This paper explores a new cyber-attack vector targeting Industrial Control Systems (ICS), particularly focusing on water treatment facilities. Developing a new multi-agent Deep Reinforcement Learning (DRL) approach, adversaries craft stealthy, strategically timed, wear-out attacks designed to subtly degrade product quality and reduce the lifespan of field actuators. This sophisticated method leverages DRL methodology not only to execute precise and detrimental impacts on targeted infrastructure but also to evade detection by contemporary AI-driven defence systems. By developing and implementing tailored policies, the attackers ensure their hostile actions blend seamlessly with normal operational patterns, circumventing integrated security measures. Our research reveals the robustness of this attack strategy, shedding light on the potential for DRL models to be manipulated for adversarial purposes. Our research has been validated through testing and analysis in an industry-level setup. For reproducibility and further study, all related materials, including datasets and documentation, are publicly accessible.

In the current artificial intelligence (AI) era, the scale and quality of the dataset play a crucial role in training a high-quality AI model. However, often original data cannot be shared due to privacy concerns and regulations. A potential solution is to release a synthetic dataset with a similar distribution to the private dataset. Nevertheless, in some scenarios, the attributes required to train an AI model are distributed among different parties, and the parties cannot share the local data for synthetic data construction due to privacy regulations. In PETS 2024, we recently introduced the first Vertical Federated Learning-based Generative Adversarial Network (VFLGAN) for publishing vertically partitioned static data. However, VFLGAN cannot effectively handle time-series data, which contains both temporal and attribute dimensions. In this article, we proposed VFLGAN-TS, which combines the ideas of attribute discriminator and vertical federated learning to generate synthetic time-series data in the vertically partitioned scenario. The performance of VFLGAN-TS is close to that of its centralized counterpart, which represents the upper limit for VFLGAN-TS. To further protect privacy, we apply a Gaussian mechanism to make VFLGAN-TS satisfy an (ε ,δ)-differential privacy. Besides, we develop an enhanced privacy auditing scheme to evaluate the potential privacy breach through the framework of VFLGAN-TS and synthetic datasets.

The rise of 5G technology has highlighted the critical role of Thick Mobile Virtual Network Operators (MVNOs) in providing customized mobile services. However, security and privacy challenges specific to Thick MVNOs remain inadequately addressed. In this paper, we present PGUS (Pretty Good User Security) for Thick MVNOs. Our proposed PGUS framework introduces a new cryptographic primitive called the Sanitizable Blind Signature (SBS), along with a novel Authentication and Key Agreement protocol named PGUS-AKA. Additionally, we have developed a seamless handover protocol, PGUS-HO, which is designed to secure all communication within a Thick MVNO environment. Furthermore, we conduct a thorough formal security analysis within the Universal Composability (UC) framework to address key threats, providing a strong solution for securing next-generation mobile networks. We also provide the evaluations on a 5G testbed which demonstrate the effectiveness of PGUS.

With the proliferation of 5G networks, it is essential to prioritise robust security and seamless compatibility with existing infrastructure. The Authentication and Key Agreement (AKA) and Handover (HO) protocols are crucial in securing communication links and maintaining user privacy in 5G networks. While 5G-AKA represents a significant improvement over its predecessors, it still cannot achieve some important security features, such as perfect forward security (PFS) and forward privacy (PFP), leaving data confidentiality and user privacy susceptible to compromise. Moreover, linkability vulnerabilities in the 5G-AKA pose additional privacy concerns, particularly in the face of active adversaries seeking to compromise user anonymity. To enhance the security and privacy of 5G protocols (5G-AKA and 5G-HO) , we aim to achieve PFS and PFP while aligning with 5G's symmetric-key foundations. In this article, we introduce Pretty Good User Privacy (PGUP), a novel symmetric-based scheme aimed at addressing security and privacy vulnerabilities in the current 5G-AKA and HO protocols. In this article, we introduce a new variant of Puncturable Key Wrapping (i.e., PKW+), which allows us to ensure PFS and PFP while maintaining resilience against DoS (desynchronization) attacks in our proposed protocols. We demonstrate that our proposed scheme is resilient against all the essential security threats by performing a comprehensive formal security analysis. We also conduct relevant experiments to show the cost-effectiveness of the proposed scheme.

Accurate load forecasting is crucial for energy management, infrastructure planning, and demand-supply balancing. The availability of smart meter data has led to the demand for sensor-based load forecasting. Conventional ML allows training a single global model using data from multiple smart meters requiring data transfer to a central server, raising concerns for network requirements, privacy, and security. To alleviate this issue, we propose a split learning-based framework for load forecasting. We split a deep neural network model into two parts, one for each Grid Station (GS) responsible for an entire neighbourhood's smart meters and the other for the Service Provider (SP). Instead of sharing their data, client smart meters use their respective GSs' model split for forward passes and only share their activations with the GS. Under this framework, each GS is responsible for training a personalized model split for their respective neighbourhoods, whereas the SP can train a single global or personalized model for each GS. Experiments show that the proposed models match or exceed a centrally trained model's performance and generalize well. Privacy is analyzed by assessing information leakage between data and shared activations of the GS model split.

Package delivery is a critical aspect of various industries, but it often incurs high financial costs and inefficiencies when relying solely on human resources. The last-mile transport problem, in particular, contributes significantly to the expenditure of human resources in major companies. Robot-based delivery systems have emerged as a potential solution for last-mile delivery to address this challenge. However, robotic delivery systems still face security and privacy issues, like impersonation, replay, man-in-the-middle attacks (MITM), unlinkability, and identity theft.In this context, we propose a privacy-preserving multi-factor authentication scheme specifically designed for robot delivery systems. Additionally, AI-assisted robotic delivery systems are susceptible to machine learning-based attacks (e.g. FGSM, PGD, etc.). We introduce the first transformer-based audio-visual fusion defender to tackle this issue, which effectively provides resilience against adversarial samples. Furthermore, we provide a rigorous formal analysis of the proposed protocol and also analyse the protocol security using a popular symbolic proof tool called ProVerif and Scyther. Finally, we present a real-world implementation of the proposed robotic system with the computation cost and energy consumption analysis. Code and pre-trained models are available at: https://github.com/YYangNUS/TIFS RobotMFA.

