Security Extensions Research Articles

S-RealSpec: A Security Extension to Detect SQLI attack and Sensitive Data Exposure

S-RealSpec: A Security Extension to Detect SQLI attack and Sensitive Data Exposure

A preliminary discussion on data privacy and data security issues

With the expeditious evolution of technologies such as the internet, big data, cloud computing, and artificial intelligence, data has ascended to the status of an invaluable and indispensable resource within the intricate tapestry of modern society. Yet, the labyrinthine ethical quandaries that intertwine with the processes of data collection, storage, processing, and application have progressively surfaced, capturing the rapt attention of academia, industry, and government as they grapple with this nascent challenge. However, with the extensive application of data technology, issues of data ethics have become increasingly prominent, posing unprecedented challenges to personal privacy, data security, social equity, and justice. This article aims to delve deeply into the connotation and extension of data privacy and data security, as well as its significant role in current society. By examining relevant research findings at this stage, analyzing the major challenges faced by data ethics and exploring corresponding strategies, this paper delves into the multifaceted challenges faced by data privacy and data security, highlights the inadvertent data collection by smart devices, the potential for re-identification of blurred and anonymized information through big data analysis, as well as the ongoing threats posed by hacker attacks, internal vulnerabilities, and the complexity of data circulation.

ProDetect: A Proactive Detection Approach of the TCP SYN Flooding Attack in the SDN Controller

The TCP SYN flooding attack or assault is one of the most prominent methods for the controller layer and the target server exhaustion in software-defined networking (SDN). The switches in the data layer or plane are forced to transfer an enormous amount of illicit SYN requests that the adversary creates to the controller because there are no forwarding rules. This extensive forwarding strains the computing capacity of both the data layer and the control layer and clogs the transmission route connecting them. We suggest a dynamic threshold-based countermeasure in this research, named ProDetect, to proactively cater to the SYN flooding attack in the SDN environment. We have fully implemented ProDetect as a security extension on the SDN controller for verifying inbound TCP connections. For SYN requests those that pass through ProDetect's validation test, the controller installs data forwarding policies for them and other malicious hosts sending forged requests are blocked. Therefore, these hosts are barred from sending any new TCP requests to the switches present inside the data layer. We have also employed a strategy to cope with forged MAC addresses in this work. When compared with the existing approaches, the evaluation of performance conducted by the simulation data reveals that ProDetect demonstrates low side effects for legitimate TCP requests and increases the total response time through an onset of SYN flooding operation.

An automated consistency management approach for a privacy-aware electric vehicle architecture

Modern vehicles contain a number of highly connected embedded systems that generate, store, and process information and exchange it with their environment. Since a large part of this information is privacy-critical, privacy laws such as the GDPR of the European Union apply to it. In this work, we evaluate the privacy-criticality of exemplary data and data flows of the electric driving domain on a reference architecture. We categorize the ECUs of the architecture based on the criticality of the data they process and propose measures and technologies as building blocks that provide adequate privacy protection according to the requirements given by the GDPR.To ensure that all requirements are met by the reference architecture, we propose a more principled solution that simplifies the mapping between an architecture and the measures. For this purpose, we propose an architecture description template in JSON and an algorithm for automated consistency checks that outputs the measures and the security extension needed per Electronic Control Unit (ECU) to comply with derived privacy requirements.

Towards Single-Event Upset detection in Hardware Secure RISC-V processors

Single-event effects and hardware security show close similarities in terms of vulnerabilities and mitigation techniques. Secure processors address physical attacks from the outside, such as external laser stimulation, to compromise the program and extract sensitive information from the systems. To overcome this vulnerability, secure extensions to the hardware architecture are often built into modern processor cores. Given the limited design resources often found in space or high-energy physics experiment development teams, this article addresses the extent to which secure hardware architectures can be a reliable source of processor SEU detection.

Localising decent work for poverty reduction in Africa: a case study of the decent work pilot project in Ghana

AbstractSince the adoption of Local Agenda 21, local governments have been enjoined to become active players in major development agendas, including the Sustainable Development Goals (SDGs). Despite the proliferation of literature on localisation strategies adopted by sub-national governments in pursuance of the 17 SDGs, little is known about localised efforts to fulfil SDG 8: “Promote inclusive and sustainable economic growth, employment and decent work for all”, particularly in Africa. Through a qualitative case study of the Ghana Decent Work Pilot Project, this paper examines how two local districts adapted and implemented the principles of decent work in a rural setting to improve the well-being of informal workers. The findings reveal that decent work was conceptualised by local authorities to mean the achievement of four main goals: the stimulation of local employment, extension of social security to informal entrepreneurs, adoption of best business practices and enhancement of entrepreneurs’ participation in local assembly decision-making. To enhance the achievement of these goals, the local authorities launched four main interventions in a gender- and poverty-sensitive manner. These interventions include institutional embedding of the project, capacity building for entrepreneurs, the unionisation of entrepreneurs and the introduction of local health and financing schemes. The study concludes with policy recommendations that, if adopted, would help to upscale and out-scale local efforts to promote decent work across Africa.

