Security in 5G high-density networks is vital, especially where large-scale unicast and multicast communication is involved. The ONE4HDD project explores practical and scalable methods for implementing secure communications using TLS, DTLS, and the Logical Key Hierarchy (LKH) for key distribution. This paper consolidates findings and implementations from a sequence of technical deliverables, each tackling specific aspects of secure communication. Simulation-based experiments were conducted using OMNET++ to model multicast security scenarios involving cyber threats such as Man-in-the-Middle (MitM) attacks, replay attacks, sniffing, and spoofed certificates. In parallel, real-world emulation on the Surrey 5GIC testbed validated the effectiveness of TLS/DTLS in secure unicast streaming. The testbed also demonstrated detection of invalid certificates and replay prevention using DTLS sequence numbers. Numerical results highlight that LKH drastically reduces rekeying overhead for multicast communication. For instance, in groups of 1024 and 8192 users, the number of rekey messages was reduced from 1023 and 8191 (flat key) to 19 and 25, respectively, achieving 98.1% and 99.7% overhead reduction. These achievements confirm the scalability and performance of the proposed architecture.

Due to the extremely important role of data in the industrial Internet of Things (IIoT) network, trust and security of data are among the major concerns. In this article, we develop a cloud-integrated 5G-IIoT network architecture enabled by a three-party authenticated key exchange (AKE) protocol with privacy-preserving to secure data exchanged via wireless communication, cope with unauthorized entities, and ensure data integrity. Moreover, we develop a trust model based on the Dempster–Shafer theory to check the trustworthiness of data collected by smart devices/sensor nodes. Security analysis performed on our scheme demonstrates that it can withstand different well known attacks in the IIoT environment. We also analyzed the validity of our scheme by using the automated validation of internet security protocols and applications tool. Additionally, the performance evaluation and experimental results prove the effectiveness of the proposed scheme compared to the existing works in terms of accuracy, delay, trust, and throughput.

Wireless interfaces, remote control schemes, and increased autonomy have raised the attacks surface of vehicular networks. As powerful monitoring entities, intrusion detection systems (IDS) must be updated and customised to respond to emerging networks' requirements. As server-based monitoring schemes were prone to significant privacy concerns, new privacy constrained learning methods such as federated learning (FL) have received considerable attention in designing IDS. However, to alleviate the efficiency and enhance the scalability of the original FL, this paper proposes a novel collaborative hierarchical federated IDS, named CHFL for the vehicular network. In the CHFL model, a group of vehicles assisted by vehicle-to-everything (V2X) communication technologies can exchange intrusion detection information collaboratively in a private format. Each group nominates a leader, and the leading vehicle serves as the intermediate in the second level detection system of the hierarchical federated model. The leader communicates directly with the server to transmit and receive model updates of its nearby end vehicles. By reducing the number of direct communications to the server, our proposed system reduces network uplink traffic and queuing-processing latency. In addition, CHFL improved the prediction loss and the accuracy of the whole system. We are achieving an accuracy of 99.10% compared with 97.01 % accuracy of the original FL.

In a critical infrastructure such as Smart Grid (SG), providing security of the system and privacy of consumers are significant challenges to be considered. The SG developers adopt Machine Learning (ML) algorithms within the Intrusion Detection System (IDS) to monitor traffic data and network performance. This visibility safeguards the SG from possible intrusions or attacks that may trigger the system. However, it requires access to residents’ consumption information which is a severe threat to their privacy. In this paper, we present a novel method to detect abnormalities on a large scale SG while preserving the privacy of users. We design a Federated IDS (FIDS) architecture using Federated Learning (FL) in a 5G environment for the SG metering network. In this way, we design Federated Deep Neural Network (FDNN) model that protects customers’ information and provides supervisory management for the whole energy distribution network. Simulation results for a real-time dataset demonstrate the reasonable improvement of the proposed FDNN model compared with the state-of-the-art algorithms. The FDNN achieves approximately 99.5% accuracy, 99.5% precision/recall, and 99.5% f1-score when comparing with classification algorithms.

