The revised EU Data Act requires the incorporation of smart contract kill switch mechanisms. Nevertheless, most existing designs are either confined to single chain architectures or dependent on centralized control, thereby conflicting with the decentralization principles of blockchain systems and limiting their applicability in cross-chain environments. This limitation becomes particularly critical in IoT-driven industrial contexts, where security incidents demand synchronized execution control across multiple chains. Under such circumstances, single chain oriented kill switch mechanisms inherently suffer from structural constraints. To address these challenges, we propose an integrated Layer 0 and Layer 1 smart contract kill switch framework. The proposed framework enables distributed decision-making across heterogeneous blockchain systems by supporting diverse consensus algorithms, including PoW, PoS, PBFT, Paxos, and Raft. Cross-chain propagation of kill switch activation signals is securely facilitated through interoperability solutions such as CCMP and LayerZero. Importantly, activation decisions made on one chain are not mandatorily enforced on others; instead, each chain independently determines whether to execute the kill switch via its own consensus process, thereby preserving both autonomy and decentralization. For performance evaluation, repeated experiments were conducted across 50 use cases derived from exhaustive combinations of two interoperability mechanisms and five consensus algorithms. The analysis considered average activation time, gas consumption, and message delay, alongside Time to Activation (TTA) and tail-latency metrics to assess real-time responsiveness. Network experiments using Linux tc-netem demonstrate that even under severely degraded network conditions, the cross-chain p99 TTA is bounded at 12.2596 s, establishing a predictable worst-case upper limit. These results highlight the structural robustness of the proposed framework by guaranteeing a bounded reaction time even in environments characterized by increased latency and consensus overhead, rather than merely improving average-case performance.

The emergence of 6G technologies is rapidly accelerating large-scale communication environments. Machine-to-machine and device-to-device communications are emerging as critical challenges in various application fields, such as the internet of things, vehicular ad hoc networks, and the internet of drones. As 6G environments demand hyper-connectivity and large-scale deployment, the need for low-latency and robust UE authentication mechanisms becomes paramount. However, current networks lack adequate mechanisms to prevent unauthorized access by malicious User Equipment (UE) and to secure UE-to-UE communications. Accordingly, this paper proposes a Directed Acyclic Graph (DAG)-based UE authentication mechanism for Open RAN, applicable to key next-generation use cases. In the proposed mechanism, when a gNB (i.e., O-DU and O-CU) authenticates a UE initially in Open RAN, the O-DU hashes the UE’s Identifier (ID) and pseudo-ID using the QUARK algorithm. The O-DU encrypts a one-time pad—generated using a physically unclonable function, location information, and finger vein data—with the ChaCha cipher. Then it generates a security credential with them. When the UE connects to a new O-DU through its movement, the new O-DU verifies the UE’s prior authentication by querying the transaction stored in the DAG-based ledger. It ensures that only authenticated UEs connect with the gNB and access the network.

The advent of network slicing has enabled mobile communication systems to provide flexible and scalable infrastructure. It enables a wide range of applications and use cases that are specific to user needs, and creates new business models. However, these technological advancements also bring expanded security challenges, especially across the entire network slicing lifecycle. Specifically, the attack surface expands across all phases of the network slicing lifecycle, as well as within and between Network Slices (NSs). The standardized Network Functions (NFs) for network slicing security focus on NS management, identifier protection, and authentication of both NSs and User Equipment (UE). Nevertheless, authenticated UEs may still be impersonated at runtime, posing persistent threats to network slicing. To address this issue, this paper introduces a security-by-design NF that enables the detection of malicious UEs in network slicing environments. The experimental results demonstrate that the proposed NF can provide security within the network slicing architecture.

