analysis of Randomly Mapped Caches

How to Improve the Security of Password Checkers

After years of the attempt to replace password with other alternatives such as biometrics and smart cards, password is still the most pervasive user authentication mechanism. The password checking authentication is widely used for financial services, online social networks, and many other applications. This paper aims to analyze the security of a <i>password checker</i> qualitatively and quantitatively, and show how to improve it. <i>Qualitative</i> security analysis, in which it does not allow any information flow from secret date to public data, considers that the password checker is not a secure process. Therefore, an alternative analysis for the password checker is to analyze <i>quantitatively,</i> i.e., quantifying its information flow and determining how much secret information has been leaked. This method can be used to decide whether we can tolerate small leakages. A quantitative security analysis can be seen as a generalization of a qualitative one. To improve the security of the password checker, we propose a <i>noisy-output</i> policy, i.e., a situation where a system operator is able to add noise to the output: instead of always producing the exact outcomes, the system sometimes reports noisy outcomes. The noisy outcomes reduce the correlation between the output and the input, and thus reduce the leakage.

Quantum Stream Cipher Based on Holevo-Yuen Theory: Part II.

This paper discusses the foundation of security theory for the Quantum stream cipher based on the Holevo-Yuen theory, which allows the use of "optical amplifiers". This type of cipher is a technology that provides information-theoretic security (ITS) to optical data transmission by randomizing ultrafast optical communication signals with quantum noise. In general, the quantitative security of ITS is evaluated in terms of the unicity distance in Shannon theory. However, the quantum version requires modeling beyond the Shannon model of a random cipher to utilize the characteristics of the physical layer. Therefore, as the first step, one has to develop a generalized unicity distance theory and apply it to the evaluation of security. Although a complete theoretical formulation has not yet been established, this paper explains a primitive structure of a generalization of the Shannon random cipher and shows that the realization of this is the generalized quantum stream cipher. In addition, we present several implementation methods of generalized quantum stream ciphers and their security.

Developing a dynamic/adaptive geofencing algorithm for HVTT cargo security in road transport

AbstractCargo security is one of the most critical issues in modern logistics. For high-value theft-targeted (HVTT) cargo the driving phase of transportation takes up a major part of thefts. Dozen fleet management solutions based on GNSS positioning were introduced in recent years. Existing tracking solutions barely meet the requirements of TAPA 2020. Map-matching algorithms present valuable ideas on handling GNSS inaccuracy, however, universal map-matching methods are overcomplicated. Commercial map data providers require additional fees for the use of real-time map-matching functionality. In addition, at the map-matching stage, information on the actual distance from which the raw data was captured is lost. In HVTT security, the distance between the raw GNSS position and map-matched position can be used as a quantitative security factor. The goal of this research was to provide empirical data for TAPA TSR 2020 Level 1 certification in terms of tracking vehicles during typical operating conditions (cargo loading, routing, transportation, stopover, unloading) as well as detecting any geofencing violations. The Dynamic Geofencing Algorithm (DGA) presented in this article was developed for this specific purpose and this is the first known pulication to examine TAPA Standarization in terms of cargo positioning and fleet monitoring. The DGA is adaptive geometric-based matching (alternately curve-to-curve, point-to-curve, point-to-point). The idea behind the algorithm is to detect and eliminate the atypical matching circumstances—namely if the raw position is registered at one of the exceptions described in the paper. The problem of dynamic/adaptive cartographic projection is also addressed so that the robus Euclidean calculactions could be used in global scale.

Regional differences, distributional dynamics and convergence of multidimensional food security levels in China.

Food security is one of the important issues in the current world development process. The article takes 31 provinces (districts and cities) in China as the research object and constructs a multidimensional food security level evaluation index system from four dimensions: quantitative security, nutritional security, ecological security, and capacity security. Using the entropy method, China's food security index was calculated for the ten-year period from 2013 to 2022. Overall, China's food security level showed an upward trend during the decade, with the provinces of Shandong, Heilongjiang, and Henan having the highest level of security. The distribution dynamics of food security and its spatiotemporal evolution in the seven regions were examined using the Dagum Gini coefficient and its decomposition, and the absolute and conditional convergence of food security in the different areas was verified. The results of the study show that the provinces within East China have the largest gap in food security levels between them, and there is absolute β-convergence. Looking at China as a whole, the development of its food security level is characterized by significant convergence, which means that provinces with a low level of food security will have a faster rate of growth than those with a high level of food security, resulting in a gradual narrowing of the gap in food security levels between provinces.

