Outsourcing logistic regression classification services to the cloud is highly beneficial for streaming data. However, it raises critical privacy concerns for the input data and the training models. Current solutions for encrypted logistic regression classification fall short in the processing of encrypted streaming data. In this paper, we propose a privacy-preserving logistic regression model (PrivESD), which allows computation over encrypted streaming data. First, we propose a lightweight framework, which creates a collaborative workload between the cloud and the edge thereby reducing the computation complexity of the cloud and the number of communications between the data owners and the cloud. Second, we develop a tailored building block library with strong data confidentiality that supports comparison operations. This library has then been used to construct logistic regression. Finally, we devise a processing scheme that uses stochastic gradient descent with momentum to train the model to prevent the problem of local optimal convergence with streaming data. We have conducted extensive performance analysis demonstrating that the proposed protocols such as our secure compare protocol outperforms existing schemes such as Bost [44] and Guo [45], and that the encryption and decryption operations of PrivESD are similar to that of Paillier [42] with$2^{30}$keys.

With the recent rapid expansion of the smart grid infrastructure paving the way for greater integration of computer and network technologies within the power grid, it has become well suited for the application of machine learning techniques. However, machine learning requires vast amounts of data, which within the smart grid setting can reveal great amounts of personal details of the individuals using the grid. This work considers the application of a variant of distributed machine learning, federated learning, which enhances data privacy. We propose a Smart Grid Hierarchical Federated Learning (SGHFL) framework, which is tuned to common smart grid architectures in the real world. We demonstrate how our SGHFL framework improves client dropout and poisoning robustness, using relatively lightweight models suitable for devices with limited computational capability. We provide theoretical justification underlying our design and have evaluated our algorithms and framework with three datasets/environments of progressively increasing practicality. We have also compared our framework with relevant works.

The White House Executive Order on Artificial Intelligence highlights the risks of large language models (LLMs) empowering malicious actors in developing biological, cyber, and chemical weapons. To measure these risks, government institutions and major AI labs are developing evaluations for hazardous capabilities in LLMs. However, current evaluations are private and restricted to a narrow range of malicious use scenarios, which limits further research into reducing malicious use. To fill these gaps, we release the Weapons of Mass Destruction Proxy (WMDP) benchmark, a dataset of 3,668 multiple-choice questions that serve as a proxy measurement of hazardous knowledge in biosecurity, cybersecurity, and chemical security. To guide progress on unlearning, we develop RMU, a state-of-the-art unlearning method based on controlling model representations. RMU reduces model performance on WMDP while maintaining general capabilities in areas such as biology and computer science, suggesting that unlearning may be a concrete path towards reducing malicious use from LLMs. We release our benchmark and code publicly at https://wmdp.ai.

The rapid progress in the field of IoT and its wide-ranging applications emphasize the criticality of robust security measures for effectively sharing, storing, and managing sensitive data generated by IoT devices. Regulations such as the Consumer Data Rights (CDR) highlight the need for the seamless sharing of sensitive data with authorized third parties while ensuring confidentiality and privacy. To enable such secure sharing, a data storage and sharing scheme should fulfill the following core requirements: (a) support multi-client data sharing settings, allowing IoT data owners to authorize multiple clients; (b) a dynamic storage environment permitting IoT owners to add or remove files with minimal privacy leak; (c) decentralized storage for distributing data across servers or Cloud Service Providers (CSPs) for greater security; and (d) efficient privilege revocation mechanism which incurs less computation and communication overhead. To address these requirements, we have proposed a novel keyword search scheme using computationally lightweight cryptographic primitives. Our scheme empowers IoT data owners to securely share, store and manage encrypted data in the CSPs, providing better security and privacy. We have provided formal security proof for our scheme as well as validated its efficiency via extensive experiments on the Docker platform. On a database of 12 million keyword/document pairs (with 105 documents and 103 keywords), our scheme took about 18 ms to return all matched documents.

Abstract Named Data Networking (NDN) is an emerging network architecture. An important characteristic of NDN is its in-network cache, which enables Data packets to be available from multiple locations on the Internet. Hence the enforcement of access control mechanisms becomes even more critical in the NDN. This paper proposes a novel access control scheme referred to as Role-Based Encryption for NDN (NDN-RBE), which uses a broadcast encryption mechanism to achieve secure data access control. Our scheme uses the role inheritance property of the traditional Role-Based Access Control (RBAC) model to achieve efficient data access control over hierarchical content. This makes our scheme particularly suitable for large-scale real-world content-centric services like Netflix. Our scheme also supports additional design features such as anonymous signature-based authentication, batch signature verification and two types of privilege revocations. In addition, our formal security analysis demonstrates that our scheme is provably secure against Chosen Plaintext Attacks. Our performance and functionality comparison show that our scheme outperforms other notable existing works in terms of security, functionality, computation, communication and storage overhead. Furthermore, our experimental results show an improvement in content delivery time of the order of 15 percent compared with the other closely related works.

Conventional malware detection approaches have the overhead of feature extraction, the requirement of domain experts, and are time-consuming and resource-intensive. Learning-based approaches are the mainstay of malware detection as they overcome most of these challenges by significantly improving the detection effectiveness and providing a low false positive rate. The exponential growth of malware variants and first-time-appeared malware, which includes polymorphic and zero-day attacks, are some of the significant challenges to learning-based malware detectors. These challenges have catastrophic impacts on the detection effectiveness of these learning-based malware detectors. This paper proposes a novel deep learning-based framework to detect first-time-appeared malware effectively and efficiently by providing better performance than conventional malware detection approaches. First, it translates and visualises each Windows portable executable (PE) file into a coloured image to eliminate the overhead of feature extraction and the need for domain experts to analyse the features. In the subsequent step, a fine-tuned deep learning model is used to extract the deep features from the last fully connected layer. The step has reduced the cost of training required by the deep learning models if used for end-to-end classification. The third step selects the most important and influential features through a powerful feature selection algorithm. The most important features are then fed to a one-class classifier for final detection. With the one-class classifier, an enclosed boundary around the features of benign data is constructed. Anything outside the boundary is declared as an anomaly/malicious. It has enhanced the framework's ability to detect evolving, unseen, polymorphic, and zero-day attacks, as well as reducing the problem of overfitting. The detection effectiveness of the proposed framework is validated with state-of-the-art deep learning models and conventional approaches. The proposed framework has outperformed with an accuracy of 99.30% on the Malimg dataset. The Wilcoxon signed-rank test is used to validate the statistical significance of the proposed framework. It is evident from the results that the proposed framework is effective and can be used in the defence industry, resulting in more powerful and robust solutions against zero-day and polymorphic attacks.

Increasingly Industrial Control Systems (ICS) systems are being connected to the Internet to minimise the operational costs and provide additional flexibility. These control systems such as the ones used in power grids, manufacturing and utilities operate continually and have long lifespans measured in decades rather than years as in the case of Information Technology (IT) systems. Such industrial control systems require uninterrupted and safe operation. However, they can be vulnerable to a variety of attacks, as successful attacks on critical control infrastructures could have devastating consequences to the safety of human lives as well as a nation’s security and prosperity. Furthermore, there can be a range of attacks that can target ICS and it is not easy to secure these systems against all known attacks let alone unknown ones. In this paper, we propose a software enabled security architecture using Software Defined Networking (SDN) and Network Function Virtualisation (NFV) that can enhance the capability to secure industrial control systems. We have designed such an SDN/NFV enabled security architecture and developed a Control System Security Application (CSSA) in SDN Controller for enhancing security in ICS by achieving real time situational awareness and dynamic policy-driven decision making across the network infrastructure. In particular, CSSA can be used for establishing secure path for end-to-end communication between devices and also deal against certain specific attacks namely denial of service attacks, from unpatched vulnerable control system components and securing the communication flows from the legacy devices that do not support any security functionality. We also discuss how CSSA provides reliable paths for safety critical messages in control systems. We discuss the prototype implementation of the proposed architecture and the results obtained from our analysis.

With the increasing tension between conflicting requirements of the availability of large amounts of data for effective machine learning-based analysis, and for ensuring their privacy, the paradigm of federated learning has emerged, a distributed machine learning setting where the clients provide only the machine learning model updates to the server rather than the actual data for decision making. However, the distributed nature of federated learning raises specific challenges related to fairness in a heterogeneous setting. This motivates the focus of our article, on the heterogeneity of client devices having different computational capabilities and their impact on fairness in federated learning. Furthermore, our aim is to achieve fairness in heterogeneity while ensuring privacy. As far as we are aware there are no existing works that address all three aspects of fairness, device heterogeneity, and privacy simultaneously in federated learning. In this article, we propose a novel federated learning algorithm with personalization in the context of heterogeneous devices while maintaining compatibility with the gradient privacy preservation techniques of secure aggregation. We analyze the proposed federated learning algorithm under different environments with different datasets and show that it achieves performance close to or greater than the state-of-the-art in heterogeneous device personalized federated learning. We also provide theoretical proofs for the fairness and convergence properties of our proposed algorithm.

Software Defined Networks (SDN) and Network Function Virtualisation (NFV) are prime driving technologies behind 5G and Beyond 5G (B5G) communications. The network control intelligence segregation in the SDN infrastructure enables dynamic network features (such as dynamic end-to-end management of security and quality of service (QoS)) offering significantly improved network performance. Even if one assumes that the centralised SDN controller can be security hardened and hence can be trusted, a fundamental challenge in such networks is that the data plane and switching devices are susceptible to cyberattacks. A malicious adversary can compromise them during run-time making them unreliable for secure and trusted communications. Furthermore, the controller communicating with OpenFlow switching devices is unable to accurately assess the state of the switching devices, which serves as the communication base for NFVs in 5G networks. Vulnerable switching devices can put the whole 5G network infrastructure at risk. Hence, there is a clear need for the controller and the management layer to determine the trustworthiness of the switching devices at run-time. The current trend is for many such devices to deploy trusted computing functionality such as Trusted Platform Module (TPM) or Software Guard Extension (SGx) to achieve local as well as remote attestation. In this paper, we present a dynamic trust management framework for evaluating the trustworthiness of the OpenFlow switching devices deployed in the SDN based networks. We formulate device properties that need to be assessed to determine the trust status of the device. We develop a trust enhanced security architecture which can be used to evaluate the trustworthiness of devices and determine their deployment in the provision of network services. The proposed framework uses subjective logic based techniques to derive trust levels of the switching devices at run-time, which are then used by the architecture to make trust enhanced decisions on the provision of network services. A prototype implementation of the proposed architecture is described, which demonstrates how the trustworthiness of the OpenFlow devices are assessed at run-time. The paper concludes with the performance and security analysis of the implemented trust enhanced architecture services.

