Information Security Services Research Articles

AS-T[formula omitted]BP: An efficient assignment scheme for space TT&C tasks with bidirectional privacy-preserving under blockchain architecture

In recent years, the space Tracking Telemetry and Command (TT&C) network has attracted much attention because it can provide users with secure and convenient information services. However, there are still challenges in achieving efficient task assignments and providing privacy-preserving for both TT&C parties in precise space TT&C services. In this paper, we propose an efficient blockchain-based task assignment scheme (AS-T3BP) in space TT&C network. Specifically, we introduce authorized privacy set intersection to ensure bidirectional privacy security for task requesters and performers and integrate an improved cuckoo filter algorithm to achieve batch assignment for tasks. And AS-T3BP allows the executor to customize the access policies of TT&C information flexibly, and only authorized satellites can access the information and verify the assignment results. For tasks that fail to be assigned, we propose a distributed and credible task reassignment method, which publishes the tasks on the blockchain built by the TT&C base station, thereby ensuring the real-time and accuracy of task assignments. Performance analysis shows that AS-T3BP is effective and can minimize misinform rates and reassignment rates of 23.39% and 8.85%, alleviate the problem of inefficient task assignment, and still maintain system stability.

Cyber Security and Compliance Management through a Single Integrated Platform

Abstract: These days, any information security product or service used in an organization is a stand-alone solution. Examples include information risk management, data security, auditing, and incident management. Since different organizations use different services from different providers, there is currently no single platform or architecture that can address all of an organization's fundamental information security procedures in one easy step. Because of this, businesses must spend a significant amount of money on separate services in order to meet the information security standards that are necessary for their businesses. These dispersed services lead to an increase in physical and manual labor, disorganized processes, and a lack of clarity regarding all information security-related business issues. To solve these issues, the approach covered in this article combines information security as a service with end-to-end platform/framework to give organizations a single framework for all information security-related organizational aspects. A single service that can handle every information security-related work for the company, including risk assessment, mitigation, vulnerability assessment, incident management, threat analytics, risk response management, and auditing. This will assist the company in spending less money on a wider range of security-related services.

Российский бизнес в условиях роста киберпреступности: изменения экономического поведения и защитные механизмы

The article is devoted to the identification and analysis of new vectors of cybercrime development, their localization and prevention. The analysis of secondary data, questionnaires, and expert assessment are used as research methods for this problem. The statistics of cybercrime in foreign countries and Russia in recent years have been analyzed. It is found out how the domestic business has changed its attitude to the security of information and information systems of the company. The sectoral landscape of cybercrimes in the Russian Federation for 2023 is presented. New vectors of phishing development are considered in detail and the main resources forged by hackers during phishing attacks are identified. Special attention is paid to phishing by the method of distribution, which today poses the greatest danger to Russian companies. Spoofing has been studied as a new type of cyberattack, where masquerading as a legal object (computer, device or network) is used by hackers as a means of penetrating other computer networks. The characteristics of modern types of spoofing and the negative consequences for business that they lead to are given. The measures taken at the state level to counter new vectors of cybercrime development are indicated. The conclusion is substantiated that state support and information protection measures themselves eliminate the consequences rather than the causes of high cybercrime, which is why the security problem cannot be solved without the participation of domestic business and the population of the country. The consolidated participation of Russian business in the fight against cybercrime is noted, which found its concrete embodiment in the creation of the F.C.C.T. joint-stock company. The key areas of activity of this company in the information technology market and the results of its work in 2023 are highlighted. Attention is focused on the fact that the creation of a joint-stock company F.C.C.T. in the country does not fully solve the problem of ensuring information security, which primarily concerns small and medium-sized business structures. It is stated that many of them, especially in the Russian regions, are not ready to purchase information security services not only financially, but also organizationally. Due to the low demand of entrepreneurs for vulnerability search services in the company’s software, web applications and IT infrastructure, it is proposed to build a typical SOC that meets the most minimal standards for combating cybercrime. An algorithm has been developed to achieve them in the form of step-by-step implementation of simple organizational and methodological recommendations for the prevention of cybercrimes and minimizing their consequences for small and medium-sized businesses.