With increased wireless connectivity and embedded sensors, vehicles are becoming more intelligent, offering Internet access, telematics, and advanced driver assistance systems. Along with all benefits, connectivity to the public network and automotive control systems introduces new threats and security risks to connected and autonomous driving systems. Therefore, it is highly critical to design robust security mechanisms to protect the system from potential attacks and security vulnerabilities. An intrusion detection system (IDS) is a promising solution to detect and identify attacks and malicious behaviour within the network. This paper proposes a two-layer IDS mechanism that exploits machine learning (ML) solutions for collaborative attack detection between an on-vehicle IDS module and a developed IDS platform at a mobile edge computing (MEC) server. The results illustrate that the proposed solution can significantly reduce communication latency and energy consumption up to 80% while maintaining a high level of detection accuracy.

Location-based services (LBSs) have gained popularity as a result of the advances in mobile and communication technologies. LBS provide users with relevant information based on their location. In spite of the desirable features provided by LBS, the geographic locations of users are not adequately protected. Location privacy is one of the major challenges in vehicular and mobile networks. In this paper, we analyze the security and privacy requirements for LBS in vehicular and mobile networks. Specifically, this paper covers privacy enhancing technologies and cryptographic approaches that provide location privacy in vehicular and mobile networks. The different approaches proposed in literature are compared and open research areas are identified.

Satellite communications can be used when other communication systems are either destroyed or overloaded. Observation satellites and delay/disruption tolerant networks (DTNs) are technologies that can be interconnected to provide emergency communication for disaster recovery operations. DTNs use a store-carry-forward mechanism to forward messages through intermediary nodes to the destination node. The reliability of relaying messages through multi-hop nodes poses a significant problem in DTNs due to lack of consistent connectivity. These network characteristics make DTNs to heavily rely on the cooperation of neighboring nodes for the successful delivery of packets. However, the presence of malicious or selfish nodes will have a great impact on the network performance. In this paper, we design a decentralized trust management scheme (DTMS) to filter out malicious nodes in DTNs. First, the number of forwarding evidence is combined with the energy consumption rate of the nodes to formulate direct trust. Then, a recommendation trust is computed from the indirect trust, recommendation credibility, and recommendation familiarity. Recommendation credibility and familiarity improve the overall recommendation trust by filtering out dishonest recommendations. A comparative analysis of DTMS is performed against a cooperative watchdog scheme, recommendation based trust model, and spray and wait protocol. The results show that DTMS can effectively deal with malicious behaviors in DTNs including trust related attacks.

Public‐key infrastructure (PKI) is based on public‐key certificates and is the most widely used mechanism for trust and key management. However, standard PKI validation and revocation mechanisms are considered major reasons for its unsuitability for delay/disruption tolerant networking (DTN). DTN requires mechanism to authenticate messages at each node before forwarding it in the network. So, certificate revocation lists (CRLs) being distributed in DTN network will need to be authenticated and validated for issuer certificate authority (CA) at each node. In this study, the authors propose new validation and revocation mechanism which is compliant with DTN semantics and protocols. This study also proposes a new design for CRL in compliance with standard PKI X.509 standard to make the proposed mechanism easy to implement for DTN. The new designed CRL is of reduced size as it contains fewer entries as compared with standard X.509 CRL and also arranges the revocation list in the form of hash table (map) to increase the searching efficiency.

As modern vehicle and communication technologies advanced apace, people begin to believe that the Intelligent Transportation System (ITS) would be achievable in one decade. ITS introduces information technology to the transportation infrastructures and aims to improve road safety and traffic efficiency. However, security is still a main concern in vehicular communication systems (VCSs). This can be addressed through secured group broadcast. Therefore, secure key management schemes are considered as a critical technique for network security. In this paper, we propose a framework for providing secure key management within the heterogeneous network. The security managers (SMs) play a key role in the framework by capturing the vehicle departure information, encapsulating block to transport keys and then executing rekeying to vehicles within the same security domain. The first part of this framework is a novel network topology based on a decentralized blockchain structure. The blockchain concept is proposed to simplify the distributed key management in heterogeneous VCS domains. The second part of the framework uses the dynamic transaction collection period to further reduce the key transfer time during vehicles handover. Extensive simulations and analysis show the effectiveness and efficiency of the proposed framework, in which the blockchain structure performs better in term of key transfer time than the structure with a central manager, while the dynamic scheme allows SMs to flexibly fit various traffic levels.