IMPROVING AN EXISTING OR ERECTING A NEW OR ADDITIONAL STRUCTURE BY ESTA OCCUPIERS: AN ANALYSIS OF Daniels v Scribante 2017 (4) SA 341 (CC), Erasmus v Mtenje [2018] ZALCC 12, and De Jager v Mazibuko [2020] ZALCC 7

The conduct of occupiers (i.e., occupiers in terms of the Extension of Security of Tenure Act 62 of 1997 (ESTA)) was central in three court judgments in recent years. The first judgment in the matter of Daniels v Scribante (2017 (4) SA 341 (CC)) is widely regarded as a progressive and transformative judgment, and as having opened the door for ESTA occupiers to improve their dwellings. In Daniels v Scribante, the Constitutional Court considered whether an ESTA occupier has a right to make improvements to a dwelling to make it habitable. The court found that ESTA affords an occupier the right to make improvements to their dwelling without the consent of the owner. However, the court pointed out that meaningful engagement between an owner or person in charge and an ESTA occupier was still necessary, because the exercise of an occupier’s right to make improvements could potentially encroach on an owner’s right to property. Since the judgment in Daniels was delivered, some ESTA occupiers, without prior consent or engaging meaningfully with the owner or person in charge, have improved or erected new structures – both inside and outside the demarcated parcel of land where they reside.Despite the ESTA occupiers’ need to improve or erect new structures, Daniels is context-sensitive and is therefore not blanket authority to engage in building operations anywhere on private farmland without prior, meaningful engagement with the owner or person in charge. Furthermore, reliance on Daniels v Scribante must be clearly justified. It is in this context that the case note emphasises that, where the current dwellings of ESTA occupiers are not suitable for human habitation and it is necessary to improve them or erect new buildings, the improvement must be done after proper meaningful engagement between the ESTA occupier and the owner or person in charge in accordance with the general guidelines set out in Daniels v Scribante. This is because the principles established in Daniels v Scribante set the scene for the much-needed balancing of rights between ESTA occupiers and owners, by alluding to the fact that ESTA occupiers are obliged to engage meaningfully with owners or persons in charge prior to embarking on improving or building new structures.The first part of this case note sets out and analyses case law that has dealt with improving or building new structures. The next part explores the competing rights and interests of ESTA occupiers and owners in relation to improving or erecting new structures. The third and final part of the contribution highlights and emphasises the importance of meaningful engagement before an ESTA occupier improves or erects a new dwelling on property belonging to another.

Secure Instruction and Data-Level Information Flow Tracking Model for RISC-V

With the proliferation of electronic devices, third-party intellectual property (3PIP) integration in the supply chain of the semiconductor industry and untrusted actors/fields have raised hardware security concerns that enable potential attacks, such as unauthorized access to data, fault injection and privacy invasion. Different security techniques have been proposed to provide resilience to secure devices from potential vulnerabilities; however, no one technique can be applied as an overarching solution. We propose an integrated Information Flow Tracking (IFT) technique to enable runtime security to protect system integrity by tracking the flow of data from untrusted communication channels. Existing hardware-based IFT schemes are either fine-, which are resource-intensive, or coarse-grained models, which have minimal precision logic, providing either control-flow or data-flow integrity. No current security model provides multi-granularity due to the difficulty in balancing both the flexibility and hardware overheads at the same time. This study proposes a multi-level granularity IFT model that integrates a hardware-based IFT technique with a gate-level-based IFT (GLIFT) technique, along with flexibility, for better precision and assessments. Translation from the instruction level to the data level is based on module instantiation with security-critical data for accurate information flow behaviors without any false conservative flows. A simulation-based IFT model is demonstrated, which translates the architecture-specific extensions into a compiler-specific simulation model with toolchain extensions for Reduced Instruction Set Architecture (RISC-V) to verify the security extensions. This approach provides better precision logic by enhancing the tagged mechanism with 1-bit tags and implementing an optimized shadow logic that eliminates the area overhead by tracking the data for only security-critical modules.