A Survey of Blockchain in Governance: Framework Selection and Future Implementation in Indonesian Government

Blockchain technology enables users to connect without the need for a third party or central server. This is achieved through the use of a decentralized system, ensuring that all data and information transacted are encrypted, verified, validated, and stored using mathematical consensus algorithms. This leads to blockchain being recognized as a technology characterized by decentralization, security, anonymity, transparency, immutable data, and trust. Blockchain is frequently associated with digital currency, although digital currency is just one of the outcomes of applying blockchain technology, resulting in cryptocurrencies. Currently, blockchain technology is a trend among academics and practitioners who are researching and developing blockchain technology for application in various domains, including government. Government systems and public servants often encounter issues related to data security. Hence, the research has the purpose to offer comprehension and perspectives on implementing blockchain technology within the government sector to enhance public service information security. The research was carried out by reviewing Scopus-indexed international articles published between 2019 and 2023, which are relevant to frameworks, consensus algorithms, and applications employed in the governmental domain. The research outcomes revealed that the Hyperledger Fabric framework, coupled with the Practical Byzantine Fault Tolerance (PBFT) algorithm, is the most suitable option for potentially developing blockchain-based government or public service applications for future implementation. Regarding this research, there are future challenges in the form of constructing prototypes and evaluating their effectiveness and efficiency. Therefore, further research and development efforts are essential to ensure that the application of blockchain technology in the government sector can be realized as required in the future.

Lagrangian Recurrent Steganalysis and Hyper Elliptic Certificateless Signcryption for Secure Image Transmission

Present-day evolution in communication and information technology dispenses straightforward and effortless access to data, but the most noteworthy condition is the formation of secure communication. Numerous approaches were designed for safety communication. One of the crucial approaches is image steganography. Moreover, provisioning of information security services is arrived at via cryptosystems where cryptosystems make certain the secure messages transmission between the users in an untrustworthy circumstance. The conventional method of providing encryption and signature is said to be first signing and then encryption, but both the computation and communication costs are found to be high. A certificateless signcryption mechanism is designed to transfer the medical data or images securely. This mechanism will minimize the storage and verification costs of public key certificates. The author of this article proposes a method named Lagrangian recurrent Steganalysis and Hyper Elliptic Certificateless Signcryption for transferring the medical data or images securely. In two sections the LRS-HECS method is split. They are medical image steganalysis and certificateless signcryption. First with the Chest X-Ray images obtained as input, a Codeword Correlated Lagrangian Recurrent Neural Network-based image steganography model is applied to generate steg images. Second, to transfer the medical images securely the steg images provided as input is designed a model named a Hyper Elliptic Curve-based Certificateless Signcryption. The issue of providing the integrity and validity of the transmitted medical images and receiver anonymity is addressed by the application of Hyper Elliptic Curve. Chest X-Ray pictures were used in experimental simulations, and the findings showed that the LRS-HECS approach had more advantages over existing state-of-the-art methods in terms of higher peak signal to noise ratio with data integrity and with reduced encryption time and transmission cost.

Assessment of Airport Service Quality at Mallam Aminu Kano International Airport (Makia) Kano

Airports are a hub for aviation activities which support Airlines operations. Airport service quality measurement is required to promote satisfaction level among Air travellers by continuously improving the defected services. The study purpose is to assess Airports service quality at Mallam Aminu Kano International Airport (MAKIA) in Kano. Using purposive sampling, MAKIA was picked out of 31 Airports in Nigeria. Cochran formulae was used to determine a total of 384 questionnaires which were administered to air travellers boarding and onboarding passengers at the terminal building. The Airport service quality measurement scale was adapted from SERVPERF model with 22 service attributes believed that air travellers attached more importance to. The study outcome showed that the average Airport service quality score was 2.701. In addition, the results revealed that there exists a statistically significant relationship between service quality and air traveller satisfaction on; reliable and updated electronic information system (P-value=0.004), Airport safety and security services (P-value= 0.000), Prompt service from airline operation (P-value= 0.001) and Provision of assistance to minor (P-value = 0.002). This study therefore concludes that Mallam Aminu Kano International Airport offered a bad service to air travellers. The study recommends among others that, Airport staff courtesy should be improved through subjecting their staff to behavioural management training by the top management. service quality is an area which both Airport management and airlines can increase their revenue through increasing patronages. Therefore, a decisive measure by the Airport authority to improve the service offered will increase the service quality rating at Mallam Aminu Kano International Airport.