Trust management systems (TMSs) play an important role in Internet of Things (IoT) by providing a means of finding whether a given device can provide a service to a satisfactory level, and for identifying potentially malicious devices in the network. Context awareness extends trust models by allowing a trustor to filter and aggregate evidence by their relevance to the current situation. Context awareness is important in the formulation of trust in IoT networks due to their heterogeneity and due to the dynamic changes in the capabilities of IoT devices. In this article, we have proposed a new type of attack on context-aware trust models for IoT systems, context-based attacks. In this attack, an adversary manipulates the context to impact a target group of IoT devices, while other devices in nontargeted groups are not even aware of the attack. We have demonstrated the effectiveness of this new type of attack on seven previously proposed trust models through practical simulations and theoretical proofs. This article also proposes a new TMS that can mitigate such context-based attacks.

The susceptibility of federated learning (FL) to attacks from untrustworthy endpoints has led to the design of several defense systems. FL defense systems enhance the federated optimization algorithm using anomaly detection, scaling the updates from endpoints depending on their anomalous behavior. However, the defense systems themselves may be exploited by the endpoints with more sophisticated attacks. First, this paper proposes three categories of attacks and shows that they can effectively deceive some well-known FL defense systems. In the first two categories, referred to as on-off attacks, the adversary toggles between being honest and engaging in attacks. We analyse two such on-off attacks, label flipping and free riding, and show their impact against existing FL defense systems. As a third category, we propose attacks based on “good mouthing” and “bad mouthing”, to boost or diminish influence of the victim endpoints on the global model. Secondly, we propose a new federated optimization algorithm, Viceroy, that can successfully mitigate all the proposed attacks. The proposed attacks and the mitigation strategy have been tested on a number of different experiments establishing their effectiveness in comparison with other contemporary methods. The proposed algorithm has also been made available as open source. Finally, in the appendices, we provide an induction proof for the on-off model poisoning attack, and the proof of convergence and adversarial tolerance for the new federated optimization algorithm.

For better data availability and accessibility while ensuring data secrecy, organizations often tend to outsource their encrypted data to the cloud storage servers, thus bringing the challenge of keyword search over encrypted data. In this article, we propose a novel authorized keyword search scheme using Role-Based Encryption (RBE) technique in a cloud environment. The contributions of this article are multi-fold. First, it presents a keyword search scheme which enables only authorized users, having properly assigned roles, to delegate keyword-based data search capabilities over encrypted data to the cloud providers without disclosing any sensitive information. Second, it supports a multi-organization cloud environment, where the users can be associated with more than one organization. Third, the proposed scheme provides efficient decryption, conjunctive keyword search and revocation mechanisms. Fourth, the proposed scheme outsources expensive cryptographic operations in decryption to the cloud in a secure manner. Fifth, we have provided a formal security analysis to prove that the proposed scheme is semantically secure against Chosen Plaintext and Chosen Keyword Attacks. Finally, our performance analysis shows that the proposed scheme is suitable for practical applications.

Role-Based Encryption (RBE) is an emerging new technique that integrates role based access control (RBAC) model with encryption. RBE embeds RBAC access policies in encrypted data itself so that only users belonging to appropriate roles are able to decrypt and access the data. However, the existing RBE schemes have been focusing on the single-organization cloud storage system, where the stored data can be accessed by users of the same organization. This paper presents a novel RBE scheme with efficient user revocation for the multi-organization cloud storage system, where the data from multiple independent organizations are stored and can be accessed by the authorized users from any other organization. Additionally, an outsourced decryption mechanism is introduced which enables the users to delegate expensive cryptographic operations to the cloud, thereby reducing the overhead on the end-users. Security and performance analyses of the proposed scheme demonstrate that it is provably secure against Chosen Plaintext Attack and can be useful for practical applications due to its low computation overhead.

In recent years, deep Convolutional Neural Networks (CNNs) have shown great potential in malware classification. CNNs, which are originally designed for image processing, identify malware binaries visualised as images. Despite offering promising performance, these human-designed networks are very large requiring more resources to train and deploy them. Evolutionary algorithms have been successfully used in designing deep neural networks automatically for different application domains. In this work, we use a Genetic Algorithm (GA) to optimise the CNN topology and hyperparameters for image-based malware classification. Computational experiments with two different malware datasets, Malimg and Microsoft Malware, show that the GA-evolved networks are very competitive to the networks designed by experts in classifying malware, yet they are also considerably smaller in size comparison.

The Internet of Things (IoT) are becoming a prevalent part of our society offering operational flexibility and convenience. However, insecure provisioning makes the IoT devices susceptible to various cyberattacks. For instance, mal-provisioned devices may leak sensitive information allowing the attackers to eavesdrop or disrupt communication infrastructures. Furthermore, compromised devices can act as zombies to intensify the scale of the attack. Hence, we need secure device provisioning services which can counteract such attacks and adverse circumstances. This article proposes a secure smart device provisioning and monitoring service architecture (SDPM) for smart network infrastructures, such as IoT-enabled smart home or office and Industrial IoT infrastructures. Our architecture allows the provisioning of devices in such a way that the malicious devices can be controlled and their activities using a dynamic policy-based approach. SDPM introduces an IoT device ontology for device registration and authentication and uses the ontology to construct device category and service-specific policies. SDPM provides a fine granular pre and post condition-based policies to provision securely the IoT devices and control their runtime operations. Furthermore, SDPM utilizes the digital twin concept, to monitor dynamically the security status of IoT devices at runtime. The policies associated with a device’s twin enables the SDPM to automate security capabilities, such as device firmware updating and patching for security vulnerabilities.

Future communication networks such as 5G are expected to support end-to-end delivery of services for several vertical markets with diverging requirements. Network slicing is a key construct that is used to provide end to end logical virtual networks running on a common virtualised infrastructure, which are mutually isolated. Having different network slices operating over the same 5G infrastructure creates several challenges in security and trust. This paper addresses the fundamental issue of trust of a network slice. It presents a trust model and property-based trust attestation mechanisms, which can be used to evaluate the trust of the virtual network functions that compose the network slice. The proposed model helps to determine the trust of the virtual network functions, as well as the properties that should be satisfied by the virtual platforms (both at boot and run time), on which these network functions are deployed for them to be trusted. We present a logic-based language that defines simple rules for the specification of properties and the conditions under which these properties need to be satisfied for trusted virtualized platforms. The proposed trust model and mechanisms enable the service providers to determine the trustworthiness of the network services as well as the users to develop trustworthy applications. We have developed a trust management architecture that enables the service providers to determine the trustworthiness of the network slices providing the network services. We have implemented a prototype of the trust management architecture using the Open Source MANO Platform and presented the performance results. The results show that our trust mechanisms cause only a slight reduction in the performance of network slices over virtualized infrastructure. We have also discussed how the proposed architecture can be used to detect and mitigate the impact of malicious virtual network functions in a dynamic manner.

The 5G network systems are evolving and have complex network infrastructures. There is a great deal of work in this area focused on meeting the stringent service requirements for the 5G networks. Within this context, security requirements play a critical role as 5G networks can support a range of services such as healthcare services, financial and critical infrastructures. 3GPP and ETSI have been developing security frameworks for 5G networks. Our work in 5G security has been focusing on the design of security architecture and mechanisms enabling dynamic establishment of secure and trusted end to end services as well as development of mechanisms to proactively detect and mitigate security attacks in virtualised network infrastructures. The focus of this paper is on the latter, namely the facilities and mechanisms, and the design of a security architecture providing facilities and mechanisms to detect and mitigate specific security attacks. We have developed a simplified version of the security architecture using Software Defined Networks (SDN) and Network Function Virtualisation (NFV) technologies. The specific security functions developed in this architecture can be directly integrated into the 5G core network facilities enhancing its security.

Named Data Networking (NDN) is an emerging network architecture, which is built by keeping data as its pivotal point. The in-network cache, one of the important characteristics, makes data packets to be available from multiple locations on the Internet. Hence data access control and their enforcement mechanisms become even more critical in the NDNs. In this paper, we propose a novel encryption-based data access control scheme using Role-Based Encryption (RBE). The inheritance property of our scheme provides a natural way to achieve efficient data access control over hierarchical content. This in turn makes our scheme suitable for large scale real world content-centric applications and services such as Netflix. Further, the proposed scheme introduces an anonymous signature-based authentication mechanism to reject bogus data requests nearer to the source, thereby preventing them from entering the network. This in turn helps to mitigate better denial of service attacks. In addition, the signature mechanism supports unlinkability, which is essential to prevent leakages of individual user's access patterns. Another major feature of the proposed scheme is that it provides accountability of the Internet Service Providers (ISPs) using batch signature verification. Moreover, we have developed a transparent and secure dispute resolution and payment mechanism using smart-contract and blockchain technologies. We present a formal security analysis of our scheme to show it is provably secure against Chosen Plaintext Attacks. We also demonstrate that our scheme supports more functionalities than the existing schemes and its performance is better in terms of computation, communication and storage.

Increasingly Industrial Control Systems (ICS) systems are being connected to the Internet to minimise the operational costs and provide additional flexibility. These control systems such as the ones used in power grids, manufacturing and utilities operate continually and have long lifespans measured in decades rather than years as in the case of IT systems. Such industrial control systems require uninterrupted and safe operation. However, they can be vulnerable to a variety of attacks, as successful attacks on critical control infrastructures could have devastating consequences to the safety of human lives as well as a nation's security and prosperity. Furthermore, there can be a range of attacks that can target ICS and it is not easy to secure these systems against all known attacks let alone unknown ones. In this paper, we propose a software enabled security architecture using Software Defined Networking (SDN) and Network Function Virtualisation (NFV) that can enhance the capability to secure industrial control systems. We have designed such an SDN/NFV enabled security architecture and developed a Control System Security Application (CSSA) in SDN Controller for enhancing security in ICS against certain specific attacks namely denial of service attacks, from unpatched vulnerable control system components and securing the communication flows from the legacy devices that do not support any security functionality. In this paper, we discuss the prototype implementation of the proposed architecture and the results obtained from our analysis.

The 5G network systems are evolving and have complex network infrastructures. There is a great deal of work in this area focused on meeting the stringent service requirements for the 5G networks. Within this context, security requirements play a critical role as 5G networks can support a range of services such as healthcare services, financial and critical infrastructures. 3GPP and ETSI have been developing security frameworks for 5G networks. Our work in 5G security has been focusing on the design of security architecture and mechanisms enabling dynamic establishment of secure and trusted end to end services as well as development of mechanisms to proactively detect and mitigate security attacks in virtualised network infrastructures. The focus of this paper is on the latter, namely the facilities and mechanisms, and the design of a security architecture providing facilities and mechanisms to detect and mitigate specific security attacks. We have developed and implemented a simplified version of the security architecture using Software Defined Networks (SDN) and Network Function Virtualisation (NFV) technologies. The specific security functions developed in this architecture can be directly integrated into the 5G core network facilities enhancing its security. We describe the design and implementation of the security architecture and demonstrate how it can efficiently mitigate specific types of attacks.

