Security Requirements Of Applications Research Articles

Modelling informal security requirements of cloud computing

Cloud computing has gained popularity for its cost-effectiveness. Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) are not new technologies, but rather new ways of providing computing services over the internet based on previous concepts. For this reason, many organizations use cloud computing platforms for their computing needs. Cloud computing, however, raises some concerns for these organizations. Several studies have been done on security issues with cloud computing, but most of them focus on formal security issues. Informal security issues have not been seriously studied in the existing research, to our knowledge. Through this study, we investigate and model informal security requirements for cloud applications. To validate our approach, we implemented the model of informal security requirements in the CloudSim simulator.

Security and Privacy Requirements for the Metaverse: A Metaverse Applications Perspective

The metaverse overcomes the time and space constraints of the real world and expands the physical world based on the Internet of Things, virtual reality, and digital twins. For this reason, interest in metaverse applications has recently increased because they can provide immersion and varied experiences similar to those in the real world. However, some security and privacy incidents are being encountered by these applications. Furthermore, users in the metaverse are concerned about personal data breaches, but metaverse studies on security and privacy are lacking. Thus, this study aims to propose security and privacy requirements for secure metaverse applications. To achieve this aim, we first analyze the existing metaverse-related studies and international standards from the perspective of security and privacy. We then present the security and privacy threats to the metaverse, which are identified by considering the characteristics of the applications. Finally, we propose security and privacy requirements and countermeasures to minimize these threats.

BV-ICVs: A privacy-preserving and verifiable federated learning framework for V2X environments using blockchain and zkSNARKs

As part of vehicle to everything (V2X) environments, intelligent connected vehicles (ICVs) generate a large amount of data, which can be exploited securely and effectively through decentralized techniques such as federated learning (FL). Existing FL systems, however, are vulnerable to attacks and barely meet the security requirements for real-world applications. If malicious or compromised ICVs upload inaccurate or low-quality local model updates to the central aggregator, they may reduce the accuracy of the global model, thereby reducing drivers safety and efficiency. This paper aims to alleviate these concerns by presenting BV-ICVs, a blockchain-enabled and privacy-preserving FL framework for ICVs in an edge-envisioned V2X environment. This system uses Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zkSNARKs) verification that is compiled as smart contracts to prevent malicious, compromised or even rational ICVs from uploading unreliable, erroneous or low-quality model updates. The verification process is embedded within the consensus of the underlying permissioned blockchain, which maximizes both the efficiency of the process and the utilization of computer resources. As demonstrated by discussions, security analysis, and numerical results, BV-ICVs reduced data poisoning attacks and increased the privacy protection and accuracy of FL.

DRLBTS: deep reinforcement learning-aware blockchain-based healthcare system

Industrial Internet of Things (IIoT) is the new paradigm to perform different healthcare applications with different services in daily life. Healthcare applications based on IIoT paradigm are widely used to track patients health status using remote healthcare technologies. Complex biomedical sensors exploit wireless technologies, and remote services in terms of industrial workflow applications to perform different healthcare tasks, such as like heartbeat, blood pressure and others. However, existing industrial healthcare technoloiges still has to deal with many problems, such as security, task scheduling, and the cost of processing tasks in IIoT based healthcare paradigms. This paper proposes a new solution to the above-mentioned issues and presents the deep reinforcement learning-aware blockchain-based task scheduling (DRLBTS) algorithm framework with different goals. DRLBTS provides security and makespan efficient scheduling for the healthcare applications. Then, it shares secure and valid data between connected network nodes after the initial assignment and data validation. Statistical results show that DRLBTS is adaptive and meets the security, privacy, and makespan requirements of healthcare applications in the distributed network.