In anticipation of the 5G-Advanced and 6G era, this paper explores Open RAN as an innovative solution to enhance the existing Radio Access Network (RAN) capabilities, particularly in managing the surge in mobile traffic. The O-RAN Alliance has made significant strides in this domain, particularly by releasing a comprehensive standard document addressing potential security threats and necessary countermeasures within Open RAN frameworks. A critical aspect of these standards is the emphasis on safeguarding the E2 interface-linking the NearRT RIC and RAN nodes-against Man-in-the-Middle (MitM) attacks, with IPsec proposed as a key defensive mechanism. Our study, however, reveals a vulnerability: the E2 interface remains susceptible to ARP spoofing, a variant of MitM attacks. This paper presents detailed simulation results to demonstrate this security flaw and delves into the potential ramifications on the E2 interface’s functionality and integrity. Our findings underscore the need for revisiting and reinforcing security protocols in the evolving landscape of Open RAN networks.

As we embrace the dawn of the 5G era, the fusion of Software Defined Network (SDN) and Network Function Virtualization (NFV) technologies has heralded a new epoch in network architecture. This provides indispensable capabilities and virtualized infrastructure to meet the burgeoning demands of modern networks. Yet, with each stride forward in mobile communication technology, security threats loom larger, casting a shadow over the very fabric of our networks. In this context, identifying and addressing these threats is crucial as it plays a key role in enhancing the security of a 5G-Advanced and a next 6G mobile communication technologies. Therefore, this paper undertakes an investigative journey to explore security threats introduced by SDN/NFV technologies in the 5G-Advanced core networks. Through our simulations, we unveil a need for fortified security technologies within the 5G-Advanced core networks, illuminating a path towards the creation of bespoke datasets tailored for the trends of 5G-Advanced security research.

Abstract The coronavirus pandemic, which first began in December 2019, has completely changed our daily lives. In particular, daily online digital content consumption over the world has soared since the start of the coronavirus pandemic. For preventing illegal digital content distribution, various technologies have been applied, but current copyright protection technologies are still lacking to provide secure digital content distribution while preserving privacy. In this article, we introduce a new digital content distribution system, which utilizes blockchain‐based decentralized identifier and format‐preserving encryption to enable user privacy preserved digital content tracking. We present the system architecture with detailed message flows of the proposal and provide its analysis result in terms of security and overhead.

Abstract User authentication is a promising security solution in which an external user having his/her mobile device can securely access the real‐time information directly from the deployed smart devices in an Internet of Things‐enabled intelligent precision agricultural environment. To achieve this goal, we present a new signature‐based three factor user authentication scheme. The established session key between a user and the accessed smart device is then used to make secure communication among them to fetch the real‐time data of the device. A detailed security analysis including the random‐oracle based formal security, formal security verification using the broadly recognized automated validation of internet security protocols and applications tool and nonmathematical informal security analysis show the robustness of the proposed scheme against a number of potential attacks. In addition, testbed experiments are performed for measuring computational time of various cryptographic primitives that are used for comparative study among the proposed scheme and other related existing competing schemes. The detailed comparative analysis shows that the proposed scheme has a better trade‐off among its offered security and functionality features, and communication and computational overheads as compared with those for other competing schemes.

Summary A message broker is widely used to enable applications, systems, and services to communicate with each other. One of the widely used message brokers is RabbitMQ that provides various functions and stability. However, as presented in this paper, RabbitMQ is vulnerable. In this paper, we present how RabbitMQ is exploited by protocol fuzzing, which is a common way to find unknown vulnerabilities inherent in software. We describe our protocol fuzzing procedures in detail and present conducted results.

Summary Watermarking is a mechanism in which owner of the audio file hides the watermark information into a audio for various applications. The identity of the owner of the audio file is hidden in the audio, which is known as watermark. In this article, a quantization‐based audio watermarking using singular value decomposition (SVD) is proposed. The original audio signal is converted into non overlapping two dimensional matrix blocks. The SVD is applied to each block. The watermark is embedded into audio signal by quantization of largest singular value of the block. The watermark is extracted blindly without using original audio signal. Experimental results show the watermark's high imperceptibility in the audio signal and good performance against Stirmark as well as traditional signal processing attacks. Compared with other audio watermarking methods, our method has higher embedding capacity and robust against various traditional signal processing attacks.