ALTERNATIVE ACCOMMODATION OF AN UNLAWFUL OCCUPIER’S CHOOSING: SOME REFLECTIONS ON Grobler v Phillips [2022] ZACC 32

An abundance of case law dealing with eviction has emerged. Clear rules for evictions exist in the eviction context and a solid body of law is being developed in this regard. For many years, little attention was given to the issue of unlawful occupiers refusing to be evicted based on preferences or wishes to remain in the same house or land under the Prevention of Illegal Eviction From and Unlawful Occupation of Land Act 19 of 1998 (PIE). However, in recent years disputes around the choice of alternative accommodation in terms of the Extension of Security of Tenure Act 62 of 1997 (ESTA) have increased significantly.

The Obligation on Landowners to Accommodate ESTA Occupiers on their Land: Critically Analysing Daniels v Scribante 2017 4 SA 341 (CC)

In Daniels v Scribante (hereafter the Daniels case) the Constitutional Court had to decide whether: (a) the Extension of Security of Tenure Act 62 of 1997 (ESTA) afforded Ms Daniels the right to make improvements to her dwelling; (b) if consent from the person in charge, Mr Scribante, was a requirement for Ms Daniels to make such improvements; and (c) if consent was not a requirement, if Ms Daniels could effect improvements to the total disregard of Mr Scribante. The judgment in Daniels is important not only because it paved the way for Ms Daniels to effect improvements on her existing dwelling without the consent of Mr Scribante, but also because it showed that under section 8(2) of the Constitution of the Republic of South Africa, 1996 (hereafter the Constitution) on the application of the Bill of Rights Mr Scribante owed a positive obligation to Ms Daniels to ensure that she lived in conditions that afforded her human dignity. In Daniels the Constitutional Court indicated that private landowners were enjoined by section 25(6) of the Constitution through ESTA to accommodate ESTA occupiers on their land. According to the Constitutional Court in Daniels, the nature of the obligation imposed by section 25(6) of the Constitution was both negative and positive, and in this particular case it rested on Mr Scribante. Against this background, this case note provides at the outset the salient facts and judgment of the Daniels case. This is followed by an analysis aimed at critiquing the judgment in Daniels pertaining to what is expected of private landowners in the new constitutional dispensation. It is concluded that more may be required from the private landowner – a positive duty – to ensure that ESTA occupiers enjoy fundamental rights.

The Influence of Training, Work Discipline, Motivation and Commitment to Work Performance on Agricultural Extension Service and Food Security in Bondowoso Regency

This study aims to investigate the effect of training, work discipline, motivation, and work commitment on the performance of agricultural extension agents and food security in Bondowoso Regency. This research was conducted using multiple linear regression and involved a sample of 100 respondents selected by purposive sampling technique. Data obtained from respondents were processed using SPSS software version 22.0. Data analysis was performed by applying multiple linear regression to evaluate the relationship between the independent variables (training, work discipline, motivation, and work commitment) and the dependent variable (instructor performance). The results showed that training, work discipline, motivation, and work commitment significantly affected the performance of the agricultural and food security extension officers in Bondowoso Regency. Training plays an important role in improving the performance of extension workers by providing the necessary knowledge and skills. High work discipline also contributes to achieving better performance. In addition, high motivation and strong work commitment also positively affect the performance of extension workers. This research has practical implications for the Department of Agriculture and Food Security in Bondowoso Regency to pay attention to the importance of training, work discipline, motivation and work commitment in improving the performance of extension workers.

Implementing a Public Policy to Extend Social Security to Informal Economy Workers in Zambia

This article analyses the strengths and bottlenecks of institutional capacity between social security institutions implementing the reform in Zambia, which focuses to provide social security to small-scale dairy farmers, a group of informal economy workers. Zambia’s informal economy workers absorb over 80 per cent of the labour force. This is a qualitative study of institutional capacity in the extension of social security. Twenty-one interviews were conducted with participants from Farmers’ Cooperatives (MCC), National Pension Scheme Authority (NAPSA), and Dairy Association of Zambia (DAZ). We selected participants through a purposive sampling technique. We reflected on data using a Consolidated Framework for Implementation Research (CFIR) built on thematic analysis. Analysis suggests that the institutions of the partnership are committed towards extending social security to informal economy workers. There was low involvement of local NAPSA officers in the project design and their role during implementation of the pension extension was unclear. This contributed to a lack of trust by some non-NAPSA members towards social security institutions. Knowledge and beliefs about the capabilities of implementers were essential in the activities for implementing the public policy on the extension of social security. However, there are several implementation lacunas concerning the process, its overarching infrastructure, and adequate human resources. There is a critical need to address gaps in process and procedures, equipment and materials, infrastructure, human resource, trust, and knowledge of context for the extension of social security to informal economy workers in Zambia. This could make the new public policy scheme more attainable.