Fallen Sanctuary: A Higher-Order and Leakage-Resilient Rekeying Scheme

This paper presents a provably secure, higher-order, and leakage-resilient (LR) rekeying scheme named LR Rekeying with Random oracle Repetition (LR4), along with a quantitative security evaluation methodology. Many existing LR primitives are based on a concept of leveled implementation, which still essentially require a leak-free sanctuary (i.e., differential power analysis (DPA)-resistant component(s)) for some parts. In addition, although several LR pseudorandom functions (PRFs) based on only bounded DPA-resistant components have been developed, their validity and effectiveness for rekeying usage still need to be determined. In contrast, LR4 is formally proven under a leakage model that captures the practical goal of side-channel attack (SCA) protection (e.g., masking with a practical order) and assumes no unbounded DPA-resistant sanctuary. This proof suggests that LR4 resists exponential invocations (up to the birthday bound of key size) without using any unbounded leak-free component, which is the first of its kind. Moreover, we present a quantitative SCA success rate evaluation methodology for LR4 that combines the bounded leakage models for LR cryptography and a state-of-the-art information-theoretical SCA evaluation method. We validate its soundness and effectiveness as a DPA countermeasure through a numerical evaluation; that is, the number of secure calls of a symmetric primitive increases exponentially by increasing a security parameter under practical conditions.

A quantitative security evaluation and analysis model for web applications based on OWASP application security verification standard

In today's digital world, web applications are popular tools used by businesses. As more and more applications are deployed on the web, they are seen as increasingly attractive targets by malicious actors eager to exploit any security gaps present. Organizations are always at risk for potential vulnerabilities in their web-based software systems, which can lead to data loss, service interruption, and lack of trust. Therefore, organizations need to have an effective and efficient method for assessing and analyzing the security of acquired web-based software to ensure adequate confidence in its use. Quantitative security evaluation employs mathematical and computational techniques to express the security level that a system reaches. This research focuses on improving the quantitative analysis of web application security evaluation. We strive to unite the Open Web Application Security Project's (OWASP) Application Security Verification Standard (ASVS) into a structural and analyzable model, which aims to efficiently evaluate web application security levels while providing meaningful insights into their strengths and weaknesses.

Secured Clustering Multilevel Underwater Acoustic Networks with Dynamic Routing Discovery (SCDRD) Protocol

Abstract: Due to multiple rising automated industry and combat field applications, researchers have developed a growing interest in the area of Underwater Acoustic Sensor Networks (UASNs) over the previous decade. Extending the lifetime of the energy and the consumption of energy in UASNs are enormous challenges. One of the primary difficulties in UASNs is the development of energy-saving routing mechanisms. In recent days the security of the data collected is the main concern because of widely accessible wireless sensors, because these low-power devices are incompatible with complicated encryption methods. As a result, for multi-hop Underwater Acoustic Sensor Networks (UASNs) with non-replenish able energy resources, lifetime optimization and security are two opposing design concerns. This work introduces an Efficient Energy Clustering with Dynamic Routing Discovery protocol (SCDRD protocol), which addresses two competing difficulties by taking into account several characteristics such as probability random walking and the energy balance control mechanism. The suggested protocol detects that energy consumption in the existing network topology is disproportional to energy deployment, which has an impact on the lifetime of wireless sensor networks. Through a quantitative security analysis, this work proposes a non-uniform efficient deployment technique to handle existing energy resource optimization problems and addresses the security location privacy concern. In all circumstances, the proposed Protocol produces the efficient trade-off between the energy balance and the routing mechanisms, allowing sensor networks to last substantially longer. In addition, the deployment of energy in the non-uniform manner results in the increased network’s lifetime and overall packets sent. The results of proposed work is compared with existing cost-aware routing protocols and outperform the existing protocol with respect to various performance parameters like energy, throughput and delivery ratio.

