We introduce a novel blockchain-based interledger authorisation scheme, a unique solution designed to support delegated authorisation management in cross-domain cloud environments. This innovative approach enables client applications, acting on behalf of a user, to request access to specific resources owned by a different organization. It benefits cross-domain multi-cloud applications, such as large-scale collaboration projects involving multiple cloud service providers. Multi-cloud presents authorisation challenges because of complex access control operations in multiple distinct domains. OAuth2 is the state-of-the-art choice for delegated authorisation. However, it falls short in handling such complex interactions with multiple authorisation servers and resource servers, and this is our motivation. Compared with OAuth2, our approach overcomes the limitations of a centralized model and achieves coordinated distinct delegations among multiple entities without a third-party trusted component. authorisation servers are blockchain participants and designated access token issuers, ensuring minimum client data collection and promoting client privacy. Multiple smart contracts are deployed in our multi-ledger blockchain environment to guarantee the provenance of the authorisation operations and facilitate scalable cross-domain authorisation. Our “hybrid interledger model” combines security techniques such as blockchain-based device authentication, hashed time-lock contracts (HTLCs), and service discovery. The blockchain-based device authentication ensures secure and trusted interactions, HTLCs enable time-bound transactions, and service discovery simplifies finding and connecting to the required cloud services. Our experimental evaluation provides insights into the scalability of our approach, which achieves decentralized authorisation in a multi-cloud environment with acceptable latencies compared with related works and shows stable throughput against concurrent authorisation requests in a multi-ledger system.

To decrease the IoT attack surface and provide protection against security threats such as introduction of fake IoT nodes and identity theft, IoT requires scalable device identity and authentication management. This work proposes a blockchain-based identity management approach with consensus authentication as a scalable solution for IoT device authentication management. The proposed approach relies on having a blockchain secure tamper proof ledger and a novel lightweight consensus-based identity authentication. The results show that the proposed decentralised authentication system is scalable as we increase number of nodes.

Device identity management and authentication are one of the critical and primary security challenges in IoT. In order to decrease the IoT attack surface and provide protection from security threats such as introduction of fake IoT nodes and identity theft, IoT requires scalable device identity management systems and resilient device authentication mechanisms. Existing mechanisms for device identity management and device authentication were not designed for huge number of devices and therefore are not suitable for IoT environments. This work presents results of a blockchain-based identity management approach with consensus authentication, as a scalable solution for IoT device authentication management. Our identity management approach relies on having a blockchain secure tamper proof registry and lightweight consensus-based identity authentication.

Road injuries are among the top ten causes of death worldwide. It has been shown that providing feedback to drivers decreases the likeliness of having them engaging into dangerous manoeuvres, such as speeding. It also contributes to reduce the amount of life-threatening incidents related with braking. Due to its ubiquity, smartphones are a great resource for assessing driving behaviour. Several mobile applications have been created with this purpose, but there is no concrete evidence that these approaches offer consistent results over distinct platforms (Operating Systems) and hardware. Providing a model for assessing driver behaviour across distinct devices represents a major challenge, due to the increasing differentiation between platforms and mobile devices' internal sensors (gyroscope, accelerometer, GPS, and magnetometer.) In this study we propose the application of Evolutionary Computation techniques to create models for driving behaviour characterisation over data acquired from mobile devices with distinct sensors. Our experiments show that we are able to evolve models that are robust and can accurately identify the legs of a car journey that have abnormal events. In concrete we are able to evolve predictive models that can successfully create a profile about the driving behaviour of a person.