Communication technologies are very important for disaster management. Satellite network's advantage of large coverage and Mobile Ad hoc Network's (MANET) advantage of high flexibility could be ideal for disaster management. In this paper, the authors propose a novel scheme for providing reliable wireless communications in disaster sites with a hybrid network of terrestrial MANET and satellite network. In comparison with normal wireless routing approaches, i.e. AODV and AOMDV, the proposed scheme could achieve higher packet delivery ratio, higher throughput and lower delay; meanwhile it could also balance traffic loads at gateways to maximum satellite links' utilization.

The unstable nature of MANETs over different types of wireless topologies and mobility models affects the Quality of Service (QoS) for real time applications such as Voice over IP (VoIP). One of the most efficient signaling systems for VoIP applications is the Session Initiation Protocol (SIP) which is mainly used to initiate, manage, and terminate VoIP calls over different types of IP based network systems. As a part of upgrading to Next Generation Network, MANETs will be considering IPv6 for different types of applications and devices. Therefore, SIP signaling over IPv6 MANETs needs to be investigated with different QoS performance metrics such as bandwidth, packet loss, delay and jitter. In this paper, an evaluation of SIP signaling is conducted for SIP based VoIP calls using GSM voice codec system over MANETs with Static, Uniform, and Random mobility models. This evaluation considered AODV as a reactive routing protocol and OLSR as a proactive routing protocol over both IPv4 as well as IPv6. The evaluation study of SIP signaling examined call setup time, number of active calls, number of rejected calls and calls duration. The results of this study show that, in general, IPv4 has better performance over different types of mobility models, while IPv6 upholds longer delays and poor performance over Random mobility models.

The concept of Delay Tolerant Networks (DTNs) are proposed to facilitate communication in challenged mobile wireless networks using the Store-Carry-Forward (SCF) routing behavior. In this paper, our motivation is to take advantage of geographic routing since it routes message without the knowledge about network topology by using realtime location information, overcoming the challenge of large network topology variation in DTNs. Different from traditional geographic algorithms, our approach only adopts history geographic information due to the difficulty to obtain the realtime location of destination, suffering from sparse network density and high mobility. The key insight of our algorithm is to separate message replication depending on the proximity to the movement range estimated for destination, followed by the proposed scheduling methodology for prioritized transmission between each phase as well as anti-diffusion function for redundancy reduction. Simulation results under the Helsinki city scenario show an improvement comparing with two well known geographic approaches in DTNs, considering delivery ratio, average latency as well as overhead ratio.

The emergence of MANET supported applications and the subsequent widespread acceptance is facilitated by the development and availability of cheap wireless Wi-Fi devices. It is on this premise that Flow-Aware Admission Control (FAAC) protocol is designed to improve the throughput assurance of MANET-based applications. The work presented in this paper is an extension of our designed FAAC protocol to guarantee the provisioning of QoS in many mobile scenarios. The source node is designed to maintain multiple paths to each destination with the reliability of the routes maintained through nodes disjointness. The designed FAAC-Multipath protocol is equipped with the intermediate route repair mechanism to enable the intermediate node to carry out route repair locally without contacting the source node. We have illustrated the effectiveness of FAAC-Multipath with the state of the art admission control protocols.

Packet injection by an attacker can trigger flooding-based DOS attacks. This paper seeks to provide a simple and robust approach to protect the access control, data integrity and sender authentication security services in resource-constrained delay tolerant networks. The aim is to make security protocols providing these mandatory security services resilient to resource exhaustion DOS attacks. To achieve this we propose a hierarchical design based on the use of light-weight and hard to forge cookies. The DOS defense mechanism can proactively identify and discard attack bundles. Compromised insider nodes are identified and isolated.

