Security Requirements Research Articles

An Anonymous Authenticated Group Key Agreement Scheme for Transfer Learning Edge Services Systems

The visual information processing technology based on deep learning (DL) can play many important yet assistant roles for unmanned aerial vehicles (UAV) navigation in complex environments. Traditional centralized architectures usually rely on a cloud server to perform model inference tasks, which can lead to long communication latency. Using transfer learning (TL) to unload deep neural networks (DNN) to the edge-fog collaborative networks has become a new paradigm for dealing with the conflicts between computing resources and communication latency. However, ensuring the security of edge-fog collaborative networks entity is still challenging. For such, we propose an anonymous authentication and group key agreement scheme for the UAV-enabled edge-fog collaborative networks, consisting of UAV authentication protocol and collaborative networks authentication protocol. Utilizing the AVISPA assessment tool and security analysis, the security requirements and functional features of the proposed scheme are demonstrated. From the performance results of the proposed scheme, we show that it is superior to existing authentication schemes and promising.

Customizable Presentation Attack Detection for Improved Resilience of Biometric Applications Using Near-Infrared Skin Detection.

Due to their user-friendliness and reliability, biometric systems have taken a central role in everyday digital identity management for all kinds of private, financial and governmental applications with increasing security requirements. A central security aspect of unsupervised biometric authentication systems is the presentation attack detection (PAD) mechanism, which defines the robustness to fake or altered biometric features. Artifacts like photos, artificial fingers, face masks and fake iris contact lenses are a general security threat for all biometric modalities. The Biometric Evaluation Center of the Institute of Safety and Security Research (ISF) at the University of Applied Sciences Bonn-Rhein-Sieg has specialized in the development of a near-infrared (NIR)-based contact-less detection technology that can distinguish between human skin and most artifact materials. This technology is highly adaptable and has already been successfully integrated into fingerprint scanners, face recognition devices and hand vein scanners. In this work, we introduce a cutting-edge, miniaturized near-infrared presentation attack detection (NIR-PAD) device. It includes an innovative signal processing chain and an integrated distance measurement feature to boost both reliability and resilience. We detail the device's modular configuration and conceptual decisions, highlighting its suitability as a versatile platform for sensor fusion and seamless integration into future biometric systems. This paper elucidates the technological foundations and conceptual framework of the NIR-PAD reference platform, alongside an exploration of its potential applications and prospective enhancements.

Aligning security and energy-efficiency using change detection and partial encryption for wireless camera networks

Wireless camera networks (WCNs) have seen widespread deployment in recent years, leading to an upsurge in monitoring and surveillance systems aimed at detecting foreign objects and changes within remote environments. However, wireless communication remains susceptible to cybersecurity threats, enabling eavesdroppers to access and manipulate confidential multimedia data effortlessly. Moreover, wireless cameras are low-power devices, encounter challenges as many state-of-the-art schemes adopt intricate security mechanisms, resulting in elevated costs, latency, and power consumption. This significantly compromises the stability of the node power and network lifetime and limits the applicability of security schemes in real-time implementations. This study addresses these issues by presenting DyimEnc, a dynamic image encryption scheme, to establish secure image transmission within wireless camera networks. The proposed scheme dynamically implements a security, complexity, and power consumption trade-off based on the currently available resources in each camera node. In the DyimEnc scheme, an effective in-node change-detection method is used to detect changes in the captured images and reduce the false transmission of images across the network. Additionally, a dynamic lightweight partial-encryption method is proposed to encrypt the edge maps of sensitive images that include changes. Moreover, a flexible key-management method is proposed for image encryption and transmission. Simulation results underscore DyimEnc's substantial impact, revealing significant reductions in power consumption, encryption cost, and transmission latency. It effectively achieves an average throughput of 254.9 KB/s and a remarkable 48 % decrease in network power consumption, showcasing a substantial 59 % improvement compared to a related study. Security analysis proved the robustness of our scheme in resisting attacks and satisfying the security requirements of WCNs.