End-to-end communications between Internet devices and Internet-integrated constrained wireless sensing platforms will provide an important contribution to the enabling of many of the envisioned IoT applications and, in this context, security must be addressed when employing communication technologies such as 6LoWPAN and CoAP. Considering the constraints typically found on sensing devices in terms of energy, memory, and computational capability, the integration of Wireless Sensor Networks (WSN) with the Internet using such technologies will open new threats and attacks that must be dealt with, particularly those originated at devices without the constraints of WSN sensors (e.g., Internet hosts). Existing encryption strategies for communications in IoT environments are unable to protect Internet-integrated WSN environments from Denial of Service (DoS) attacks, as well as from other forms of attacks at the network and application layers using CoAP. We may thus fairly consider that anomaly and intrusion detection will play a major role in the materialization of most of the envisioned IoT applications. In this article, we propose a framework to support intrusion detection and reaction in Internet-integrated CoAP WSN, and in the context of this framework we design and implement various approaches to support security against various classes of attacks. We have implemented and evaluated experimentally the proposed framework and mechanisms, considering various attack scenarios, and our approach was found to be viable, from the point of view of its impact on critical resources of sensing devices and of its efficiency in dealing with the considered attacks.

Abstract Currently, there are several ongoing efforts for the definition of new regulation policies, paradigms, and technologies aiming a more efficient usage of the radio spectrum. In this context, cognitive radio (CR) emerges as one of the most promising players by enabling the dynamic access to vacant frequency bands on a non-interference basis. However, the intrinsic characteristic of CR opens new ways for attackers, namely in the context of the effective detection of incumbent or primary users (PUs), the most fundamental and challenging requirement for the successful operation of CR networks. In this article, we provide a global and integrated vision of the main threats affecting CR environments in the context of the detection of primary users, with a particular focus on spectrum sensing data falsification and primary user emulation attacks. We also address solutions and research challenges still required to address such threats. Our discussion aims at being complete and self-contained, while also targeting readers with no specific background on this important topic of CR environments. It is, as far as our knowledge goes, the first work providing a global and clear vision of security threats and countermeasures in the context of primary user detection in CR.

The availability of inexpensive sensing devices capable of wireless communications enables the design of exciting and new distributed sensing applications. The integration of such applications with the Internet will contribute to materialize a vision of a future Web that we nowadays describe as the Web of Things (WoT). Many security-related aspects are still open on how to address security for communications on the WoT, and that must be targeted before such applications can realistically be considered ready for deployment. We discuss the experimental evaluation of mechanisms proposed to secure end-to-end web communications with IPv6-capable sensing applications and devices, as such mechanisms may provide an important contribution towards the WoT. Our experimental evaluation study considers the impact of security on real sensing devices and requirements from sensing applications, allowing the identification of the limitations of current sensing platforms in supporting the proposed mechanisms.

Security plays a vital role in enabling future integration of Wireless Sensor Networks (WSNs) with the Internet. Although security in WSNs is a mature field of research and many proposals currently exist that can address particular security threats, how to guarantee end-to-end security at the network layer for IPv6-enabled WSNs remains an open research issue. Security should be addressed at the network layer, as sensor nodes will evolve to become IPv6 aware and new applications are adapted or designed that depend on IPv6 connectivity to sensor nodes. We propose and evaluate new compressed AH and ESP 6lowpan security headers that allow the protection of IPv6 communications on IEEE 802.15.4 WSNs. As the security headers are designed to work side-by-side with other extension headers of the 6lowpan adaptation layer, they allow also the establishment of end-to-end secure communications between Internet hosts and wireless sensor nodes. The usage of IPv6 on WSNs has the potential of enabling the integration of sensing applications with the Internet and, if end to end security is properly addressed, can represent a major contribution towards the "internet of things".

Many issues still remain to be addressed in order to achieve acceptable security in wireless sensor networks (WSNs). This necessity, together with the adoption of IPv6 on WSNs being defined at the 6lowpan working group of the IETF, motivates our investigation on the feasibility of the application of IPSec on sensor nodes. IPSec is already part of IPv6, which makes it a natural candidate to be directly employed or adapted for WSNs. We discuss results obtained from practical experiments on the usage of cryptographic algorithms typically employed within IPSec in real sensor nodes. We analyze the security and performance tradeoffs involved when employing cryptography measures in WSNs, also in the context of their usage side-by-side with IPv6. The results obtained show that the adoption of a security architecture such as IPSec is viable, and also point towards the successful design and deployment of a security architecture for WSNs.