Access control is essential for the IoT environment to ensure that only approved and trusted parties are able to configure devices, access sensor information, and command actuators to execute activities. The IoT ecosystem is subject to various access control complications due to the limited latency between IoT devices and the Internet, low energy requirements of IoT devices, the distributed framework, ad-hoc networks, and an exceptionally large number of heterogeneous IoT devices that need to be managed. The motivation for this proposed work is to resolve the incurring challenges of IoT associated with management and access control security. Each IoT domain implementation has particular features and needs separate access control policies to be considered in order to design a secure solution. This research work aims to resolve the intricacy of policies management, forged policies, dissemination, tracking of access control policies, automation, and central management of IoT nodes and provides a trackable and auditable access control policy management system that prevents forged policy dissemination by applying Software Defined Network (SDN) and blockchain technology in an IoT environment. Integration of SDN and blockchain provides a robust solution for IoT environment security. Recently, smart contracts have become one of blockchain technology’s most promising applications. The integration of smart contracts with blockchain technology provides the capability of designing tamper-proof and independently verifiable policies. In this paper, we propose a novel, scalable solution for implementing immutable, verifiable, adaptive, and automated access control policies for IoT devices together with a successful proof of concept that demonstrates the scalability of the proposed solution. The performance of the proposed solution is evaluated in terms of throughput and resource access delay between the blockchain component and the controller as well as from node to node. The number of nodes in the IoT network and the number of resource access requests were independently and systematically increased during the evaluations. The results illustrate that the resource access delay and throughput were affected neither linearly nor exponentially; hence, the proposed solution shows no significant degradation in performance with an increase in the number of nodes and/or requests.

The Internet of Things (IoT) is a complex and diverse network consisting of resource-constrained sensors/devices/things that are vulnerable to various security threats, particularly Distributed Denial of Services (DDoS) attacks. Recently, the integration of Software Defined Networking (SDN) with IoT has emerged as a promising approach for improving security and access control mechanisms. However, DDoS attacks continue to pose a significant threat to IoT networks, as they can be executed through botnet or zombie attacks. Machine learning-based security frameworks offer a viable solution to scrutinize the behavior of IoT devices and compile a profile that enables the decision-making process to maintain the integrity of the IoT environment. In this paper, we present a machine learning-based approach to detect DDoS attacks in an SDN-WISE IoT controller. We have integrated a machine learning-based detection module into the controller and set up a testbed environment to simulate DDoS attack traffic generation. The traffic is captured by a logging mechanism added to the SDN-WISE controller, which writes network logs into a log file that is pre-processed and converted into a dataset. The machine learning DDoS detection module, integrated into the SDN-WISE controller, uses Naive Bayes (NB), Decision Tree (DT), and Support Vector Machine (SVM) algorithms to classify SDN-IoT network packets. We evaluate the performance of the proposed framework using different traffic simulation scenarios and compare the results generated by the machine learning DDoS detection module. The proposed framework achieved an accuracy rate of 97.4%, 96.1%, and 98.1% for NB, SVM, and DT, respectively. The attack detection module takes up to 30% usage of memory and CPU, and it saves about 70% memory while keeping the CPU free up to 70% to process the SD-IoT network traffic with an average throughput of 48 packets per second, achieving an accuracy of 97.2%. Our experimental results demonstrate the superiority of the proposed framework in detecting DDoS attacks in an SDN-WISE IoT environment. The proposed approach can be used to enhance the security of IoT networks and mitigate the risk of DDoS attacks.

The Internet of Things (IoT) can provide intelligent and effective solutions to various applications with higher accuracy that requires less or no human intervention. Smart Cities are one of the significant applications of the IoT comprising a collection of various services such as intelligent transportation, waste management, smart homes, etc. These heterogeneous services offer a wide range of collaborative applications in smart cities. A smart municipality in a smart city is a concept in which a digital municipal corporation is developed to provide comprehensive local government collaboration services based on digitization and automation aiming towards raising the living standards of citizens. Interoperability between heterogeneous services for collaborative tasks creates challenges for data security and privacy. Ensuring integrity and confidentiality of information is critical, and reliable data is essential to both the government and its citizens. In this paper, we proposed a service security architecture based on authentication and authorization for constrained environments during collaborative tasks for Software Defined Networking (SDN) and smart contract-enabled municipal smart cities. The proposed collaborative service security framework is being tested on the Multichain Blockchain networks. We present a novel method for using smart contracts in multichain blockchains for data security during collaborative tasks in smart city municipal architecture. The proposed security solution is based on the dynamism of smart contracts to govern and control all interactions and transactions securely between different heterogeneous IoT networks. We implemented a supportive use case for collaborative services in an SDN-enabled IoT architecture to evaluate the feasibility of the proposed service security architecture.