The Internet of Things (IoT) is increasingly being used in applications ranging from precision agriculture to critical national infrastructure by deploying a large number of resource-constrained devices in hostile environments. These devices are being exploited to launch attacks in cyber systems. As a result, security has become a significant concern in the design of IoT-based applications. In this article, we present a security architecture for IoT networks by leveraging the underlying features supported by software-defined networks (SDNs). Our security architecture not only restricts network access to authenticated IoT devices but also enforces fine granular policies to secure the flows in the IoT network infrastructure. The authentication is achieved using a lightweight protocol to authenticate IoT devices. Authorization is achieved using a dynamic policy driven approach. Such an integrated security approach involving authentication of IoT devices and enables authorized flows to protect IoT networks from malicious IoT devices and attacks. We have implemented and validated our architecture using ONOS SDN Controller and Raspbian Virtual Machines, and demonstrated how the proposed security mechanisms can counteract malware packet injection, DDoS attacks using Mirai, spoofing/masquerading, and man-in-the-middle attacks. An analysis of the security and performance of the proposed security mechanisms and their applications is presented in this article.

Abstract The evolution of integrated clinical environments (ICE) and the future generations of mobile networks brings to reality the hospitals of the future and their innovative clinical scenarios. The mobile edge computing paradigm together with network function virtualization techniques and the software-defined networking paradigm enable self-management, adaptability, and security of medical devices and data management processes making up clinical environments. However, the logical centralized approach of the SDN control plane and its protocols introduce new vulnerabilities which affect the security of the network infrastructure and the patients’ safety. The paper at hand proposes an SDN/NFV-based architecture for the mobile edge computing infrastructure to detect and mitigate cybersecurity attacks exploiting SDN vulnerabilities of ICE in real time and on-demand. A motivating example and experiments presented in this paper demonstrate the feasibility of of the proposed architecture in a realistic clinical scenario.

Summary The fast pace evolving of Android malware demands for highly efficient strategy. That is, for a range of malware types, a malware detection scheme needs to be resilient and with minimum computation performs efficient and precise. In this paper, we propose Mutual Information and Feature Importance Gradient Boosting (MIFIBoost) tool that uses byte n‐gram frequency. MIFIBoost consists of four steps in the model construction phase and two steps in the prediction phase. For training, first, n‐grams of both the classes.dex and AndroidManifest.xml binary files are obtained. Then, MIFIBoost uses Mutual Information (MI) to determine the top most informative items from the entire n‐gram vocabulary. In the third phase, MIFIBoost utilizes the Gradient Boosting algorithm to re‐rank these top n‐grams. For testing, MIFIBoost uses the learned vocabulary of byte n‐grams term‐frequency (tf) to feed into the classifier for prediction. Thus, MIFIBoost does not require reverse engineering. A key insight from this work is that filtering using XGBoost helps us to address the hard problem of detecting obfuscated malware better while having a negligible impact on nonobfuscated malware. We have conducted a wide range of experiments on four different datasets one of which is obfuscated, and MIFIBoost outperforms state‐of‐the‐art tools. MIFIBoost's f1‐score for Drebin, DexShare, and AMD datasets is 99.1%, 98.87%, and 99.62%, respectively, a False Positive Rate of 0.41% using AMD dataset. On average, the False Negative Rate of MIFIBoost is 2.1% for the PRAGuard dataset in which seven different obfuscation techniques are implemented. In addition to fast run‐time performance and resiliency against obfuscated malware, the experiments show that MIFIBoost performs quite efficiently for five zero‐day families with 99.78% AUC.

Internet of Medical Things (IoMT) are getting popular in the smart healthcare domain. These devices are resource-constrained and are vulnerable to attack. As the IoMTs are connected to the healthcare network infrastructure, it becomes the primary target of the adversary due to weak security and privacy measures. In this regard, this paper proposes a security architecture for smart healthcare network infrastructures. The architecture uses various security components or services that are developed and deployed as virtual network functions. This makes the security architecture ready for future network frameworks such as OpenMANO. Besides, in this security architecture, only authenticated and trusted IoMTs serve the patients along with an encryption-based communication protocol, thus creating a secure, privacy-preserving and trusted healthcare network infrastructure.

Software Defined Networking (SDN) is disruptive networking technology which adopts a centralised framework to facilitate fine-grained network management. However security in SDN is still in its infancy and there is need for significant work to deal with different attacks in SDN. In this paper we discuss some of the possible attacks on SDN switches and propose techniques for detecting the attacks on switches. We have developed a Switch Security Application (SSA)for SDN Controller which makes use of trusted computing technology and some additional components for detecting attacks on the switches. In particular TPM attestation is used to ensure that switches are in trusted state during boot time before configuring the flow rules on the switches. The additional components are used for storing and validating messages related to the flow rule configuration of the switches. The stored information is used for generating a trusted report on the expected flow rules in the switches and using this information for validating the flow rules that are actually enforced in the switches. If there is any variation to flow rules that are enforced in the switches compared to the expected flow rules by the SSA, then, the switch is considered to be under attack and an alert is raised to the SDN Administrator. The administrator can isolate the switch from network or make use of trusted report for restoring the flow rules in the switches. We will also present a prototype implementation of our technique.

Enterprise networks are increasingly moving towards Software Defined Networking, which is becoming a major trend in the networking arena. With the increased popularity of SDN, there is a greater need for security measures for protecting the enterprise networks. This paper focuses on the design and implementation of an integrated security architecture for SDN based enterprise networks. The integrated security architecture uses a policy-based approach to coordinate different security mechanisms to detect and counteract a range of security attacks in the SDN. A distinguishing characteristic of the proposed architecture is its ability to deal with dynamic changes in the security attacks as well as changes in trust associated with the network devices in the infrastructure. The adaptability of the proposed architecture to dynamic changes is achieved by having feedback between the various security components/mechanisms in the architecture and managing them using a dynamic policy framework. The paper describes the prototype implementation of the proposed architecture and presents security and performance analysis for different attack scenarios. We believe that the proposed integrated security architecture provides a significant step towards achieving a secure SDN for enterprises.

We address the problem of adversarial examples in machine learning where an adversary tries to misguide a classifier by making functionality-preserving modifications to original samples. We assume a black-box scenario where the adversary has access to only the feature set, and the final hard-decision output of the classifier. We propose a method to generate adversarial examples using the minimum description length (MDL) principle. Our final aim is to improve the robustness of the classifier by considering generated examples in rebuilding the classifier. We evaluate our method for the application of static malware detection in portable executable (PE) files. We consider API calls of PE files as their distinguishing features where the feature vector is a binary vector representing the presence-absence of API calls. In our method, we first create a dataset of benign samples by querying the target classifier. We next construct a code table of frequent patterns for the compression of this dataset using the MDL principle. We finally generate an adversarial example corresponding to a malware sample by selecting and adding a pattern from the benign code table to the malware sample. The selected pattern is the one that minimizes the length of the compressed adversarial example given the benign code table. This modification preserves the functionalities of the original malware sample as all original API calls are kept, and only some new API calls are added. Considering a neural network, we show that the evasion rate is 78.24 percent for adversarial examples compared to 8.16 percent for original malware samples. This shows the effectiveness of our method in generating examples that need to be considered in rebuilding the classifier.

Abstract Malware detection based on static features and without code disassembling is a challenging path of research. Obfuscation makes the static analysis of malware even more challenging. This paper extends static malware detection beyond byte level $n$-grams and detecting important strings. We propose a model (Byte2vec) with the capabilities of both binary file feature representation and feature selection for malware detection. Byte2vec embeds the semantic similarity of byte level codes into a feature vector (byte vector) and also into a context vector. The learned feature vectors of Byte2vec, using skip-gram with negative-sampling topology, are combined with byte-level term-frequency (tf) for malware detection. We also show that the distance between a feature vector and its corresponding context vector provides a useful measure to rank features. The top ranked features are successfully used for malware detection. We show that this feature selection algorithm is an unsupervised version of mutual information (MI). We test the proposed scheme on four freely available Android malware datasets including one obfuscated malware dataset. The model is trained only on clean APKs. The results show that the model outperforms MI in a low-dimensional feature space and is competitive with MI and other state-of-the-art models in higher dimensions. In particular, our tests show very promising results on a wide range of obfuscated malware with a false negative rate of only 0.3% and a false positive rate of 2.0%. The detection results on obfuscated malware show the advantage of the unsupervised feature selection algorithm compared with the MI-based method.

With the advancement of the Internet of Things (IoT) in recent years, there is a bigger potential to use online services than ever before. The use of the IoT brings numerous opportunities for both service providers and end users, however, it faces critical questions of security and privacy. Toward this, access control is one of the significant security challenges for the IoT, in particular, considering the characteristics of such IoT systems. To develop a secure access control architecture for the IoT, the propagation of access right delegation is a major issue. Many proposals present access control issues for the IoT but given the specific context of access right delegation, it is still in its infancy. This article presents an approach to address such a delegation issue for the IoT using the blockchain technology. We propose a delegation model that employv the critical issues, e.g., the use of nonunique identities, asynchronous and flexible delegation nature of communication for the IoT without the need of a centralized system. The goal of our primitive is to use attributes for validating the identity of an entity instead of relying on a concrete unique identity of an entity. To provide privacy for the attributes, we propose a dual blockchain architecture that moves the attribute storage and access of the public blockchain and onto a secure private blockchain. To demonstrate the feasibility of our proposed approach, we evaluate the system performances using the Ethereum blockchain network.

Software-defined networks (SDNs) offer unique and attractive solutions to solve challenging management issues in Internet of Things (IoT)-based large-scale multi-technological networks. SDN-IoT network collaboration is innovative and attractive but expected to be extremely heterogeneous in future generation IoT systems. For example, multi-technology network, network externality, and nodes heterogeneity in SDN-IoT may seriously affect the flow or application-specific quality-of-service (QoS) requirements. Furthermore, it highly influences security adoption in a network of interconnected IoT nodes. We observe that both QoS and security are interdependent and nonnegligible factors, thus we emphasize that in order to alleviate heterogeneity it is inevitable to study both these factors hand to hand (or vice versa). With this aim, first, we discuss significant and reasonable cases to encourage researchers to study QoS and security integrally in order to alleviate heterogeneity at SDN-IoT control plane. Second, we propose a framework which successfully transforms the m heterogeneous controllers to n homogeneous controller groups. The key metric of our observation and analysis is the SDN controller's response time. Following this, to validate our approach, we use the mathematical model and a proof of concept (PoC) in a virtual SDN ecosystem is demonstrated. From performance evaluation, we observe that the proposed framework significantly alleviates heterogeneity which helps to maintain QoS and enhance security. This fundamental analysis will enable network security individuals to deal heterogeneity, QoS, and security, of SDN-IoT, in more successful and promising ways.