Securing industry 5.0 using 6σ CYBERNETIC framework

The data-driven digital economy highly relies on immersive and emerging technologies, mass customisation, autonomous systems, and seamless connectivity. Enabling such an Industrial IoT/Industry 5.0 environment requires streamlined and end-to-end transparent methods for insights, visibility, and control. However, it is important to note that its success depends on data security metrics. The recent cyber-attacks in healthcare and industrial infrastructures have led service providers to high-risk scenarios. From supply chain to service delivery, remote functionality variables, enabling a fully connected factory is a major cybersecurity concern as emerging technologies employ different security requirements. To mitigate these risks, strategic, operational, technical, and cybersecurity alignment is a must, where the gaps between the production and process environments must be bridged to achieve the prime goal of a sustainable, secure, and technologically innovative factory. This research provides a systematic approach to bridging Industry 5.0’s QoS metrics and security gaps by implementing a Six Sigma (6σ) approach in a manufacturing environment. The approach further maps IT/OT, cloud, and cybersecurity standards, thereby enabling insights, visibility, and control. A healthcare 5.0 use-case is demonstrated to show how a 6σ implementation can improve the QoS metrics, unifying standards to achieve a secure, sustainable, resilient, and high-performance environment.

Including GRC Principles in IoT Security: A Comparison of Current Approaches and Future Prospects

With its ability to provide seamless communication between systems and objects, the Internet of Things (IoT) has completely changed the way we engage with technology. However, because the Internet of Things (IoT) ecosystem consists of a diverse variety of devices with differing security and compliance requirements, this interconnection also presents substantial issues for security, privacy, and compliance. In order to solve these issues, this research attempts to present a thorough examination of how Governance, Risk, and Compliance (GRC) concepts might be included into IoT security frameworks. The first section of the report provides an overview of IoT security as it is now, stressing the dangers and weaknesses that the ecosystem faces. The use of GRC concepts to reducing these risks and guaranteeing adherence to pertinent laws and guidelines is next covered. Through the incorporation of GRC concepts into IoT security frameworks, entities may adopt a comprehensive strategy for risk management and compliance assurance throughout the IoT ecosystem. A comparative study of current approaches that incorporate GRC guidelines into IoT security frameworks is also part of the project. This review assesses the benefits and drawbacks of various solutions, highlighting typical problems and suggested approaches for applying GRC concepts to IoT security. The study suggests potential options for incorporating GRC concepts into IoT security frameworks based on the comparative analysis's findings. In order to improve security and compliance in IoT systems, these include adopting new technologies like blockchain and artificial intelligence as well as developing standardized frameworks and protocols for integrating GRC concepts in IoT security. All things considered, this study offers insightful information about how GRC principles may be included into IoT security frameworks, providing useful advice for businesses trying to improve their IoT security posture and guarantee compliance with pertinent laws and standards.

Proposing the future skill requirements for maritime cyber security

Proposing the future skill requirements for maritime cyber security

Digital Contact Tracing Solutions: Promises, Pitfalls and Challenges

The COVID-19 pandemic has caused many countries to deploy novel digital contact tracing (DCT) systems to boost the efficiency of manual tracing of infection chains. In this paper, we systematically analyze DCT solutions and categorize them based on their design approaches and architectures. We analyze them with regard to effectiveness, security, privacy and ethical aspects and compare prominent solutions based on these requirements. In particular, we discuss shortcomings of the Google and Apple Exposure Notification API (GAEN) that is currently widely adopted all over the world. We find that the security and privacy of GAEN has considerable deficiencies as it can be compromised by severe large-scale attacks. We also discuss other proposed approaches for contact tracing, including our proposal <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TraceCORONA</small> , that are based on Diffie-Hellman (DH) key exchange and aim at tackling shortcomings of existing solutions. Our extensive analysis shows that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TraceCORONA</small> fulfills the above security requirements better than deployed state-of-the-art approaches. We have implemented <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TraceCORONA</small> and its beta test version has been used by more than 2000 users without any major functional problems <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://tracecorona.net/download-tracecorona/</uri> , demonstrating that there are no technical reasons requiring to make compromises with regard to the requirements of DCT approaches.