Blockchain-based mobile-edge computing (BMEC) is an innovative architecture, which is essential in the future fifth-generation (5G) network era. BMEC solves the problem of limited computing resources of devices in the mobile blockchain environment while ensuring the distributed deployment of computing resources and the traceable of transaction data. However, the blockchain technology has many security vulnerabilities, among which attacks against consensus algorithms are particularly serious, i.e., double-spend attacks, long-range attacks, and selfish mining. All of these attacks can break the integrity of BMEC, allowing the correct block record to be overwritten with a false one. In this article, we propose a group signature scheme designed for validating blocks of blockchain to address such issues. Each new block will be regarded as a valid block if it obtains a valid group aggregate signature of the group which the block creator belongs to. We describe in detail the process of authentication and key changes when mobile devices join and leave BMEC. We also provide a more efficient authentication scheme of authenticating mobile devices compared to traditional schemes in BMEC. Last, the security analysis is presented to prove that our proposed group signature scheme is effective.

Rewriting-history attacks are devastating for blockchain-based cryptocurrency systems. To deter such attacks, this paper introduces a new model utilizing a smart contract to effectively prevent such attacks from succeeding. Each node who creates a new block is required to register with the smart contract to get a voucher required for the subsequent block validation. We explain the flow of the proposed model and the algorithms of the smart contract. We have implemented this smart contract in the Solidity language and simulated on the Ethereum test network. We also present security and simulation results of the proposed model.

A double-spend attack is one of the major security issues in most blockchain systems, but it is difficult to successfully launch unless an adversary has massive computing power. In this paper, we introduce a new attack model that combines a double-spend attack with a Sybil attack in the Bitcoin network. We present analysis results that a double-spending attacker can make a block propagation delay by conducting Sybil attacks and increase the probability of winning the mining race, thus successfully launching the double-spend attack. We develop the probability of success of this new attack in mathematics forms and analyze this attack model from the perspective of economics. We present the attacker's break-even point in various situations and demonstrate the effect of the proposed attack.

In recent times, Plug-in Electric Vehicles (PEVs) have emerged as a new alternative to increase the efficiency of smart grids (SGs) in a vehicles-to-grid (V2G) environment. The V2G environment provides a bidirectional power and information flow, so that users can have an optimized usage as per their requirements. However, uncontrolled and unmanaged power distribution may lead to an overall performance degradation in V2G environment. One reason for this uncontrolled and unmanaged flow may be due to the usage of power by unauthorized users. To address this issue, we propose a Bayesian Coalition Negotiation Game (BCNG) as a utility for secure energy management for PEVs in the V2G environment. We have used a BCNG along with Learning Automata (LA), wherein LA are stationed on PEVs and are assumed as the players in the game. To provide an approach based on resilience for any misuse of electricity consumption, a new Secure Payoff Function (SPF) is proposed. The players take actions and update their action probability vector using the SPF. A Nash Equilibrium (NE) is also achieved in the game using convergence theory. Our proposal is evaluated with various metrics. The proposed scheme also provides mutual authentication and resilience against various attacks during power distribution.

In a mobile video surveillance system (MVSS), an efficient approach is required, so that captured video can be transmitted to its final destination under tight constraints of delay and accuracy. This paper presents a new intelligent MVSS using the concepts of Bayesian coalition game and learning automata (LA). These LA are assumed to be the players in a game and are deployed on vehicles. Coalition among players is formed using the Bayesian Coalition Game Theory. To decrease the delay that occurred during transmission of captured video to the nearest access points, the best path is chosen based on a new metric called Path Score, which is computed by each player in the game. For each action performed by the automata, their actions may be rewarded or penalized by a value, which is defined as a sequence, with respect to the inputs provided from the stochastic environment. According to the reward or penalty received from the environment, the automata update their action probability vector. After 15 iterations, a Nash equilibrium is achieved in the game by defining a twice-differentiable function in Banach spaces, and convergence of sequence is proved using the Cauchy convergence theorem. The performance of the proposed scheme is found to be better in comparison to the other state-of-the-art schemes, with respect to various performance evaluation metrics.