Cloud security is of paramount importance in the new era of computing. Advanced malware can hide their behavior on detection of the presence of a security tool at a tenant virtual machine (TVM). Hence, TVM-layer security solutions are not reliable. In this paper, we propose a Virtual Machine Introspection (VMI) based security architecture design for fine granular monitoring of the virtual machines to detect known attacks and their variants. We have developed techniques for monitoring the TVMs at the process level and system call level to detect attacks such as those based on malicious hidden processes, attacks that disable security tools in the virtual machines and attacks that alter the behavior of legitimate applications to access sensitive data. Our architecture, VMGuard, utilizes the introspection feature at the VMM-layer to analyze system call traces of programs running on TVM. VMGuard applies the software breakpoint injection technique which is OS agnostic and can be used to trap the execution of programs. Motivated by text mining approaches, VMGuard provides `Bag of n-grams (BonG)' approach integrated with Term Frequency-Inverse Document Frequency (TF-IDF) method, to extract and select features of normal and attack traces. It then applies the Random Forest classifier to produce a generic behavior for different categories of intrusions of the monitored TVM. We have implemented a prototype and conducted a detailed analysis using University of New Mexico (UNM) datasets and a Windows malware dataset obtained from the University of California. The results obtained are promising and demonstrate the applicability of the VMGuard. We compare VMGuard with existing techniques and discuss its advantages.

The Internet of things (IoT) presents new opportunities and challenges due to its scale and dynamic nature. One significant challenge for the IoT is the need for security, in particular access control solutions, that are designed to meet the characteristics of these systems. Delegation of rights, from one entity to another, is a crucial component of an access control system. The IoT requires a secure, flexible, and fine-grained delegation model. While there has been considerable work in the area of delegation, much of it assumes a centralized, well-resourced system and these solutions have limited capacity in the context of the IoT. Where delegation models for the IoT have been proposed they typically provide only coarse-grained control over the delegation of rights. Moreover, many of them require a centralized trusted authority, which can suffer from a single-point failure and is not an ideal base for a large and dynamic system like the IoT. In this paper, we propose an identity-less, asynchronous, and decentralized delegation model for the IoT based on blockchain technology. We describe system components, architecture, and key aspects related to the security of the system. We use attributes to validate an entity rather than depending upon unique identities. We demonstrate the feasibility of our model through use-case examples and analyze the performance with a proof of concept testbed implementation using Ethereum private blockchain.

The four papers in this special section focus on the use of blockchain in the healthcare field. With the development of society, health has received increasing attentions. The development of science and technology has also promoted the protection of health. In recent years, the rapid development of computing and networking technologies has improved the ability to collect, measure, and analyze health-related data, and thus tremendous opportunities have opened up for healthcare computing. Meanwhile, these technologies have also brought new challenges and issues.

This paper proposes security techniques for counteracting attacks from malicious end hosts in a software defined networking (SDN) environment. This paper describes the design of a security architecture, which comprises a security management application running in the SDN controller for specifying and evaluating security policies, and security components in the switches for enforcing these security policies on network flows. Our proposed security solution helps to detect the attacking end hosts even before the flow requests from the malicious end hosts are forwarded to the SDN controller. Furthermore, if the end hosts become malicious after the interactions with the SDN controller and generate attacks in the data plane, then our architecture has mechanisms to address these attacks that occur after the establishment of routes by the SDN controller. The domain wide network visibility of the SDN controller enables our security architecture to achieve dynamic management of the security policies. The enforcement of security policies in the data plane is tailored to the functionality available in the network switches, making the proposed security solution practical. We describe the implementation of the proposed security architecture and analyze its security and performance characteristics. We also discuss the advantages of the proposed security architecture over existing solutions.

We propose to redesign SDN control in IoT lastmiles so as to extend the capability from edge routers to devices (end-node things enabled with SDN capabilities). Our approach put forward existing and new challenges that are impossible to be resolved using the seminal approaches directly. The main challenges we identify are: scalability of sensor nodes/things, maintaining the security of the system, and fulfilling the Quality of Service (QoS) requirement of all IoT applications. Firstly, we elaborate and discuss the aforementioned critical and fundamental challenges that require immediate investigations. Secondly, we propose a policy-driven framework for secure routing and conduct performance modeling and analysis. Further, in the QoS context, we have proposed an intent-based flow offloading scheme to meet the flow-specific QoS requirements. More importantly, we have developed an analysis by modeling TCP-based flows over WiFi, thus forming the required SDN-IoT network, by using mathematics as a tool for reasoning our challenges. With new insights from our analysis, the feasibility of the proposed approach is validated using factors such as path set-up time in SDN-IoT networks, SDN controller/devices throughputs, packets losses and response time of the controller.

The Internet of Things (IoT) provides connectivity between heterogeneous devices in different applications, such as smart wildlife, supply chain and traffic management. Trust management system (TMS) assesses the trustworthiness of service with respect to its quality. Under different context information, a service provider may be trusted in one context but not in another. The existing context-aware trust models usually store trust values under different contexts and search the closest (to a given context) record to evaluate the trustworthiness of a service. However, it is not suitable for distributed resource-constrained IoT devices which have small memory and low power. Reputation systems are applied in many trust models where trustor obtains recommendations from others. In context-based trust evaluation, it requires interactive queries to find relevant information from remote devices. The communication overhead and energy consumption are issues in low power networks like 6LoWPAN. In this paper, we propose a new context-aware trust model for lightweight IoT devices. The proposed model provides a trustworthiness overview of a service provider without storing past behavior records, that is, constant size storage. The proposed model allows a trustor to decide the significance of context items. This could result in distinctive decisions under the same trustworthiness record. We also show the performance of the proposed model under different attacks.

As networks expand in size and complexity, they pose greater administrative and management challenges. Software-defined networks (SDNs) offer a promising approach to meeting some of these challenges. In this paper, we propose a policy-driven security architecture for securing end-to-end services across multiple SDN domains. We develop a language-based approach to design security policies that are relevant for securing SDN services and communications. We describe the policy language and its use in specifying security policies to control the flow of information in a multi-domain SDN. We demonstrate the specification of fine-grained security policies based on a variety of attributes, such as parameters associated with users and devices/switches, context information, such as location and routing information, and services accessed in SDN as well as security attributes associated with the switches and controllers in different domains. An important feature of our architecture is its ability to specify path- and flow-based security policies that are significant for securing end-to-end services in SDNs. We describe the design and the implementation of our proposed policy-based security architecture and demonstrate its use in scenarios involving both intra- and inter-domain communications with multiple SDN controllers. We analyze the performance characteristics of our architecture as well as discuss how our architecture is able to counteract various security attacks. The dynamic security policy-based approach and the distribution of corresponding security capabilities intelligently as a service layer that enables flow-based security enforcement and protection of multitude of network devices against attacks are important contributions of this paper.

Autonomous Networks has a potential to solve complex and critical management issues in large scale multi- technological networks. Further, the novel paradigms, i.e., Software-Defined Networks (SDN) and Network Function Vir- tualization (NFV) offer unique and attractive solutions for Autonomous Networks or Systems (AS). However, despite of these attractive features, we observed two critical issues in this interlinked multi-technology domain. Firstly, the network externality and nodes heterogeneity seriously effected the flow specific Quality of Service (QoS). Secondly, it influenced se- curity adoption in an network of interconnected nodes. We observed that QoS and security both are non-negligible and inter-dependent factors. This motivates us to investigate solution towards a) alleviating the SDN network heterogeneity at control layer, and b) to strengthen the network security after alleviating the heterogeneity. In this research effort, we have attempted to alleviate the first issue. Firstly, significant and reasonable examples have been cited to motivate researchers to study QoS and security hand-to-hand. Secondly, a theoretical high level frame work has been proposed with the aim to transform the N heterogeneous controllers to n homogeneous controller groups. Following this, we have demonstrated that our approximation method to transform heterogeneous systems to homogeneous groups works well even at high degree of heterogeneity in the network. We have shown our theoretical analysis results using Matlab. Following this, we have shown the Proof of Concept (PoC) of our approach in SDN-NFV ecosystem using Mininet. This early analysis will help researchers to address heterogeneity and security in more effective ways.

In this paper, we propose an access control architecture for constrained healthcare resources in the IoT. Our policy-based approach provides fine-grained access for authorised users to services while protecting valuable resources from unauthorised access. We use a hybrid approach by employing attributes, roles and capabilities for our authorisation design. We apply attributes for role membership assignment and in permission evaluation. Membership of roles grants capabilities. The capabilities which are issued may be parameterised based on further attributes of the user and are then used to access specific services provided by IoT devices. This significantly reduces the number of policies required for specifying access control settings. The proposed scheme is XACML driven. Our approach requires very little additional overhead when compared to other proposals employing capabilities for access control in the IoT. We have implemented a proof of concept prototype and provide a performance evaluation of the implementation.

In this paper, we propose techniques and architecture for securing services that are hosted in a multi-tenant networked cloud infrastructures. Our architecture is based on trusted virtual domains and takes into account both security policies of the tenant domains as well as specific security policies of the virtual machines in the tenant domains. We describe techniques for detecting a range of attacks such as attacks between the virtual machines within a trusted virtual domain, attacks between the virtual machines in different domains, malicious insider attacks and attacks against specific services such as DNS, database and web servers within a domain. We address security policies for trusted virtual domain management such as secure addition and deletion of a virtual machine and the revocation of privileges associated with a virtual machine in a domain. We also discuss forensic analysis of attacks and fine granular detection of malicious entities and mechanisms for restoration of services. Furthermore the proposed architecture provides mechanisms for enhancing the assurance of communications between the virtual machines in different domains. Finally, we present the implementation of our security architecture using Xen and illustrate how our architecture is able to secure services in networked cloud infrastructures.

This paper presents a novel feature learning model for cyber security tasks. We propose to use Auto-encoders (AEs), as a generative model, to learn latent representation of different feature sets. We show how well the AE is capable of automatically learning a reasonable notion of semantic similarity among input features. Specifically, the AE accepts a feature vector, obtained from cyber security phenomena, and extracts a code vector that captures the semantic similarity between the feature vectors. This similarity is embedded in an abstract latent representation. Because the AE is trained in an unsupervised fashion, the main part of this success comes from appropriate original feature set that is used in this paper. It can also provide more discriminative features in contrast to other feature engineering approaches. Furthermore, the scheme can reduce the dimensionality of the features thereby signicantly minimising the memory requirements. We selected two different cyber security tasks: networkbased anomaly intrusion detection and Malware classication. We have analysed the proposed scheme with various classifiers using publicly available datasets for network anomaly intrusion detection and malware classifications. Several appropriate evaluation metrics show improvement compared to prior results.