Cryptography based on algebraic perpendicularities

Cryptography, the mathematics of protecting secret or sensitive information, is a continuously evolving area of interest. A concrete example of this is the fact that worldwide spending on information security and risk management technology and services has been estimated to reach over $150 billion in 2021. Modern cryptography is actually not a single separate domain of mathematics but an advanced encryption scheme can be based on applications of results in number theory, such as the Euler–Fermat Theorem, or involve the discrete logarithm problem using either a primitive root of a large prime or an element of an elliptic curve over a prime field. In the background, probability theory, statistics, studies on computational models and finite geometries, etc. play a major role. Recent research has considered even DNA-based molecular cryptography systems.

Особливості управління правами користувачів у корпоративних IT-системах

Today, there is no workplace at any enterprise where employees don’t use information technol-ogies. Automation provided by information technologies has already covered all the aspects of company’s activity: document flow, accounting, warehouse accounting, financial accounting, analytical accounting, and enterprise management. To work efficiently, employees need access to systems the use of which is required by their positions. The management and control of user accounts in corporate IT systems are serious tasks for the IT department or information security service. Since the systems are weakly integrated with each other, each of them requires a sepa-rate configuration of user accounts and corresponding access rights. The main directions in the management of access to corporate IT systems are the identification of accounts, the manage-ment of user accounts, and compliance with the requirements of authorized access rights. The modern concept of work with corporate systems consists in the formation of a service model based on the used IT systems. From the point of view of the service model, the company pro-vides an employee with a certain service based on the existing corporate systems. The organiza-tion of the effective management of user rights in corporate IT systems requires automation. A step forward in access management automation is the creation of self-service portals, where employees can familiarize themselves with the list of corporate services available to them and request access to them in the automated mode. The automation of the process of giving and changing user accounts in the corporate IT systems allows you to reduce the time it takes to cre-ate or change access rights, create prerequisites for controlling access rights to systems, and in-crease the efficiency of the IT department as a whole.

ПРОБЛЕМЫ ОБЛАЧНЫХ СЕРВИСОВ И МЕТОДЫ ЗАЩИТЫ ОТ РИСКОВ И УГРОЗ

More and more people are starting to use cloud services for storing, editing and transferring data via the Internet, because it is very convenient, not too expensive and does not require large resource intensity. In addition, with the development of remote work, almost all companies use cloud services, some pay for services, others create their own. Such servers sometimes store very important data, the loss of which would lead to disaster and huge financial losses for companies. Therefore, it is necessary not to forget about security and the need to protect information efficiently and continuously. In connection with world changes, this year the popularity of cloud information security services has grown very much due to the sharp number of attacks on various Russian information systems and resources of various industries, and therefore more and more attention and finances have been paid to this area and its protection in general. In this article, we will consider cloud services, possible risks, available ways to solve threats, as well as possible development in this direction.

Analysis of methods and algorithms for generating key data for FALCON-like electronic signature algorithms

At present and in the future, mathematical methods, mechanisms and algorithms of standardized asymmetric cryptotransformations such as electronic signature (ES) are and will be used for information cryptographic protection. Electronic signature is the main and essential component of cybersecurity, in terms of providing quality information security services such as integrity, irresistibility and authenticity of information and data being processed. However, there are well-founded suspicions that in the post-quantum period the existing ES standards will be broken and compromised using classical and quantum cryptanalytic systems with appropriate mathematical, software and hardware-software. An analysis was performed, which confirms that quantum computers have already been developed, manufactured and used. This work is devoted to the analysis of methods and algorithms for generating key data for Falcon-like algorithms of electronic signature. Some of the basic algorithms for Falcon-shaped algorithms of electronic signature are considered, namely the algorithm of key data generation and algorithm of random polynomials f, g generation, which satisfy the Gauss distribution. The Falcon algorithm itself is the finalist of the post-quantum electronic signature contest due to the satisfactory value of the public key and signature lengths, but the key data generation algorithm uses many methods and difficult to implement. The Falcon authors use this algorithm for polynomials n=512, 1024. To increase the sixth level of cryptostability, this algorithm can be expanded for n=2048. This work is devoted to study the Falcon algorithm, taking into account its expansion for n=512, 1024, 2048 in terms of generating key data. Also, the paper considers the results of justifying the choice of a mathematical apparatus for implementing a software package for generating a key pair of a cryptographic algorithm for an electronic signature in order to create reliable electronic signatures.

