Required Security Services Research Articles

DDQN-SFCAG: A service function chain recovery method against network attacks in 6G networks

Service Function Chain (SFC) as an effective solution can satisfy the diverse service requirements of six application scenarios in Network Function Virtualization (NFV)-enabled 6G networks. Resilience as a new key capability indicator in 6G networks puts forward higher requirements for the Quality of Service (QoS) of SFCs. In this article, we study the resilience recovery method in network attack scenarios. We make full use of the monitoring and early warning capability of the monitoring function and propose a proactive recovery method called Double Deep Q-Network based on SFC Attack Graph (DDQN-SFCAG). We fully consider the characteristics of network attacks to generate SFC attack graphs and determine the recovery strategy of SFC according to the service security requirements to provide guidance for recovery. Among them, we design three recovery modes for the recovered Virtual Network Functions (VNFs) to determine the optimal recovery strategy and avoid resource waste. We formalize the SFC recovery problem, which aims to minimize the recovery cost while meeting the recovery strategy. In order to shorten the interruption time, we use DDQN to quickly solve the recovery solution to ensure optimal recovery performance. Our extensive evaluation shows DDQN-SFCAG has excellent recovery performance in network attack scenarios and can reduce the recovery cost by at least 31% compared to the state-of-the-art methods.

Blockchain-Based Quality Assurance System for Academic Programs

Nowadays, technology is increasingly being adopted in different kinds of businesses to process, store, and share sensitive information in digital environments that include enormous numbers of users. However, this has also increased the likelihood of cyberattacks and misuse of information, potentially causing severe damage. One promising technology, which can provide the required security services with an improved level of efficiency, is blockchain. This research explores the use of Ethereum blockchain and smart contracts to create a secure and efficient quality assurance system (QAS) for academic programs. By utilizing blockchain and smart contracts, the proposed approach improves the integrity and reliability of sensitive information processed by the QAS, promotes transparency and governance, and reduces the time and effort required for quality operations. The current approach uses an additional access control layer to further enhance user privacy. Smart contracts automate various quality transactions and saves time and resources, and hence increases the efficiency of the QAS. The interplanetary file system (IPFS) is used to address the challenge of size limitations in blockchain. Additionally, this research investigates the use of various cryptographic schemes to provide robust security services at the application layer. The experimental results showed that the use of a hybrid cryptosystem relying on an Elliptic curve digital signature and AES encryption (AES_ECCDSA) outperforms other counterparts’ cryptosystems using an RSA digital signature and AES encryption (AES_RSADSA) and Elliptic Curve Integrated Encryption Scheme (ECIES) in terms of speed. The performance results showed that AES_ECCDSA consumes 188 ms to perform the required cryptographic operations for a standard-quality document with a size of 8088 KB, compared to the 231 ms and 739 ms consumed by the AES_RSADSA and ECIES schemes, respectively. This study presents a prototype implementation of the blockchain-based QAS, which outlines the processing model and system requirements for key QAS processes. It has been found that the cost and time required for blockchain operations vary depending on the size of the input data—a larger data size requires more time and costs more to process. The results of the current study showed that the time delay for blockchain transactions ranges from 15 to 120 s, while the cost ranges from USD 50 to USD 400. This research provides evidence that blockchain and smart contract technologies have the potential to create a secure, efficient, and trustworthy QAS environment for academic programs.

Research and Application of Active Security Protection Methods for Automotive Cloud

With the gradual maturity of the Internet of vehicles and cloud computing industry and the continuous evolution of network attack forms, the demand for cloud security in the automotive industry will increase year by year. In the automobile cloud platform environment, because the traditional security scheme is still effective for the north-south traffic, the security problem of the automobile cloud platform mainly lies in the security protection of the east-west traffic of the platform and the division of the security boundary. The purpose of this project is to solve the security risk of east-west cross-subnet traffic of the automobile cloud platform, especially the traffic security problem between hosts, in order to provide the next generation firewall, intrusion prevention and other professional security protection functions for the virtual network environment without affecting the service virtual machine. In order to achieve the above purpose, it is necessary to solve the problem of virtual switch diversion and virtual machine drift on the cloud platform, study the service security requirements of the automotive cloud platform, the relationship between data transfer and processing on the cloud platform, and finally provide a prototype system of active security protection for the cloud platform risks. The system implements VM microisolation, network attack defense, malicious code defense, ip address-based secure access policies, application-type secure access policies, and VM migration security functions in cloud application scenarios.