Talk Is Cheap: Self-Reported Versus Actual Marksmanship Proficiency Among Military and Community Samples

Abstract Marksmanship is a critical skill for military, law enforcement, and security professionals as well as recreational shooters who participate in competitions or hunting. Unfortunately, skill assessments vary wildly between branches of military service and even more so when compared with local law enforcement or security requirements. This heterogeneity creates wide-ranging opinions about what constitutes a firearm expert, with people claiming expertise despite only rudimentary training. The high degree of subjectivity undermines communication between firearm professionals and raises questions about the value of opinions. The current investigation thus explored self-reported marksmanship capabilities and their relationship with actual marksmanship capabilities. A novel firearm survey gauged subjective self-evaluations with participants also performing multiple objective shooting tasks. Participants included a community sample, who completed shooting tasks on simulator for safety reasons, and a military sample, who completed live fire exercises. Self-reported opinions sufficiently captured actual marksmanship variability among the community sample, although self-reported opinions did not predict marksmanship abilities among the professional military sample. This discrepancy identifies the relative practical value of using self-reported metrics based on the participant population, but more importantly, it underscores the limited value of professional opinion without some objective marksmanship data to provide a more direct comparison.

EPri-MDAS: An efficient privacy-preserving multiple data aggregation scheme without trusted authority for fog-based smart grid

With the increasingly pervasive deployment of fog servers, fog computing extends data processing and analysis to network edges. At the same time, as the next-generation power grid, the smart grid should meet the requirements of security, efficiency, and real-time monitoring of user energy consumption. By utilizing the low-latency and distributed properties of fog computing, it can improve communication efficiency and user service satisfaction in smart grids. For the sake of providing adequate functionality for the power grid, various schemes have been proposed. Whereas, many methods are vulnerable to privacy leakage since the existence of trusted authority may increase the exposure to threats. In this paper, we propose the EPri-MDAS: an Efficient Privacy-preserving Multiple Data Aggregation Scheme without trusted authority based on the ElGamal homomorphic cryptosystem, which achieves both data integrity verification and data source authentication with the most efficient block cipher-based authenticated encryption algorithm. It performs well in energy efficiency with strong security. Especially, the proposed multidimensional aggregation statistics scheme can perform the fine-grained data analyses; it also allows for fault tolerance while protecting personal privacy. The security analysis and simulation experiments show that EPri-MDAS can satisfy the security requirements and work efficiently in the smart grid.

Wireless IoT Networks Security and Lightweight Encryption Schemes- Survey

— IoT networks suffered from different kinds of attacks. The main issue of IoT security is the limitation of its node’s energy ability to perform big tasks such as encryption. This paper provides a comprehensive overview of the dynamic landscape of lightweight cryptography research, particularly in the context of real-time traffic security and Internet of Things (IoT) networks. The aim of this research is to identify the gaps in IoT research efforts and draw up ways to address it. The objectives are highlighting the global collaboration and standardization initiatives that have shaped its development. Also, it emphasizes the importance of balancing cryptographic strength with practical considerations such as encryption latency, energy efficiency, and memory constraints, particularly crucial in the context of resource constrained IoT devices. Furthermore, it highlights innovative approaches proposed by researchers to enhance the security of cryptographic operations while minimizing overhead and ensuring compatibility with evolving wireless environments. It calls for sustained research efforts to address these challenges and foster the development of robust cryptographic solutions capable of meeting the stringent security requirements of modern digital ecosystems.

Contradictions Identification of Safety and Security Requirements for Industrial Cyber–Physical Systems

Contradictions Identification of Safety and Security Requirements for Industrial Cyber–Physical Systems