Cybersecurity in smart local energy systems: requirements, challenges, and standards

Smart local energy system (SLES) can support tailored regional solutions through the orchestration of cyber physical architectures, coordinating distributed technologies, with operational and forecasting models across all energy actors. Unprecedented access to new information, data streams and remotely accessible control can substantially benefit the multi-objective optimisation of multiple performance metrics. Given the expansion of this internet of things (IoT) and cyber-physical system (CPS), it is important to not only design effective detection and management of potential cybersecurity issues, but also to address the challenges in having affective and adaptive governance—built on standards to ensure the security of the IoT to minimise risks and harms to all users. This study conducts an extensive and critical investigation into the existing standards and identifies areas to focus on as to support the expansive adoption of cyber physical networks. Although existing standards and protocols are highly fragmented, our findings suggest that many of them can meet the requirements of the applications and infrastructures of SLES. Additionally, many standards have been introduced to protect information security and personal privacy due to their increasing importance. The research also suggests that the industry needs to produce more affordable and cyber-secured devices and services. For the government and regulators, relevant guidelines on the minimum function and security requirements for applications should be provided. Additionally, compliance testing and certifications should be in place and carried out by an independent third party to ensure the components of SLES ecosystem with a satisfied security level by design.

An Attention-Guided Framework for Explainable Biometric Presentation Attack Detection.

Despite the high performances achieved using deep learning techniques in biometric systems, the inability to rationalise the decisions reached by such approaches is a significant drawback for the usability and security requirements of many applications. For Facial Biometric Presentation Attack Detection (PAD), deep learning approaches can provide good classification results but cannot answer the questions such as “Why did the system make this decision”? To overcome this limitation, an explainable deep neural architecture for Facial Biometric Presentation Attack Detection is introduced in this paper. Both visual and verbal explanations are produced using the saliency maps from a Grad-CAM approach and the gradient from a Long-Short-Term-Memory (LSTM) network with a modified gate function. These explanations have also been used in the proposed framework as additional information to further improve the classification performance. The proposed framework utilises both spatial and temporal information to help the model focus on anomalous visual characteristics that indicate spoofing attacks. The performance of the proposed approach is evaluated using the CASIA-FA, Replay Attack, MSU-MFSD, and HKBU MARs datasets and indicates the effectiveness of the proposed method for improving performance and producing usable explanations.

Інформаційно-аналітичне забезпечення функціонування організаційно-технологічних систем у складі науково-дослідних організацій

The program-technological architecture of corporate reporting system, structure of information presentation and data extraction is offered in the work, which will significantly simplify the interaction of senior management with electronic information resources of the organization, which is universities or research institutes. R&D and information-analytical systems, namely the composition of the information-analytical system of a high-level manager, the subject area of information-analytical system, basic requirements for building information-analytical systems, non-functional requirements, functional requirements, system application security requirements, information-analytical architecture systems. The proposed information and analytical system will solve the following tasks: collection, filtering and placement of information on plans and results of RandD, classification and analysis of available information to identify promising scientific and technical developments; providing analytical information to the management of the research organization.

Security Service Function Chain Based on Graph Neural Network

With the rapid development and wide application of cloud computing, security protection in cloud environment has become an urgent problem to be solved. However, traditional security service equipment is closely coupled with the network topology, so it is difficult to upgrade and expand the security service, which cannot change with the change of network application security requirements. Building a security service function chain (SSFC) makes the deployment of security service functions more dynamic and scalable. Based on a software defined network (SDN) and network function virtualization (NFV) environment, this paper proposes a solution to the particularity optimization algorithm of network topology feature extraction using graph neural network. The experimental results show that, compared with the shortest path, greedy algorithm and hybrid bee colony algorithm, the average success rate of the graph neural network algorithm in the construction of the security service function chain is more than 90%, far more than other algorithms, and far less than other algorithms in construction time. It effectively reduces the end-to-end delay and increases the network throughput.

Design and Test of an Integrated Random Number Generator with All-Digital Entropy Source.

In the cybersecurity field, the generation of random numbers is extremely important because they are employed in different applications such as the generation/derivation of cryptographic keys, nonces, and initialization vectors. The more unpredictable the random sequence, the higher its quality and the lower the probability of recovering the value of those random numbers for an adversary. Cryptographically Secure Pseudo-Random Number Generators (CSPRNGs) are random number generators (RNGs) with specific properties and whose output sequence has such a degree of randomness that it cannot be distinguished from an ideal random sequence. In this work, we designed an all-digital RNG, which includes a Deterministic Random Bit Generator (DRBG) that meets the security requirements for cryptographic applications as CSPRNG, plus an entropy source that showed high portability and a high level of entropy. The proposed design has been intensively tested against both NIST and BSI suites to assess its entropy and randomness, and it is ready to be integrated into the European Processor Initiative (EPI) chip.

