PLC control programs are vulnerable to real-time threats, where attackers can disrupt the backhaul/front-end network of industrial production by creating numerous loops or I/O operations, leading to severe consequences. Therefore, formal verification of PLC control logic at the binary level is essential. In this study, we introduce a framework designed for formal verification of PLC control logic at the binary level. Our verification framework is based on simulation execution, which extracts the core control logic from PLC binary code. Initially, we develop an efficient framework for automating the parsing of PLC programs at the binary level and constructing their control flow graphs (CFGs). Next, we devise an algorithm to transform the reversed PLC assembly program into an smv model, a widely accepted formal verification tool. Subsequently, we generate real-time requirements relevant to industrial production and perform formal verification on the constructed models. To assess the real-time performance of our framework in safeguarding PLC systems, we implement a prototype and evaluated it across various representative ICS scenarios. The evaluation results demonstrate the capability of our proposed approach to effectively detect synchronization threats in PLC logic control programs.

Industrial communication system (ICS) is widely used in critical infrastructure. As the scale of ICS increases, more and more devices are equipped with wireless capabilities which widen the scope of attack vectors. Therefore, its security has draw significant attention in recent years. As a key component of ICS, the security of Programmable Logic Controller (PLC) is directly related to ICS security. However, due to PLC's special mechanism, as long as the attack successfully break into the PLC, conventional control flow integrity (CFI) mechanism can't effectively protect its control flow. To address this problem, we propose a novel CFI mechanism to enhance the security of PLC. First, we design an instrumentation framework, with which we can add custom features such as CFI to enhance the PLC. Second, to effectively protect the control flow, we design a CFI mechanism based on sensitive memory protection using hash check. Last, to ensure the instrumented binary can be correctly loaded and match the constraint of runtime, we design a control binary reconstruction method. To evaluate the correctnessof our CFI mechanism, we perform experiments in two different PLCs using 15 different control binaries. The result shows that our CFI mechanism can successfully protect PLC's control flow. Besides, according to our evaluation, the size of the generated control binary instrumented with CFI mechanism code merely grow a little compared with its original size. As for the dynamically cost, our instrumented code does influence the count of the instructions non-ignorable but is within the acceptable range.

The flexibility and low cost of unmanned aerial vehicles (UAVs) offer great potential for them in areas such as disaster relief, energy line inspection, and traffic monitoring. Multiple UAVs form an airborne UAV network to share geo-tagged observation data for better collaborative missions. Blockchain can solve the security threats caused by the environment’s untrustworthiness and the UAV networks’ openness. However, the key to sharing data in blockchain-assisted UAV networks is identifying and understanding observational data and providing authentication query services in free boundary spatial. This paper proposes a blockchain-assisted UAV network data-sharing framework based on Non-Fungible Token (NFT). First, we design a marking and describing data method based on NFT to help geo-tagged data be effectively understood. Moreover, we propose a free-boundary spatial index tree to manage data and provide efficient queries. Furthermore, combined with the consensus mechanism and the blockchain transaction tree, the proposed sharing framework can provide query results authentication. Compared with the existing schemes, analysis and experiments demonstrate that our scheme could support the arbitrary expansion of UAV flight range and the random distribution of observation data in space, save at least 22% of storage overhead and reduce more than 36% of query time overhead.

The emerging federated learning (FL) enables distributed data mining for Internet of Things (IoT) big data while avoiding data outsourcing privacy risks via local data training and knowledge (i.e., model) sharing. However, only simplified local knowledge sharing will also cause user privacy leaks due to advanced attacks (e.g., model inversion or gradient leakage). Further, how to realize fine-grained and personalized privacy protection for IoT users is still a challenge. In this paper, we first propose a hierarchical cloud-edge orchestrated federated learning architecture for IoT, named HCE-FL, which aims to provide intelligent and distributed data analysis for IoT users. To address the FL privacy issues, we then design a multi-level access control encryption-based IoT knowledge sharing approach for HCE-FL. In our approach, IoT users could be classified into different levels according to their individual privacy requirements. In addition, the proposed multi-level access control encryption algorithm could ensure the confidentiality of the IoT knowledge flow, which runs through local clients, edge sanitizers, and cloud servers in HCE-FL. Moreover, security theoretical analysis shows that our HCE-FL could satisfy“no read” and no write” security rules for the mandatory IoT knowledge access control. Finally, we conduct experiments based on classic MNIST and CIFARIO datasets to evaluate our HCE-FL. The experimental results demonstrate that our solution can achieve personalized privacy-preserving FL without losing IoT data availability and users can obtain better model accuracy and convergence rate through secure IoT knowledge access and sharing.

The 6G (the sixth generation mobile communication) network is a heterogeneous network, which includes the cloud computing and the fog computing environment. And, the data securities in the 6G Systems may face great challenges. On the one hand, fine-grained data access control in fog and cloud computing environments is essential to the 6G network. On the other hand, quantum computing attacks may cause great security threats for the 6G network. In order to solve the above problems, we propose a lattice-based fine-grained data access control and sharing scheme in fog and cloud computing environments (LB-DACSS) for the 6G network. Firstly, our LB-DACSS scheme can achieve secure data sharing and fine-grained access control in fog and cloud computing environments. Secondly, we apply a lattice encryption algorithm to ensure our LB-DACSS scheme can withstand quantum computing attacks. Thirdly, our LB-DACSS scheme can achieve secure attribute revocation. Fourthly, we bind a unique secret value related to the user's attribute to construct the user's secret key. Finally, both formal security analysis and performance analysis show that our LB-DACSS scheme is efficient and secure.

Software-defined Home Networks (SDHN) is a key development trend of smart home. Security is still an important issue in SDHN. In this paper, a multi-stage attack mitigation mechanism is proposed for SDHN using Software-Defined Networking (SDN) and Network Function Virtualization (NFV). Firstly, an evidence-driven security assessment method using SDN factors and NFV- based detection is designed to perform security assessment along with observed security events. Secondly, an attack mitigation countermeasure selection method is proposed. The evaluation shows that the proposed mechanism is effective for multi-stage attack mitigation in SDHN.

Industrial Wireless sensor networks (IWSNs) are emerging as a promising technique for industrial applications. With limited energy resources, prolonging the lifetime of IWSNs is a fundamental problem for industrial applications. At the same time, Software- Defined Networking (SDN) and Network Function Virtualization (NFV) are future network techniques which make the underlying networks and node functions programmable. SDN and NFV have inherent advantages to control topology and node mode in IWSNs. In this paper, we propose a mechanism improving energy efficiency in industrial wireless sensor networks using SDN and NFV named M-SEECH for industrial application. Firstly, we propose a new architecture based on traditional IWSNs and operation mechanism using SDN and NFV. In the architecture, the global view and central control properties of SDN are utilized to monitor IWSNs. Also, the programmability of SDN and instant deployment capability of NFV are utilized to control the topology of IWSNs and the modes of nodes in IWSNs. Thirdly, we propose advanced algorithms for controller in IWSNs taking the advantages of SDN and NFV. By this way, the average lifetimes of IWSNs are prolonged. Finally, the case study and evaluation show the advantages of the proposed energy efficient scheme comparing with traditional methods.