The concept of Delay Tolerant Networks (DTNs) has been utilized for wireless sensor networks, mobile ad hoc networks, interplanetary networks, pocket switched networks and suburb networks for developing region. Because of these application prospects, DTNs have received attention from academic community. Whereas only a few state of the art routing algorithms in DTNs address the problem of aborted messages due to the insufficient encounter duration. In order to reduce these aborted messages, we propose a routing framework which consists of two optional routing functions. Specifically, only one of them is activated according to the encounter angle between pairwise nodes. Besides, the copies of the undelivered message carried by most of the nodes in the network are more likely to be cleared out after successful transfer, which reduces the number of unnecessary transmissions for message delivery. By means of the priority for message transmission and deletion in case of the limited network resource, the proposed algorithm achieves the high delivery ratio with low overhead as well as less number of aborted messages due to the insufficient encounter duration, thus is more energy efficient.

Privacy, Anonymity, pseudonymity are the debatable terms which on one angle restrict the rights but on other angle open doors for malicious activity.This paper proposes design for a pseudonymised communication which is optimal solution for the privacy issues, where the real identity is hidden from the outside world by using blind signature in a different way of group communication.The protocol is deployed and analysed in extreme environment of Delay Tolerant Networks (DTN), which is overlay on the top of traditional Internet which provides end to end connectivity and characterized with long delay and disruption. A telemedicine application of rural area network is explored to provide source anonymity.The protocol is finally analysed using Dolev Yao model with two different cases and it preserves the original identity of the node.

The framework of Delay Tolerant Networks (DTNs) has recently received an extensive attention and widely implemented, ranging from Wireless Sensor Networks (WSNs) to Interplanetary Networks. It has been applied in military communication, scientific research and exploration. Due to the characteristic of long delay, intermittent disruption, limitation of buffer space and energy, the traditional routing algorithms in the Internet do not perform well in DTNs. Since most of the existing DTN routing algorithms are based on the replication mechanism to achieve the high delivery ratio. In this paper, we propose an asymmetric spray algorithm based on the limited number of replication with the consideration of utility metric. In addition, we also design an adaptive replication function to optimize the dropped messages due to the insufficient encounter duration. Simulation results show the effectiveness of our asymmetric spray approach. In combination with the other designed functions, our proposed algorithm achieve a better performance than the state of the art algorithms.

Opportunistic Networks (ONs) utilize the communication opportunity with a hop-by-hop behavior, and implement communication between encountered nodes based on the Store-and-Forward routing pattern. This approach, which is totally different from the traditional communication model, has received extensive interests from academic community. We consider the ONs are a type of Delay Tolerant Networks (DTNs) since their routing behavior are quite same regardless of the bundle layer protocol. Until currently, a set of congestion control mechanisms have been proposed in Deterministic DTNs, which is mainly implemented in the network with limited mobility or the static network with scheduled disruption interval. However, regarding the networks with large topology variation, known as Opportunistic DTNs, to design a congestion control mechanism is difficult. In this paper, we propose an active congestion control based routing algorithm that pushes the selected message before the congestion happens. In order to predict the future congestion situation, a corresponding estimation function is designed and our proposed algorithm works based on two asynchronous routing functions, which are scheduled according to the decision of estimation function. Simulation results show our proposed algorithm efficiently utilizes the distributed storage to achieve a quite low overhead ratio and also performs well in the realistic scenario.

Satellite communications are characterized by long delays, packet losses, and sometimes intermittent connectivity and link disruptions. The TCP/IP stack is ineffective against these impairments and even dedicated solutions, such as performance enhancing proxies (PEPs), can hardly tackle the most challenging environments, and create compatibility issues with current security protocols. An alternative solution arises from the delay- and disruption-tolerant networking (DTN) architecture, which specifies an overlay protocol, called bundle protocol (BP), on top of either transport protocols (TCP, UDP, etc.), or of lower layer protocols (Bluetooth, Ethernet, etc.). The DTN architecture provides long-term information storage on intermediate nodes, suitable for coping with disrupted links, long delays, and intermittent connectivity. By dividing the end-to-end path into multiple DTN hops, in a way that actually extends the TCP-splitting concept exploited in most PEPs, DTN allows the use of specialized protocols on the satellite (or space) links. This paper discusses the prospects for use of DTN in future satellite networks. We present a broad DTN overview, to make the reader familiar with the characteristics that differentiate DTN from ordinary TCP/IP networking, compare the DTN and PEP architectures and stacks, as a preliminary step for the subsequent DTN performance assessment carried out in practical LEO/GEO satellite scenarios. DTN security is studied next, examining the advantages over present satellite architectures, the threats faced in satellite scenarios, and also open issues. Finally, the relation between DTN and quality of service (QoS) is investigated, by focusing on QoS architectures and QoS tools and by discussing the state of the art of DTN research activity in modeling, routing, and congestion control.