In this paper we proposed policy based security architecture for securing the communication in multiple Autonomous System (AS) domains with Software Defined Networks (SDN). We will present a high level overview of the architecture and detail discussion on some of the important components for securing the communication in multiple AS domains. A key component of the security architecture is the specification of security policies that are to be enforced on the SDN communications whether they are intra or inter-domain. We will present example scenarios to demonstrate the operation of the security architecture to enable end-to-end secure communication within a single AS domain and for multiple AS domains. We have justified the model using ONOS controller.

In this paper, we propose an access control architecture for IoT systems by developing a hybrid model with attributes, capabilities and role-based access control. We apply attributes for role-membership assignment and in permission evaluation, Membership of roles grants capabilities which are used to access specific services provided by things. This approach improves policy management for IoT systems with a large number of things and users.

The Internet of Things (IoT) is facilitating the development of novel and cost-effective applications that promise to deliver efficient and improved medical facilities to patients and health organisations. This includes the use of smart 'things' as medical sensors attached to patients to deliver real-time data. However, the security of patient data is an ever-present concern in the healthcare arena. In the wider deployment of IoT-enabled smart healthcare systems one particular issue is the need to protect smart 'things' from unauthorised access. Commonly used access control approaches e.g. Attribute Based Access Control (ABAC), Role Based Access Control (RBAC) and capability based access control do not, in isolation, provide a complete solution for securing access to IoT-enabled smart healthcare devices. They may, for example, require an overly-centralised solution or an unmanageably large policy base. To address these issues we propose a novel access control architecture which improves policy management by reducing the required number of authentication policies in a large-scale healthcare system while providing fine-grained access control. We devise a hybrid access control model employing attributes, roles and capabilities. We apply attributes for role-membership assignment and in permission evaluation. Membership of roles grants capabilities. The capabilities which are issued may be parameterised based on further attributes of the user and are then used to access specific services provided by IoT 'things'. We also provide a formal specification of the model and a description of its implementation and demonstrate its application through different use-case scenarios. Evaluation results of core functionality of our architecture are provided.

Summary Cloud computing provides on demand provisioning of resources mostly offered as Infrastructure as a Service. The flexibility in services has opened doors for attackers. Research has been performed to detect various malware in the last few years. However, modern malware are advanced enough to detect the presence of virtualization environment, security analyzer, or even the hypervisor by observing the virtualization‐specific information such as virtual processor features, timing features, etc. The malware exhibit evasive nature and can fool existing security solutions by performing modern antidetection tactics. In this paper, we propose an approach named as VMI‐assisted evasion detection (VAED), deployed at virtual machine monitor, to detect the evasion‐based malware attacks. The VAED is based on learning the program semantic of evasive malware. It uses system call dependency graph approach generated using Markov Chain principle and keeps track of system call ordering with transition probability distribution between each pair system calls. It uses software break point injection technique to extract the system call traces of evasive malware samples, which is free from any modification in hardware‐specific values. Hence, it is secure from evasion attempts. The VAED is validated over evasive samples collected from the University of California on request, and results seem to be promising.

In this paper, we propose an integrated security architecture which combines policy based access control with intrusion detection techniques and trusted computing technologies for securing distributed applications running on virtualised systems. Our security architecture incorporates access control security policies for secure interactions between applications and virtual machines in different physical virtualized servers. It provides intrusion detection and trusted attestation techniques to detect and counteract dynamic attacks in an efficient manner. We demonstrate how this integrated security architecture is used to secure the life cycle of virtual machines including dynamic hosting and allocation of resources as well as migration of virtual machines across different physical servers. We discuss the implementation of the developed architecture and show how the architecture can counteract attack scenarios involving malicious users exploiting vulnerabilities to achieve privilege escalation and then using the compromised machines to generate further attacks. The feedback between the various security components of our security architecture plays a critical role in detecting sophisticated, dynamically changing attacks, thereby increasing the resilience of the overall secure system.

Lightweight devices such as smart cards and RFID tags have a very limited hardware resource, which could be too weak to cope with asymmetric-key cryptography. It would be desirable if the cryptographic algorithm could be optimized in order to better use hardware resources. In this paper, we demonstrate how identity-based encryption algorithms from bilinear pairing can be optimized so that hardware resources can be saved. We notice that the identity-based encryption algorithms from bilinear pairing in the literature must perform both elliptic curve group operations and multiplicative group operations, which consume a lot of hardware resources. We manage to eliminate the need of multiplicative group operations for encryption. This is a significant discovery since the hardware structure can be simplified for implementing pairing-based cryptography. Our experimental results show that our encryption algorithm saves up to 47 percent memory (27,239 RAM bits) in FPGA implementation.

In this paper, we propose a policy driven security architecture for securing end to end services across multiple autonomous domain based SDN environment. We develop a language based approach to designing a range of security policies that are relevant for SDN services and communications. The design of a security architecture that enables secure routing of packets based on the specified security policies in the SDN Controller is described.

Modern computing platforms have progressed to deploying more secure software with various defensive techniques such as code signing and application whitelisting. However, the adversary, on the other hand, has been developing offensive techniques including using legitimate digital certificates in their attacks. In this paper (extended version of a paper published in the conference DSN 2015), we propose a new security mechanism for software systems that extends the Windows integrity mechanism and code signing technique. Our security mechanism gives rise to three major benefits. First, it prevents a wide range of attacks such as DLL hijacking and DLL injection, and mitigates the impact of shellcode that is executed by successful software vulnerability exploitation. It also prevents the use of untrusted plugins such as web browser add-ons. Second, it achieves developer-enforced security at the software component level so that components cannot be abused by malware. Third, it ensures a flexible environment where untrusted applications and software components are allowed to be loaded/executed at a low integrity level with restricted access permissions to system resources. We have implemented a prototype and carried out a thorough evaluation, showing the advantages of our proposed mechanism in mitigating real world malware attacks and preventing unauthorised software use as well as demonstrating the ease of adoption for software developers.

With the rapid developments occurring in cloud services, there has been a growing trend to use cloud for large-scale data storage. Due to the increasing popularity of cloud storage, many healthcare organizations have started moving electronic health records (EHRs) to cloud-based storage systems. However, this has raised the important security issue of how to protect and prevent unauthorized access to EHR data stored in a public cloud. Several cryptographic access control schemes have been proposed to protect the security of data stored in the cloud by integrating cryptographic techniques with access control models. In this paper, we consider a novel role-based encryption technique to build a secure and flexible large-scale EHR system where role-based access control policies are enforced in a cloud environment. Then we discuss a practical EHR system called the personally controlled electronic health record (PCEHR) system recently developed by the Australian Government, and show how the security weaknesses in the PCEHR system can be addressed by our proposed scheme. The proposed system has the potential to be useful in commercial healthcare systems as it captures practical access policies based on roles in a flexible manner and provides secure data storage in the cloud enforcing these access policies.

Major anti-virus solutions have introduced a feature known as ‘self-protection’ so that malware (and even users) cannot modify or disable the core functionality of their products. In this paper, we have investigated 12 anti-virus products from four vendors (AVG, Avira, McAfee and Symantec) and have discovered that they have certain security weaknesses that can be exploited by malware. We have then designed a novel malware, which makes use of the weaknesses in anti-virus software and embeds itself to become a part of the vulnerable anti-virus solution. It subverts the self-protection features of several anti-virus software solutions. This malware integrated anti-virus enjoys several advantages such as longevity (anti-virus is active while the system is running), improved stealthy behaviour, highest privilege and capability to bypass security measures. Then we propose an effective defence against such malware. We have also implemented the defensive measure and evaluated its effectiveness. Finally, we show how the proposed defence can be applied to the current versions of vulnerable anti-virus solutions without requiring signficant modifications. Copyright © 2015 John Wiley & Sons, Ltd.

In mobile communication, spatial queries pose a serious threat to user location privacy because the location of a query may reveal sensitive information about the mobile user. In this paper, we study approximate k nearest neighbor (kNN) queries where the mobile user queries the location-based service (LBS) provider about approximate k nearest points of interest (POIs) on the basis of his current location. We propose a basic solution and a generic solution for the mobile user to preserve his location and query privacy in approximate kNN queries. The proposed solutions are mainly built on the Paillier public-key cryptosystem and can provide both location and query privacy. To preserve query privacy, our basic solution allows the mobile user to retrieve one type of POIs, for example, approximate k nearest car parks, without revealing to the LBS provider what type of points is retrieved. Our generic solution can be applied to multiple discrete type attributes of private location-based queries. Compared with existing solutions for kNN queries with location privacy, our solution is more efficient. Experiments have shown that our solution is practical for kNN queries.

Yoking-proofs show an interesting application in Radio Frequency Identification (RFID) that a verifier can check whether two tags are simultaneously scanned by a reader. We consider a scenario that multi-group of tags can be proved to be scanned simultaneously. Grouping-proof, which is an extension of yoking-proofs, allows multiple tags to be proved together, while existing protocols cannot support multiple groups. In this paper, we introduce a novel concept called "yoking-group proofs". Additionally, we propose an anonymous yoking-proof protocol and an anonymous yoking-group proof protocol and prove their security in Universal Composability framework.

In this paper, we propose a cross verification mechanism for secure execution and dynamic component loading. Our mechanism is based on a combination of code signing and same-origin policy, and it blocks several types of attacks from drive-by download attacks to malicious component loadings such as DLL hijacking, DLL side-loading, binary hijacking, typical DLL injection and loading of newly installed malware components, even when malicious components have valid digital signatures. Considering modern malware often uses stolen private keys to sign its binaries and bypass code signing mechanism, we believe the proposed mechanism can significantly improve the security of modern computing platforms. In addition, the proposed mechanism protects proprietary software components so that unauthorised use of such components cannot occur. We have implemented a prototype for Microsoft Windows 7 and XP SP3, and evaluated application execution and dynamic component loading behaviour under our security mechanism. The proposed mechanism is general, and can be applied to other major computing platforms including Android, Linux and Mac OS X.