The Internet of Things (IoT) has revolutionized connectivity by enabling a large number of devices to autonomously exchange real-time data over the Internet. However, IoT devices used in public spaces are vulnerable to physical and cloning attacks. To address this issue, researchers have introduced the concept of physical-unclonable functions (PUFs) to enhance security in IoT applications. While PUF-based security solutions typically rely on static challenge-response behavior, many practical applications require dynamic or reconfigurable PUFs. For instance, PUF-based key storage may require updating or revoking secrets, and protection against modeling attacks, where an attacker can derive a PUF model from a set of challenge-response pairs (CRPs) using learning capabilities. In this paper, we introduce LR-OPUF, a reconfigurable one-time PUF, and propose a lightweight and privacy-preserving authentication scheme based on this LR-OPUF foundation. One notable feature of our authentication scheme is that it enables a device to prove its legitimacy to a semi-honest verifier without disclosing the CRPs. Through security and performance analyses, we demonstrate that our approach not only ensures vital security aspects but also exhibits high computational efficiency.

Consumers seeking a new mobile plan have many choices in the present mobile landscape. The Mobile Virtual Network Operator (MVNO) has recently gained considerable attention among these options. MVNOs offer various benefits, making them an appealing choice for a majority of consumers. These advantages encompass flexibility, access to cutting-edge technologies, enhanced coverage, superior customer service, and substantial cost savings. Even though MVNO offers several advantages, it also creates some security and privacy concerns for the customer simultaneously. For instance, in the existing solution, MVNO needs to hand over all the sensitive details, including the users' identities and master secret keys of their customers, to a mobile operator (MNO) to validate the customers while offering any services. This allows MNOs to have unrestricted access to the MVNO subscribers' location and mobile data, including voice calls, SMS, and Internet, which the MNOs frequently sell to third parties (e.g., advertisement companies and surveillance agencies) for more profit. Although critical for mass users, such privacy loss has been historically ignored due to the lack of practical and privacy-preserving solutions for registration and handover procedures in cellular networks. In this paper, we propose a universally composable authentication and handover scheme with strong user privacy support, where each MVNO user can validate a mobile operator (MNO) and vice-versa without compromising user anonymity and unlinkability support. Here, we anticipate that our proposed solution will most likely be deployed by the MVNO(s) to ensure enhanced privacy support to their customer(s).

Introducing Small Cell Networks (SCN) has significantly improved wireless link quality, spectrum efficiency and network capacity, which has been viewed as one of the key technologies in the fifth-generation (5G) mobile network. However, this technology increases the frequency of handover (HO) procedures caused by the dense deployment of cells in the network with reduced cell coverage, bringing new security and privacy issues. The current 5G-AKA and HO protocols are vulnerable to security weaknesses, such as the lack of forward secrecy and identity confusion attacks. The high HO frequency of HOs might magnify these security and privacy concerns in the 5G mobile network. This work addresses these issues by proposing a secure privacy-preserving universal HO scheme (UniHand) for SCNs in 5G mobile communication. UniHand can achieve mutual authentication, strong anonymity, perfect forward secrecy, keyescrow-free and key compromise impersonation (KCI) resilience. To the best of our knowledge, this is the first scheme to achieve secure, privacy-preserving universal HO with KCI resilience for roaming users in 5G environment. We demonstrate that our proposed scheme is resilient against all the essential security threats by performing a comprehensive formal security analysis and conducting relevant experiments to show the cost-effectiveness of the proposed scheme.

Digital Twin (DT) is a revolutionary technology changing how a smart manufacturing industry carries out its day-to-day activities. DT can provide numerous advantages such as real-time synchronised functioning, monitoring and data analysis. However, security and privacy issues in DT have not been thoroughly investigated. This article proposes a user-empowerment-based privacy-preserving authentication protocol for a cloud-based Digital Twin using a Decentralised Identifier (DID) and Verifiable Credential (VC). Here, user empowerment provides full control to users over their identities, and with the help of VC, users can prove their authenticity and preserve their privacy. Although DID has emerged as a promising technology for introducing user empowerment, it suffers from some fundamental problems such as usability and auditability. Here we address all these issues and propose a user-revocation-enabled security solution for the DT. A security analysis of the proposed scheme shows that it is secured against significant security threats. With the help of performance analysis, we prove that the proposed work effectively ensures security and privacy in DT.

The transition from paper-based information to Electronic-Health-Records (EHRs) has driven various advancements in the modern healthcare industry. In many cases, patients need to share their EHR with healthcare professionals. Given the sensitive and security-critical nature of EHRs, it is essential to consider the security and privacy issues of storing and sharing EHR. However, existing security solutions excessively encrypt the whole database, thus requiring the entire database to be decrypted for each access request, which is time-consuming. On the other hand, the use of EHR for medical research (e.g., development of precision medicine and diagnostics techniques) and optimisation of practices in healthcare organisations require the EHR to be analysed. To achieve that, they should be easily accessible without compromising the patient’s privacy. In this paper, we propose an efficient technique called E-Tenon that not only securely keeps all EHR publicly accessible but also provides the desired security features. To the best of our knowledge, this is the first work in which an Open Database is used for protecting EHR. The proposed E-Tenon empowers patients to securely share their EHR under their own multi-level, fine-grained access policies. Analyses show that our system outperforms existing solutions in terms of computational complexity.

