This paper presentsdcGuard, a unified security approach for detecting and isolating misbehaving computing and forwarding nodes in multi-tenant virtualized cloud data centers.dcGuardemploys technological advancements in Virtual Machine Introspection (VMI), Software-Defined Networking (SDN), and secure probabilistic sketching to detect and isolate parts of the Virtual Machines (VMs) and network switches experiencing malicious behavior dynamically. The main contribution lies in designing a divide-and-conquer strategy that utilizes VMI and network programmability to apply focused distributed task and packet probing mechanisms on portions of the data center network rather than focusing the security functions on the entire physical network. The processing VMs and network switches are recursively partitioned into independent logical groups inspected individually to localize abnormal/malicious computing and switching nodes incrementally. This remarkably enhances the efficiency of the detection mechanisms, which opportunistically approaches a logarithmic time complexity in the number of protocol steps towards convergence (compared to a linear time complexity in traditional intrusion detection systems) when a relatively low number of hostile VMs and switches are present. Real experiments are evaluated, and a test-bed blueprint of the proposed design is emulated in a virtualized cloud environment using the Mininet emulator. The performance, convergence, and accuracy benchmarks corroborate the analytical advantage of the proposed security approach.

This paper presents Nodeguard, a security approach for detecting and isolating misbehaving Virtual Machines (VMs) in multi-tenant virtualized cloud data centers, based on the Virtual Machine Introspection (VMI) monitoring primitives. Nodeguard employs a divide-and-conquer strategy that checks logical groups of VMs to ensure the efficiency of the detection mechanisms which opportunistically approaches a complexity of$\mathcal{O}(\log_{2}(n))$when there is a relatively low number of hostile VMs. This greatly enhances the algorithmic time complexity of the pro-posed security system compared to the$\mathcal{O}(n)$complexity achieved by the traditional VMI inspection strategy that checks each VM separately. The approach has been evaluated in a virtualized cloud environment using the Mininet network emulator.

IIoT is the industrial tier of the Internet of Things initiative characterized by stringent security requirements, high sensor fault rates, and frequent mission-critical software updates. In this work, we propose the design and implementation of two security-aware protocols for node replacements and incremental software updates in IIoT. The node replacement protocol ensures the legitimacy of newly added replacement sensors by coordinating an efficient key management procedure to refresh their cryptographic keying material without the need of resource-intensive public-key cryptographic techniques. This is done by leveraging private secret sharing protocols and relying on the already established security associations between the IoT gateway and neighboring sensor nodes. The node update protocol supports multi-component software updates on the IIoT sensors and ensures their authenticity using probabilistic set membership data structures. This results in major reductions in network traffic overhead and protocol convergence times compared to traditional integrity enforcement approaches at the expense of minimal false positives probability. Moreover, the node update protocol realizes an incremental component loading and integrity verification mechanism on the IIoT sensors that lessens their storage requirements and avoids any superfluous operation intermission. A prototype implementation of the two proposed protocols demonstrates their feasibility in a real IoT network and exhibits high savings in convergence time and network traffic overhead.

The advancement in medical technology lead to the controlled monitoring of patients in recovery or at home even for patients with dementia. With all this progress the procedure for selecting viable donors remains for the most part unchanged. As such we present in this paper our idea which we will discuss in detail. The donor and patient will be filtered on a set of parameters before being listed as candidates. Rather than wasting time looking for potential matches, donors' locations are tracked and select candidates will be contacted with the patient details.

This paper presents VISKA, a cloud security service for dynamically detecting malicious switching elements in software defined networking (SDN) infrastructures. The main contributions of VISKA lie in (1) utilizing network programming and secure probabilistic sketching in SDN environments to dynamically detect and isolate parts of the data plane that experience malicious behavior, (2) applying a set of focused packet probing and sketching mechanisms on isolated network partitions/views rather than focusing the security mechanisms on the whole physical network, (3) efficiently analyzing the network behavior of the resulting views by recursively partitioning them in a divide-and-conquer fashion to logarithmically reduce the problem size in order to localize abnormal/malicious switching units, and (4) providing an attack categorization module that analyzes live ingress/egress traffic of the maliciously detected switch(es) solely to identify the specific type of attack, rather than inspecting the whole network traffic as is done in traditional intrusion detection systems. This significantly enhances the performance of attack detection and reduces the load on the controller. A testbed prototype implementation is realized on the Mininet network emulator. The experimental analysis corroborated the algorithms’ convergence property using the linear and FatTree topologies with network sizes of up to 250 switches. Moreover, an implementation of the attack categorization module is realized and achieved an accuracy rate of over 90% for the different attack types supported.