In this paper, we analyse the Internet of Things (IoT) aspect of smart home from a security perspective, and adapt an advanced malware technique (called feature-distributed malware) for the IoT. We design several attacks including cyber-physical system attacks and advanced cyber attacks, and then evaluate their impact via practical evaluations. Our proposed offensive techniques are based on the following current smart home status: (1) almost every smart home appliance is directly or indirectly connected to the Internet for remote monitoring and/or control. (2) there are Internet services that integrate heterogeneous devices into one single smart home environment. These integration services make it easy and simple to build any form of customised smart home configurations. However, at the same time, such services also put the smart home at risk when they are compromised and abused by attackers, which means that the attackers can achieve their goals without needing to compromise individual smart home devices. Our evaluation results show that using traditional web attack techniques such as cookie stealing can be turned into sophisticated attacks that enable the attackers to perform various malicious activities such as unlocking the smart lock installed at the target premises and disarming security alarms. Considering existing research efforts on the smart home security are mainly about security analysis of individual devices and protocols, we believe this work will shed light on the practical implications of integrating the smart home with the Internet of things, therefore helping the development of more secure smart home environments in the future.

Cloud computing technologies are receiving a great deal of attention. Although there are several benefits with the cloud, attackers can also make use of the cloud infrastructure for hosting malicious services and generating different types of attacks. In this paper, we propose trust enhanced security techniques for securing tenant transactions in the cloud. Our model takes advantage of the features of trusted computing technology to enhance the design and enforcement of security policies and mechanisms in a cloud environment. Furthermore, the cloud service provider monitors the ongoing tenant transactions for different types of attacks and terminates the malicious transactions. Hence, our model can be used to enhance the security of tenant transactions in cloud.

Summary The current mobile devices have become smart and are increasingly being used for conducting business and personal activities. Also, there is increasing number of attacks targeting such mobile devices. The term mobile botnet refers to group of mobile devices that are compromised and controlled by the attacker that can be used for generating distributed denial‐of‐service attacks. The security protocols that have been proposed for wireless and mobile networks have several weaknesses that can be exploited by the attacker to obtain unauthorized access and generate attacks. Also, there is growing number of malicious applications that are aimed to compromise smartphones and using them for generating different types of attacks. In this paper, we propose techniques to counteract distributed denial‐of‐service attacks on wireless mobile devices. We describe the operation and architectural components of our model. We will show that our model is able to efficiently deal with the attacks by dropping the attack traffic before it targets the victim mobile node, can prevent the attack traffic at the upstream nodes, and also deal with the attack cases that involve mobility of the attacking and victim nodes. Copyright © 2014 John Wiley & Sons, Ltd.

Radio frequency identification (RFID) authentication is an indispensable part of RFID applications, which allows a reader to identify objects in an authenticated manner. Recently, Liao and Hsiao proposed a very interesting elliptic curve cryptography-based RFID authentication scheme with ID-verifier transfer protocol. They claimed that the proposed protocol is secure against many attacks and satisfies essential security requirements of RFID systems. However, in this paper, we demonstrate that the protocol suffers from several attacks, in contrast to their original claims in the paper. Furthermore, we also propose a repaired version of the authentication protocol against identified attacks, and we provide formal security proofs.

In many network applications, the nature of traffic is of burst type. Often, the transient response of network to such traffics is the result of a series of interdependant events whose occurrence prediction is not a trivial task. The previous efforts in IEEE 802.15.4 networks often followed top-down approaches to model those sequences of events, i.e., through making top-view models of the whole network, they tried to track the transient response of network to burst packet arrivals. The problem with such approaches was that they were unable to give station-level views of network response and were usually complex. In this paper, we propose a non-stationary analytical model for the IEEE 802.15.4 slotted CSMA/CA medium access control (MAC) protocol under burst traffic arrival assumption and without the optional acknowledgements. We develop a station-level stochastic time-domain method from which the network-level metrics are extracted. Our bottom-up approach makes finding station-level details such as delay, collision and failure distributions possible. Moreover, network-level metrics like the average packet loss or transmission success rate can be extracted from the model. Compared to the previous models, our model is proven to be of lower memory and computational complexity order and also supports contention window sizes of greater than one. We have carried out extensive and comparative simulations to show the high accuracy of our model.

Cloud storage auditing is viewed as an important service to verify the integrity of the data in public cloud. Current auditing protocols are all based on the assumption that the client's secret key for auditing is absolutely secure. However, such assumption may not always be held, due to the possibly weak sense of security and/or low security settings at the client. If such a secret key for auditing is exposed, most of the current auditing protocols would inevitably become unable to work. In this paper, we focus on this new aspect of cloud storage auditing. We investigate how to reduce the damage of the client's key exposure in cloud storage auditing, and give the first practical solution for this new problem setting. We formalize the definition and the security model of auditing protocol with key-exposure resilience and propose such a protocol. In our design, we employ the binary tree structure and the preorder traversal technique to update the secret keys for the client. We also develop a novel authenticator construction to support the forward security and the property of blockless verifiability. The security proof and the performance analysis show that our proposed protocol is secure and efficient.

Cloud data storage has provided significant benefits by allowing users to store massive amount of data on demand in a cost-effective manner. To protect the privacy of data stored in the cloud, cryptographic role-based access control (RBAC) schemes have been developed to ensure that the data can only be accessed by those who are allowed by access policies. However, these cryptographic approaches do not address the issues of trust. In this paper, we propose trust models to reason about and to improve the security for stored data in cloud storage systems that use cryptographic RBAC schemes. The trust models provide an approach for the owners and roles to determine the trustworthiness of individual roles and users, respectively, in the RBAC system. The proposed trust models consider role inheritance and hierarchy in the evaluation of trustworthiness of roles. We present a design of a trust-based cloud storage system, which shows how the trust models can be integrated into a system that uses cryptographic RBAC schemes. We have also considered practical application scenarios and illustrated how the trust evaluations can be used to reduce the risks and to enhance the quality of decision making by data owners and roles of cloud storage service.

Embedded systems are increasingly pervasive, interdependent and in many cases critical to our every day life and safety. Tiny devices that cannot afford sophisticated hardware security mechanisms are embedded in complex control infrastructures, medical support systems and entertainment products [51]. As such devices are increasingly subject to attacks, new hardware protection mechanisms are needed to provide the required resilience and dependency at low cost.

In mobile communication, spatial queries pose a serious threat to user location privacy because the location of a query may reveal sensitive information about the mobile user. In this paper, we study k nearest neighbor (kNN) queries where the mobile user queries the location-based service (LBS) provider about k nearest points of interest (POIs) on the basis of his current location. We propose a solution for the mobile user to preserve his location privacy in kNN queries. The proposed solution is built on the Paillier public-key cryptosystem and can provide both location privacy and data privacy. In particular, our solution allows the mobile user to retrieve one type of POIs, for example, k nearest car parks, without revealing to the LBS provider what type of points is retrieved. For a cloaking region with n×n cells and m types of points, the total communication complexity for the mobile user to retrieve a type of k nearest POIs is O(n+m) while the computation complexities of the mobile user and the LBS provider are O(n + m) and O(n2m), respectively. Compared with existing solutions for kNN queries with location privacy, our solutions are more efficient. Experiments have shown that our solutions are practical for kNN queries.

Smart grid, the future power grid, is expected to provide better energy efficiency, more customer choices and improved reliability and security. As the smart grid is an integrated system that consists of multiple subsystems, understanding it as a whole system is required to fully understand the security risks it faces. In this paper, a sophisticated cyber-physical system (CPS) unique malware attack against the smart grid is proposed. The paper first outlines the architecture of the smart grid in general. Then we present the characteristics of recent malware attacks targeting the CPS such as Stuxnet and Shamoon. These lead to the design of our proposed attack that incorporates the key features from the smart grid architecture and the recent real attacks. One key aspect of the proposed attack is that it manipulates various physical field devices as well as cyber systems to illustrate how a blackout is possible even under the security-improved smart grid environment. Then, we explain the application of defensive techniques in the context of the suggested attack. Lastly, prototype implementation showing the effectiveness of the attack and the defensive measures is described.

In this paper, we propose a new advanced malware that distributes its features to multiple software components in order to bypass various security policies such as application white listing and security tools like anti-virus. A tool that automatically generates such malware has been developed, and malware instances generated by this tool have been evaluated, showing the risks of the proposed malware. The new threat proposed in this paper is particularly important in modern computing platforms since they have progressed to more secure environments with various defensive techniques such as application-based permission and application white listing. In addition, anti-virus solutions are improving their detection techniques, especially based on behavioural properties. Our offensive technique is designed to overcome these hurdles so that appropriate defensive mitigations can be explored before the adversary develops such offensive technique as they always have done.

Today, healthcare service providers are increasingly making use of the cloud for hosting their services. Although such services are regulated by policies such as HIPAA and healthcare service providers follow best practises to minimise attacks, the attackers can easily exploit such services. Hence there is need for securing such critical services. In this paper we propose trust enhanced cloud security model for healthcare services.

Server-aided verification (SAV) has potential applicability in lightweight devices for improving signature verification, where the verifier possesses a computationally weak hardware. We observe that lightweight devices run all algorithms through hardware implementation with logic circuits. Existing SAV protocols indeed improve computational efficiency for lightweight devices, however, few of them take the hardware cost into consideration. The hardware implementation of SAV protocols could be still costly and expensive for lightweight devices. Currently, the most secure SAV protocols in the literature for pairing-based (𝔾1 × 𝔾2 → 𝔾T) signatures can securely delegate pairing computations to the server; however, verifiers are still required to perform group operations over two completely different groups 𝔾1 and 𝔾T, which heavily contribute to the cost of hardware implementation. In this work, we propose several collusion-resistant SAV protocols for pairing-based signatures to improve their applicability for lightweight devices. In our SAV protocols, verifiers are only required to perform group operations in 𝔾1. In comparison with existing SAV protocols, our protocols save the unnecessary hardware cost for implementing group operations in 𝔾T and therefore are more applicable to lightweight applications.

The security of modern computer systems heavily depends on security tools, especially on antivirus software solutions. In the anti-malware research community, development of techniques for evading detection by antivirus software is an active research area. This has led to malware that can bypass or subvert antivirus software. The common strategies deployed include the use of obfuscated code and staged malware whose first instance (usually installer such as dropper and downloader) is not detected by the antivirus software. Increasingly, most of the modern malware are staged ones in order for them to be not detected by antivirus solutions at the early stage of intrusion. The installers then determine the method for further intrusion including antivirus bypassing techniques. Some malware target boot and/or shutdown time when antivirus software may be inactive so that they can perform their malicious activities. However, there can be another time frame where antivirus solutions may be inactive, namely, during the time of update. All antivirus software share a unique characteristic that they must be updated at a very high frequency to provide up-to-date protection of their system. In this paper, we suggest a novel attack vector that targets antivirus updates and show practical examples of how a system and antivirus software itself can be compromised during the update of antivirus software. Local privilege escalation using this vulnerability is also described. We have investigated this design vulnerability with several of the major antivirus software products such as Avira, AVG, McAfee, Microsoft, and Symantec and found that they are vulnerable to this new attack vector. The paper also discusses possible solutions that can be used to mitigate the attack in the existing versions of the antivirus software as well as in the future ones. Copyright © 2013 John Wiley & Sons, Ltd.