As the usability of Internet of Things (IoT) devices increases, the security threats and vulnerabilities associated with these resource-constrained IoT devices also rise. One of the major threats to IoT devices is Distributed Denial of Service (DDoS). To make the security of IoT devices effective and resilient, continuous monitoring and early detection, along with adaptive decision making, are required. These challenges can be addressed with software-defined networking (SDN), which provides an opportunity for effectively managing the DDoS threats faced by IoT devices. This research proposes a novel SDN-based secure IoT framework that can detect the vulnerabilities in IoT devices or malicious traffic generated by IoT devices using the session IP counter and IP Payload analysis. The framework’s DDoS attack detection module consisting of the proposed algorithms can easily detect the DDoS attack in the SD-IoT network by analyzing different parameters even with a large traffic volume. These techniques are implemented on an SDN controller and tested by generating a large volume of traffic from a compromised node, which is then detected and notified. According to the results and comparative analysis, the proposed framework detects DDoS attacks in the early stage with high accuracy and detection rate from 98% to 100%, having a low false-positive rate.

Distributed denial of service (DDoS) flooding attacks are one of the main methods to destroy the availability of critical online services today. These DDoS attacks cannot be prevented ahead of time, and once in place, they overwhelm the victim with huge volume of traffic and render it incapable of performing normal communication or crashes it completely. Any delays in detecting the flooding attacks completely halts the network services. With the rapid increase of DDoS volume and frequency, the new generation of DDoS detection mechanisms are needed to deal with huge attack volume in reasonable and affordable response time. In this paper, we propose HADEC, a Hadoop-based live DDoS detection framework to tackle efficient analysis of flooding attacks by harnessing MapReduce and HDFS. We implemented a counter-based DDoS detection algorithm for four major flooding attacks (TCP-SYN, HTTP GET, UDP, and ICMP) in MapReduce, consisting of map and reduce functions. We deployed a testbed to evaluate the performance of HADEC framework for live DDoS detection on low-end commodity hardware. Based on the experiment, we showed that HADEC is capable of processing and detecting DDoS attacks in near to real time.

Distributed Denial of Service (DDoS) flooding attacks are one of the biggest challenges to the availability of online services today. These DDoS attacks overwhelm the victim with huge volume of traffic and render it incapable of performing normal communication or crashes it completely. If there are delays in detecting the flooding attacks, nothing much can be done except to manually disconnect the victim and fix the problem. In this paper, we propose HADEC, a Hadoop based Live DDoS Detection framework to tackle efficient analysis of flooding attacks by harnessing MapReduce and HDFS. We implemented a counter-based DDoS detection algorithm for four major flooding attacks (TCP-SYN, HTTP GET, UDP and ICMP) in MapReduce. Subsequently we deployed a testbed to evaluate the performance of HADEC framework for live DDoS detection. Based on the experiment we showed that HADEC is capable of processing and detecting DDoS attacks in affordable time.

Near Field Communication (NFC) is inherently vulnerable to eavesdropping and proximity hijacking attacks. NFC standards itself lack built-in security features against eavesdropping for all the modes of communication in NFC-ecosystem. This drives the application developers to implement customize security features on their own. These non-standard solutions in turn result in the system's security against vulnerabilities being subject to the developer's capability of designing a secure solution. Clearly, this model is a limiting factor in the widespread adoption and deployment of NFC applications. In this paper we propose a standard Encryption Record Type Definition (ERTD) to provide confidentiality to NFC Data Exchange format (NDEF). Subsequently, we develop a fully compliant prototype of our ERTD as a lightweight plug and play confidentiality middleware in the existing NFC communication architecture. Finally, we perform an in-depth performance evaluation, of different confidentiality related primitives that focuses on processing latency and data overheads.

NFC, similar to RFID, is a contactless identification technology that has gained widespread adoption in application domains such as contactless transactions, micropayments, identity management and mobile health IDs etc. However, the NFC standard itself does not provide built-in security features. This means that each and every developer would need to implement security features in his NFC application on his own. This in turn results in users being as secure from NFC-based security vulnerabilities as the developer chooses to implement. Clearly, this environment is a major impediment in the widespread adoption and deployment of NFC applications. In this paper, we propose the concept of a light weight security middleware that could implement the different security safeguards needed by a wide array of applications. The applications in turn can then implement the security features relevant to their scenarios. Furthermore, we implemented security safeguards to deal with malicious tag content in NFC applications. Our evaluations showed that the security middleware is both lightweight and has low functional latency.

In this paper we introduce LENS, a novel spam protection system based on the recipient's social network, which allows correspondence within the social circle to directly pass to the mailbox and further mitigates spam beyond social circles. The key idea in LENS is to select legitimate and authentic users, called Gatekeepers (GKs), from outside the recipients social circle and within pre-defined social distances. Unless a GK vouches for the emails of potential senders from outside the social circle of a particular recipient, those e-mails are prevented from transmission. In this way LENS drastically reduces the consumption of Internet bandwidth by spam. Using extensive evaluations, we show that LENS provides each recipient reliable email delivery from a large fraction of the social network. We also evaluate the computational complexity of email processing with LENS deployed on two Mail Servers (MSs) and compared it with the most popular content-based filter i.e SpamAssassin. LENS proved to be fast in processing emails (around 2-3 orders of magnitude better than SpamAssassin) and scales efficiently with increasing community size and GKs.