In the current artificial intelligence (AI) era, the scale and quality of the dataset play a crucial role in training a high-quality AI model. However, good data is not a free lunch and is always hard to access due to privacy regulations like the General Data Protection Regulation (GDPR). A potential solution is to release a synthetic dataset with a similar distribution to that of the private dataset. Nevertheless, in some scenarios, it has been found that the attributes needed to train an AI model belong to different parties, and they cannot share the raw data for synthetic data publication due to privacy regulations. In PETS 2023, Xue et al. [29] proposed the first generative adversary network-based model, VertiGAN, for vertically partitioned data publication. However, after thoroughly investigating, we found that VertiGAN is less effective in preserving the correlation among the attributes of different parties. This article proposes a Vertical Federated Learning-based Generative Adversarial Network, VFLGAN, for vertically partitioned data publication to address the above issues. Our experimental results show that compared with VertiGAN, VFLGAN significantly improves the quality of synthetic data. Taking the MNIST dataset as an example, the quality of the synthetic dataset generated by VFLGAN is 3.2 times better than that generated by VertiGAN w.r.t. the Frechet Distance. We also designed a more efficient and effective Gaussian mechanism for the proposed VFLGAN to provide the synthetic dataset with a differential privacy guarantee. On the other hand, differential privacy only gives the upper bound of the worst-case privacy guarantee. This article also proposes a practical auditing scheme that applies membership inference attacks to estimate privacy leakage through the synthetic dataset.

Physically Unclonable Functions (PUFs) provide a streamlined solution for lightweight device authentication. Delay-based Arbiter PUFs, with their ease of implementation and vast challenge space, have received significant attention; however, they are not immune to modelling attacks that exploit correlations between their inputs and outputs. Research is therefore polarized between developing modelling-resistant PUFs and devising machine learning attacks against them. This dichotomy often results in exaggerated concerns and overconfidence in PUF security, primarily because there lacks a universal tool to gauge a PUF’s security. In many scenarios, attacks require additional information, such as PUF type or configuration parameters. Alarmingly, new PUFs are often branded ‘secure’ if they lack a specific attack model upon introduction. To impartially assess the security of delay-based PUFs, we present a generic framework featuring a Mixture-of-PUF-Experts (MoPE) structure for mounting attacks on various PUFs with minimal adversarial knowledge, which provides a way to compare their performance fairly and impartially. We demonstrate the capability of our model to attack different PUF types, including the first successful attack on Heterogeneous Feed-Forward PUFs using only a reasonable amount of challenges and responses. We propose an extension version of our model, a Multi-gate Mixture-of-PUF-Experts (MMoPE) structure, facilitating multi-task learning across diverse PUFs to recognise commonalities across PUF designs. This allows a streamlining of training periods for attacking multiple PUFs simultaneously. We conclude by showcasing the potent performance of MoPE and MMoPE across a spectrum of PUF types, employing simulated, real-world unbiased, and biased data sets for analysis.

Underwater Acoustic Sensor Networks (UW-ASNs) are predominantly used for underwater environments and find applications in many areas. However, a lack of security considerations, the unstable and challenging nature of the underwater environment, and the resource-constrained nature of the sensor nodes used for UW-ASNs (which makes them incapable of adopting security primitives) make the UW-ASN prone to vulnerabilities. This paper proposes an Adaptive decentralised Intrusion Detection and Prevention System called AIDPS for UW-ASNs. The proposed AIDPS can improve the security of the UW-ASNs so that they can efficiently detect underwater-related attacks (e.g., blackhole, grayhole and flooding attacks). To determine the most effective configuration of the proposed construction, we conduct a number of experiments using several state-of-the-art machine learning algorithms (e.g., Adaptive Random Forest (ARF), light gradient-boosting machine, and K-nearest neighbours) and concept drift detection algorithms (e.g., ADWIN, kdqTree, and Page-Hinkley). Our experimental results show that incremental ARF using ADWIN provides optimal performance when implemented with One-class support vector machine (SVM) anomaly-based detectors. Furthermore, our extensive evaluation results also show that the proposed scheme outperforms state-of-the-art bench-marking methods while providing a wider range of desirable features such as scalability and complexity.

Considering the limited power and computational resources available, designing sufficiently secure systems for low-power devices is a difficult problem to tackle. With the ubiquitous adoption of the Internet of Things (IoT) not appearing to be slowing any time soon, resource-constrained security is more important than ever. Physical Unclonable Functions (PUFs) have gained momentum in recent years for their potential to enable strong security through the generation of unique identifiers based on entropy derived from unique manufacturing variations. Strong-PUFs, which are desirable for authentication protocols, have often been shown to be insecure to Machine Learning Modelling Attacks (ML-MA). Recently, some schemes have been proposed to enhance security against ML-MA through post-processing of the PUF; however, often, security is not sufficiently upheld, the scheme requires too large an additional overhead or key data must be insecurely stored in Non-Volatile Memory. In this work, we propose a generic framework for securing Strong-PUFs against ML-MA through obfuscation of challenge and response data by exploiting a DRAM-PUF to supplement a One-Way Function (OWF) which can be implemented using the available resources on an FPGA platform. Our proposed scheme enables reconfigurability, strong security and one-wayness. We conduct ML-MA using various classifiers to thoroughly evaluate the performance of our scheme across multiple 16-bit and 32-bit Arbiter-PUF (APUF) variants, showing our scheme reduces model accuracy to around 50% for each PUF (random guessing) and evaluate the properties of the final responses, demonstrating that ideal uniformity and uniqueness are maintained. Even though we demonstrate our proposal through a DRAM-PUF, our scheme can be extended to work with memory-based PUFs in general.

The overwhelmingly widespread use of Internet of Things (IoT) in different application domains brought not only benefits, but, alas, security concerns as a result of the increased attack surface and vectors. One of the most critical mechanisms in IoT infrastructure is key management. This paper reflects on the problems and challenges of existing key management systems, starting with the discussion of a recent real-world attack. We identify and elaborate on the drawbacks of security primitives based purely on physical variations and - after highlighting the problems of such systems - continue on to deduce an effective and cost-efficient key management solution for IoT systems extending the symbiotic security approach in a previous work. The symbiotic architecture combines software, firmware, and hardware resources for secure IoT while avoiding the traditional scheme of static key storage and generating entropy for key material on-the-fly via a combination of a Physical Unclonable Function (PUF) and pseudo-random bits pre-populated in firmware.