AMAKAS: Anonymous Mutual Authentication and Key Agreement Scheme for securing multi-server environments

The rapid growth of Internet users was the motivation of the emerge appearance of new computing models such as cloud computing, fog computing and edge computing. For this reason, the multi-server’s architecture has been introduced to extend scalability and accessibility. To ensure that these servers can only be accessed by the authorized users, many authentication and key agreement schemes have been introduced for multi–server environments. In this paper, we propose an anonymous mutual authentication and key agreement scheme for multi-server architecture based on elliptic curve cryptography to achieve the required security services and resist the well-known security attacks. Furthermore, formal and informal security analysis is conducted to prove the security of the proposed scheme. Moreover, we provide a performance comparison with related work in terms of computational cost, communication cost and the number of messages transferred on the public channel. This performance comparison clearly shows that the proposed scheme is highly efficient in terms of computation, communication cost and security analysis as compared to other related schemes which makes the proposed scheme more suitable and practical for multi-server environments than other related schemes.

Hardware Implementation of Effective Framework for the Trade-off between Security and QoS in Wireless Sensor Networks

The trade-off between security and quality of service (QoS) in wireless networks has attracted great attention in recent years. This paper presents a hardware implementation of a novel framework for realizing the trade-off between security and QoS in wireless sensor networks (WSNs) regarding the hostility of the operating environment and the available resources of our objects. For evaluating the hostility of the operating environment, we developed an effective intrusion detection unit that sends an alarm signal to a control unit that also collects the data-carrying information about the available resources. As our work is concerned with WSNs, we focus on the power consumption of sensor nodes as the considered object resources. According to the collected data from the intrusion detection unit and resources status unit, the control unit can evaluate the situation of the object in the operating environment and sends control signals to a security unit to select the appropriate level of security among three levels (low, medium, and high) available in our developed framework. The three security levels consider different combinations of the cryptographic algorithms Hash-based Message Authentication Code (HMAC) and Advanced Encryption Standard (AES), with different key lengths, regarding the required security services (confidentiality, authentication and integrity) and available resources. To reinforce the QoS, we considered the advantages of hardware implementation in addition to maintaining the object resources. Our framework has been implemented using Field Programmable Gate Array (FPGA), Virtex-7 (xc7v585tffg1761–3), which helps in achieving reasonable performance with a maximum operating frequency of 206.838 MHz and throughput of 2.3 Gbps.

An Effective and Secure Quality Assurance System for a Computer Science Program

Improving the quality assurance (QA) processes and acquiring accreditation are top priorities for academic programs. The learning outcomes (LOs) assessment and continuous quality improvement represent core components of the quality assurance system (QAS). Current assessment methods suffer deficiencies related to accuracy and reliability, and they lack well-organized processes for continuous improvement planning. Moreover, the absence of automation, and integration in QA processes forms a major obstacle towards developing efficient quality system. There is a pressing need to adopt security protocols that provide required security services to safeguard the valuable information processed by QAS as well. This research proposes an effective methodology for LOs assessment and continuous improvement processes. The proposed approach ensures more accurate and reliable LOs assessment results and provides systematic way for utilizing those results in the continuous quality improvement. This systematic and well-specified QA processes were then utilized to model and implement automated and secure QAS that efficiently performs quality-related processes. The proposed system adopts two security protocols that provide confidentiality, integrity, and authentication for quality data and reports. The security protocols avoid the source repudiation, which is important in the quality reporting system. This is achieved through implementing powerful cryptographic algorithms. The QAS enables efficient data collection and processing required for analysis and interpretation. It also prepares for the development of datasets that can be used in future artificial intelligence (AI) researches to support decision making and improve the quality of academic programs. The proposed approach is implemented in a successful real case study for a computer science program. The current study serves scientific programs struggling to achieve academic accreditation, and gives rise to fully automating and integrating the QA processes and adopting modern AI and security technologies to develop effective QAS.

