The recent advances in mobile technologies have resulted in Internet of Things (IoT)-enabled devices becoming more pervasive and integrated into our daily lives. The security challenges that need to be overcome mainly stem from the open nature of a wireless medium, such as a Wi-Fi network. An impersonation attack is an attack in which an adversary is disguised as a legitimate party in a system or communications protocol. The connected devices are pervasive, generating high-dimensional data on a large scale, which complicates simultaneous detections. Feature learning, however, can circumvent the potential problems that could be caused by the large-volume nature of network data. This paper thus proposes a novel deep-feature extraction and selection (D-FES), which combines stacked feature extraction and weighted feature selection. The stacked autoencoding is capable of providing representations that are more meaningful by reconstructing the relevant information from its raw inputs. We then combine this with modified weighted feature selection inspired by an existing shallow-structured machine learner. We finally demonstrate the ability of the condensed set of features to reduce the bias of a machine learner model as well as the computational complexity. Our experimental results on a well-referenced Wi-Fi network benchmark data set, namely, the Aegean Wi-Fi Intrusion data set, prove the usefulness and the utility of the proposed D-FES by achieving a detection accuracy of 99.918% and a false alarm rate of 0.012%, which is the most accurate detection of impersonation attacks reported in the literature.

Botnets, which consist of remotely controlled compromised machines called bots, provide a distributed platform for several threats against cyber world entities and enterprises. Intrusion detection system (IDS) provides an efficient countermeasure against botnets. It continually monitors and analyzes network traffic for potential vulnerabilities and possible existence of active attacks. A payload-inspection-based IDS (PI-IDS) identifies active intrusion attempts by inspecting transmission control protocol and user datagram protocol packet's payload and comparing it with previously seen attacks signatures. However, the PI-IDS abilities to detect intrusions might be incapacitated by packet encryption. Traffic-based IDS (T-IDS) alleviates the shortcomings of PI-IDS, as it does not inspect packet payload; however, it analyzes packet header to identify intrusions. As the network's traffic grows rapidly, not only the detection-rate is critical, but also the efficiency and the scalability of IDS become more significant. In this paper, we propose a state-of-the-art T-IDS built on a novel randomized data partitioned learning model (RDPLM), relying on a compact network feature set and feature selection techniques, simplified subspacing and a multiple randomized meta-learning technique. The proposed model has achieved 99.984% accuracy and 21.38 s training time on a well-known benchmark botnet dataset. Experiment results demonstrate that the proposed methodology outperforms other well-known machine-learning models used in the same detection task, namely, sequential minimal optimization, deep neural network, C4.5, reduced error pruning tree, and randomTree.

Password-based Authenticated Key Exchange (PAKE) allows a server to authenticate a user and to establish a session key shared between the server and the user just by having memorable passwords. In PAKE, conventionally the server is assumed to have the authentication functionality and also provide on-line services simultaneously. However, in the real-life applications, this may not be the case, and the authentication server may be separate from on-line service providers. In such a case, there is a problem that a malicious service provider with no authentication functionality may be able to guess the passwords by interacting with other participants repeatedly. Abdalla et al. put forward a notion of the server password protection security to deal with this problem. However, their proposed schemes turned out to be vulnerable to Undetectable On-line Dictionary Attack (UDonDA). To cope with this situation, we propose the Gateway Threshold PAKE provably secure against this password guessing attack by also taking the corruption of authentication servers into consideration.

Abstract Cloud storage service providers apply data client‐side deduplication across multiple users to achieve cost savings of network bandwidth and disk storage. However, deduplication can be used as a side channel by attackers who try to obtain sensitive information of other users' data. We propose a differentially private client‐side deduplication protocol. A storage gateway allows efficient data deduplication while reducing the risk of information leakage. Its security can be strongly guaranteed according to the definition of differential privacy. We evaluate the effectiveness and efficiency of the proposed protocol through experiments. Copyright © 2014 John Wiley & Sons, Ltd.