The role of national cybersecurity strategies on the improvement of cybersecurity education

Digital information and telecommunication technologies have not only become essential to individuals’ daily lives but also to a nation’s sustained economic growth, societal well-being, critical infrastructure resilience, and national security. Consequently, the protection of a nation’s cyber sovereignty from malicious acts is a major concern. This signifies the importance of cybersecurity education in facilitating the creation of a resilient cybersecurity ecosystem and in supporting cyber sovereignty. This study reviews a sample from world-leading countries National Cybersecurity Strategic Plans (NCSPs) and analyzes the associated existing cybersecurity education and training improvement initiatives. Furthermore, a proposal to adopt the Goal-Question-Outcomes(GQO)+Strategies paradigm into cybersecurity education and training programs curricula improvement to national cybersecurity strategic goals is presented. The proposal maps cybersecurity strategic goals to cybersecurity skills and competencies using the National Initiative for Cybersecurity Education (NICE) framework. The newly proposed cybersecurity education and training programs’ curricula learning outcomes were generated from the GQO+Strategies paradigm based on the three major cybersecurity strategic goals: Development of secure digital and information technology infrastructure and services, defending from sophisticated cyber threats, and enrichment of individuals’ cybersecurity maturity and awareness. It is highly recommended that cybersecurity university program administrators utilize the proposed GQO+Strategies to align their program’s curriculum to NCSP. Hence, closing the gap that exists with the relevant skills and sustain national cybersecurity workforces.

Input-Latency Free Versatile Bit-Serial GF(2 m ) Polynomial Basis Multiplication

Cryptography and error correction codes are widely used for information security and data integrity services in modern digital computing and communications systems. A number of standardized and published cryptography, and error correction algorithms utilize arithmetic operations over <inline-formula> <tex-math notation="LaTeX">$\text {GF}(2^{m})$ </tex-math></inline-formula>. The polynomial basis (PB) representation of <inline-formula> <tex-math notation="LaTeX">$\text {GF}(2^{m})$ </tex-math></inline-formula> elements is suitable for the support of multiple <inline-formula> <tex-math notation="LaTeX">$\text {GF}(2^{m})$ </tex-math></inline-formula> fields (that is, versatility). This article considers the problem of reduced hardware efficiency of versatile <inline-formula> <tex-math notation="LaTeX">$\text {GF}(2^{m})$ </tex-math></inline-formula> PB multipliers as a result of increased loading latency of the inputs and irreducible polynomial. In this context, to the best of our knowledge, this article proposes the first input-latency free versatile bit-serial <inline-formula> <tex-math notation="LaTeX">$\text {GF}(2^{m})$ </tex-math></inline-formula> multiplier using PB. The superiority of the proposed versatile PB multiplier is demonstrated for the case where the multiplication&#x2019;s inputs arrive serially in terms of higher output throughput and hardware efficiency compared to existing versatile PB and Gaussian normal basis (GNB) counterparts based on the application-specific integrated circuit (ASIC) and field-programmable gate array (FPGA) realizations, respectively. The proposed versatile PB multiplier improves hardware efficiency by factors of 1.8 and 2.5, respectively, compared to the versatile PB and versatile GNB counterparts.

Rural Tourism Public Service Performance Evaluation Based on Analytic Hierarchy Process

In recent years, more and more attention has been paid to the construction of rural tourism, and tourists’ demand for rural tourism public services has become stronger and stronger. Through the objective and fair evaluation of rural tourism public service performance, on the one hand, it is helpful to improve the overall satisfaction of tourists to rural tourism. On the other hand, it can also ensure the efficiency of public service financial investment and expenditure. Firstly, on the basis of theoretical summary and hierarchical analysis, this paper constructs the performance evaluation index system of rural tourism public service from five aspects of infrastructure services, public transport services, public information services, security services, and public environmental services. Then taking China as an example, the performance of rural tourism public service is evaluated by analytic hierarchy process. The results show that the construction of hard environment such as public transport services, security services, and infrastructure services is a key factor in the construction of rural tourism public services. Finally, according to the evaluation results obtained in this paper, some suggestions are put forward for the development of rural tourism and the improvement of public service quality in the future.