Maintaining Zero Trust With Federation

Federated activity presents a challenge for enterprises with high-level security architectures. Federation involves information sharing among services and with working partners, coalition partners, first responders, and other organizations. Federation may be unilateral or bilateral with similar or dissimilar information-sharing goals. Strong internal security, including zero trust controls, often do not extend cleanly across enterprise boundaries, potentially leading to insecure shortcuts and workarounds that can become the rule instead of the exception. This paper presents methods for an enterprise to extend its zero trust security policies to include federation partners. It applies to federation partners that support the same security policies with compatible standards and services and to partners that provide a similar but incompatible security framework, a subset of required security services, or no security services. The partner organization may be fully trusted, partially trusted, or untrusted. Even for trusted partners, the services may not meet required security standards. Our solution combines selected partner security services, internal services, derived credentials, delegated authorities, and supplemental services to form the federation security architecture based on zero trust premises to the maximum extent. This paper uses the Zero Trust for Enterprise (ZTE) architecture as the starting point for a secure enterprise and addresses the challenge of extending this model to federate with different types of partners. We review the security approach, the security properties, and several options for an enterprise to maintain the ZTE security properties while enabling federated sharing with other enterprises that have different capabilities and levels of trust

An efficient watermarking algorithm for medical images

Medical images exchanged over vulnerable networks are sensitive to modifications or tampering which could lead to misdiagnosis, risking the lives of the patients. Therefore, to provide safe and secure transmission of medical images, key security requirements such as authenticity, integrity, and confidentiality must be addressed. In this paper, a novel and efficient algorithm is proposed which provides security services for transmitted medical images in tele-medicine applications. The proposed algorithm employs joint encryption/watermarking procedures to provide the required security services, as well as to provide control access privileges at the receiving side. The algorithm is based on reversible data hiding principles that guarantee the extraction of the hidden data while restoring the original image unaffected. The embedded data is basically two watermarks; a spatial domain watermark and an encrypted domain watermark. The dual watermarks allow the authenticity and integrity of the transmitted medical images to be verified in the spatial and encrypted domains. The proposed algorithm has been extensively evaluated using three performance metrics; embedding capacity, visual image quality, and entropy. The ability of the algorithm to fulfill the security, reversibility, and separability requirements has been validated.

A Three-Tier Approach for Lightweight Data Security of Body Area Networks in E-Health Applications

Wireless body area networks (WBANs) can enable e-health applications under Internet of Things (IoT) scenarios. However, to use WBAN technologies in practical applications, sensitive data collected by wireless sensors must be protected when transmitted across a network and until accessed by authorized applications or end-users. Specifically, it is necessary to provide confidentiality, integrity, authentication and access control in WBANs. This paper presents a security approach to provide these security services in a layered WBAN system using lightweight cryptography. Layer 1 consists of the communication between the sensor nodes and the base station (data acquisition); Layer 2 involves the communication between the base station and a data repository (data storage); and Layer 3 deals with the communication of end-users to the repository (data access). In the past, security has focused only on Layer 1 and for limited security levels. In this paper, security concerns in the three layers of a WBAN system are studied and addressed. As primary contributions, the design details of a secure WBAN system prototype and the impact of lightweight cryptographic engines on the performance of the primary use cases in the WBAN system are highlighted from data acquisition until data use. We present a novel WBAN system prototype that ensures most of the required security services for standard security levels.

Lightweight Secure MQTT for Mobility Enabled e-health Internet of Things

Internet of Things (IoT) is a smart interconnection of miniature sensors, enabling association of large number of smart objects ranging from assisted living and e-health to smart cities. IoT devices are equipped with limited resources in terms of power, memory and processing capabilities, therefore, presenting novel challenges to security. The purpose of this paper is to design energy efficient security mechanism for IoT based e-health system in which medical data is encrypted using lightweight cryptographic operations. The proposed scheme provides end-to-end data confidentiality for mobility enabled e-health IoT system. Our security scheme is simple and can be computed quickly on scarce resourced motes while providing required security services. Further, the mobility of patients is managed securely without the need of frequent reconfigurations during their movement within hospital/home premises. The evaluation results demonstrate that the proposed scheme reduces energy utilization to 17.84% and increases longevity of motes by 5.6 times compared to Certificate-Based Datagram Transport Layer Security (CB-DTLS). Energy consumption in configuration handover during mobility is handled by resource-rich devices, which make this scheme efficient in managing mobility of sensors. This work can be used as a basis for future research on securing patient data in an e-health system using energy efficient cryptographic operations.