Quantitative security analysis of three-level unitary operations in quantum secret sharing without entanglement

Quantum secret sharing (QSS) protocols without entanglement have showed high security by virtue of the characteristics of quantum mechanics. However, it is still a challenge to compare the security of such protocols depending on quantitative security analysis. Based on our previous security analysis work on protocols using single qubits and two-level unitary operations, QSS protocols with single qutrits and three-level unitary operations are considered in this paper. Under the Bell-state attack we propose, the quantitative security analyses according to different three-level unitary operations are provided respectively in the one-step and two-step situations. Finally, important conclusions are drawn for designing and implementing such QSS protocols. The method and results may also contribute to analyze the security of other high-level quantum cryptography schemes based on unitary operations.

CPES-QSM: A Quantitative Method Toward the Secure Operation of Cyber–Physical Energy Systems

Power systems are evolving into cyber-physical energy systems (CPES) mainly due to the integration of modern communication and Internet-of-Things (IoT) devices. CPES security evaluation is challenging since the physical and cyber layers are often not considered holistically. Existing literature focuses on only optimizing the operation of either the physical or cyber layer while ignoring the interactions between them. This paper proposes a metric, the Cyber-Physical Energy System Quantitative Security Metric (CPES-QSM), that quantifies the interaction between the cyber and physical layers across three domains: electrical, cyber-risk, and network topology. A method for incorporating the proposed cyber-metric into operational decisions is also proposed by formulating a cyber-constrained AC optimal power flow (C-ACOPF) that considers the status of all the CPES layers. The C-ACOPF considers the vulnerabilities of physical and cyber networks by incorporating factors such as voltage stability, contingencies, graph-theory, and IoT cyber risks, while using a multi-criteria decision-making technique. Simulation studies are conducted using standard IEEE test systems to evaluate the effectiveness of the proposed metric and the C-ACOPF formulation.

Efficient Vertical Federated Learning Method for Ridge Regression of Large-Scale Samples

Integrating data from multiple parties to achieve cross-institutional machine learning is an important trend in Industry 4.0 era. However, the privacy risks from sharing data pose a significant challenge to data integration. To integrate data without sharing data and meet large-scale samples' modeling needs, we propose two vertical federation learning algorithms for ridge regression via least-squares solution for two-party and multi-party scenarios, respectively. Compared with the state-of-the-art algorithms, our algorithms only need one round of calculation for the optimization instead of iteration. Furthermore, our algorithms can effectively handle large-scale samples due to the number of cryptographic operations in our algorithms being independent of the number of samples. Through our proposed the matrix secure agent computing theory and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\delta$</tex-math></inline-formula> -data indistinguishability theory, we provide quantitative theoretical guarantees for the security of our algorithms. Our algorithms satisfy complete data indistinguishability under the “semi-honest” assumption and the quantitative security under the “malicious” assumption. The experiments show that our proposed algorithm takes only about 400 seconds to handle up to 9.6 million large-scale samples, while the state-of-the-art algorithms take close to 1000 seconds to handle every 1000 samples, which embodies the advantage of our algorithms in handling large-scale samples.

Defining Cyber Risk Scenarios to Evaluate IoT Systems

The growth of the Internet of Things (IoT) has accelerated digital transformation processes in organizations and cities. However, it has also opened new security challenges due to the complexity and dynamism of these systems. The application of security risk analysis methodologies used to evaluate information technology (IT) systems have their limitations to qualitatively assess the security risks in IoT systems, due to the lack of historical data and the dynamic behavior of the solutions based on the IoT. The objective of this study is to propose a methodology for developing a security risk analysis using scenarios based on the risk factors of IoT devices. In order to manage the uncertainty due to the dynamics of IoT behaviors, we propose the use of Bayesian networks in conjunction with the Best Worst Method (BWM) for multi-criteria decision-making to obtain a quantitative security risk value.