DNS for IoT: A Survey.

The Internet of Things (IoT) is paving the way to becoming necessary in numerous aspects of people's lives. IoT is becoming integrated in many domains, such as medical, industrial, and personal. Recent years have witnessed the creation of many IoT technologies that differ not only in their applications and use cases but also in standards. The absence of universally accepted standards and the variety of technologies are only some challenges the IoT market faces. Other challenges include the constrained nature of most IoT devices, the diverse identification schemes, the inadequate security mechanisms, and the lack of interoperability between different technologies. The Domain Name System (DNS) persisted throughout the years as the Internet's naming service and accumulated more trust from users with the introduction of its security extensions. DNS could be utilized to address some of the challenges the IoT market faces. However, using DNS for IoT applications might jeopardize DNS infrastructure. In this survey, we study the coexistence of DNS and IoT. We define IoT, present its architecture and discuss its main challenges. We then introduce DNS and its function; we discuss its security and privacy drawbacks and the extensions standardized to address them. We further discuss the uses of DNS in IoT environments to address some of IoT's challenges and the impact these uses might have on DNS.

An Exploration of the Adoption of DNSSEC by Businesses within the Norwegian ccTLD

The Domain Name System Security Extension (DNSSEC) is a cryptographic extension to the Domain Name System (DNS). The DNSSEC gives the DNS hierarchy a chain of trust from the root zone all the way down to the domain. By utilising DNSSEC, the client can verify that the DNS server’s response has not been tampered with in transit using strong trustworthy cryptographic algorithms. This paper presents a pilot research into the adoption of DNSSEC in Norwegian (.NO) ccTLD. The data set investigated in this researched a collection of Norwegian businesses that have a domain within the Norwegian ccTLD. This research found out that the Norwegian ccTLD adoption rate is amongst one of the highest compared to other ccTLDs. The DNSKEY resource records (RRs) collected in this research were used to identify some potential weaknesses. These possible weaknesses include the algorithm used, how long validity there was on the DNSKEY, and shared DNSKEY values across multiple domains.

Dynamic Reduced-Round TLS Extension for Secure and Energy-Saving Communication of IoT Devices

The security of wireless Internet of Things (IoT) communication is a complex challenge due to not only growing attack surfaces and threats but also the limitations of energy consumption. As a significant portion of the IoT market is composed of both security- and energy-critical sectors, e.g., smart homes and e-health, there is a pressing demand for solutions to secure billions of IoT devices while minimizing energy footprint. To this end, this article proposes a transport layer security (TLS) extension to integrate a lightweight and self-monitored mechanism that dynamically balances communication security and power consumption according to the IoT device’s current battery level. Integrated within the TLSv1.3 protocol, the secure extension automatically adjusts the encryption round number of the negotiated cipher according to an operator-defined policy while ensuring the minimum required security level. A Proof-of-Concept (PoC) has been implemented on the wolfSSL library and a real-world IoT platform, on which the performance of the proposed mechanism has been reported for various lightweight ciphers. The results showed an energy reduction of encryptions by 57.1% and a battery saving of 9.4% when encrypting at 4 kBps with reduced-round encryption, demonstrating the potential of the proposed extension into the TLS protocol.

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

When the global rollout of the DNS Security Extensions (DNSSEC) began in 2005, it started a first-of-its-kind trial: increasing complexity of a core Internet protocol in favor of better security for the overall Internet. The necessary cryptographic key management is made particularly challenging by DNS' loosely-federated delegation substrate and unprecedented cryptographic scale. Though fundamental for current and future operational success, our community lacks a clear notion of how to empirically evaluate the process of securely changing (or transitioning) keys. In this paper, we propose two building blocks to fundamentally understand and assess key transitions. First, the anatomy of key transitions: measurable and well-defined properties of key changes; and second a novel classification model based on this anatomy to describe key transitions practices in abstract terms. Our anatomy enables the evaluation of cryptographic keys' life cycles in general, and comparison of operational practices with prescribed key management processes, e.g., RFC key rollover guidelines. The fine-grained transition anatomy is then abstracted through our classification model to characterize transitions in abstract terms which rather describe a transition's behavior than its specific features. The applicability and utility of our proposed transition anatomy and transition classes are exemplified for the global DNSSEC deployment. Specifically, we use measurements from the first 15 years of the DNSSEC rollout to detect and measure which key rollover/transitions have been used, to what degree, and what their rates of errors and warnings have been. Our results show measurable gaps between prescribed key management processes and key transitions in the wild. We also find evidence that such noncompliant transitions are inevitable in the wild.

