Security Weaknesses Research Articles

Efficient Electronic Voting System Based on Homomorphic Encryption

In the last decade, E-voting has received great attention due to its advantages in efficiency and accuracy. Fan et al. presented a novel E-voting system named HSE-Voting by utilizing homomorphic signcryption. The HSE-Voting system was claimed to gain a provable security goal under the standard proof. In this paper, we illustrate that their scheme may suffer from some potential security issues. On the one hand, the voting information could be recovered by the authentication center (AC). On the other hand, any malicious voter could disrupt the voting system undetected by locally modifying his ballot. In order to increase the resilience of the voting system to risks, an improvement of the HSE-Voting system is developed. Our improved system fixes the above security weaknesses but increases the computation cost on the AC side by a small amount. In addition, the proposed scheme satisfies voter anonymity, ballot privacy, and verifiability of election results.

Security Weaknesses in IoT Management Platforms

Security Weaknesses in IoT Management Platforms

On Security Weaknesses and Vulnerabilities in Deep Learning Systems

On Security Weaknesses and Vulnerabilities in Deep Learning Systems

Sustainable crypto-currency blockchain defence against security attacks

In spite of increasing attacks against crypto-currency platforms, involving staggeringly large amounts of money, there has been surprisingly little research into how the blockchain infrastructure at the core of these platforms could be enhanced to improve security. This study examines security weaknesses in public blockchains in an attempt to gain a clearer view of the vulnerabilities.

Information Security Evaluation of Data Centre Architecture Using COBIT 5

Pusat Teknologi Informasi dan Pangkalan Data (Pustipanda) UIN Jakarta is an institution in charge of managing all information systems and data management for UIN Jakarta. However, security issues are still one of the problems faced by Pustipanda today, such as data leaks, and websites that are often problematic. This research aims to assess the level of information security at the UIN Jakarta Pustipanda data centre using the COBIT 5 framework. Information security is very important in supporting organizational operations, especially facing cyber threats in the data centre environment. The research approach included document analysis, observation, and interviews with stakeholders at Pustipanda UIN Jakarta. Identification of information security weaknesses, assessment of compliance with security standards, and design of appropriate solutions are the subject of the research. It is hoped that the results will provide a comprehensive picture of information security in the data centre as well as concrete recommendations for improvement. The results of the research include an understanding of the status of information security at Pustipanda UIN Jakarta, as well as guidelines for improving information security in accordance with COBIT 5 principles. These efforts aim to reduce risk and protect the integrity, confidentiality, and availability of data in the data centre environment

A new authentication scheme for dynamic charging system of electric vehicles in fog environment

AbstractThe dynamic charging system of electric vehicles has great potential for development. Electric vehicles initiate charging requests, and charging stations charge authorized electric vehicles. Fog computing improves the efficiency of request processing. However, open channels can be vulnerable to various attacks by a malicious adversary. Mutual authentication schemes allow users and charging stations to confirm each other. Therefore, numerous authentication and key agreement schemes have been proposed. In 2021, Babu et al. proposed an authentication scheme based on fog servers. Unfortunately, we found that their scheme can not resist FS impersonation attack and replay attack. Hence, we propose an authentication scheme between electric vehicles and fog servers to resolve the security weakness. Our scheme uses lightweight hash functions and XOR operations, which is more suitable for resource‐constrained electric vehicles. We proved our scheme can achieve mutual authentication by using BAN logic, and analyzed that our scheme can resist impersonation, replay, and known session key attacks, ensuring anonymity and untraceability. We finally compare computation cost and communication cost of our scheme with the existing schemes. The result shows that our scheme performs better than others overall. Therefore, our scheme is secure and suitable for dynamic charging systems.

Robust and energy-efficient authentication protocols for medical sensor networks

The growing incorporation of medical sensor networks into healthcare systems has emphasized the crucial requirement for secure and energy-efficient authentication protocols. The purpose of this study is to present a new method called Sidechain-based Trusted Platform Module (s-TPM) authentication, which aims to overcome the inherent difficulties in ensuring the security of medical sensor networks. This study performs a thorough comparison of s-TPM with two well-established authentication protocols, LEAP and TinySec, across multiple evaluation parameters, such as security, energy efficiency, and performance. The s-TPM authentication method utilizes sidechain technology to strengthen the resilience of authentication procedures in medical sensor networks. s-TPM utilizes a decentralized and tamper-proof system to reduce security weaknesses, offering a robust protection against unauthorized entry and data breaches. The results indicate that s-TPM surpasses LEAP and TinySec in terms of security resilience, guaranteeing a dependable protection against diverse cyber threats. Moreover, s-TPM demonstrates exceptional energy efficiency, which enhances the longevity of medical sensor devices’ operation while upholding a high standard of security. The results emphasize the importance of utilizing innovative methods, like s-TPM, to create authentication protocols that are specifically designed for the distinct difficulties encountered in medical settings.