Secure Agent-Oriented Modelling with Web-based Security Application Development

Nowadays, privacy and security have become challenges in developing web-based applications. For example, e-commerce applications are threatened with security issues like scammers, SQL injection attacks, bots, DDOs, Server Security, and Phishing. Although various security requirement methodologies are introduced, it has been reported that security consideration is consistently ignored or treated as the lowest priority during the application development process. Hence, the application is being violated by various security attacks. This paper introduces an alternative methodology to secure a web-based application through an Agent-Oriented Modelling extension. The secure AOM starts with Context and Asset Identification. The models involved in this phase are the Goal Model and Secure Tropos model. The second phase is the Determination of Security Objective. The model that will be used is Secure Tropos. The third phase is Risk Analysis and Assessment. The model that will be used is Secure Tropos. The fourth phase is Risk Treatment. In this phase, there is no model, but we use the suggestion from Secure Tropos: to eliminate risk, transfer risk, retain risk, and reduce risk. The fifth phase is Security Requirements Definition. The models that will be used are the scenario model, interaction model, and knowledge model. The last phase is Control Selection and Implementation. The model that will be used is the Behavior Model. We conducted a reliability analysis to analyze the participants' understanding of Secure AOM. From the reliability test, we can conclude that Secure AOM can become the alternative methodology, as the percentage that agrees that Secure AOM can protect users against making errors and mistakes is 80.9%, and 71.9% agree that SAOM can help to prevent users from specifying incorrect model elements and the relation between the model. This result means that over 50% of the participants agree that Secure AOM can be an alternative methodology that supports security risk management.

Lora Based Advanced Multipurpose Security System

Abstract: As the Internet of Things (IoT) continues to evolve, the demand for advanced multipurpose security systems has become increasingly pronounced. This review paper explores the integration of Long Range (LoRa) technology into the realm of security, presenting a comprehensive analysis of its applications and benefits. LoRa's exceptional characteristics, including extended range, low power consumption, and scalability, position it as a promising solution to the limitations of traditional security systems. The paper begins with an introduction to the current challenges in security systems and the need for innovative approaches. It then delves into a detailed exploration of LoRa technology, elucidating its technical aspects and showcasing its advantages over conventional communication protocols. A critical component of the paper lies in dissecting the elements of an advanced multipurpose security system. The integration of LoRa into intrusion detection sensors, video analytics through surveillance cameras, access control systems, and seamless connectivity with smart home devices is thoroughly examined. This comprehensive approach aims to highlight the versatility and efficacy of LoRa in addressing diverse security requirements. The communication architecture section elucidates the role of LoRa as the primary communication protocol. Emphasis is placed on the implementation of mesh networking to enhance reliability and coverage, accompanied by robust data encryption protocols to secure sensitive information. Realworld implementations and case studies form a pivotal part of this review, providing tangible examples of successful LoRa-based security systems. Performance metrics and comparisons with traditional security setups serve to underscore the practical advantages of adopting LoRa in security applications. In conclusion, this paper synthesizes key findings, emphasizing the transformative impact of LoRa on advanced multipurpose security systems. The integration of LoRa technology offers a scalable, efficient, and secure solution to the evolving landscape of security challenges. The abstract serves as a precursor to a comprehensive exploration of LoRa's role in shaping the future of security systems.

Behavioral equivalences for AbU: Verifying security and safety in distributed IoT systems

Attribute-based memory Updates (▪in short) is an interaction mechanism recently introduced for adapting the Event-Condition-Action (ECA) programming paradigm to distributed reactive systems, such as autonomic and smart IoT device ensembles. In this model, an event (e.g., an input from a sensor, or a device state update) can trigger an ECA rule, whose execution can cause the state update of (possibly) many remote devices at once; the latter are selected “on the fly” by means of predicates over their state, without the need of a central coordinating entity.However, the combination of different ▪systems may yield unexpected interactions, e.g., when a new device is added to an existing secure system, potentially hindering the security of the whole ensemble of devices. This can be critical in the IoT, where smart devices are more and more pervasive in our daily life.In this paper, we consider the problem of ensuring security and safety requirements for ▪systems (and, in turn, for IoT devices). The first are a form of noninterference, as they correspond to avoid forbidden information flows (e.g., information flows violating confidentiality); while the second are a form of non-interaction, as they correspond to avoid unintended executions (e.g., leading to erroneous/unsafe states).In order to formally model these requirements, we introduce suitable behavioral equivalences for ▪. These equivalences are generalizations of hiding bisimilarity, i.e., a kind of weak bisimilarity where we can compare systems up to actions at different levels of security. Leveraging these behavioral equivalences, we propose (syntactic) sufficient conditions guaranteeing the requirements and, then, effective algorithms for statically verifying such conditions.