STBEAT: Software Update on Trusted Environment Based on ARM TrustZone

In recent years, since edge computing has become more and more popular, its security issues have become apparent and have received unprecedented attention. Thus, the current research concentrates on security not only regarding devices such as PCs, smartphones, tablets, and IoTs, but also the automobile industry. However, since attack vectors have become more sophisticated than ever, we cannot just protect the zone above the system software layer in a certain operating system, such as Linux, for example. In addition, the challenges in IoT devices, such as power consumption, performance efficiency, and authentication management, still need to be solved. Since most IoT devices are controlled remotely, the security regarding system maintenance and upgrades has become a big issue. Therefore, a mechanism that can maintain IoT devices within a trusted environment based on localhost or over-the-air (OTA) will be a viable solution. We propose a mechanism called STBEAT, integrating an open-source project with ARM TrustZone to solve the challenges of upgrading the IoT system and updating system files more safely. This paper focuses on the ARMv7 architecture and utilizes the security stack from TrustZone to OP-TEE under the STM32 board package, and finally obtains the security key from the trusted application, which is used to conduct the cryptographic operations and then install the newer image on the MMC interface. To sum up, we propose a novel software update strategy and integrated ARM TrustZone security extension to beef up the embedded ecosystem.

Secure and Efficient Semantic Extension Search over Encrypted Documents by Integrating Cloud and Fog Systems

With the explosive increase of document files, more and more data owners outsource their documents to the public cloud, which can decrease the costs of local data management systems. However, the problem of information privacy leakage in the cloud is a great challenge and it has been attracting more and more attention. In this article, we propose a secure and efficient document search scheme, named SES, based on both the cloud and fog systems. All the documents are symmetrically encrypted before being outsourced to the cloud, and an index vector is constructed based on the keywords for each document. Specifically, we integrate the position information of keywords into the TF-IDF model to generate document vectors, which are accurate and inherent summarizations about the documents. In query requests, a data user needs to provide a set of keywords, which are first extended by the Word2Vec tool and then mapped to a query vector. The extension process of keywords makes the provided keywords more comprehensive and accurate, and hence, it improves document search accuracy. To achieve the forward and backward security, both the document vectors and query vectors are appended with an ingenious vector. The relevance score between a document and a query is defined as the inner product of the document vector and the query vector. We return the most k relevant documents as the search results to the data users. To protect the contextual information stored in the document and query vectors, we encrypt the vectors by the secure kNN algorithm. To improve the search efficiency, a searchable index structure for the document set is constructed based on the Diffie–Hellman secret key negotiation algorithm. The analysis and simulation results illustrate that the proposed scheme performs well in terms of both security and search efficiency.

Bivariate Polynomial Codes for Secure Distributed Matrix Multiplication

We consider the problem of secure distributed matrix multiplication (SDMM). Coded computation has been shown to be an effective solution in distributed matrix multiplication, both providing privacy against workers and boosting the computation speed by efficiently mitigating stragglers. In this work, we present a non-direct secure extension of the recently introduced bivariate polynomial codes. Bivariate polynomial codes have been shown to be able to further speed up distributed matrix multiplication by exploiting the partial work done by the stragglers rather than completely ignoring them while reducing the upload communication cost and/or the workers’ storage’s capacity needs. We show that, especially for upload communication or storage constrained settings, the proposed approach reduces the average computation time of SDMM compared to its competitors in the literature.

Gulf Region and EU’s Maritime Security Strategy: The Expanding ‘Blue Border’?

The European Union (EU) and its core member states are active participants and stakeholders in the security affairs of the Gulf region. European maritime security is not only an important extension of European security in geospatial and functional areas, but also an indispensable part of Europe’s overall security strategy. However, the attention to the EU’s maritime security was distracted before 2010, while the concern for European maritime security and the Gulf region was limited to safe transit routes through the international straits and archipelagic waters of the Gulf region. With the tension in Gulf was increased by oil tanker attacks, the role of EU and its core member states as major stakeholders in Gulf maritime security affairs has been more and more important.