An efficient hybrid model for secure transmission of data by using efficient data collection and dissemination (EDCD) algorithm based WSN

<span>Wireless Sensor Network (WSN) is one of the most important elements of the Internet of Things paradigm. Energy consumption is a vital issue in IoT and WSN. Security primitives in the IoT are energy consuming. Addressed the security issue for transmitted data by IoT sensor node add another challenge in term of energy consumption. finding the satisfactory solutions that reduce power consumption at the same time as making sure the required security services is not always an easy undertaking. Therefore, in this article, we proposed an efficient hybrid model for secure transmission of data from sensor nodes to receivers in WSN applications. The proposed model includes two algorithms Rivest–Shamir–Adleman (RSA) and efficient data collection and dissemination (EDCD). The key idea behind the proposed model is to prevent to secure sensed data if no significant change between the current data and the last transmitted data by the apply EDCD1 algorithm, which that will help in saving the sensor node energy. The reason for that the size of cipher data is so large compared to the sensed data, which that will increase the energy consumption. The outcome results shown that the proposed model has a high performance compared to RSA in term of energy consumption.</span>

Highlighting Issues Relevant to Encryption Algorithms and Security Schemes

Cryptography provides a security backbone for most Electronic-Services (E-Services). Computer systems’ users trust encryption techniques and protocols as robust mechanisms that deliver the required security services. Therefore, security researchers should act proactively to identify and resolve potential threats in current security schemes in order to preserve this relation of trust between average users and Secure E-Services. This research paper aims to address some of the potential threats in order to urge scholars to take action towards discussing and resolving them. Keywords: Certification Authority, Cryptography, Cryptanalysis, Information Security, Security Breaches

A Security Aware Resource Allocation Model for Cloud Based Healthcare Workflows

Objective: Cloud Computing is the new model in distributed computing that provides Software as a service (SaaS), Infrastructure as a service (IaaS), and Platform as a service (PaaS). Researchers utilize the services of cloud for running large scale data and other computation intensive applications like healthcare workflows. The major issue arises while allocating the cloud resources to the task in the workflows, in this paper an efficient scheduling method for work flow has been proposed. Analysis: The applications are modeled as workflows which include dependent tasks that are represented as a Directed Acyclic Graph (DAG) considering every node as a job. The known algorithms cannot solve the problem of resource allocation, and are categorized as NP hard problem. Findings: The proposed hybrid workflow scheduling algorithm which is the combination of Heterogeneous Earliest Finish Time (HEFT) and Security Aware and Budget Aware (SABA) algorithm helps to schedule the workflow efficiently with reduced makespan and required security services.

SABA: A security-aware and budget-aware workflow scheduling strategy in clouds

High quality of security service is increasingly critical for Cloud workflow applications. However, existing scheduling strategies for Cloud systems disregard security requirements of workflow applications and only consider CPU time neglecting other resources like memory, storage capacities. These resource competition could noticeably affect the computation time and monetary cost of both submitted tasks and their required security services. To address this issue, in this paper, we introduce immoveable dataset concept which constrains the movement of certain datasets due to security and cost considerations and propose a new scheduling model in the context of Cloud systems. Based on the concept, we propose a Security-Aware and Budget-Aware workflow scheduling strategy (SABA), which holds an economical distribution of tasks among the available CSPs (Cloud Service Providers) in the market, to provide customers with shorter makespan as well as security services. We conducted extensive simulation studies using six different workflows from real world applications as well as synthetic ones. Results indicate that the scheduling performance is affected by immoveable datasets in Clouds and the proposed scheduling strategy is highly effective under a wide spectrum of workflow applications.

Design and Develop a Video Conferencing Framework for Real-Time Telemedicine Applications Using Secure Group-Based Communication Architecture

One of the applications of modern technology in telemedicine is video conferencing. An alternative to traveling to attend a conference or meeting, video conferencing is becoming increasingly popular among hospitals. By using this technology, doctors can help patients who are unable to physically visit hospitals. Video conferencing particularly benefits patients from rural areas, where good doctors are not always available. Telemedicine has proven to be a blessing to patients who have no access to the best treatment. A telemedicine system consists of customized hardware and software at two locations, namely, at the patient's and the doctor's end. In such cases, the video streams of the conferencing parties may contain highly sensitive information. Thus, real-time data security is one of the most important requirements when designing video conferencing systems. This study proposes a secure framework for video conferencing systems and a complete management solution for secure video conferencing groups. Java Media Framework Application Programming Interface classes are used to design and test the proposed secure framework. Real-time Transport Protocol over User Datagram Protocol is used to transmit the encrypted audio and video streams, and RSA and AES algorithms are used to provide the required security services. Results show that the encryption algorithm insignificantly increases the video conferencing computation time.

Secured telemedicine using region-based watermarking with tamper localization.