IPv6 over Low-powered Wireless Personal Area Networks (6LoWPAN) has grown in importance in recent years, with the Routing Protocol for Low Power and Lossy Networks (RPL) emerging as a major enabler. However, RPL can be subject to attack, with severe consequences. Most proposed IDSs have been limited to specific RPL attacks and typically assume a stationary environment. In this article, we propose the first adaptive hybrid IDS to efficiently detect and identify a wide range of RPL attacks (including DIO Suppression, Increase Rank, and Worst Parent attacks, which have been overlooked in the literature) in evolving data environments. We apply our framework to networks under various levels of node mobility and maliciousness. We experiment with several incremental machine learning (ML) approaches and various ‘concept-drift detection’ mechanisms (e.g. ADWIN, DDM, and EDDM) to determine the best underlying settings for the proposed scheme.

Abstract Reasoning weakening because of dementia degrades the performance in activities of daily living (ADL). Present research work distinguishes care needs, dangers and monitors the effect of dementia on an individual. This research contrasts in ADL design execution between dementia-affected people and other healthy elderly with heterogeneous sensors. More than 300,000 sensors associated activation data were collected from the dementia patients and healthy controls with wellness sensors networks. Generated ADLs were envisioned and understood through the activity maps, diversity and other wellness parameters to categorize wellness healthy, and dementia affected the elderly. Diversity was significant between diseased and healthy subjects. Heterogeneous unobtrusive sensor data evaluate behavioral patterns associated with ADL, helpful to reveal the impact of cognitive degradation, to measure ADL variation throughout dementia. The primary focus of activity recognition in the current research is to transfer dementia subject occupied homes models to generalized age-matched healthy subject data models to utilize new services, label classified datasets and produce limited datasets due to less training. Current research proposes a novel Smart Aging Monitoring and Early Dementia Recognition system that provides the exchange of data models between dementia subject occupied homes (DSOH) to healthy subject occupied homes (HSOH) in a move to resolve the deficiency of training data. At that point, the key attributes are mapped onto each other utilizing a sensor data fusion that assures to retain the diversities between various HSOH & DSOH by diminishing the divergence between them. Moreover, additional tests have been conducted to quantify the excellence of the offered framework: primary, in contradiction of the precision of feature mapping techniques; next, computing the merit of categorizing data at DSOH; and, the last, the aptitude of the projected structure to function thriving due to noise data. The outcomes show encouraging pointers and highlight the boundaries of the projected approach.

Recent development of smart cities includes advanced and necessary use of modern smart grid (SG), than the traditional power grid. The paradigm of SG has also transformed houses into a home area networks (HAN). In HAN, several smart devices and appliances are connected to the electricity control centers (ECC). Appliances share their load and consumption related information to ECC through smart meters. The consumption data may be used for supply-demand management, for example, by ramping production up or down as needed. However, security and privacy of the consumers data are greatly important, since fine-grained smart meter data may reveal an users presence/absence in his/her house. To address this issue, several public-key-based or identity-based data aggregation schemes have been proposed in the literature. However, most of such schemes either suffer from the complexity of certificate management or key escrow problem. To eliminate these issues, in this paper we propose an efficient certificate-based data aggregation (CB-DA) scheme. In the proposed CB-DA scheme, the owner selects a secret key and then use the secret key along with certificates as decryption/signing keys.

The 5G mobile communication network provides seamless communication between users and service providers and promises to achieve several stringent requirements, such as seamless mobility and massive connectivity. Although 5G can offer numerous benefits, security and privacy issues still need to be addressed. For example, the inclusion of small cell networks (SCN) into 5G brings the network closer to the connected users, providing a better quality of services (QoS), resulting in a significant increase in the number of Handover procedures (HO), which will affect the security, latency and efficiency of the network. It is then crucial to design a scheme that supports seamless handovers through a secure authentication process. With this aim, in this article, we propose a secure region-based handover scheme that supports seamless connectivity for SCNs in 5G. Our proposed scheme is based on asymmetric-key-based authenticated key exchange and handover protocols that preserve user privacy and network security while providing a seamless region-based handover mechanism and effective membership revocation management. In this context, we introduce three privacy-preserving protocols, i.e., an initial authentication protocol, an intra-region handover protocol and an inter-region handover protocol, for dealing with three communication scenarios. To the best of our knowledge, this is thefirstpaper to consider the privacy and security in both the intra-region and inter-region handover scenarios in 5G communication with effective membership revocation management support. Detailed security and performance analysis of our proposed scheme is presented to show that it is resilient against many security threats, is cost-effective and provides an efficient solution for 5G-enabled mobile communication.

As the demand for highly secure and dependable lightweight systems increases in the modern world, Physically Unclonable Functions (PUFs) continue to promise a lightweight alternative to high-cost encryption techniques and secure key storage. While the security features promised by PUFs are highly attractive for secure system designers, they have been shown to be vulnerable to various sophisticated attacks - most notably Machine Learning (ML) based modelling attacks (ML-MA) which attempt to digitally clone the PUF behaviour and thus undermine their security. More recent ML-MA have even exploited publicly known helper data required for PUF error correction in order to predict PUF responses without requiring knowledge of response data. In response to this, research is beginning to emerge regarding the authentication of PUF devices with the assistance of ML as opposed to traditional PUF techniques of storage and comparison of pre-known Challenge-Response pairs (CRPs). In this article, we propose a classification system using ML based on a novel ‘PUF-Phenotype’ concept to accurately identify the origin and determine the validity of noisy memory-derived (DRAM) PUF responses as an alternative to helper data-reliant denoising techniques. To our best knowledge, we are thefirstto perform classification over multiple devices per model to enable a group-based PUF authentication scheme. We achieve up to 98% classification accuracy using a modified deep convolutional neural network (CNN) for feature extraction in conjunction with several well-established classifiers. We also experimentally verified the performance of our model on a Raspberry Pi device to determine the suitability of deploying our proposed model in a resource-constrained environment.