Quantitative Security Characteristics of Perl Programs

Качество программ принято характеризовать числом ошибок на 1000 строк кода. Эта характеристика получается в результате регрессионного анализа числа выявленных ошибок в последовательных версиях кода с последующей экстраполяцией в отдаленное будущее. Данная процедура является очень трудоемкой даже для крупных компаний. Проверить достоверность такой оценки для обычных пользователей как правило довольно сложно. Такая проблема возникает из-за недоступности исходных данных. Существуют различные способы оценки числа ошибок в программе, например, модель Шумана, Муса, Ла Падула, Джелинского-Моранды, Шика-Волвертона, модель переходных вероятностей, статистическая модель Миллса, простая интуитивная модель, модель Липова, Коркорэна, Бернулли, Нельсонаи т.д.. Часто приходится иметь дело с программами, в которых формально нет ошибок, при этом их качество на первый взгляд не очевидно. В данной статье предложен новый метод количественной оценки качества программ, написанных на языке Perl. Данный метод позволяет выявить места в программах, где могут быть допущены ошибки. В отличие от существующих алгоритмов данный метод позволяет оценивать качество программы, анализируя стиль написания ее кода. Предлагаемый метод оценки качества применим к любым программам, написанным на алгоритмических языках высокого уровня с открытыми кодами (Python, Perl, PHP и т. д.).В том числе его можно использовать для сравнения качества и выбора программ, решающих одну и ту же задачу. The program quality is used to be characterized with error number per 1000 code lines. This parameter is calculated by a statistical regressive analysis of error numbers for successive code versions, with a subsequent extrapolation for the future. This procedure is very tedious even for large companies. It is very hard to verify this estimate for common users, as they have no initial data. There are a lot of methods to estimate code error number, e.g., models Shooman, Musa, Bell-LaPadula, Jelinski-Moranda, Schick-Wolverton, Mills, Lipov, Corcoran, Bernoulli simple intuitive software reliability model, Nelson's software reliability. But often we deal with programs that formally have no errors, at the same time their quality is not evident. The method is proposed to estimate quantitatively a code quality for Perl-routines. This method can identify weaknesses in certain program components, where errors are possible. The proposed method is based on programming style analysis. The method is applicable for any programs with open sources (Python, Perl, PHP, etc). The method can be used for quality comparison and choice of the programs solving similar tasks.

Enhancing quality-driven food consumption policies in Tunisia

In Tunisia, food security policies’ objectives are increasing production to satisfy the growing demand and reduce the food deficit rate (35% per year). Since 1980, intensive production system and government subsidies for basic commodities were used to enhance food availability. This article aims to analyze food quantitative security policy impact on Tunisian consumption model versus Mediterranean diet and to readjust policies for qualitative food security. Based on five-year National Statistics Institute surveys on household consumption from 1985 to 2015, ANOVA analysis shows the need to address rural and urban consumption separately. Three groups were identified through clustering by consumption deviation degree compared to 1985. Variables of consumption evolution were determined by linear regression: price, income, location, domestic production and a quality factor measuring the conformity degree with Mediterranean diet. In order to achieve a better adherence to Mediterranean diet, new measures and synergy should take place at several levels policy makers, producers and consumers.

Security analysis of a QAM modulated quantum noise stream cipher under a correlation attack.

Quantum noise stream cipher where encrypted signals are masked by quantum noise and ASE noise provides a physical layer of security. It requires the transmitter and the receiver to share a stream cipher that is generated from a PRNG. Yet a correlation attack threatens its security due to the mathematical properties of PRNG. This paper discusses the security of QNSC system under correlation attacks. Our experiment results find that the security of the whole system depends on the cycle to refresh the seed key and the correlation between the incepted running key, original running key, and seed key. Furthermore, it is important to provide security for the QNSC system by maintaining low optical power. Besides, this new analytical method provides quantitative security analysis for a QNSC system under a correlation attack.

Developing Security Assurance Metrics to Support Quantitative Security Assurance Evaluation

Security assurance (SA) is a technique that helps organizations to appraise the trust and confidence that a system can be operated correctly and securely. To foster effective SA, there must be systematic techniques to reflect the fact that the system meets its security requirements and, at the same time, is resilient against security vulnerabilities and failures. Quantitative SA evaluation applies computational and mathematical techniques for deriving a set of SA metrics to express the assurance level that a system reaches. Such metrics are intended to quantify the strength and weaknesses of the system that can be used to support improved decision making and strategic planning initiatives. Utilizing metrics to capture and evaluate a system’s security posture has gained attention in recent years. However, scarce work has described how to combine SA evaluation while taking into account both SA metrics modeling and analysis. This paper aims to develop a novel approach for the modeling, calculation, and analysis of SA metrics that could ultimately enhance quantitative SA evaluation.