Towards Practical Multi-Client Order-Revealing Encryption: Improvement and Application

Order-revealing encryption (ORE) enables the untrusted server to perform greater-than-comparison over ciphertext without compromising data privacy, which allows anyone to evaluate the lexicographic ordering of two arbitrary ciphertexts with a public comparison algorithm. However, most ORE constructions merely support ciphertext comparison for single-user. Recently, a variant of ORE named delegatable ORE has been introduced, which achieves cross-user ciphertext comparison by employing token mutual authorization technique at the cost of weak security, i.e., reveals the most significant differing bit of underlying plaintexts. To tackle this problem, we first present a deterministic property-preserving hash called DPPH with short-size hash value, and then propose a novel multi-client ORE scheme (m-ORE) from DPPH that supports ciphertext comparison among multiple users while hiding the most significant differing bits. Furthermore, we present an enhanced construction dubbed m-H-ORE by introducing a two-phase comparison method, which can achieve supper-efficient comparison in some cases, i.e., two ciphertexts with different bit-length. Finally, we provide formal security proofs of the proposed schemes and run extensive experiments to evaluate their performance on real-world and synthetic datasets. The results demonstrate that both of the proposed schemes can achieve a speedup of 47× and 138× in comparison cost to that of parameter-hiding ORE, respectively.

A Construction Method for Grade Protection System Based on STRIDE Threat Modeling

Abstract In recent years, against the backdrop of the national high attention to cybersecurity, the implementation of grade protection systems has been vigorously carried out in various industries within the Internet+ environment. However, the construction of grade protection systems has gradually revealed several issues: network product providers have a weak security awareness and lack of secure development experiences, leading to systems often failing to meet their grade protection requirements; Grade protection evaluation is complex and tedious, consuming a significant amount of time and labor costs. To address the issues above, this paper proposes a construction method for grade protection systems based on STRIDE threat modeling: by establishing the correspondence between threats and grade protection requirements, threats are eliminated during the system development process while implementing the content of grade protection requirements; through the security verification of threat elimination, materials for grade protection evaluation are accumulated, and work reuse is leveraged to alleviate the workload of grade protection evaluation. Implementing this method can effectively promote the construction of grade protection systems.

High-Performance Encryption Algorithms for Dynamic Images Transmission

With the proliferation of the internet, the issue of image tampering has escalated, necessitating robust image encryption schemes. Despite the multitude of proposed image encryption algorithms, challenges such as slow computational speed, weak security, and suboptimal visibility persist. This study addresses these challenges by introducing a high-performance encryption algorithm tailored for dynamic images—QEDI (Quick Encryption Algorithm for Dynamic Images). QEDI leverages elliptic curve-based asymmetric encryption algorithms and hash algorithms. The process involves using a hash algorithm to calculate the hash of the dynamic image slated for encryption, employing the elliptic curve algorithm to generate public and private keys, and utilizing the asymmetric encryption algorithm to process the image hash, resulting in a signature ciphertext. This ciphertext is embedded into the dynamic image, completing the encryption process. To enhance the execution speed without compromising the image quality and visibility, the bit depth of the dynamic image is reduced before hash calculation, and custom information fields are encapsulated to embed the signature ciphertext into the dynamic image. Experimental evaluations, conducted within a dynamic image generation system, encompassed assessments of security, encryption algorithm execution time, and image quality. The results indicate that utilizing QEDI for dynamic image encryption yields better security compared to EDI (Encryption Algorithm for Dynamic Images). QEDI exhibits minimal impact on image quality, with a noteworthy 69.77% reduction in execution time compared to EDI. Furthermore, when compared to existing algorithms employing image conversion for encryption, QEDI-encrypted images demonstrate enhanced visibility, better image quality, and expedited encryption speed.