ABSTRACT GeoNetworking is a protocol specially designed to provide geographical addressing and forwarding for Cooperative Intelligent Transport Systems (ITS). Unlike advanced messages defined in GeoNetworking, beaconing messages are fundamental to periodically advertise essential information, e.g., a vehicle ITS station's geographical position and speed, to neighbor ITS stations. The beaconing messages should be delivered in a secure manner. Otherwise, geographical addressing and forwarding of GeoNetworking cannot be supported as unauthorized actions from attackers break down cooperative communication between ITS stations. However, security mechanisms for beaconing messages come with overhead that affect the overall performance. This being so, in this paper, we analyze the overhead of secure beaconing messages in terms of packet delivery ratio, delay, and normalized throughput. From the conducted numerical analysis, we demonstrate that 1) three parameters such as the number of ITS stations in a given radio range, the backoff window size, and the message size mainly affect the performance; 2) the delay of secure beaconing message is still acceptable with proper channel bit rates; and 3) the normalized throughput of secure beaconing message is better than that of the basic beaconing message. Copyright © 2011 John Wiley & Sons, Ltd.

Recent technical breakthroughs in wireless communications have facilitated significantly increased data rates and reduced end-to-end latency in cellular networks. Higher throughputs however lead to increase traffic loads on cellular networks and require mechanisms to mitigate such traffic loads on the cellular networks. In this paper, we introduce a host-based distributed mobility management protocol supporting selective traffic offloading for the evolution of the 3GPP core network architecture. Unlike the current approach of 3GPP, traffic offloading is achieved based on IP flow mobility in a distributed manner. The offloading point is thus also distributed. We show how the proposed host-based distributed mobility management protocol alleviates the high traffic loads in the evolution of the 3GPP core network architecture.

The world is entering a post-PC era in which more real-time entertainment traffic is delivered to mobile devices than to PCs. The unprecedented expansion of mobile Internet traffic has resulted in the development of distributed mobility management (DMM) at the IETF. In this paper, we introduce a dynamic tunneling scheme for network-based DMM, in which mobility anchors are distributed at an access network level while tunnels for data packets are dynamically configured taking into account of both session and mobility status. We illustrate the proposed scheme's initial attachment and handover procedures step-by-step in an environment where network-based DMM is coexisted with Proxy Mobile IPv6. To justify the effectiveness of the proposed scheme, we develop an analytical cost model that is used to compare the performance of the proposed scheme with existing ones in terms of signaling and packet delivery costs. Our analysis shows that the proposed scheme optimizes packet delivery paths and thus provides a cost reduction during the packet delivery compared to the existing schemes. We also describe possible performance extensions to the proposed scheme.

In this paper, we introduce a deployment strategy to support large scale mobility management based on Proxy Mobile IPv6 (PMIPv6). As a centralized mobility management protocol, PMIPv6 employs a single-handed mobility anchor, Local Mobility Anchor (LMA), to maintain the mobility context and routing status of all registered mobile nodes in a localized domain. However, this single-handed mobility anchor will suffer with ever-increasing mobile Internet traffic. We propose a distributed local mobility anchor architecture with new prefix and address management schemes and then present a mobility management procedure with operational aspects. In the proposed architecture, the registration message is always routed to the closest LMA thanks to the anycast routing. The other LMAs create the direct host route to the serving Mobility Anchor Gateway (MAG) for the optimized packet transmission. We also analyze the proposed architecture's performance in terms of scalability, robustness, and efficiency. The results demonstrate that the state synchronization of the proposed architecture induces extra signaling cost during the handover, however, the optimized route established by it can save more cost when the PMIPv6 service is adopted in the large-scale environment.

International audience

To cope with challenging problems faced by traditional multicast routing protocols, many branching-router (BR)-based multicast routing schemes with desirable features have been proposed. However, the current BR-based methods still lack efficient multicast management and suffer from a long join latency, leading to a disappointing mobility performance. In this paper, we propose a novel BR-based multicast architecture with a corresponding multicast routing protocol supporting multicast receiver mobility. In the proposed multicast architecture, a new management entity called multicast controller (MC) is used to handle most of the multicast management-related tasks, while other routers in the network construct a multicast tree according to the proposed Branching-Router-based Multicast routing protocol with Mobility support (BRMM). Besides, the fast handover of multicast service can be supported by BRMM through the pre-establishment of temporary multicast paths. Through extensive simulation and analysis, we show that BRMM outperforms existing protocols and has many other attractive features.