Context-Aware Ontology-based Security Measurement Model

Security measurement models (SMMs) and quantitative security metrics (QSMs) are crucial pillars of systematic security measurement. How to design the enhanced SMMs and effective QSMs has been seriously considered in recent years. However, to the best of our knowledge, a desirable SMM has not yet been provided to measure the security effectiveness of a national-level network (NLN) due to its specific attributes. NLN has three main attributes, including plurality and diversity of network components, continuous changes, and simultaneous functionalities. These attributes cause three major challenges to designing a desirable SMM for NLN, including complexity, dynamic measurement, and multidimensionality. Hence, a desirable SMM for NLN should fulfill five desirability criteria to overcome the challenges, including simplicity, dynamics, comprehensiveness, scalability, and simultaneous overall and granular measurement. Considering the comparison of SMMs, such a desirable model should exclusively be a context-aware ontology-based SMM (CAO-SMM). In this paper, we propose a three layers CAO-SMM in which a comprehensive set of contextual dynamic QSMs are embedded. Our proposed SMM measures the security effectiveness component of network security situation relying on three indices: (1) deterrence against threats; (2) resiliency versus attacks; (3) survivability to impacts. First, an ontology-based SMM is designed. Then, the context-awareness feature is embedded to turn it into a CAO-SMM. Eventually, the desirability of our proposed CAO-SMM and its embedded QSMs are evaluated. CAO-SMM desirability along with the comprehensive coverage and distribution of its embedded QSMs enable us to precisely measure the security effectiveness across the whole network and its contextual components, including the network functionalities.

Research on Quantitative Security Protection Technology of Distribution Automation Nodes based on Attack Tree

In order to improve the security of distribution automation system nodes and ensure the safe operation of distribution network, a quantitative security protection technology for distribution automation nodes based on attack tree is proposed. This paper analyzes the factors of node risk assessment of the distribution automation system, and through the evaluation and analysis of node vulnerabilities; it discovers the faulty nodes in the distribution automation system in advance. Based on the node vulnerability evaluation results of the distribution automation system, the risk of the distribution automation system is comprehensively evaluated using the attack tree. Establish the distribution network control model under network attack, locate the fault node, and use trusted computing technology to design trusted distribution terminals. When the amount of data is large, more effective symmetric encryption algorithm SM4 is required to achieve node security protection in the distribution network automation system. The experimental results show that the method has high fault node location accuracy, low reliability calculation time, and the distribution automation system network has certain robustness, which fully verifies the application effect of the method.

Application of game theory for modeling information security problems

There is a continuous development of information technologies in terms of diversity and level of their complexity, which is accompanied by an increase in requirements for information protection. With the development of scientific progress, attackers also improve their skills and knowledge causing more damage. Constant communication and increased availability of computing resources for attackers help them to carry out complex and distributed attacks at any moment of time. Since the beginning of the Internet, researchers have been studying the problem of cyber security. However, the problem is far from completely solved. Re-cently, game theory concepts have been applied to all levels of security, including cyberspace, often referred to as security games. Games involve the actions of two or more rational players who have a certain strategy and compete for a certain reward. Game theory secures escrow using quantitative security measures rather than the qualitative measures provided by cryptographic security. In addition, game-theoretic approaches can be extended to design mechanisms that allow system designers to shift balances and predict outcomes in favor of defenders using complex play designs. Qualitative ways of overcoming traditional approaches to cyber security and privacy with game theory methods were described. In addition, in relation to cyber privacy, game theory has applications in information sharing, anonymity, privacy, and cryptography. This article examines research on game theory and differential game theory in network security at the applied level. It has been observed that most research works applying game theory concepts are not network specific due to the complexity of cyberspace. So, we present the best research methods that can be used to achieve better results in the defense of cyberspace using game theory.

Food Systems based on Life Cycle Assessment

The food system is a complex social system. At present, international studies on food security evaluation indicators are mainly at the level of quantitative security, and even after including quality security, ecological and market security, they are only analyzed at the national macro level, and cannot be compared with other major international food producing and consuming countries. Therefore, the construction of a complete food system model is of great practical research interest. We establish the current food system with efficiency and profitability as priorities. Considering that food cannot be completely separated from other agricultural production, and that defining strict geographical areas is also its difficult, we selected three-level indicators around the boundaries of the food system, such as factors such as import and export of agricultural products, based on the Life Cycle Assessment (LCA) analysis method. Regarding the optimization of the food system with the priority of equity and sustainability, we select two developed countries, the United Kingdom and the United States, and two developing countries, China and India.