The rapid revolution of cloud computing model is accompanied by huge amounts of energy consumed by the cloud data centers. So, enhancing the energy efficiency of those data centers has become a major challenge. This paper tackles the problem of enhancing the energy consumption of cloud data centers by proposing a novel virtual machine placement strategy. The proposed strategy suits both static and dynamic placement process. It aims to better utilize the involved physical machines which host the virtual machines. As different types of jobs do not intensively use the compute and/or non-compute resources in the hosted physical machine, virtual machines allocated to the jobs of different types are placed on the same physical machine where possible. The paper presents a mathematical formulation of the virtual machine placement process based on the Multiple Choice Knapsack Problem which is a generalization of the classical Knapsack Problem. The performance evaluation of the proposed strategy shows that it can enhance the energy efficiency of the cloud data centers by trying to minimize the number of the involved physical machines which host the virtual machines, and by optimally utilizing the involved physical machines.

In this paper, we present VISKA, a Cloud security service for detecting malicious switching elements in software defined networking (SDN) environments. VISKA leverages network virtualization and secure probabilistic sketching to isolate misbehaving switches in the underlying SDN network data plane. The main contribution lies in utilizing network virtualization in SDN environments to dynamically isolate parts of the data plane and check their forwarding behavior. This is achieved by applying a set of focused packet probing and sketching mechanisms on virtualized network views mapped to these data plane partitions instead of focusing the security mechanisms on the whole physical network. VISKA flexibly analyzes the network behavior of the granular virtual views and recursively partitions these views to reduce the problem size in order to localize abnormal/malicious network switching units. A test bed prototype implementation is realized on the OpenVirtex SDN network virtualization platform. The experimental analysis corroborated the algorithm's convergence property using the linear and FatTree topologies with SDN network sizes of up to 250 switching units.

We present SinPack, a security protocol for preventing packet pollution attacks in network-coded content distribution networks. SinPack employs a homomorphically-addressable Bloom filter data structure to enforce the integrity of network-coded packets all the way from source to destination. Using a Bloom filter "amortizes" the functionality of traditional cryptographic integrity verification constructs (Message Authentication Codes, hash trees, digital signatures, etc) in a relatively small-sized data structure. This aids in reducing network traffic and, more significantly, allows the incremental integrity verification of out of order network packets. The novel homomorphic Bloom filter construction permits intermediate routers and destination end systems to verify the integrity of source packets even after being network-coded by routers. This methodology avoids the need to establish expensive and intricate trust relationships among the different network routers and ensures the authenticity of the integrity structures using a single source public-key operation. Moreover, SinPack not only allows the content downloader to immediately verify the integrity of coded packets, but also provides this capability to any intermediate router on the path to the destination. This helps in eliminating polluted packets in the network upstream closest to the source of attack and as a result contributes to a great reduction in bogus network traffic and hence sizeable energy savings.

In this paper we present PasS (privacy as a service); a set of security protocols for ensuring the privacy and legal compliance of customer data in cloud computing architectures. PasS allows for the secure storage and processing of users' confidential data by leveraging the tamper-proof capabilities of cryptographic coprocessors. Using tamper-proof facilities provides a secure execution domain in the computing cloud that is physically and logically protected from unauthorized access. PasS central design goal is to maximize users' control in managing the various aspects related to the privacy of sensitive data. This is achieved by implementing user-configurable software protection and data privacy mechanisms. Moreover, PasS provides a privacy feedback process which informs users of the different privacy operations applied on their data and makes them aware of any potential risks that may jeopardize the confidentiality of their sensitive information. To the best of our knowledge, PasS is the first practical cloud computing privacy solution that utilizes previous research on cryptographic coprocessors to solve the problem of securely processing sensitive data in cloud computing infrastructures.

Abstract We present PARAGON, a novel security protocol for efficiently securing the network communications of web‐deployed enterprise applications. PARAGON relies on an application tag set, which is a collection of metadata entries that specify the backend servers with which the client application is expected to communicate during its lifetime. The application tag set controls the quality of the security mechanisms established on each backend server connection, and allows the security protocol to utilize the trust relationship present between the deployed application and its source server to create a set of public‐key security associations between the source server and the enterprise backend servers on behalf of the client. PARAGON is a multi‐phase security protocol that matures with time. Incrementally, PARAGON approaches a fully symmetric‐key encryption system. The performance advantage becomes evident when the client application communicates with a relatively large set of remote servers. Examples of such clients include web browsers, email clients, file torrent clients, stock exchange applications, etc. A prototype implementing PARAGON's specifications and showing its performance advantages is shown for SUN's J2SE 1.6/J2EE 1.5 platforms. Copyright © 2008 John Wiley & Sons, Ltd.