Recently, there has been great interest in physical layer security techniques that exploit the randomness of wireless channels for securely extracting cryptographic keys. Several interesting approaches have been developed and demonstrated for their feasibility. The state-of-the-art, however, still has much room for improving their practicality. This is because i) the key bit generation rate supported by most existing approaches is very low which significantly limits their practical usage given the intermittent connectivity in mobile environments; ii) existing approaches suffer from the scalability and flexibility issues, i.e., they cannot be directly extended to support efficient group key generation and do not suit for static environments. With these observations in mind, we present a new secret key generation approach that utilizes the uniformly distributed phase information of channel responses to extract shared cryptographic keys under narrowband multipath fading models. The proposed approach enjoys a high key bit generation rate due to its efficient introduction of multiple randomized phase information within a single coherence time interval as the keying sources. The proposed approach also provides scalability and flexibility because it relies only on the transmission of periodical extensions of unmodulated sinusoidal beacons, which allows effective accumulation of channel phases across multiple nodes. The proposed scheme is thoroughly evaluated through both analytical and simulation studies. Compared to existing work that focus on pairwise key generation, our approach is highly scalable and can improve the analytical key bit generation rate by a couple of orders of magnitude.

The advent of converged environment merged with wireless sensor networks (WSNs) and mobile networks can have the possibility on enabling us to experience variety of ubiquitous applications based on multi-sensor attached smartphones. However, most of current researches are failed to recognise the fact that there are many drawbacks to break through between the heterogeneous networks such as a WSN and mobile network. In this study, the authors propose the authentication and key agreement protocol that efficiently reduces the overall computational and communication costs in the next generation converged network. The enhanced security procedures are operated through the mobile network in order to maximise the lifetime of the sensor networks and to apply the combined capabilities of both networks. The authors show the presented novel design can show the feasibility to minimise the usage of the sensor networks with the battery-powered sensors in comparison with the existing authentication models, and can be deployed under the standard architectures.

Energy efficiency is one of important issues in the resource constrained wireless sensor network. In this paper, we propose the authentication and key agreement protocol that efficiently reduces the overall computational and communication costs in the next generation converged network. The enhanced security procedures are operated through the mobile network in order to maximize the lifetime of the sensor networks and to apply the combined capabilities of both networks.

A group key agreement protocol is a process to establish a cryptographic key for a group of participants over an open network. In this paper, we propose a group key agreement (CAGKA) protocol, based on a certificateless public key cryptosystem. CAGKA protocol provides group key establishment and group membership change (join and leave) services for dynamic groups. This protocol is proved to be secure against passive and active adversaries and is more efficient than previous group key agreement protocols.

In wireless sensor networks, the random key pre-distribution arises as the practical solution for sharing common keys between sensor nodes. Since sensor networks suffer from the resource constraints like limited memory space, key pre-distribution scheme should require less memory space as possible while supporting strong security strength, i.e., high resilience against node capture. However, the existing schemes still require a large number of keys for each sensor to carry. Although location information is facilitated as deployment knowledge for improvement, if two sensor nodes closely located each other have very low probability to be in active-state at the same time, unnecessary key assignments can be happened since keys shared only between them may be hardly used. In this paper, we propose a novel random key pre-distribution scheme that exploits new deployment knowledge, state of sensors, to avoid unnecessary key assignments and reduce the number of required keys that each sensor node should carry while supporting higher connectivity and better resilience against node captures. The analysis of our proposed scheme shows the better performance and security strength than the previous schemes

This paper focuses on one of the future applications and services area of mobile communications. Mobile devices like mobile phones and PDAs would very soon allow us to interact with other smart devices around us, thus supporting a ubiquitous society. There would be many competitive service providers selling location-based services to users. To avail such services, a user's mobile device may need to handle many service providers. It should also he able to identify and securely communicate with only genuine service providers. But these tasks could create a huge burden on the low-computing and resource-poor mobile device. Our protocol establishes a convincing trust model through which secure key distribution is accomplished. Secure job delegation and use of cost-effective cryptographic techniques help in reducing the communication and computational burden on the mobile device. The protocol also provides user privacy protection, replay protection, entity authentication, and message authentication, integrity and confidentiality.

Mobile IP enables a mobile node (MN) to move around without losing their transport-layer connectivity by using resources in a foreign domain network. Mobile IP (MIP) is expected to be the core infrastructure of future mobile communication, but two services must be provided before the wide deployment of MIP. One is to provide secure communication and the other is to make payment. Security services, such as authentication and access control, have been considered since the birth of MIP, but little attention has been given to location privacy and anonymity services despite of their increased significance in wireless network. An incontestable payment protocol must be also developed, considering the usage of foreign domain network resources by the MN. As mix-network provides basic concept of location privacy protection, this paper proposes an authentication and payment protocol hiding location information, based on mix-network.