Deep learning has been used in many computer-vision-based industrial Internet of Things applications. However, deep neural networks are vulnerable to adversarial examples that have been crafted specifically to fool a system while being imperceptible to humans. In this article, we propose a consensus defense (Cons-Def) method to defend against adversarial attacks. Cons-Def implements classification and detection based on the consensus of the classifications of the augmented examples, which are generated based on an individually implemented intensity exchange on the red, green, and blue components of the input image. We train a CNN using augmented examples together with their original examples. For the test image to be assigned to a specific class, the class occurrence of the classifications on its augmented images should be the maximum and reach a defined threshold. Otherwise, it is detected as an adversarial example. The comparison experiments are implemented on MNIST, CIFAR-10, and ImageNet. The average defense success rate (DSR) against white-box attacks on the test sets of the three datasets is 80.3%. The average DSR against black-box attacks on CIFAR-10 is 91.4%. The average classification accuracies of Cons-Def on benign examples of the three datasets are 98.0%, 78.3%, and 66.1%. The experimental results show that Cons-Def shows a high classification performance on benign examples and is robust against white-box and black-box adversarial attacks.

Trajectory design is of great significance for the intelligent Unmanned Ground Vehicle (UGV) when performing various ground tasks. Though obstacle avoidance, speed control and other movement issues in the UGV navigation have been considered by the current research, the UGV path planning against malicious radio source is off the beaten path. To address such a research gap, we propose a reinforcement learning-based scheme to design UGV trajectory against malicious radio source as well as minimize the movement cost. Firstly, the malicious radio source detection and localization models are introduced after the Received Signal Strength Indicator (RSSI) map establishment. Then, the RSSI Map-based UGV trajectory design problem is formulated, where the movement cost and security risk are both concerned. To solve the formed problem, we propose a reinforcement learning-based trajectory design scheme, whose complexities are analyzed in detail. Finally, experiments are conducted under various parameter settings, where the simulation results evaluate the correctness and effectiveness of the proposed algorithm.

Vehicle authentication is an essential component validating the vehicle’s identity and ensuring the integrity of transformed data for intelligent transport vehicles (ITS) in the vehicular ad hoc network (VANET). Easy to deploy and operate privacy-enhancing vehicle authentication mechanisms are the mainstay for the widespread ITS in the VANET. Very recently, VANET security architectures are constituting by IEEE 1609.2 group, NoW project, the SeVeCom project. However, these approaches heavily depend on the consuming public key infrastructure (PKI) and certification authorities (CA). In this work, walking along the research line, we attempt to design authentication protocols with two diverse factors for Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) networks, respectively, without depending on the stumbling block PKI/CA. In addition, a smooth projective hash function (SPHF) (a.k.a., a special case of the designated-verifier zero-knowledge proof system) guarantees any recipient can confirm the authenticity and integrity of the received messages without knowing the authentication factors. Thus, to optimize the communication round, SPHF is used to design a (group) two-factor authenticated key exchange (AKE) with low-interactive communication rounds. The proof-of-concept implementation indicates that the computation and communication overheads introduced by our solution are acceptable in real-world deployments. The security of the proposed approach is validated using Bellare-Pointcheval-Rogaway (BPR) model along with the experimental evaluation and the theoretical analysis.

E-health is the use of information and communication technology (ICT) for the healthcare-related services. It uses various types of digital technologies and telecommunications, such as computers, sensing devices, Internet, and mobile devices to deliver medical services. Internet of Medical Things (IoMT) is a communication environment optimized for low-power devices (for example, health sensors and actuators) and operation on, in, or around the human body (i.e., a patient). It can be used in various applications that are related to healthcare, such as “body automation,” “healthcare,” “medical monitoring,” “body interaction,” and “medical implants (i.e., pacemaker).” Most of the communications happen in IoMT-based e-healthcare system are wireless in nature. This may cause severe threats to the security of the system. Various information security-related attacks, i.e., replay, man-in-the-middle attack (MiTM), impersonation, privileged insider, unauthorised session key computation, credentials leakage, stolen verifier, malware injection are possible in IoMT-based e-healthcare system. These threats and attacks can create serious problems in the social life of an individual, as this may reveal their confidential healthcare information to other unauthorised parties. Therefore, it is essential to propose an access control and key management scheme to secure the communication of a IoMT-based e-healthcare system. Moreover, the security of such kind of scheme can also be enhanced through the deployment of a blockchain mechanism. Therefore, in this article, we propose a blockchain-enabled access control and key management protocol for IoMT-based e-healthcare system that is named as “BACKM-EHA” in short. The security analysis of proposed BACKM-EHA is also provided through the standard, i.e., “Real-Or-Random model.” The various conducted security analyses prove the security of BACKM-EHA against the different types of potential attacks. The performance of BACKM-EHA is better than the other existing schemes, as it requires less communication cost, computation cost, and provides more “security and functionality features.”

The Internet of Things (IoT) is generating and processing a huge amount of data that are then used and shared to improve services and applications in various industries. The collected data are always including sensitive information (sensitive data, users/devices/applications behaviors, etc.), which can be exchanged over the IoT to third-party for storing, processing, and sharing with associated applications. It is important to protect data privacy from compromising using consistently privacy preserving techniques. In this work, we propose a privacy-preserving solution for both structured data and unstructured data by using data anonymization techniques, which are able to enhance privacy associated with IoT services, applications, and users/device behavior. This can allow IoT users/devices to access privacy-enhanced data protecting sensitive data against re-identification risks. The experimental results demonstrate that the proposed solution can provide privacy-enhanced data for third-party services and applications over the IoT.

Low-power and Lossy Networks (LLNs) comprise nodes characterised by constrained computational power, memory, and energy resources. The LLN nodes empower ubiquitous connections amongst numerous devices (e.g. temperature, humidity, and turbidity sensors, together with motors, valves and other actuators) to sense, control and store properties of their environments. They are often deployed in hostile, unattended, and unfavourable conditions. Securing them often becomes very challenging. The extent of interconnected LLN devices poses a series of routing threats (e.g. wormhole, grayhole, DIO suppression, and increase rank attacks). Consequently, an efficient and effective intrusion detection system (IDS) is of utmost importance in identifying anomalous activities in the IPv6 over Low-powered Wireless Personal Area Networks (6LoWPAN). This article proposes a robust Adversarial Reinforcement Learning (ARL) framework to generate efficient IDSs for evolving data environments. The integration of ARL and incremental machine-learning facilitates the generation of resource-efficient and robust IDS detectors. We demonstrate in particular how such an approach, leveraging notions of ’concept drift’ detection and adaptation, can handle inevitable changes in the environment, giving the IDS best chances of detecting attacks in the current profile. The range of routing attacks considered is the most comprehensive to date. For the first time, Black-box and Grey-box ML-based adversaries aiming to destabilise the 6LoWPAN are distinguished and addressed.