Privacy-Preserving Two-Factor Key Agreement Protocol Based on Chebyshev Polynomials

Two-factor authentication is one of the widely used approaches to allow a user to keep a weak password and establish a key shared with a server. Recently, a large number of chaotic maps-based authentication mechanisms have been proposed. However, since the Diffie–Hellman problem of the Chebyshev polynomials defined on the interval [−1,+1] can be solved by Bergamo et al.’s method, most of the secure chaotic maps-based key agreement protocols utilize the enhanced Chebyshev polynomials defined on the interval (−∞,+∞). Thus far, few authenticated key agreement protocols based on chaotic maps have been able to achieve user unlinkability. In this paper, we take the first step in addressing this problem. More specifically, we propose the notions of privacy in authenticated key agreement protocols: anonymity-alone, weak unlinkability, medium unlinkability, and strong unlinkability. Then, we construct two two-factor authentication schemes with medium unlinkability based on Chebyshev polynomials defined on the interval [−1,1] and (−∞,+∞), respectively. We do the formal security analysis of the proposed schemes under the random oracle model. In addition, the proposed protocols satisfy all known security requirements in practical applications. By using Burrows-Abadi-Needham logic (BAN-logic) nonce verification, we demonstrate that the proposed schemes achieve secure authentication. In addition, the detailed comparative security and performance analysis shows that the proposed schemes enable the same functionality but improve the security level.

Optimization of the Enterprise Human Resource Management Information System Based on the Internet of Things

In this paper, the optimization of the enterprise HR information system is studied based on IoT first-off technology, the system demand phase is analysed, and the edge control system is designed and built. The hardware and software system and edge node management platform are implemented first, and then the communication scenarios between the edge layer of the system and the sensing layer, the edge layer, and the cloud layer are analysed, and the business type-driven link selection algorithm and the northbound multilink switching algorithm are designed and implemented, respectively, to guarantee the communication reliability between different layers of the system. Based on the implementation of the above functions, the edge control system can meet the intelligence, expandability, and security requirements of IoT applications. An in-depth investigation and research are launched mainly on the enterprise demand to determine the functional requirements and performance requirements of the enterprise and to achieve the basic logical structure; in the system design phase, the system architecture and other aspects of the design are realized. According to the conditions of the system function structure, a number of system module functions are designed in detail. The system is composed of the following modules, namely, personnel change management, organization management, and salary and benefits management. The system consists of the following modules, namely, personnel change management, organization management, compensation and benefits management, and personnel information management. The system modules run through the process of human resource management; in the system implementation stage, the system coding and page operation are realized based on the development tools and software development techniques. The system finally achieves the system design objectives and is put on a trial operation to meet its actual business requirements.

VFChain: Enabling Verifiable and Auditable Federated Learning via Blockchain Systems

Advanced artificial intelligence techniques, such as federated learning, has been applied to broad areas, e.g., image classification, speech recognition, smart city, and healthcare. Despite intensive research on federated learning, existing schemes are vulnerable to attacks and can hardly meet the security requirements for real-world applications. The problem of designing a secure federated learning framework to ensure the correctness of training procedure has not been sufficiently studied and remains open. In this paper, we propose VFChain, a verifiable and auditable federated learning framework based on the blockchain system. First, to provide the verifiability, a committee is selected through the blockchain to collectively aggregate models and record verifiable proofs in the blockchain. Then, to provide the auditability, a novel authenticated data structure is proposed for blockchain to improve the search efficiency of verifiable proofs and support a secure rotation of committee. Finally, to further improve the search efficiency, an optimization scheme is proposed to support multiple-model learning tasks. We implement VFChain and conduct extensive experiments by utilizing the popular deep learning models over the public real-world dataset. The evaluation results demonstrate the effectiveness of our proposed VFChain system.