In this paper we present PRIDE (Policy-driven web secuRity for handheld wireless DEvices) as an efficient security architecture for assuring the confidentiality and integrity of web traffic between wireless handheld devices and enterprise application servers. PRIDE is a scalable, policy-based solution capable of evolving and adapting to suit the security requirements of a wide range of wireless devices with various capabilities and resources. The customizable policy-based architecture in PRIDE can be configured to provide the security services according to the content and sensitivity of the network data in a web transaction. This gives PRIDE considerable performance gains over existing bulk encryption protocols such as SSI. PRIDE is designed as a platform- independent architecture and can be seamlessly integrated into existing application servers and wireless mobile client devices.

In this paper we present ESCORT, an Enterprise, policy-baSed seCurity prOtocol for protecting relational daTabase network objects. ESCORT is an efficient end-to-end security architecture that ensures the confidentiality and integrity of database objects flowing over network links between the Enterprise Information System (EIS) layer represented mainly in relational database servers and the client layer represented by a large variety of devices with diverse capabilities and resources. ESCORT is designed to provide the suitable security strength for a wide range of enterprise application configurations without compromising the application's efficiency and performance. It secures data based on content and sensitivity and highly surpasses the performance of bulk encryption protocols such as the SSL protocol and the TLS protocol by utilizing a customizable policy-based security architecture. This policy-based architecture makes use of the relational structure of database objects to provide flexible, multi-level, and fine-grained encryption and hashing methodologies that target the field level in the database result object. Moreover, ESCORT's security policy can be configured to hit the byte- level granularity in securing individual database fields. This makes ESCORT a very efficient choice for operation in wireless enterprise environments characterized by low-bandwidth wireless networks and supporting limited-resource wireless devices with low memory and processing power. ESCORT neither deals with the security of static data in the database store nor requires the encryption of database objects at the storage level. Results show a performance gain by a factor of three for ESCORT as compared to bulk encryption.

This paper presents PATRIOT (Policy-bAsed, mulTi-level secuRIty prOTocol), an optimized, policy-driven security architecture for protecting the confidentiality and integrity of audit log files on wireless devices. PATRIOT is based on a set of well-known cryptographic protocols and is designed to suit the limited nature of wireless devices. It offers a policy-driven, customizable security model and specifies a flexible, multilevel, and fine-grained encryption methodology that provides the suitable security strength without compromising performance. PATRIOT is designed in a platform-neutral manner and it can be deployed on a wide range of wireless devices and operating systems.

This paper presents SPECSA, a new, optimized, policy-driven security architecture for wireless enterprise applications. SPECSA is scalable, extensible, flexible, and customizable. It supports end-to-end client authentication, data integrity and confidentiality between wireless clients and enterprise servers. The security services provided by SPECSA are customized and controlled by an easily configurable security policy that specifies several security-related attributes, classifies network data based on sensitivity and content, and provides an abstraction for the communication and messaging between the client and the server. In addition, SPECSA provides an application programming interface (API) that conceals to a great extent the complexity of security operations and programming from the application. SPECSA was designed in a platform-neutral manner and can be implemented on a wide range of wireless clients ranging from low-end platforms such as the Java 2 mobile edition/connected limited device configuration (J2ME/CLDC) on limited-memory mobile devices to Personal Java and the .Net compact framework on PDAs. On the server side, SPECSA can be implemented on any of the available enterprise server platforms. A sample implementation of SPECSA was developed for J2ME on the client-side and Java 2 enterprise edition (J2EE) on the server-side.

This paper shows an end-to-end application-layer security solution for wireless enterprise applications using the Java 2 Platform Micro Edition (J2ME). The proposed solution uses pure Java components to provide end-to-end client authentication and data confidentiality between wireless J2ME based clients and J2EE based servers. This solution can be implemented with the available limited resources of a Java MIDP device, without any modification to the underlying protocols or wireless network infrastructure. A mobile banking application is used to illustrate the implementation of the proposed solution.