Researches on multicast has explored security challenges faced by group communications. Multicast transport protocols and multicast security protocols need to work closely to provide reliable and secure multicast services. However, there has been comparatively little work carried out to specify how exactly the two technologies can work together efficiently. In this paper, authors present an example of partially integrating the Timed Efficient Stream Loss-Tolerant Authentication (TESLA) protocol and the File Delivery over Unidirectional Transport (FLUTE) protocol. TESLA provides source authorization and data integrity for multicast groups while FLUTE ensures reliability of the multicast transmission. This paper proposes a loose synchronization mechanism for a unidirectional transmission environment, suited to satellite networks. The proposed algorithm was implemented on a testbed with multicast tunnel between University of Surrey and University of Aberdeen and the results are presented in this paper.

The notion of Quality of Service (QoS) in Delay Tolerant Network (DTN) is different due to the challenging nature of DTN which might suffer from intermittent disconnections and long delays. DTN has scarce resources; therefore, controlling the admissions to these resources is important to best share them among the users according to each user privilege. This paper presents the requirements for QoS in DTN and identifies the DTN flow characteristics metrics. The control and managements of these metrics will enhance DTN QoS. Also this paper proposes an Admission Control model based on local information of the node resource in order to avoid network congestion and enhance network performance.

The broadband satellite multimedia (BSM) architecture standardised by ETSI defines a satellite independent service access point (SI-SAP) interface layer that separates the satellite independent features of the upper layers from the satellite dependant features of the lower layers, and provides a mechanism to carry IP-based protocols over these satellite dependent lower layers. This enables interoperability at the IP layer between satellite systems of different physical and link layers technologies that fully comply with the SI-SAP concept. This study reviews past and current standardisation activities including the BSM quality of service (QoS) architecture, security architecture, network management that have been carried out by the ETSI Technical Committee-Satellite Earth Stations and Systems (TC-SES)/BSM working group and looking into the future to extend current SI-SAP functions that can enhance existing QoS provision and security management capabilities as well as proposing a mobility management architecture that complies with the IEEE 802.21 media independent handover framework to support BSM mobility and to allow integration of satellite networks with fixed and mobile network infrastructures. A service-based network management architecture is also proposed to allow management flexibility and integration of business and operation support functions, paving the way for satellite integration into the Internet of the future.

In satellite networks, voice over IP performance is degraded by long delays and low bandwidth. Both call setup time and quality of service (QoS) for voice calls are affected. Separate studies have been undertaken for these performance metrics. In this paper, we have carried out experiments using different voice codecs to evaluate SIP call setup time and QoS parameters together. The experiments are performed on the satellite network testbed at Centre for Communication Systems Research (CCSR) at University of Surrey. The results present a comparison of different codecs, highlighting their performance.

Multicast research has explored the security challenges faced in group communications. Multicast transport and multicast security need to work in close collaboration to realise a multicast service. However, there has been comparatively little work to combine the two technologies. In this paper the authors, presenting an example of partially integrating Timed Efficient Stream Loss-Tolerant Authentication (TESLA) protocol and the File Delivery over Unidirectional Transport (FLUTE) protocol. TESLA provides source authorization and data integrity for multicast groups. This paper proposes a loose synchronization mechanism for a unidirectional transmission environment, suited to satellite networks. It also analyses the effects on Forward Error Control (FEC) and the congestion control building blocks of FLUTE when used with TESLA.