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

The demand for encrypted communication is increasing with the continuous development of secure and trustworthy networks. In edge computing scenarios, the requirement for data processing security is becoming increasingly high. Therefore, the accurate identification of encrypted traffic has become a prerequisite to ensure edge intelligent device security. Currently, encrypted network traffic classification relies on single-feature extraction methods. These methods have simple feature extraction, making distinguishing encrypted network data flows and designing compelling manual features challenging. This leads to low accuracy in multi-classification tasks involving encrypted network traffic. This paper proposes a hybrid deep learning model for multi-classification tasks to address this issue based on the synergy of dilated convolution and gating unit mechanisms. The model comprises a Gated Dilated Convolution (GDC) module and a CA-LSTM module. The GDC module completes the spatial feature extraction of encrypted network traffic through dilated convolution and gating unit mechanisms. In contrast, the CA-LSTM module focuses on extracting temporal network traffic features. By employing a collaborative approach to extract spatio-temporal features, the model ensures feature extraction diversity, guarantees robustness, and effectively enhances the feature extraction rate. We evaluate our multi-classification model using the ISCX VPN-nonVPN public dataset. Experimental results show that the proposed method achieves an accuracy rate of over 95% and a recall rate of over 90%, significantly outperforming existing methods.

Authentication, Authorization, Access Control, and Key Exchange in Internet of Things

The Internet of Things (IoT) is a dynamic network of devices and infrastructure supporting instances composed to platforms being based on cloud/fog and blockchain technologies. Its intervention in more and more sensitive areas requires IoT entities (devices and platform instances) to communicate with each other via secure channels generally established by using cryptographical methods. This needs an authentic key exchange, which in turn requires an authentication process. Moreover, it has to be ensured that client entities can access only authorized services provided by authorized server entities. Additionally, requirements specifically introduced by IoT complicate realizing these security goals even more. This article introduces a novel approach providing authentication, authorization, access control, and key exchange in instance-to-instance, device-to-instance, and device-to-device communications to handle cloud/fog-based and blockchain-based platforms. In contrast to related work, realizations of these security goals are not disjunct processes and are integrated with each other in our approach combining zero-knowledge and identity-based schemes while meeting the IoT security requirements. Thus, it does not require any public data pre-distribution or secret pre-sharing between communicating entities, and no entity has to hold any device-specific or instance-specific data to be used for authentication or authorization. While supporting the autonomous character of IoT, our approach is independent of application and platform types without requiring additional components or procedures. Moreover, it is resistant to active man-in-the-middle attacks and does not include costly cryptographic operations. This article also demonstrates the high performance of our approach with regard to multiple affecting factors.

Features of state regulation of defense procurements

The article is devoted to the consideration of state regulation in the field of public procurement, in particular in the defense-industrial complex. The main law defining the basic principles and mechanisms of procurement is the Law of Ukraine «On Public Procurement». However, during the period of martial law, many changes were made in the procedures and mechanisms of public procurement, changes were already made more than once, through the adoption of separate laws and by-laws. The article analyzes the peculiarities of the application of public procurement mechanisms in certain sectors of the economy, in particular the defense-industrial complex. The necessity of modernization and improvement the procurement procedures for successful and effective compliance with the principles of competition and overcoming corruption, and other principles stipulated by legislation, is argued. Mechanisms for conducting procurement procedures are analyzed as one of the key elements of increasing the effectiveness of state economic policy, which is based, in particular, on the principles of fair competition, openness and transparency, non-discrimination of participants, objectivity and impartiality of evaluation of tender offers.&#x0D; It is substantiated that it is important to borrow international procurement experience to ensure compliance of national legislation with EU legislation. The issue of ensuring the appropriate level of defense capability of Ukraine in the conditions of countering full-scale military aggression on the territory of Ukraine by the Russian Federation is quite acute. A pressing challenge now is to ensure the rational spending of budget funds and the effective functioning and development of the state defense procurement system. It has been proven that the mechanism for the redistribution of budget funds should have the most transparent order of organization and the order of execution of the concluded procurement contract, which in the case of defense procurement involves reducing the number of closed procurements, excessive secrecy, increasing competitive procedures in the procurement of imported products and services, further improving pricing, canceling profit limits, accounting for inflation and life cycle cost.&#x0D; It is argued that consideration of physical, economic and informational security requirements is extremely important. It is about compliance with the principles of protecting customers from military threats, ensuring the simplification of public procurement by reducing the terms of the procurement procedure and simplifying the requirements for procedure participants, the effectiveness of the procurement process and the efficiency of the use of funds, primarily through the involvement of domestic entrepreneurs in tenders and ensuring the development of the domestic market, stability and defense capability.