Chaos Based Secure Medical Image Transmission Model for IoT- Powered Healthcare Systems

Due to the extensive development of Internet of Things (IoT) in e-healthcare environment, security and integrity of the medical data especially medical images became a big issue. This paper proposes a chaotic security architecture for ensuring the security of the medical images during transmission and storage. The proposed model is built by comprising of three main stages. At first, message digest 5 algorithm is applied to the plain image for generating the seed key of Lorenz chaotic map. Subsequently Lorenz map is iterated to generate the chaotic key series utilized for further process. In second stage, dual confusion such as row-by-row and column-by-column confusion is executed on the plain image. At last, dual diffusion process is performed by applying binary reverse and compliment operation, in addition to that XOR operation is executed between diffused image and Lorenz chaotic key image. Simulation results and analysis of security level by applying different attacks indicates that the developed cryptosystem has the potential of satisfying the security requirements of IoT healthcare applications.

Security Challenges and Requirements for Smart Internet of Things Applications: A Comprehensive Analysis

Smart homes, smart cities, smart grids, and smart vehicles are a few examples of the Internet of Things (IoT) applications. These applications possess distributed data delivery infrastructures for remote access, storage, distribution, and processing. As a result, the communication amongst such smart objects offers new horizons for applications to improve human well being. However, massive communication within such cyber-physical systems poses a wide variety of security challenges. These security malfunctions may disturb the entire applications/systems and lead to lethal consequences. Therefore, trust and security are major prerequisites in advanced IoT applications. To this end, there is a dire need to understand the key security challenges within smart IoT applications, such as e-health, agriculture, and energy sectors. Therefore, this paper provides and discusses major security challenges and requirements of smart IoT applications in order to enhance their security.

Security and Privacy Implications on Database Systems in Big Data Era: A Survey

For over many decades, relational database model has been considered as the leading model for data storage and management. However, as the Big Data explosion has generated a large volume of data, alternative models like NoSQL and NewSQL have emerged. With the advancement of communication technology, these database systems have given the potential to change the existing architecture from centralized mechanism to distributed in nature, to deploy as cloud-based solutions. Though all of these evolving technologies mostly focus on performance guarantees, it is still being a major concern how these systems can ensure the security and privacy of the information they handle. Different datastores support different types of integrated security mechanisms, however, most of the non-relational database systems have overlooked the security requirements of modern Big Data applications. This paper reviews security implementations in today's leading database models giving more emphasis on security and privacy attributes. A set of standard security mechanisms have been identified and evaluated based on different security classifications. Further, it provides a thorough review and a comprehensive analysis on maturity of security and privacy implementations in these database models along with future directions/enhancements so that data owners can decide on most appropriate datastore for their data-driven Big Data applications.

Governance of IoT in order to Move ahead of the calendar & live the future today

The Internet of Things (IoT) is a system of interrelated computing devices, mechanical and digital machines, objects, animals or people that are provided with unique identifiers and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction. The Internet of Things (IoT) world may be exciting, but there are serious technical challenges that need to address, especially by developers. In this handwriting, learn how to meet the security, analytics, and testing requirements for IoT applications. A thing, in the Internet of Things, can be a person with a heart monitor implant, a farm animal with a biochip transponder, an automobile that has built-in sensors to alert the driver when tire pressure is low -- or any other natural or man-made object that can be assigned an IP address and provided with the ability to transfer data over a network. IoT has evolved from the convergence of wireless technologies, micro-electromechanical systems (MEMS), micro services and the internet. The convergence has helped tear down the silo walls between operational technologies (OT) and information technology (IT), allowing unstructured machine-generated data to analyze for insights that will drive improvements. The Internet of things (IoT) is the interconnection via the Internet of computing devices embedded in everyday objects, enabling them to send and receive data. If one thing can prevent the Internet of things from transforming the way we live and work, it will be a breakdown in security. Therefore, there are some important challenges in privacy and maintaining security of the Internet of things. In this paper, we are going to list the typical items which can be major challenges facing IoT.