Delivering ubiquitous services to various users and devices through heterogeneous networks is a major aim in next generation networks. The delivery should be efficient and secure. The support and integration of security, quality of service (QoS) and mobility management (MM) in access networks become parts of the essential issues. An enhanced node (EN) with a network sub-layer is proposed here to achieve this integration. The architectural framework with ENs located in the IP-based access networks is presented. The focus of this paper is to investigate the challenges of integrating security with QoS and MM, notably the threats and requirements, based on this framework. The solutions are also proposed to provide the authenticated and authorized access control and to secure the handover process.

With the advent of various access technologies and increasing number of applications, a set of challenges concerning efficient delivery of ubiquitous services to heterogeneous users and devices have been posed. One of the important challenges is to integrate quality of service (QoS), security and mobility support in heterogeneous networks. To facilitate the interworking of these mechanisms we propose the concept of enhanced node (EN) in this paper. The EN is an intelligent entity with a network sub-layer, which integrates QoS, security and mobility management (MM). ENs are located in the access network and they communicate with each other via signalling. In this paper, the functionalities of the ENs are described and the framework with ENs to integrate QoS, security and MM in IP-based networks is presented. The mechanisms to provide the authenticated and authorized access control and to enhance the secured QoS combined fast handovers are also proposed.

A secure multicast communication is important for applications such as pay-per-view and secure videoconferencing. A key tree approach has been proposed by other authors to distribute the multicast group key in such a way that the rekeying cost scales with the logarithm of the group size for a join or depart request. The efficiency of this key tree approach critically depends on whether the key tree remains balanced over time as members join or depart. In this paper, we present two Merging Algorithms suitable for batch join requests. To additionally handle batch depart requests, we extend these two algorithms to a Batch Balanced Algorithm. Simulation results show that our three algorithms not only maintain a balanced key tree, but their rekeying costs are lower compared with those of existing algorithms.

Security is an important concern in today's information age and particularly so in satellite systems, where eavesdropping can be easily performed. This paper addresses efficient key management for encrypted multicast traffic transmitted via satellite. We consider the topic of encrypting traffic in large multicast groups, where the group size and dynamics have a significant impact on the network load. We consider life cycle key management costs of a multicast connection, and show for a logical key hierarchy (LKH) how member preregistration and periodic admission reduces the initialization cost, and how the optimum outdegree of a hierarchical tree varies with the expected member volatility and rekey factor. This improves network utilization, but encryption at the network layer can pose problems on satellite links. We, therefore, propose and analyze an interworking solution between multilayer Internet protocol security (IPSEC) and LKH that also reduces key management traffic while enabling interworking with performance enhancing modules used on satellite links.

This paper describes the architecture of a proposed multiparty conferencing system for satellites. Different conferencing models are discussed and compared. A session initiation protocol (SIP)-based conference signaling model and an extension to protocol-independent multicast sparse mode that supports quality-of-service (QoS) in DiffServ networks are proposed, as particularly suitable for multiparty conferencing applications over satellite links. The paper also presents key issues and potential solutions of scalable QoS multicast services for multiparty conferences over satellite. End-to-end QoS parameters for voice and video are measured and analyzed on a prototype.

The Terminal at High Speed for European Stock Exchange USers (THESEUS) is a European research project. THESEUS with its multimedia communications capabilities enables brokers to trade not only with their national stock exchange but also with all the European stock exchanges. This will make secure trading in the stock exchanges more effective through Europe. This paper presents an overview of the THESEUS system design and architecture and the terrestrial, satellite and security field demonstrations.

Mobile agent frameworks have attracted a lot of attention in recent years, seen as counterparts of static distributed object frameworks but allowing also for object or agent mobility. A lot of research is currently being carried out trying to assess their applicability to network management and control environments. In this paper, we present our experiences of using a mobile agent framework to design and realize a performance management system which exhibits "constrained mobility", constrained in the sense that performance monitoring agents are sent to execute within network elements and stay there until their task is accomplished. We present the architecture, design and implementation of such a system, compare and contrast it to static object approaches and present a detailed performance comparison to a similar Java-RMI based implementation, trying to assess the overhead of mobile agent solutions.