The recent development has enlightened health informatics on the Internet of medical Things (IoT) 5.0. Healthcare services have seen greater acceptance of information and communications technology (ICT) in recent years; in light of the increasing volume of patient data, the traditional way of storing data in physical files has eventually moved to a digital alternative such as electronic health record (EHR). However, conventional healthcare data systems are plagued with a single point of failure, security issues, mutable logging, and inefficient methods to retrieve healthcare records. Social linked data (Solid) has been developed as a decentralized technology to alter digital data sharing and ownership for its users radically. However, Solid alone cannot address all the security issues posed to data exchange and storage. Present research combines two decentralized technologies, Solid ecosystem and blockchain technology, to tackle all potential security issues using solidity-based smart contracts, thereby providing a secure patient-centric design for the complex under developing EHR data exchange.

The Internet of Things (IoT) is becoming a revolutionary paradigm, moving toward ubiquity in day-to-day life and used in several applications such as smart healthcare systems, industry 4.0, critical infrastructure, etc. As with any concept that relies on wireless communication, authentication is of paramount importance in regards to security considerations. Devices in many IoT applications are severely constrained in terms of computational resources and are thus unable to utilize many modern cryptographic methods for security purposes. Physically unclonable functions (PUFs) propose to solve this issue by allowing devices to generate unique and secure digital fingerprints at extremely low computational cost. However, PUFs are vulnerable to machine learning based modeling attacks that can mathematically clone the PUFs in order to impersonate them. To address these requirements, this article introduces a new lightweight and practical anonymous authentication protocol for IoT that is resilient against machine learning attacks on PUFs.

The descending of intelligence from the cloud to the heterogeneous and low-power edge in the Artificial Intelligence-of-Things prevents uploading user-sensitive information to the cloud. It brings an urgent demand for deploying training tasks collaboratively in industrial scenarios to manage data locally. This article proposes an edge-based collaborative training system for the smart factory which harnesses the intelligence of edge devices by balancing the computational and communicational resources and improving system dependability. Two typical scenarios of parts recognition and defect inspection are evaluated as a case study with our system. The feasibility and dependability of the presented system are verified with a platform composed of eight high-performance (Nvidia Jetson Nano) and eight low-performance edge devices (Raspberry Pi 4B). The efficiency under tradeoff between computational resource and network condition constraints in a cluster is tested to simulate real-case performance in smart factory scenarios. Our platform reaches the peak performance of 1167 images/s training efficiency on ResNet32 under a 125 MB/s bandwidth. Experimental results demonstrate that the proposed design can collaboratively perform training tasks with optimized efficiency and provide dependable collaborations for system fault detection and cluster extension.

Anonymous exchange of data has a strong demand in many scenarios. With the development of IoT and wireless networks, plenty of smart devices are interconnected through wireless technologies such as 5G and Wi-Fi, making it possible to use them for information exchanging. The authors find a P2P network model for secure and anonymous communication, which is a typical Crowds system and the operating mechanism meets the characteristics of limited-resources of IoT devices. Based on this network model, the authors design a lightweight communication scheme for the remote-control system in this work, using two kinds ofVirtual-Spaces to achieve the purpose of identity announced and data exchanged. The authors implemented a prototype system of the scheme and tested it over theFreenet, proving that the scheme can effectively resist the impact of flow analysis on the anonymity of communication while ensuring communication data security. By analyzing the scheme’s performance, the author believes that the scheme is practical and is suitable for scenarios that are not time-sensitive but require high anonymity.

The Routing Protocol for low power Lossy networks (RPL) is a critical operational component of low power wireless personal area networks using IPv6 (6LoWPANs). In this paper we propose a Reinforcement Learning (RL) based IDS to detect various attacks on RPL in 6LoWPANs, including several un-addressed by current research. The proposed scheme can also detect previously unseen attacks and the presence of mobile intruders. The scheme is well suited to the resource constrained environments of our target networks.

The advent of the Internet of Things (IoT) has escalated the sharing of information among various smart devices many fold, irrespective of their geographical location. Recently, applications, such as e-healthcare, farm monitoring, border security, smart transportation, etc. have attracted wide attention from the research community. However, as devices in the Industrial-IoT (IIoT) environment share their information using the Internet, security issues, such as authentication, integrity, and confidentiality of data pose various challenges to the research community for the successful implementation of any solution. To handle these issues, several digital signature-based schemes have been designed in the past. However, because of the usage of the identity-based public-key cryptography (IDPKC) or certificate-less-based public-key cryptography (CLPKC), these schemes suffer from key escrow or secret key distribution problems. To eliminate these flaws, this article presents a short digital signature scheme without pairing in certificate-based setting with aggregation in IIoT environment. Besides, in IIoT environment, communication and computational costs are also considered as imperative challenges. In this regard, the pairing free construction, short length signature and aggregation make it a communication and computational efficient signature scheme. The performance comparison of the proposed scheme shows that our scheme causes less computational overhead and takes significantly less execution time as compared to the existing schemes, which is imperative for the resource limited IIoT devices. We also demonstrate that signature aggregation and verification cost is 6.67(n+2) ms which is much less in comparison to the verification cost ( 20.01n ms) of n short signatures.