The recent explosion of mobile Internet traffic has resulted in an evolution of mobile network architectures. Mobile network architectures are being flattened to cope with the recent traffic growth. Existing IP mobility support protocols relying on centralized mobility anchors are thus required to be adopted in the evolution of mobile network architectures. In this paper, a new IP mobility support protocol is presented: a new host-based distributed mobility management support protocol designed for the current evolution of mobile network architectures. Mobility anchors are distributed at an access network level and a mobile node is served by a close-by mobility anchor. While the mobile node changes its point of attachment to the Internet, it keeps previous IP address(es) for continuous communications established with the previous IP address(es). The detailed protocol operation is explained with discussion for operational considerations. The performance of the proposed protocol is compared with Mobile IPv6 in terms of handover latency and throughput.

GeoNetworking is a protocol specially designed to provide geographical addressing and forwarding for Intelligent Transport Systems (ITS). Unlike advanced messages defined in GeoNetworking, beaconing messages are fundamental to periodically advertise essential information, e.g., a vehicle ITS station's geographical position and speed, to neighbor ITS stations. The beaconing messages should be delivered in a secure manner. Otherwise, geographical addressing and forwarding of GeoNetworking cannot be supported as unauthorized actions from attackers breakdown cooperative communication between ITS stations. However, security mechanisms for beaconing messages come with overhead that affects the overall performance. This being so, in this paper, we analyze the overhead of secure beaconing messages in terms of packet delivery ratio, delay, and normalized throughput.

As IP multicast allows the efficient use of network bandwidth for multipoint communication, it is expected to be an essential communication type for delivering multimedia services to mobile nodes (MNs). In this paper, we review current status of PMIPv6 multicast listener support being standardized in the IETF and point out limitations of the current approach. Then, we introduce a fast multicast handover procedure for a PMIPv6 environment wherein network-based mobility management is deployed for mobility-unaware MNs. The introduced fast PMIPv6 multicast handover procedure optimizes multicast group management by utilizing the context of mobility-unaware MNs. We evaluate the proposed multicast handover procedure compared to the base one through the developed analytical models and confirm that introduced fast PMIPv6 multicast handover procedure provides the reduced service interruption time compared to the based one during handovers.

As Internet Protocol (IP) multicast allows the efficient use of network bandwidth for multipoint communication, it is expected to be an essential communication type for delivering multimedia services to mobile nodes (MNs). In this study, the authors address an issue of consumer multicast traffic support in a Proxy Mobile IPv6 (PMIPv6) environment wherein network-based mobility management is deployed for MNs. The recently standardised PMIPv6 multicast listener support provides options for deploying multicast listener functions in a PMIPv6 domain, whereas it does not address specific optimisations and efficiency improvements of multicast routing. The authors first review the PMIPv6 multicast listener support and point out the limitations of the current approach. Then, propose an improved multicast handover procedure that optimises multicastgroup management by utilising the context of consumer's MN running multicast applications. The authors develop analytical models to evaluate the proposed multicast handover procedure compared with the base one. From the conducted analysis, it is demonstrated that the proposed multicast handover procedure minimises the service interruption time and prevents the multicast packet loss during handovers. Furthermore, in terms of signalling cost consumption, the proposed multicast handover procedure operates on an equal basis with the base one.

Abstract As wireless mobile network technologies have grown tremendously over the past few years, security issues of protecting user privacy and network resources have emerged. Particularly, a mobile node (MN) must be authenticated in order to utilize the network resources whenever the MN performs its initial access or handover. In this paper, we present secure handover scenarios for Proxy Mobile IPv6 (PMIPv6): namely, handover re‐authentication (HORA)and handover early‐authentication (HOEA). The presented secure handover scenarios are based on EAP that is a common authentication framework for wireless mobile networks. Analysis results for the total handover latency and packet loss are presented to demonstrate whether the presented secure handover scenarios satisfy with real‐time applications. PMIPv6 is in the early stage of deployment in various wireless mobile networks. The conducted results in this paper thus offer the key to an understanding of feasibility of PMIPv6 in the coming next‐generation network environments. Copyright © 2009 John Wiley & Sons, Ltd.