Cross-platform adaptation of algorithmic editing techniques

The research relevance is determined by the rapid development of technology and the growing need for efficient data processing on various platforms. The study aimed to address methods that would enable the use of data editing algorithms on various operating systems and hardware platforms. A methodology was developed for studying cross-platform adaptation technologies, including cross-compilation, virtualisation, the use of universal libraries and Application Programming Interface, as well as methods for testing and optimising algorithm performance. The study addressed various approaches to implementing cross-platform compatibility, including the use of cross-compilation, virtualisation and containerisation. The main technical challenges are managing resources, optimising performance and ensuring compatibility with hardware from different platforms. The principles included selecting the most appropriate technology for the task at hand, considering performance and security requirements, and ensuring effective integration of existing systems and infrastructure. The workflows are focused on creating modular and extensible solutions that can easily adapt to changes in the technological environment and user requirements. In the context of this study, artificial intelligence software plays a key role in improving the efficiency and accuracy of data processing across different platforms. The results showed that artificial intelligence software can automate various stages of the video and audio editing process. Artificial intelligence is used to analyse large amounts of content data, such as video files, images and audio recordings. The study determined that artificial intelligence is increasingly relevant in various aspects of movie production. Artificial intelligence can analyse scripts, predict their potential success and suggest improvements using data from previous films and their commercial success

A Systematic Literature Review of Current Trends in Electronic Voting System Protection Using Modern Cryptography

Electronic voting, based on cryptographic protocols and blockchain technology, represents an advanced method for ensuring the security, transparency, and reliability of electoral processes. The scientific research presented in this article is devoted to the analysis of trends and advanced technologies in the field of electronic voting. The authors propose a systematic mapping of this area using bibliometric analysis. The research is based on the analysis of scientific articles extracted from the Web of Science and Scopus databases. Bibliometric analysis tools are used to automatically identify key topics and trends in the literature. The results of the study reveal the key directions of the development of electronic voting, including the integration of cryptographic protocols and blockchain technology. Specific aspects include improving privacy through the use of modern cryptographic protocols, creating an immutable register of votes using blockchain technology, ensuring trust through open-source code, and increasing resilience to cyber-attacks. These areas reflect the desire to develop efficient, transparent, and secure electronic voting systems. Based on the identified trends, recommendations are proposed for further research aimed at improving electronic electoral systems and their adaptation to the modern requirements of security and transparency in electoral processes.

Unsupervised Layer-Wise Score Aggregation for Textual OOD Detection

Out-of-distribution (OOD) detection is a rapidly growing field due to new robustness and security requirements driven by an increased number of AI-based systems. Existing OOD textual detectors often rely on anomaly scores (\textit{e.g.}, Mahalanobis distance) computed on the embedding output of the last layer of the encoder. In this work, we observe that OOD detection performance varies greatly depending on the task and layer output. More importantly, we show that the usual choice (the last layer) is rarely the best one for OOD detection and that far better results can be achieved, provided that an oracle selects the best layer. We propose a data-driven, unsupervised method to leverage this observation to combine layer-wise anomaly scores. In addition, we extend classical textual OOD benchmarks by including classification tasks with a more significant number of classes (up to 150), which reflects more realistic settings. On this augmented benchmark, we show that the proposed post-aggregation methods achieve robust and consistent results comparable to using the best layer according to an oracle while removing manual feature selection altogether.