A Review of SCADA IoT Device Vulnerabilities in the Power Grid (A Case Study of Smart Meter)

This article summarizes and organizes recent research findings in information and communication technology security developments integrated with smart grids. A vital component of a smart grid is a smart meter. It is relevant because it can collect, process, and transport customer’s data over the Internet. Whereas developments in smart grid and smart meter technologies have given new productivity gains, they have also presented new security concerns. Security is essential in defending both the smart grid and smart meter from cyber-attack. Guaranteeing safety is one of the most challenging aspects of designing and deploying a smart metering infrastructure. This study presents a thorough investigation of the integrity of smart metering technologies from multiple different viewpoints. It focuses on threats, countermeasures, and estimations. This article makes four contributions: First, all potential vulnerabilities in smart metering components are described and examined. Second, it assesses the impact of attacks that use these weaknesses to boost the performance of each part and the whole smart meter structure. Thirdly, potential countermeasures to defend smart meters are discussed. lastly, it discusses the unresolved issues surrounding smart meter security and future research areas. This evaluation is distinctive due to its exhaustive treatment of security weaknesses and attacks on smart meter components. In conclusion, the future vision is described.

Certificate-based authenticated encryption with keyword search: Enhanced security model and a concrete construction for Internet of Things

The Internet of Things (IoT) devices produce a humongous amount of data frequently stored on cloud servers, and as a result, cryptographic techniques to guarantee the privacy of outsourced data while preserving search ability on servers are becoming indispensable research topics. A prominent example of such topics is the concept of public key authenticated encryption with keyword search (PAEKS). In spite of the large number of PAEKS schemes in the literature, most existing schemes exhibit issues in certificate management, key escrow, or even key distribution. To address these issues, recently, PAEKS schemes in the certificate-based setting have gained attention. To the best of our knowledge, there exist only two Certificate-Based Authenticated Encryption with Keyword Search (CBAEKS) schemes, both presented with rather weak security models based on single keyword challenges. In this paper, we propose an enhanced security model for CBAEKS which captures notions of multi-ciphertext and multi-trapdoor indistinguishability, then proceed to devise a concrete instantiation for a CBAEKS scheme and formally prove its security under our enhanced model. Furthermore, we prove that the existing CBAEKS schemes are insecure under the enhanced security model. Comparisons with related schemes in the literature are also provided to demonstrate that the enhanced security is achieved at some affordable costs.

ECC based Authentication Approach for Secure Communication in IoT Application

Internet of Things (IoT) is an advanced applied science in recent years that enables communication among humans and smart components or among Internet-based components. Besides, IoT provides affiliation of physical and virtual elements that are fully controlled by different kinds of hardware, software, and interaction advancements. Though numerous methods of IoT offer many advantages to our day-to-day routine, it also possesses huge security weaknesses. The traditional methods are vulnerable to a huge range of attacks. Hence, establishing safe and effective security alternatives for the IoT environment remains as a main challenge and the major risk in this security solution is to transfer significant information in a secure manner. To address such limitations, an effective authentication approach named CHEK-based authentication methodology is devised for secure communication in IoT. The proposed authentication scheme consists of four steps and the authentication approach is developed by considering various security operations like hashing, encryption, secret key pairs, passwords, and so on. Moreover, the CHEK-based authentication scheme provides promising solution with minimum computational cost of 16.541 and minimum memory usage of 72.3MB.

Analysis of linear congruent methods and multiplicative random number generator in computer-based test

This research focuses on the implementation of computer - based test exams in high schools which face the problem of not having differences in exam questions which results in weak security and validity of exam results. Therefore, a randomization method is needed to overcome this problem. The method used in random ization is linear congruent methods and multiplicative random number generator. There are 101 random questions, but only 40 questions are displayed for each student with a reference value of Xn and C, 2 will be added for each package of exam questions and to avoid question code=0, the calculation results will be added 1. The linear congruent methods (LCM) results achieve 100% accuracy, while the method The multiplicative random number generator (MRNG) only achieved 62.5% accuracy in randomizing the exam que stions. This accuracy comparison highlights the difference in the ability of the two methods to generate random permutations of test item packages. LCM randomization accuracy ensures that each student will receive a different set of test questions in a con sistent manner. However, the low accuracy of randomization using MRNG indicates a weakness in generating permutations of exam question packages. The results of this study show that the LCM method is better than the MRNG in conducting exams.

Cryptanalysis on “a secure three-factor user authentication and key agreement protocol for TMIS with user anonymity ”

The health-care delivery services were made possible by telecare medicine information systems (TMIS). These systems are paving the way for a world where computerised telecare facilities and automated patient medical records are the norm. Authentication schemes are common mechanisms for preventing unauthorised access to medical records via insecure networks. Amin and Biswas recently proposed an authentication scheme for TMIS, asserting that their scheme can withstand various attacks. Despite this, their scheme still has significant security weaknesses. In this paper, we present a cryptanalysis of Amin and Biswas’ scheme and show that it is subject to a variety of attacks.