Proxy Mobile IPv6 has been developed from the concept of network-based mobility support protocol in the IETF. The recently published specification of proxy mobile IPv6 only focuses on the mobility support. Then, route optimization issues are left in the basket for further works. In this paper, we provide the performance analysis in where the recently proposed route optimization is evaluated in terms of signaling cost and packet delivery cost. Through the provided analysis results, we demonstrate that route optimization solves the ineffective routing path problem during the mobile host communicates with its corresponding host and argue that the scalability of proxy mobile IPv6 architecture is improved due to the distributed routing path. In addition, the cost model developed in this paper would be a reference model in order to facilitate decision-making for further route optimization design.

In recent years, high-bandwidth and low-cost wireless technologies have emerged as a competitive element, enabling the smart home environment. On the other hand, with the increasing demands for various services, the current access point allocation schemes give rise to significant challenges for a stable connection service, bandwidth and load distribution. In this paper, we present an optimal access point allocation scheme based on genetic algorithm that attempts to optimize multiple parameters, such as bandwidth, and load-balancing requirements. The proposed allocation scheme provides a set of approximately efficient solutions, which allows a wireless user to choose an access point based on its capacity and load balancing, not only regarding its signaling strength or service set identifier. The simulation results are provided to demonstrate the impact of the proposed optimization procedure on overall system performance in terms of connection distribution, load balancing and call dropping probability.

Mobile IP is the basic solution to providing host mobility, whereas network mobility (NEMO) refers to the concept of the collective mobility of a set of nodes. The NEMO basic support protocol has been proposed in IETF as a first solution to the problem of network mobility. The main limitation of this basic solution is that it forces triangular routing, i.e., packets are always forwarded through the home agent (HA), following a suboptimal path. This is because each sub-NEMO obtains a care of address (CoA) that belongs to the home prefix of its parent mobile router. Such a CoA is not topologically meaningful in the current location, since the parent mobile router could also be away from home, and hence, packets addressed to the CoA are forwarded through the HA of the parent NEMO. To solve this problem, various extended proposals, with differing approaches and goals, exist for route optimization (RO) in NEMO applications. Their influences on the RO performance have been evaluated by classifying the detailed operations performed within the nested NEMO network, and then each category is analyzed in detail. The modeling of the detailed RO operation is intended to quantify the tradeoffs between the different approaches in order to provide a basis for the selection decision. In particular, the proposed grouping of the different proposals, based on their address configuration strategy, clarifies their similarities and differences, and provides some useful insights into the various methods that have been developed. In conclusion, it is suggested that, when choosing a solution for deploying NEMO, the designer has to balance his choices between the different pros and cons, and the different cases of application that are derived in this paper.

Proxy mobile IPv6 is one of network-based mobility support protocols which does not require a mobile host to be involved in mobility support signaling. Even though proxy mobile IPv6 has many advantages than client-based mobility support protocols such as mobile IPv6, unfortunately, it may cause an out-of-sequence problem during its route optimization procedure. Thus, in this paper, we develop an estimation function for an out- of-sequence time period and reveal the out-of-sequence problem caused by the route optimization procedure. Then we propose a scheme which minimizes the arrival of out-of-sequence packets to the mobile host and analyze the impact of out-of-sequence packets. The performance evaluation results demonstrate that the traffic rate and out-of-sequence time period mainly have an effect on the out-of-sequence problem.

In this paper, we present a comparative signaling cost analysis of hierarchical mobile IPv6 and proxy mobile IPv6. The two mobility support protocols have a similar hierarchical mobility management architecture. They, however, are clearly different: Hierarchical mobile IPv6 has a specific properties of host-based mobility support protocol and proxy mobile IPv6 is a kind of network-based mobility support protocols. Thus, it is important to reveal their mobility characters and performance impact factors. In this paper, we develop a cost model that evaluates the location update cost and the packet delivery cost based on protocol operations. Then, we present the numerical results in where the impacts of various system parameters are evaluated.