Lightweight devices, such as radio frequency identification tags, have a limited storage capacity, which has become a bottleneck for many applications, especially for security applications. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptographic tool, where the encryptor can decide the access structure that will be used to protect the sensitive data. However, current CP-ABE schemes suffer from the issue of having long decryption keys, in which the size is linear to and dependent on the number of attributes. This drawback prevents the use of lightweight devices in practice as a storage of the decryption keys of the CP-ABE for users. In this paper, we provide an affirmative answer to the above long standing issue, which will make the CP-ABE very practical. We propose a novel CP-ABE scheme with constant-size decryption keys independent of the number of attributes. We found that the size can be as small as 672 bits. In comparison with other schemes in the literature, the proposed scheme is the only CP-ABE with expressive access structures, which is suitable for CP-ABE key storage in lightweight devices.

Virtual private networks (VPNs) are increasingly used to build logically isolated networks. However, existing VPN designs and deployments neglected the problem of traffic analysis and covert channels. Hence, there are many ways to infer information from VPN traffic without decrypting it. Many proposals have been made to mitigate network covert channels, but previous works remained largely theoretical or resulted in prohibitively high padding overhead and performance penalties. In this paper, we: 1) analyse the impact of covert channels in IPsec; 2) present several improved and novel approaches for covert channel mitigation in IPsec; 3) propose and implement a system for dynamic performance trade-offs; and 4) implement our design in the Linux IPsec stack and evaluate its performance for different types of traffic and mitigation policies. At only 24% overhead, our prototype enforces tight information-theoretic bounds on information leakage. To encourage further research, we put our prototype code and data in the public domain.

Cloud computing is becoming increasingly important for provision of services and storage of data in the Internet. However there are several significant challenges in securing cloud infrastructures from different types of attacks. The focus of this paper is on the security services that a cloud provider can offer as part of its infrastructure to its customers (tenants) to counteract these attacks. Our main contribution is a security architecture that provides a flexible security as a service model that a cloud provider can offer to its tenants and customers of its tenants. Our security as a service model while offering a baseline security to the provider to protect its own cloud infrastructure also provides flexibility to tenants to have additional security functionalities that suit their security requirements. The paper describes the design of the security architecture and discusses how different types of attacks are counteracted by the proposed architecture. We have implemented the security architecture and the paper discusses analysis and performance evaluation results.

Cloud computing technologies are receiving a great deal of attention. Although there are several benefits with the cloud, the attackers can also use the cloud infrastructure for hosting malicious services and generating different types of attacks. In this paper we propose techniques for securing tenant transactions in the cloud.

With the rapid developments occurring in cloud computing and services, there has been a growing trend to use the cloud for large-scale data storage. This has raised the important security issue of how to control and prevent unauthorized access to data stored in the cloud. One well known access control model is the role-based access control (RBAC), which provides flexible controls and management by having two mappings, users to roles and roles to privileges on data objects. In this paper, we propose a role-based encryption (RBE) scheme that integrates the cryptographic techniques with RBAC. Our RBE scheme allows RBAC policies to be enforced for the encrypted data stored in public clouds. Based on the proposed scheme, we present a secure RBE-based hybrid cloud storage architecture that allows an organization to store data securely in a public cloud, while maintaining the sensitive information related to the organization's structure in a private cloud. We describe a practical implementation of the proposed RBE-based architecture and discuss the performance results. We demonstrate that users only need to keep a single key for decryption, and system operations are efficient regardless of the complexity of the role hierarchy and user membership in the system.

A virtual domain enables grouping of related virtual machines running on separate physical machine into a single network domain with a unified security policy. Since the virtual machines can be running different operating systems and applications, the attacker can exploit even a single vulnerability in any of the operating system or applications in a single virtual machine to attack other machines in the virtual domain. There is a need to develop intrusion detection techniques to deal with different types of attacks in virtual domains. In this paper we consider the design choices for attack detection and propose intrusion detection architecture to deal with attacks in virtual domains. Our architecture takes into account the specific features of the virtual machine as well as security policies of the virtual domains to deal with different types of attacks in virtual machines. We have described the operation of the proposed system architecture in detail. Finally we present how our model can efficiently deal with different types of attacks and performance analysis of our model.

We propose Distributed Service Control (DSC) technique for securing critical services. One of the main aims of DSC is to deal with the attacks by minimising the attack surface between two hosts. In our model, light weight security policies are enforced at the client machines to ensure that the client can access the services using legitimate traffic only. This will minimise the number of attacks that can be generated by the malicious client machine on the server. We will show that our model can increase the availability of the critical services. Our model can also be used as an early detection technique for the outbreak of worms.

Today, cloud computing is one of the popular technologies. In addition to this, most of the hardware that is being shipped today is equipped with the TPM which can be used for realization of trusted platforms. Recently several TPM attestation techniques such as binary attestation and property based attestation techniques have been proposed but there are some fundamental issues that need to be addressed for using these techniques in practice. In this paper we consider an architecture where different services are hosted on the cloud infrastructure by multiple cloud customers (tenants). Then we consider an attacker model that is specific to the cloud and some of the challenges with the current TPM based attestation techniques. We will also propose a novel trust enhanced security model for cloud which overcomes the challenges with the current TPM based attestation techniques and efficiently deals with the attacks in the cloud. In our model, the cloud service provider is used as the Certification Authority (CA) for the tenant virtual machines. The CA only certifies the basic security properties which are the assurance on the traffic originating from the tenant virtual machine and validation of the tenant virtual machine transactions. The components of the CA monitor the interactions of the tenant virtual machine for the certified properties. Since the tenant virtual machines are running on the cloud service provider infrastructure, it is aware of the dynamic changes to the tenant virtual machine. The CA can terminate the ongoing transactions and/or dynamically isolate the tenant virtual machine if there is a variation in the behaviour of the tenant virtual machine from the certified properties. Hence our model can be used to address the challenges with the current TPM based attestation techniques and efficiently deal with the attacks in the cloud. We will present implementation of our model on Xen and how it deals with the attacks in different attack case scenarios. We will also show that our model is beneficial for the cloud service providers, tenants and tenant customers.

Many wireless sensor networks (WSNs) consist of a large number of distributed sensor nodes that are batteries powered, vulnerable to tampering, and equipped with limited computational capabilities and memory. These characteristics render WSNs facing many security threats, which require cryptographic security mechanisms for secure communication, key revocation and management of security issues arising from the addition of new nodes. In this paper, we propose a key management scheme to meet the security requirements of wireless sensor networks. The scheme relies on the theory of random graph to build a fully secure connectivity for distributed sensor nodes. It uses heterogeneous structure to limit ranges of attacks, and utilizes hash chains to realize authentication of pool keys and broadcast messages of auxiliary nodes. The security and network connectivity characteristics supported by the key management scheme are discussed and simulation experiments are presented.

There has been an increasing trend towards outsourcing data to the cloud to cope with the massive increase in the amount of data. Hence trusted enforcement of access control policies on outsourced data in the cloud has become a significant issue. In this paper we address trusted administration and enforcement of role-based access control policies on data stored in the cloud. Role-based access control (RBAC) simplifies the management of access control policies by creating two mappings; roles to permissions and users to roles. Recently crypto-based RBAC (C-RBAC) schemes have been developed which combine cryptographic techniques and access control to secured data in an outsourced environment. In such schemes, data is encrypted before outsourcing it and the ciphertext data is stored in the untrusted cloud. This ciphertext can only be decrypted by those users who satisfy the role-based access control policies. However such schemes assume the existence of a trusted administrator managing all the users and roles in the system. Such an assumption is not realistic in large-scale systems as it is impractical for a single administrator to manage the entire system. Though administrative models for RBAC systems have been proposed decentralize the administration tasks associated with the roles, these administrative models cannot be used in the C-RBAC schemes, as the administrative policies cannot be enforced in an untrusted distributed cloud environment. In this paper, we propose a trusted administrative model AdC-RBAC to manage and enforce role-based access policies for C-RBAC schemes in large-scale cloud systems. The AdC-RBAC model uses cryptographic techniques to ensure that the administrative tasks such as user, permission and role management are performed only by authorized administrative roles. Our proposed model uses role-based encryption techniques to ensure that only administrators who have the permissions to manage a role can add/revoke users to/from the role and owners can verify that a role is created by qualified administrators before giving out their data. We show how the proposed model can be used in an untrusted cloud while guaranteeing its security using cryptographic and trusted access control enforcement techniques.

The rapidly increasing data usage and overload in mobile broadband networks has driven mobile network providers to actively detect and bill customers who tether tablets and laptops to their mobile phone for mobile Internet access. However, users may not be willing to pay additional fees only because they use their bandwidth dierently, and may consider tethering detection as violation of their privacy. Furthermore, accurate tethering detection is becoming harder for providers as many modern smartphones are under full control of the user, running customized, complex software and applications similar to desktop systems.

Current Internet environment is vulnerable to a range of different types of attacks, and furthermore, new types of attacks are being discovered on a daily basis. In this paper, we address the design of comprehensive intrusion detection for virtual-machine-based systems. We propose a novel security architecture using a virtual machine monitor-based intrusion detection system called Virtual machine Intrusion deteCTOR (VICTOR), which takes into account the specific characteristics of operating system and applications running in each virtual machine at a fine granular level to detect attacks. The components of our architecture are designed to deal with different types of malicious behaviour. The entity validation component is used for capturing information of the operating system and applications running in the virtual machines, secure logging and detection of attacks that are generated with spoofed source address. The intrusion detection engine component is used for the detection of known attacks and suspicious behaviour of the entities by monitoring the incoming and outgoing traffic of virtual machines. The dynamic analyser is used for detection and validation of hidden processes, detection of zero-day attacks and fine granular isolation of malicious process that is generating the attack traffic. After a zero-day attack is detected, interactive virtual machine technique is used to determine whether the zero-day attack exhibits polymorphic or metamorphic behaviour and develop attack signatures to deal with the attack. We have analysed our architecture with different types of attacks such as hidden processes and attacks such as Slammer. In this paper, we illustrate the operation of our system architecture by considering Slammer worm attack in detail.

Today, PDF is one of the widely used applications for sharing documents. Some of the important factors for the popular use of the PDF application are due to its platform independency and rich digital offerings such as ability to include multimedia files, direct URL access and HTTP communication. However its wider acceptance among the user community has also attracted the attackers to develop and spread malware using PDF files. Most of the existing security tools are not equipped to deal with the attacks related to PDF. In this paper we present different techniques that can be used by an attacker to generate PDF attacks. Then we propose portable document scanner (PDSCAN) which can detect the attacks by analyzing the suspicious objects and the scripts that are embedded in the documents. PDSCAN makes use of dynamic and static analysis techniques to deal with the malware. Finally we present detail analysis of a malicious PDF file in Virtual Box environment.