Exploring the viability of remote work for SME

PurposeThis study aims to identify and examine the relevance of implementing remote work by small and medium-sized enterprise (SME) business operators during the post-COVID-19 era in developing nations. Design/methodology/approachThe study utilised a qualitative methodology, conducting interviews with twenty SME businesses, including business leaders and management level employees. It explores the challenges faced by these operators in maintaining remote work and its impact on their business operations. Data was analysed and compiled using ATLAS.ti software. FindingsThe findings indicate that not all SME are capable of sustaining remote working environments. The nature of the business plays a crucial role in providing flexibility to employees in their operations. There are also weaknesses in remote work security that need to be addressed, as they can potentially impact business operations and performance. Research limitations/implicationsThe implications of the pandemic on business operations, regardless of size, are significant globally. This study sheds light on the challenges faced by SME in implementing remote work and its feasibility in the post-COVID-19 period. Originality/valueThe content of this paper is based on information, observations, and discussions with SME operators on how COVID-19 has compelled their businesses to adapt to the changing environment. Previously, there was no urgency for businesses to embrace remote work operations, but the pandemic has forced them to adopt such measures.

An investigation into the impacts of deep learning‐based re‐sampling on specific emitter identification performance

AbstractIncreasing Internet of Things (IoT) deployments present a growing surface over which villainous actors can carry out attacks. This disturbing revelation is amplified by the fact that most IoT devices use weak or no encryption. Specific Emitter Identification (SEI) is an approach intended to address this IoT security weakness. This work provides the first Deep Learning (DL) driven SEI approach that upsamples the signals after collection to improve performance while reducing the hardware requirements of the IoT devices that collect them. DL‐driven upsampling results in superior SEI performance versus two traditional upsampling approaches and a convolutional neural network‐only approach.

ChatGPT: The potential is clear, but what are the risks?

ChatGPT is everywhere and organisations are frantically searching for ways to get on the bandwagon. And the technology has great potential for transforming business processes. But like so many technological innovations, this one is a two-edged sword. And that's because it also offers similar benefits to people with malicious intent. And being so new, the security weaknesses and ethical consequences of the technology have yet to be fully explored.

Application of Electronic Certificate in Indonesia and the Adaptation of the Provision of Electronic Certification (Psre) Under the Menteri Agraria/BPN Nomor 1 Tahun 2021

Technology that is growing rapidly affects all levels of society to keep up with existing technological advances. It is no exception with various government agencies in Indonesia which are now implementing the speed of technology. This also applied by the National Land Agency or BPN, which through the regulation of the Minister of Agrarian and Spatial Planning Head of the Republic of Indonesia Land Agency or commonly referred to as ATR / BPN Number 1 of 2021 concerning Electronic Certificates which has now taken effect in January 2021. The regulation states that Electronic Certificates will replace physical certificates that were previously in the form of books. However, the problem experienced is that the Indonesian people do not fully understand the performance and also the use of electronic certificates due to the uneven socialization carried out by ATR / BPN. In addition, what is feared by the public is the very easy theft of data that occurs in Indonesia because of the weak security system especially in the Indonesian government.

A time-efficient and noise-resistant cryptosystem based on discrete wavelet transform and chaos theory: An application in image encryption

Due to the exponential rise of multimedia technologies, digital information privacy is now more crucial than ever. The process of transmitting data across a channel such as the internet has become a challenging task. In recent years, a variety of techniques for encrypting digital data have been proposed. However, due to shortcomings such as a high computational cost and weak security, it is important to build an encryption scheme that can provide a suitable level of security while also being time-effective. This research introduces a Discrete Wavelet Transform (DWT), chaotic map, and substitution box-based encryption scheme that is both time efficient and provides high levels of security for digital images. DWT is utilized to reduce the computation complexity of the encryption scheme proposed in this research. This is done by transforming the input image into its four frequency sub-bands (ΓΓ, Γħ, ħΓ, and ħħ) and selecting only the low-frequency sub-band (ΓΓ) for encryption, while the substitution boxes (S-boxes) and a chaotic map are used to increase the level of security. Using chaotic maps, random sequences are also generated to introduce confusion and diffusion. The final encrypted image is created by combining all of the non-modified and encrypted frequency bands. Finally, the results show that proposed encryption system nears the optimum values with a key-space of 2265 to avoid a brute-force attack.