A smart home enables users to access devices such as lighting, HVAC, temperature sensors, and surveillance camera. It provides a more convenient and safe living environment for users. Security and privacy, however, is a key concern since information collected from these devices are normally communicated to the user through an open network (i.e. Internet) or system provided by the service provider. The service provider may store and have access to these information. Emerging smart home hubs such as Samsung SmartThings and Google Home are also capable of collecting and storing these information. Leakage and unauthorized access to the information can have serious consequences. For example, the mere timing of switching on/off of an HVAC unit may reveal the presence or absence of the home owner. Similarly, leakage or tampering of critical medical information collected from wearable body sensors can have serious consequences. Encrypting these information will address the issues, but it also reduces utility since queries is no longer straightforward. Therefore, we propose a privacy-preserving scheme, \sf PrivHomePrivHome. It supports authentication, secure data storage and query for smart home systems. PrivHome provides data confidentiality as well as entity and data authentication to prevent an outsider from learning or modifying the data communicated between the devices, service provider, gateway, and the user. It further provides privacy-preserving queries in such a way that the service provider, and the gateway does not learn content of the data. To the best of our knowledge, privacy-preserving queries for smart home systems has not been considered before. Under our scheme is a new, lightweight entity and key-exchange protocol, and an efficient searchable encryption protocol. Our scheme is practical as both protocols are based solely on symmetric cryptographic techniques. We demonstrate efficiency and effectiveness of our scheme based on experimental and simulation results, as well as comparisons to existing smart home security protocols.

Vehicle-to-grid (V2G) networks have been emerged as a new technology in the smart grid (SG). These networks allow a two-way flow of energy-trading between electric vehicles (EVs) and charging stations (CSs) in the SG. EVs are regarded as one of the most effective tools to reduce energy demands. It will bring a great impact on our society and human life. Thus, during energy trading between EVs and CSs, various security, and privacy challenges occur in V2G networks. Although several proposals have been proposed, still there are many issues like lack of integrity, mutual authentication, and identity privacy-preservation make the system more vulnerable. Researchers have used the centralized system in V2G networks which may act as a single point of failure. So, for deploying secure V2G networks in the SG, we propose an energy-trading scheme having blockchain between three communicating parties, i.e., EVs, CSs, utility center. The proposed system is divided into three phases, first, the registration process provides identity privacy-preservation to the EVs and CSs, second, the searching process makes the registration and key-generation steps faster, and third, the authentication process provides mutual authentication between them and a blockchain network is used to execute transactions using Merkle Root Hash. The security analysis result shows that the proposed scheme is secure for energy-trading in V2G networks. The performance evaluation results illustrate that our scheme has less communication cost and computation time as compared to the existing proposals.

The advent of Internet of Things (IoT) has escalated the information sharing among various smart devices by many folds, irrespective of their geographical locations. Recently, applications like e-healthcare monitoring has attracted wide attention from the research community, where both the security and the effectiveness of the system are greatly imperative. However, to the best of our knowledge none of the existing literature can accomplish both these objectives (e.g., existing systems are not secure against physical attacks). This paper addresses the shortcomings in existing IoT-based healthcare system. We propose an enhanced system by introducing a Physical Unclonable Function (PUF)-based authentication scheme and a data driven fault-tolerant decision-making scheme for designing an IoT-based modern healthcare system. Analyses show that our proposed scheme is more secure and efficient than existing systems. Hence, it will be useful in designing an advanced IoT-based healthcare system.

Device authentication is an essential security feature for Internet of Things (IoT). Many IoT devices are deployed in the open and public places, which makes them vulnerable to physical and cloning attacks. Therefore, any authentication protocol designed for IoT devices should be robust even in cases when an IoT device is captured by an adversary. Moreover, many of the IoT devices have limited storage and computational capabilities. Hence, it is desirable that the security solutions for IoT devices should be computationally efficient. To address all these requirements, in this paper, we present a lightweight and privacy-preserving two-factor authentication scheme for IoT devices, where physically uncloneable functions have been considered as one of the authentication factors. Security and performance analysis show that our proposed scheme is not only robust against several attacks, but also very efficient in terms of computational efficiently.

The concept of smart metering allows real-time measurement of power demand which in turn is expected to result in more efficient energy use and better load balancing. However, finely granular measurements reported by smart meters can lead to starkly increased exposure of sensitive information, including various personal attributes and activities. Even though several security solutions have been proposed in recent years to address this issue, most of the existing solutions are based on public-key cryptographic primitives, such as homomorphic encryption and elliptic curve digital signature algorithms which are ill-suited for the resource constrained smart meters. On the other hand, to address the computational inefficiency issue, some masking-based solutions have been proposed. However, these schemes cannot ensure some of the imperative security properties, such as consumer's privacy and sender authentication. In this paper, we first propose a lightweight and privacy-friendly masking-based spatial data aggregation scheme for secure forecasting of power demand in smart grids. Our scheme only uses lightweight cryptographic primitives, such as hash functions and exclusive-OR operations. Subsequently, we propose a secure billing solution for smart grids. As compared with existing solutions, our scheme is simple and can ensure better privacy protection and computational efficiency, which are essential for smart grids.

Industrial wireless sensor network (IWSN) is an emerging class of a generalized WSN having constraints of energy consumption, coverage, connectivity, and security. However, security and privacy is one of the major challenges in IWSN as the nodes are connected to Internet and usually located in an unattended environment with minimum human interventions. In IWSN, there is a fundamental requirement for a user to access the real-time information directly from the designated sensor nodes. This task demands to have a user authentication protocol. To satisfy this requirement, this paper proposes a lightweight and privacy-preserving mutual user authentication protocol in which only the user with a trusted device has the right to access the IWSN. Therefore, in the proposed scheme, we considered the physical layer security of the sensor nodes. We show that the proposed scheme ensures security even if a sensor node is captured by an adversary. The proposed protocol uses the lightweight cryptographic primitives, such as one way cryptographic hash function, physically unclonable function, and bitwise exclusive operations. Security and performance analysis shows that the proposed scheme is secure, and is efficient for the resource-constrained sensing devices in IWSN.

Electronic health systems, such as telecare medical information system (TMIS), allow patients to exchange their health information with a medical center/doctor for diagnosis in real time, and across borders. Given the sensitive nature of health information/medical data, ensuring the security of such systems is crucial. In this paper, we revisit Das et al.'s authentication protocol, which is designed to ensure patient anonymity and untraceability. Then, we demonstrate that the security claims are invalid, by showing how both security features (i.e., patient anonymity and untraceability) can be compromised. We also demonstrate that the protocol suffers from smartcard launch attacks. To mitigate such design flaws, we propose a new lightweight authentication protocol using the cryptographic hash function for TMIS. We then analyze the security of the proposed protocol using AVISPA and Scyther, two widely used formal specification tools. The performance analysis demonstrates that our protocol is more efficient than other competing protocols.