Enhanced dynamic team access control for collaborative Internet of Things using context

SummaryThe development of the Internet of Things (IoT) aims to overcome security issues especially in critical areas that require integrity, confidentiality and a high level of privacy of the data. Among security challenges, the access control model should be well defined and adapted to the characteristics and security requirements of IoT applications. The work presented here proposes big enforcement of security for dynamic team access control using context information in order to provide granular and secure authorizations with different access control levels related to collaborative IoT. The enhanced dynamic team access control (EDTMAC) model introduces a formal theoretical model which relies on the top of the role‐based access control model. The use of different context information with a global context information security policy and security rules raised the model strength against unauthorized access and avoided security breaches such as the leak of information by providing the least privileges for the users. The result of EDTMAC analysis shows that the model is well adapted to IoT dynamic nature and collaborative IoT activities for teams. Moreover, the model is flexible and scalable, user‐driven, reliable, and secure against unauthorized access requests. The developed model supports the well‐known least‐privilege principle and separation of duties for the team members. In addition, it allows easy management of the teams, provides fine‐grained access control authorizations and supports delegation.

Monitoring Vehicle Communication and Road Condition in VANET

The connected vehicular ad-hoc network (VANET) and cloud computing technology allows entities in VANET to enjoy the advantageous storage and computing services offered by some cloud service provider. However, the advantages do not come free since their combination brings many new security and privacy requirements for VANET applications. In this article, we investigate the cloud-based road condition monitoring (RCoM) scenario, where the authority needs to monitor real-time road conditions with the help of a cloud server so that it could make sound responses to emergency cases timely. When some bad road condition is detected, e.g., some geologic hazard or accident happens, vehicles on site are able to report such information to a cloud server engaged by the authority. We focus on addressing three key issues in RCoM. First, the vehicles have to be authorized by some roadside unit before generating a road condition report in the domain and uploading it to the cloud server. Second, to guarantee the privacy against the cloud server, the road condition information should be reported in ciphertext format, which requires that the cloud server should be able to distinguish the reported data from different vehicles in ciphertext format for the same place without compromising their confidentiality. Third, the cloud server and authority should be able to validate the report source, i.e., to check whether the road conditions are reported by legitimate vehicles. To address these issues, we present an efficient RCoM scheme, analyze its efficiency theoretically, and demonstrate the practicality through experiments

A New Secure and Efficient Approach for TRNG and Its Post-Processing Algorithms

Random numbers are important parameters for the security of cryptographic applications. In this study, a secure and efficient generator is proposed to generate random numbers. The first part of the generator is a true random number generator that consists of chaotic systems implemented on FPGA. The second part of the generator is a post-processing algorithm used to overcome the problems that emerge from the generator or environmental factors. As the post-processing algorithm, Keccak, the latest standard of hash algorithm, was rearranged and used. Random numbers with the proposed approach meet the security requirements for cryptographic applications. Furthermore, the NIST 800-22 test suite and autocorrelation test are used to ensure the generated numbers have no statistical weakness. The successful test results demonstrate the security of the generated numbers. An important advantage of the proposed generator does not cause any data loss and perform 100% efficiency although data loss can be up to 70% in some post-processing algorithms.

Efficient Hierarchical Authentication Protocol for Multiserver Architecture

The multiserver architecture authentication (MSAA) protocol plays a significant role in achieving secure communications between devices. In recent years, researchers proposed many new MSAA protocols to gain more functionality and security. However, in the existing studies, registered users can access to all registered service providers in the system without any limitation. To ensure that the system can restrict users that are at different levels and can access to different levels of service providers, we propose a new lightweight hierarchical authentication protocol for multiserver architecture using a Merkle tree to verify user’s authentication right. The proposed protocol has hierarchical authentication functionality, high security, and reasonable computation and communication costs. Moreover, the security analysis demonstrates that the proposed protocol satisfies the security requirements in practical applications, and the proposed protocol is provably secure in the general security model.