Comparative Analysis of Factors Affecting Quality of Community-Based Care Services in Korea.

Aging societies have an increased need for care services. To solve the problem of care, we suggest community care, through which medical services are provided that meet individual needs. Korea provides care services in advance of the community care project and implements quality control to improve the quality of these social services. Therefore, this study aims to compare and analyze the factors affecting user satisfaction in care services in both 2013 and 2016. We analyzed secondary data from 2013 and 2016 collected by the Social Security Information Service. These data include standardized metrics for the quality of care. Based on the evaluation indexes for care service in 2013 and 2016, we used commonly used indexes for analysis. Specifically, non-profit organizations were influenced by sales, accounting management, lifetime tenure rate, etc., while for-profit organizations were affected by number of users, contract termination, etc. In addition, on-site evaluation had a negative effect on the change rate of user satisfaction. Therefore, in order to increase satisfaction with care services, evaluation indexes by service type should be diversified and differentiated. In addition, field evaluations related to user satisfaction should be performed in order to provide care services appropriate for local characteristics.

AI-Based Secure Construction of University Information Services Platform

The service efficiency of the university information services platform directly affects the efficiency of university management. However, the university has rich data resources and complex management, and how to construct a comprehensive, standardized, efficient, and shared university information services platform has become a research hotspot. In recent years, the progress of artificial intelligence (AI) in many aspects has created opportunities for its large-scale application in smart campuses. With the wide penetration of AI technology into all walks of life, especially in the fields of industry, commerce, finance, security, and so on, some technologies have experienced practical tests. Many scholars have discussed the significance and possibility of the application of AI in the field of education from a theoretical level. The university’s secure information services platform can penetrate into all details of university management. Therefore, this paper studies the construction of a university secure information services platform based on AI, taking the dormitory allocation of freshmen and the face recognition of each building as the entry points. First, the beetle antennae search algorithm was introduced to improve the clustering efficiency and accuracy of the K-means algorithm for intelligent dormitory allocation. Then, the improved variational auto encoder-generative adversarial networks (VAE-GAN) model and convolutional neural networks (CNN)-based face recognition algorithm are proposed to enhance the security of building entry in universities. Finally, the simulation results reveal that the proposed two algorithms improve the clustering efficiency in dormitory allocation and the security of the university in the basic construction of the university information services platform, respectively.

Comprehensive Survey of Multimedia Steganalysis: Techniques, Evaluations, and Trends in Future Research

During recent years, emerging multimedia processing techniques with information security services have received a lot of attention. Among those trends are steganography and steganalysis. Steganography techniques aim to hide the existence of secret messages in an innocent-looking medium, where the medium before and after embedding looks symmetric. Steganalysis techniques aim to breach steganography techniques and detect the presence of invisible messages. In the modern world, digital multimedia such as audio, images, and video became popular and widespread, which makes them perfect candidates for steganography. Monitoring this huge multimedia while the user communicates with the outside world is very important for detecting whether there is a hidden message in any suspicious communication. However, steganalysis has a significant role in many fields, such as to extract the stego-message, to detect suspicious hidden messages and to evaluate the robustness of existing steganography techniques. This survey provides the general principles of hiding secret messages using digital multimedia as well as reviewing the background of steganalysis. In this survey, the steganalysis is classified based on many points of view for better understanding. In addition, it provides a deep review and summarizes recent steganalysis approaches and techniques for audio, images, and video. Finally, the existing shortcomings and future recommendations in this field are discussed to present a useful resource for future research.

