Motivated by challenges in cyber-physical systems (CPS), this paper investigates the inconsistency of errors between certification authorities (CAs) to evaluate trustworthiness in cross-domain authentication. CPS integrates physical space and cyberspace through interconnected devices. Cross-domain authentication is essential for CPS, enabling dynamic communication between devices from different domains. Public key infrastructure (PKI) facilitates this authentication as multiple CAs bind public keys to device identities. However, recent research on evaluating the trustworthiness of PKI focuses on a single CA and overlooks the relationships between CAs. We analyze the inconsistency of errors between CAs based on public key certificates collected from the wild via Censys. Our findings reveal that CAs with inconsistencies often lack essential access information for CAs, risking incomplete certificate verification and communication with fraudulent devices. This research highlights the importance of considering CA relationships in trustworthiness evaluations for secure cross-domain authentication in heterogeneous CPS environments.

In wireless communication standards such as IEEE 802.11az, indoor localization techniques are expected to achieve submeter accuracy for security and/or privacy applications. Motivated by this background, we propose a new receive signal strength indicator (RSSI)-based localization technique using segmented convolution neural network (CNN) regression, which can be applicable for legacy devices. Specifically, assuming a testbed partitioned into certain subregions, the proposed technique estimates a subregion as a coarse estimate by using a K-nearest neighbors (KNN) algorithm, and it refines the position estimate by performing a CNN regression whose model is trained per each subregion. The experiment results using measurement data verified that the proposed technique achieves mean absolute error (MAE) of 0.34m by reducing more than 0.2m from those of the conventional cascade-connected artificial neural network (CC-ANN) and extreme gradient boosting (XGBoost) methods. In addition, the simulation results confirmed that the proposed technique reduces costs needed to make a fingerprint database to 7% of that of the XGBoost in indoor propagation channels generated from a ray-tracing model.

To deal with the increasing number of cyber-attacks, intrusion detection system (IDS) plays an important role in monitoring and ensuring the security of the computer network. With the power of machine learning and deep learning, intelligent IDS systems have gained increasing attention due to their efficiency and high classification accuracy. However, the premise of machine learning/deep learning is that the data must be in one central entity (e.g., server) to train the model. This causes additional concerns, such as data transmission costs and privacy leakage. Federated learning complements this shortcoming with a privacy-preserving decentralized learning technique. In federated learning, the data are not shared with the server, local model training is performed where the data reside and only the model parameters are exchanged with the server. This work investigates the federated learning-based IDS approach in the context of IoT data to study the main challenges imposed by federated learning. Two main issues, such as data heterogeneity and poisoning attacks launched by malicious clients, are the main focus of this study. As real-world IoT datasets are heterogeneous, we propose a personalized federated learning-based IDS approach to handle imbalanced data distributions. Moreover, a curious yet malicious client can poison the local data or model to corrupt the global intrusion detection model due to the distributed nature of federated learning, where the central server has no control over the client’s local training process. This study demonstrates that the existence of a malicious client can degrade the performance of the federated learning-based IDS model. Accordingly, we propose a robust approach called pFL-IDS to combat poisoning attacks against the federated learning-enabled IDS on heterogeneous IoT data. Our approach introduces mini-batch logit adjustment loss to local model training to obtain a personalized model tailored to each local data distribution. Moreover, we design a detection mechanism at the server to identify malicious agents by considering the cosine similarity of local models from the non-poisoned client’s centroid. The non-poisoned centroid is determined from the similarity between the pre-computed global model and the local models. If the poisoning attack is successful, poisoned clients will be closer to the pre-computed global model; any models further from the pre-computed model are taken as the non-poisoned clients. With this two-phase client similarity alignment, we identify poisoned clients and restrict their aggregation on the global intrusion detection model. In comparison with the baseline methods, we demonstrate that our pFL-IDS can detect poisoning attacks without compromising performance.

User-centric data sharing is essential to encourage citizens' active participation in the digital economy. One key to smart cities, a form of the digital economy, is the promotion of public use of citizen data. Nevertheless, it is not easy to utilize data without citizens’ consent. In this study, we took a technological approach to these issues. User-managed access (UMA) is a well-known framework for delegating resource access rights to others on the Internet. In UMA, authorization mechanisms are designed to be centralized so that resource owners can centrally manage access rights for various resources stored in different domains. However, the lack of transparency in the authorization mechanism is a barrier to its implementation in large-scale systems such as smart cities. In this study, we developed a blockchain-based cross-domain authorization architecture that enables a resource-sharing ecosystem in which organizations that wish to utilize data can freely trade with each other. The proposed architecture solves the transparency problem that conventional authorization systems have had by designing the authorization mechanism on blockchain technology. We implemented the proposed architecture as smart contracts and evaluated its processing performance. The resultant time required for delegating access rights and accessing resources was less than 500 ​ms. Furthermore, we found that the fluctuation in the processing time overhead was small. Based on these results, we concluded that performance degradation with the proposed architecture is minor.