Smart grids take advantage of information and communication technologies to achieve energy efficiency, automation, and reliability. These systems allow two-way communications and power flow between the grid and consumers. However, these bidirectional communications introduce several security and privacy threats to consumers. One of the open challenges in this context is user privacy when smart meters (SMs) are used to capture fine-grained energy usage information. Although considerable research has been carried out in this direction, most of the existing solutions invariably introduce computational complexity and overhead, which makes them infeasible for resource constrained SMs. In this paper, we propose a privacy-friendly and efficient data aggregation scheme for dynamic pricing-based billing and demand-response management in smart grids. To the best of our knowledge, this is thefirst paperto address privacy in the context of billing under dynamic electricity pricing. Security and performance analyses show that the proposed scheme offers better privacy protection for electric meter reading aggregation and computational efficiency, as compared to existing schemes.

Radio frequency identification (RFID) has been considered one of the imperative requirements for implementation of Internet-of-Things applications. It helps to solve the identification issues of the things in a cost-effective manner, but RFID systems often suffer from various security and privacy issues. To solve those issues for RFID systems, many schemes have been recently proposed by using the cryptographic primitive, called physically uncloneable functions (PUFs), which can ensure a tamper-evident feature. However, to the best of our knowledge, none of them has succeeded to address the problem of privacy preservation with the resistance of DoS attacks in a practical way. For instance, existing schemes need to rely on exhaustive search operations to identify a tag, and also suffer from several security and privacy related issues. Furthermore, a tag needs to store some security credentials (e.g., secret shared keys), which may cause several issues such as loss of forward and backward secrecy and large storage costs. Therefore, in this paper, we first propose a lightweight privacy-preserving authentication protocol for the RFID system by considering the ideal PUF environment. Subsequently, we introduce an enhanced protocol which can support the noisy PUF environment. It is argued that both of our protocols can overcome the limitations of existing schemes, and further ensure more security properties. By analyzing the performance, we have shown that the proposed solutions are secure, efficient, practical, and effective for the resource-constraint RFID tag.

In recent years, mobile computing has gained a huge popularity among mobile users (MUs). It basically combines the mobile devices with the cloud computing. By the means of on-demand self-service and extendibility, it can offer the infrastructures, platform, entertainments, and software services in a cloud to MUs through the mobile network. However, offering secure access to these services by preserving the privacy of the MU is indeed a challenge for any mobile cloud service provider. In this paper, we aim to propose a new robust anonymous mutual authentication scheme for mobile cloud environment. Through this scheme, both the MU and the service cloud need to prove their legitimacy, and it eventually helps the legitimate mobile cloud user to enjoy n times all the ubiquitous services in a secure and efficient way, where the value of n may differ based on the principal he/she has paid for. The security of the proposed scheme is thoroughly analyzed using both formal as well as informal security analysis. Furthermore, functionality and performance comparisons using the testbed simulation among the proposed scheme and other existing relevant schemes reveal that the proposed scheme outperforms other existing schemes.

This article proposes a secure and energy efficient user authentication protocol, which can preserve the user anonymity for roaming service in the mobile network. Compared to other state of the art solutions, the proposed scheme has several considerable advantages. Firstly, no encryption/ decryption, modular and exponential operations have been introduced in our design. Instead, it uses the low cost function such as HMAC and exclusive-OR operations to accomplish the goals of authentication and key agreement. This makes the protocol more suitable for battery-powered mobile devices. Secondly, the proposed scheme can resolve several existing security issues like forgery attack, known session key attack, etc., with the limited computation and communication overheads which are indeed essential for offering a secure and expeditious roaming services in mobile communication environment.

Abstract Authenticated Encryption is a cryptographic process of providing confidentiality and integrity protection of messages in a single pass without any support of conventional checksum, Message Authentication Code (MAC), or hash function. In this paper, at first, we show that how to construct the stream‐cipher‐based Authenticated Encryption environment, where the key‐stream is generated from any secure block algorithm like Advanced Encryption Standard. In order to do that, we introduce two stream‐cipher modes of Authenticated Encryption, namely, PFC‐CTR (Counter‐based Authenticated Encryption environment) and PFC‐OCB (OCB‐based Authenticated Encryption environment), which are quite robust against several active attacks, for example, message stream modification attacks, known‐plain‐text attacks, and chosen‐plain‐text attacks, and at the same time, they can also efficiently deal with some other issues like “limited error propagation” existing in several conventional stream‐cipher modes of operation like Cipher Feedback, Output Feedback, and Counter. Finally, we enforce the concept of Authenticated Encryption in the sense of data communication security of the wireless sensor network (WSN), Global Mobility Networks (GLOMONET), and Cloud Computing environment, where only encryption can guarantee both the privacy and integrity in a single pass with the assurance of reasonable computational overhead. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract It is highly desirable that a real‐time crypto system should be designed to offer a strong security level by assuring both the privacy and integrity together in the same podium. However, the conventional stream cipher modes of operation (counter (CTR), cipher feedback (CFB), and Output Feedback (OFB)), often used in several real‐time applications, are unable to prevent any unauthorized message modification, which may often lead to several active attacks. This article shows a way to construct the real‐time based Authenticated Encryption (AE) environment, where the real‐time key stream is generated from any secure block algorithm like Advanced Encryption Standard (AES). Accordingly, in order to demonstrate the principle of the real‐time based AE environment, here we introduce two modes of operations, namely integrity aware real‐time based counter (IAR‐CTR) and cipher feedback (IAR‐CFB) modes, where both the proposed modes of operations can guarantee to offer both the confidentiality and message integrity in a single pass without any Message Authentication Code (MAC) or even any kind of non‐crypto checksum Cyclic Redundancy Check (CRC) support. Besides, here we argue that both the proposed real‐time based AE environments are quite robust against several active attacks, for example, message stream modification attacks and chosen‐plain‐text attacks, and at the same time, they can also be useful to deal with some other issues like ‘limited error propagation’ existing in several conventional stream cipher modes like CFB, OFB, and CTR. Copyright © 2015 John Wiley & Sons, Ltd.