DEVELOPMENT OF RECOMMENDATIONS FOR REDUCING CYBER THREATS DURING REMOTE WORK FROM THE POINT OF VIEW OF CYBER SECURITY

For several years in a row, Ukrainian organizations (first due to the Covid-19 pandemic and its consequences, and now military operations) and in general the world, have been forcibly transferring employees to a more optimal work format - this is remote work (work at home). According to statistics, this practice has shown its positive side in terms of higher labor productivity (less time spent on moving around the city, comfortable home conditions, etc.), however, from the point of view of cyber security, there has been an increase in cases of cyber threats (hereinafter - cyber threats) and the activation of cyber criminals. Remote work mode means full or partial transition to the use of personal devices by employees. Setting up remote work of employees requires a clear preparation of information systems within the organization, therefore information security (hereinafter - IS) and information technology (hereinafter - IT) services must ensure the security and continuity of the organization's business processes. Because remote work is associated with a high risk of cyber threats and the intervention of cybercriminals. Cybernetic threats (cyberthreats) are existing and/or potentially possible phenomena and factors that pose a danger to the vital interests of a person and citizen, society and the state, the implementation of which depends on the proper functioning of information, telecommunication, and information-telecommunication systems [1]. The formation and effective implementation of cyber security, within the framework of which a set of recommendations and measures for predicting and countering cyber threats is developed, is a necessary condition for the safe and continuous functioning of the organization.

Design of an Information Security Service for Medical Artificial Intelligence

The medical convergence industry has gradually adopted ICT devices, which has led to legacy security problems related to ICT devices. However, it has been difficult to solve these problems due to data resource issues. Such problems can cause a lack of reliability in medical artificial intelligence services that utilize medical information. Therefore, to provide reliable services focused on security internalization, it is necessary to establish a medical convergence environment-oriented security management system. This study proposes the use of system identification and countermeasures to secure system reliability when using medical convergence environment information in medical artificial intelligence. We checked the life cycle of medical information and the flow and location of information, analyzed the security threats that may arise during the life cycle, and proposed technical countermeasures to overcome such threats. We verified the proposed countermeasures through a survey of experts. Security requirements were defined based on the information life cycle in the medical convergence environment. We also designed technical countermeasures for use in the security management systems of hospitals of diverse sizes.

РОЛЬ ПРОФАЙЛИНГА В ОБЕСПЕЧЕНИИ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The article deals with the analysis of the place and importance of profiling in solving the issues of ensuring information security. It considers the concept and origins of profiling and its main components. The role of profiling in the field of information security is considered against the background of emphasizing of such areas of the profiling application in modern practice as the forensic, personnel and commercial. The analysis of tasks that can help to solve the use of profiling techniques, as well as the tools used for that, is carried out. The author analyzes possible sources of obtaining data for compiling a profile in commercial organizations. The article discusses questions that can be answered by employees of the information security services of companies using profiling techniques. The author also pays special attention to automated profiling techniques used today and supposed to be used in the near future. Examples of possible criteria for evaluating the user behavior when applying automated profiling techniques are considered. The article analyzes the advantages of automated profiling over traditional profiling, examples of practical software developments existing in that area, as well as the main issues that arise in the development and implementation of automated profiling techniques in the practice of commercial and government organizations that help in solving the information security issues.

Substantiation and proposals for the selection, improvement and standardization of the post-quantum electronic signature mechanism at the national and international levels

At present and in the future, mathematical methods, mechanisms and algorithms of standardized asymmetric cryptotransformations such as electronic signature (ES) are and will be used for information cryptographic protection. Electronic signature is the main and essential component of cybersecurity, in terms of providing quality information security services such as integrity, irresistibility and authenticity of information and data processed. However, there are well-founded suspicions that in the post-quantum period the existing ES standards will be broken and compromised using classical and quantum cryptanalytic systems with appropriate mathematical, software and hardware-software. An analysis was performed, which confirms that quantum computers have already been developed, manufactured and used. It is believed that the actual state of development and use of powerful quantum computers and their mathematical and software is obviously strictly confidential and secure, and only publicly known data on quantum computers and their applications in cryptology are disclosed. A preliminary analysis has been carried out showing that in Ukraine there is an understanding of the existence of threats to cybersecurity and information security in the case of using available standardized ES in the transition and post-quantum periods. Currently, development and adoption of post-quantum ES standards is also one of the main issues in ensuring the necessary levels of security in the transition and post-quantum periods. The objective of this article is to substantiate, compare alternatives and develop proposals for the selection and standardization of post-quantum ES standards at the international and national levels, taking into account the results of the 2nd and 3rd rounds of the NIST US competition and national researches.