This paper studies adaptive modulation techniques aiming to implement secure transmission in practical communication systems imposed with finite alphabet constraints. As a baseline, the logarithm barrier method is applied to solve the adaptive modulation problem formulated with an inequality constrained secrecy capacity maximization. However, the interested problem requires to jointly solve plural sub-problems to select the best alphabet-set, which incurs a high complexity issue for the baseline technique due to identifying infeasible cases. Hence, we propose a new cache-aided power optimization algorithm that finds the optimal solution with a statistically independent complexity order of the number of the sub-problems. Simulation results obtained in MIMO-ME scenarios verify the effectiveness of the new cache-aided bisection (C-bisect) method that it achieves normalized throughput performance of 0.95.

Provable Data Possession (PDP) is one of the data security techniques to make sure that the data stored in the cloud storage exists. In PDP, the integrity of the data stored in the cloud storage is probabilistically verified by the user or a third-party auditor. In the conventional PDP, the user creates the metadata used for audition. From the viewpoint of user convenience, it is desirable to be able to audit without operations other than uploading. In other words, the challenge is to provide a transparent PDP that verifies the integrity of files according to the general cloud storage system model so as not to add operations to users. We propose a scheme in which the cloud generates the metadata used during verification, and the user only uploads files. It is shown that the proposed scheme is resistant to the forgery of cloud proof and the acquisition of data by a third-party auditor.

Many physical devices and sensors make it possible to obtain more localized data and applications which provide more localized information for users will appear. Generally, those applications use a storage server for computing location-dependent data. Traffic of Internet of Things (IoT) devices may cause concentration, when data is stored into a server. It is desirable that each location-dependent data is stored in each area, because each data request can be processed there and each user can get the data from a nearby server. This paper proposes the virtual storage with Key-Value Stores over Named Data Networking. In proposed system, the location-dependent data is cached in local servers, which are located at network edge, and each user can get the data from a nearby local server. We evaluate the proposed system by simulation from the views of delay time and energy consumption. We compare the proposed system with the conventional system, in which all data is stored in a certain server and all users retrieve it from the server. We show that the proposed system can reduce the both of delay time and energy consumption compared with the conventional system.

By exchanging the information on the status and the surrounding environment between devices, devices can determine the optimal action. We focus on the construction of a digital signature scheme for local broadcast, which allows the devices with limited resources to securely transmit broadcast messages. A multi-group authentication scheme that enables a node to authenticate its membership in multi verifiers by the sum of the secret keys has been proposed for its use on devices with limited resources. This paper proposes a multi-group signature scheme by converting the multi-group authentication via the Fiat-Shamir transform. In the proposed scheme, a sender can sign a message by the secret keys which multiple certification authorities issue and the signature can validate the authenticity and integrity of the message to multiple verifiers. By comparing the proposed scheme with a code-based signature scheme, where a sender signs a message by individual secret key as many times as the number of the secret key and each of verifiers verify each signature, the proposed scheme provides efficient multi-group signature in terms of the amount of transmitted data.

While many two-party fair exchange protocols have been proposed, more than three-party fair exchange protocol is required depending on a type of applications. Asokan et al. have proposed a multi-party fair exchange protocol for mesh topology. This scheme can be adapted to all kinds of topologies but requires much communication costs, which is 4n(n-1) passes in the all n-participators honest cases and 8n2-n-10 passes in the worst case. In previous works, more efficient and multi-functional schemes specialized for a kind of topologies have been proposed but most of these are for ring topology and star topology. Zhou et al. have proposed an efficient multi-party contract signing protocol for line topology. It is shown the two protocols such that a simple protocol which is completed with 4(n-1) passes in the all honest cases and 5n-3 passes in the worst case and an optimized protocol which is completed with 3(n-1) passes in the all honest cases and 4n-2 passes in the worst. This result means that a fair exchange protocol for line topology is efficient in a number of communications nevertheless a certified email protocol specialized for line topology has not been proposed. That is, a certified email protocol run on line topology is only a protocol for mesh proposed by Asokan et al. adapted to line topology, therefore there is large room for reducing a number of communications by specializing for a certified email protocol. In this paper, we propose a three-party certified email protocol for line topology towards a design of n-party protocol. The proposed protocol has such basic properties of certified email as fairness, non-repudiation, trusted third party invisibility and timeliness, as same as the previous works. Our scheme is completed with eight passes in the case of all honest and twelve passes in the worst. The communication cost is less than the Asokan et al.'s scheme with 24 (n=3) passes even if the all n-participators are honest.

A key advantage of SSL (secure socket layer) VPN is that no specialized client software is required. When a user requests access to a server, the SSL client module, which is a Java applet code, is downloaded into the host first. However, it is quite likely that not all applications run well, because a client cannot connect with a server through an HTTPS tunnel in some applications. Moreover, there is the possibility that we can not use the VPN connections when the SSL port is under denial of service (DoS) or distributed DoS (DDoS) attack. We propose a port randomized VPN architecture such that any application can use the VPN and the VPN has strength against DoS or DDoS attack. The proposed VPN uses the same Java applet as existing SSL VPNs use, but the function of the applet, which we call mobile code, is dynamically changed by Java remote method invocation (RMI). The VPN client applet can cooperate with a VPN server and a firewall in the server side.