Medical images exchanged over public networks require a methodology to provide confidentiality for the image, authenticity of the image ownership and source of origin, and image integrity verification. To provide these three security requirements, we propose in this paper a region-based algorithm based on multiple watermarking in the frequency and spatial domains. Confidentiality and authenticity are provided by embedding robust watermarks in the region-of-non-interest (RONI) of the image using a blind scheme in the discrete wavelet transform and singular value decomposition domain (DWT-SVD). On the other hand, integrity is provided by embedding local fragile watermarks in the region-of-interest (ROI) of the image using a reversible scheme in the spatial domain. The integrity provided by the proposed algorithm is implemented on a block-level of the partitioned-image, thus enabling localized detection of tampered regions. The algorithm was evaluated with respect to imperceptibility, robustness, capacity, and tamper localization capability, using MRI, Ultrasound, and X-ray gray-scale medical images. Performance results demonstrate the effectiveness of the proposed algorithm in providing the required security services for telemedicine applications.

A Procedure for the Optimal Management of Medium-voltage AC Networks with Distributed Generation and Storage Devices

A medium-voltage AC network with distributed generation and storage devices is considered for which set points are assigned in each time period of a given time horizon. A set point in a time period is defined by modules and phases of voltages in all nodes, active and reactive powers, on load tap changer and variable loads. When some parameters vary, in order to restore feasibility new set points need to be determined so as to minimize the variations with respect to the initial ones. This can be done by minimizing distributor's redispatching costs, which are modeled by means of binary variables, while satisfying service security requirements and ensuring service quality, which are represented by nonlinear constraints, such as the nodal balance of active and reactive power and the current transits on lines and transformers for security. Storage devices are modeled by means of constraints that relate adjacent time periods. A two-step solution procedure is proposed, which is based on decoupling active and reactive variables: in the first step a MILP model determines the active power production and the use of storage devices that minimize redispatching costs over all time periods in the time horizon; in the second step, given the optimal active power production computed in the first step, reactive variables in each time period are computed by solving a nonlinear programming model.

Security-aware optimization for ubiquitous computing systems with SEAT graph approach

For ubiquitous computing systems, security has become a new metric that designers should consider throughout the design process, along with other metrics such as performance and energy consumption. A combination of selected cryptographic algorithms for required security services forms a security strategy for the application. In this paper, we propose methods to generate security strategies to achieve the maximal overall security strength while meeting the real-time constraint. In order to express security requirements of an application, we propose a novel graph model called Security-Aware Task (SEAT) graph model to represent real-time constraints and precedence relationships among tasks. Based on the SEAT graph approach, we propose an optimal algorithm, Integer Linear Programming Security Optimization (ILP-SOP). For the special structures such as simple path graph and tree, we propose two dynamic programming based algorithms (DPSOP-path/tree) to generate the optimal security strategy. Experiment results demonstrate the correctness and efficiency of our proposed method. The experimental results show that, by using our proposed techniques, the security strength can be improved by 44.3% on average.

Secure e-Government Services

E-Government offers many benefits to government agencies, citizens and the business community. However, e-Government services are prone to current and emerging security challenges posing potential threats to critical information assets. Securing it appears to be a major challenge facing governments globally. Based on the international security standards – the paper thoroughly investigates and analyzes eleven e-government maturity models (eGMMs) for security services. Further, it attempts to establish a common frame of reference for eGMM critical stages. The study utilizes the Soft Systems Methodology (SSM) of scientific inquiry/ learning cycle adopted from Checkland and Scholes. The findings show that security services (technical and non-technical) are lacking in eGMMs – implying that eGMMs were designed to measure more quantity of offered e-government services than the quality of security services. Therefore, as a step towards achieving secure e-government services the paper proposes a common frame of reference for eGMM with five critical stages. These stages will later be extended to include the required security services.

A novel peer-to-peer SMS security solution using a hybrid technique of NTRU and AES-Rijndael

Short message service (SMS) is a very popular and easy to use communications technology for mobile phone devices. Originally, this service was not designed to transmit secured data, so the security was not an important issue during its design. Yet today, it is sometimes used to exchange sensitive information between communicating parties. This paper proposes an alternative solution that provides a peer-to-peer SMS security that guarantees provision of confidentiality, authentication, integrity and non-repudiation security services. A hybrid cryptographic scheme has been used which combines the NTRU and AES-Rijndael algorithms to achieve more robust functionality. For implementation, a mobile information device application (MIDlet) has been developed in J2ME to introduce a required security services for SMS. The developed application is tested on real equipment such as a Nokia N70. It is able to achieve all the required cryptographic operations completely on the users’ mobile phone in less than one second for each operation, and thus the mobile phone performance still remains effective.