Today, cloud computing is one of the increasingly popular technology where the customer can use the resources of the cloud services providers to perform their tasks and only pay for the resources they use. The customer virtual machines in the cloud are vulnerable to different types of attacks. In this paper we propose techniques for securing customer virtual machines from different types of attacks in the Infrastructure as a Service cloud and describe how this can be achieved in practice. Our model enables to differentiate attack traffic originating from each virtual machine even if multiple virtual machines on a VMM are sharing a single IP address.

Significant developments in the recent times have led to an increasing use of mobile devices such as smart phones in accessing Internet services and applications over wireless networks. In this paper, we propose a security architecture for counteracting denial of service attacks in Beyond 3G (B3G) network architecture with mobile nodes. We describe the system architecture and discuss the different cases of attack scenarios involving the mobility of the attacking and victim nodes. Our proposed solution takes into account practical issues such as limited resources of the mobile nodes. It has distinct advantages such as monitoring of the traffic to the victim node and the attack traffic being dropped before reaching the victim, the ability to trace back the attacking node and prevent the attack at the home agent or foreign agent that is closer to the attacking node, and the ability to deal with dynamic changes in attack traffic patterns. We also present an analysis of our proposed architecture as well as simulation results.

In this paper we propose comprehensive security architecture called VICTOR to deal with different types of attacks on virtual machines. Our model takes into account the specific characteristics of operating system and applications running in each virtual machine (VM) at a fine granular level to deal with the attacks. Our architecture has several components such as entity validation, intrusion detection engine and dynamic analyzer. The entity validation component is used in the detection of attack traffic with spoofed source address, secure logging, and capturing information of the operating system and applications running in the virtual machines. The intrusion detection engine component is used for detection of known attacks and suspicious behaviour by monitoring the incoming and outgoing traffic of virtual machines. The dynamic analyzer is used for detection and validation of suspicious processes, detection of zero day attacks and fine granular isolation of malicious process or application that is generating the attack traffic.

We propose security architecture to detect and prevent zero day attacks and techniques to deal with the polymorphic and metamorphic behaviour of the attacks. The components of our architecture are designed to deal with different types of malicious behaviour. The entity validation component is used for capturing information of the operating system and applications running in the virtual machines, secure logging and detection of attacks that are generated with spoofed source address. The intrusion detection engine component is used for detection of known attacks and suspicious behaviour of the entities by monitoring the incoming and outgoing traffic of virtual machines. The dynamic analyzer is used for detection and validation of hidden processes, detection of zero day attacks and fine granular isolation of malicious process that is generating the attack traffic. After a zero day attack is detected, interactive VM technique is used to determine if the zero day attack exhibits polymorphic or metamorphic behaviour and develop attack signatures to deal with the attacks efficiently.

Instances of batch traffic can be seen in many applications. A set of sensors around the source of a sudden event which try to report it to the cluster head, and energy conserving MAC protocols in hierarchical networks with sleep-awake schedules which lead to burst traffics toward a single destination are good examples. The transient non-stationary nature of network reaction to batch arrivals has led to the development of complex models in order to estimate the network quantities of interest. In this paper, we propose a non-stationary Markov model to capture the transient characteristics of IEEE 802.15.4-based networks response to batch traffic arrivals of one- shot type. Mainly, the slotted CSMA/CA MAC protocol of the IEEE 802.15.4 standard is analyzed and the packet loss metric value is extracted from the proposed model. Extensive simulations were conducted to evaluate the accuracy of the proposed model and to compare its performance with that of the previous models.

The security protocols for WLAN such as WEP have fundamental weakness which can be exploited by the attacker to obtain unauthorized access to the wireless networks and generate attacks. In this paper, we propose a security architecture for counteracting denial of service attacks in wireless based network architecture with mobile nodes. We describe the system model and discuss the different cases of attack scenarios involving the mobility of the attacking and victim nodes. We describe how mobile IP protocol in conjunction with our model can be used to deal efficiently with the attacks on mobile nodes.

It is clear that the Internet is transforming the way we live and the recent decades have witnessed dramatic developments in information and communication technologies (ICT). Along with the phenomenal growth in technology enabled information economy has been a growth in computing technology related crimes. Security and privacy issues have become increasingly significant over the years and expected to continue to dominate the technology scene with the increased focus on digital economy and dramatic growth in social networking and the adoption of technologies such as cloud computing by businesses. In this talk I will begin with a brief look at current trends in the technology scenery and some of the key security issues that are impacting on business and society. In particular, I will describe the notion that I refer to as increasing threat velocity, with more and more attacks and their dynamic nature, an evolving set of bad guys with different motives and sophisticated easy to use tools readily available for ordinary users to conduct severe attacks. Hence there is a need for security professionals and researchers to rethink about cyber threats and how to respond to them. In this regard, we will examine attribution which is one of the key issues when it comes to counteracting security attacks. The unauthenticated nature of the Internet makes attribution difficult and furthermore has implications on accountability. Then the talk will focus on attacks and risks in cloud computing, where issues of security, trust and accountability are particularly significant. Cloud computing with its shared multi-tenancy environment aggravates the traditional security threats. Trust that cloud providers will provide proper security measures to counteract the security threats and ensure availability of services and data stored data become paramount. We will conclude the talk by discussing some key security technologies that are relevant for cloud services.

Authorisation systems play a vital role in protecting access to resources in distributed systems. Traditionally, authorisation is performed at the user level to determine whether a user has the necessary privileges to access a requested resource. However, when it comes to the user's platform, it is often assumed that the system hosting the user and the software running on it are 'trusted' and that it will behave correctly. In this paper, we propose a hybrid trust model that provides techniques for authorisation taking into account state of user platforms leveraging trusted computing technology. The model encompasses the notions of 'hard' and 'soft' trust to determine whether a platform can be trusted for authorisation. We first explain the rationale for the model and then provide a description of the proposed hybrid model.

Today most of the desktops, laptops are being shipped with the TPM and Virtualisation technology is widely being deployed. On the other hand, we are witnessing an increasing number of zero day attacks. Our analysis confirms that Local Area Networks are highly vulnerable to such attacks since there is free communication between the hosts in the LAN. A single compromised host can severely degrade the services in the traditional LAN and it is extremely difficult task for the security administrator to determine the compromised host that is generating attack traffic. In this paper we propose techniques to enhance the security in traditional LAN by making use of the trusted computing and virtualisation technologies. Often virtualisation is considered as a technology which enables to run multiple computers on a single server. We will show that virtualisation technology has significant benefits even if a single virtual machine is hosted on each VMM. Our model enables the security administrator to enforce security policies on the traffic that can be placed on the LAN medium. Hence our model efficiently deals with the attack at the VMM that is hosting the compromised virtual machine. The security can be enhanced furthermore by using the TPM technology to secure the virtualized local area networks. We will also present detail analysis of different cases scenarios on how the proposed model can enhance the security of the local area networks. There are several advantages with our model. Emerging attacks such as Conficker remain dormant in our proposed architecture in order to avoid detection. Hence our model can transform the highly vulnerable traditional LANs into trust enhanced and secure virtualized local area networks.

In recent times, there has been increasing interest in storing data securely in the cloud environment. To provide owners of data stored in the cloud with flexible control over access to their data by other users, we propose a role-based encryption (RBE) scheme for secure cloud storage. Our scheme allows the owner of data to store it in an encrypted form in the cloud and to grant access to that data for users with specific roles. The scheme specifies a set of roles to which the users are assigned, with each role having a set of permissions. The data owner can encrypt the data and store it in the cloud in such a way that only users with specific roles can decrypt the data. Anyone else, including the cloud providers themselves, will not be able to decrypt the data. We describe such an RBE scheme using a broadcast encryption algorithm. The paper describes the security analysis of the proposed scheme and gives proofs showing that the proposed scheme is secure against attacks. We also analyse the efficiency and performance of our scheme and show that it has superior characteristics compared with other previously published schemes.

Broadcasting a request or challenge is a classic method of collecting local information in distributed wireless networks. Neighbor discovery is known to be a fundamental element in ad hoc and sensor networks topology formation, which takes advantage of such methods. Most of the current neighbor discovery protocols rely on a challenge or request broadcast by the discovering node called “Hello.” Hello flooding attack was specifically designed to exploit the broadcasting nature of these protocols in order to convince a large group of nodes that the sender is their neighbor by using very high transmission power. Several studies have been done to mitigate the effectiveness of the flooding threats but little effort has been made in modeling and analyzing this problem. Arguing that random channel access protocols must be inevitably employed in neighbor discovery, we propose an analytical approach for stochastic modeling of the challenge-broadcasting scenarios in networks using slotted carrier sense multiple access with collision avoidance (CSMA/CA) protocols. We model the nonstationary channel right after issuance of the request by a recursive method and then put forward an approach to find the broadcaster's approximate payoff. The model also supports the cases where the broadcaster is a malicious node with an abnormally high transmission and reception range, which is found in severe flooding attacks. We investigate the applications of the model in finding the optimal attack range for the flooding adversaries and deriving a flood-resilient medium access control (MAC) protocol design framework to increase the security of challenge-response protocols. The latter one is especially relevant to mobile networks as it provides a low-cost solution. This paper describes the detailed analysis of the proposed theoretical framework as well as the comprehensive evaluations that have been carried out via simulations.

Binary attestation in trusted computing platforms provide the ability to reason about the state of a system using hash measurements. Property based attestation on the other hand enables more meaningful attestation by abstracting low level binary values to high level security properties or functions of systems. In this paper, we try to understand the kind of security properties that trusted platforms can attest. We propose that security properties can have different levels of granularity and provide a pyramid model that classifies properties at four different levels. We leverage the Common Criteria framework for security requirements to provide examples of such properties. The model is then implemented in the context of authorisation for Web services.

A trusted virtual domain (TVD) enables grouping of related virtual machines running on separate physical machine into a single network domain with a unified security policy. Since the virtual machines can be running different operating systems and applications, the attacker can generate attacks in the TVD by exploiting a single vulnerability in any of the operating systems or applications. Our aim in this paper is to consider the design choices and develop an intrusion detection architecture that would enable efficient detection and prevention of different types of attacks in such a TVD based distributed environments. The proposed architecture can capture the knowledge of the operating systems and applications at fine granular level and isolate the malicious entities that are generating the attack traffic. Our model takes into account the security policies that are specific to the virtual machine as well as security policies of the trusted virtual domains to deal with the attacks efficiently.

In this paper, we present a trust establishment and management framework for hierarchical wireless sensor networks. The wireless sensor network architecture we consider consists of a collection of sensor nodes, cluster heads and a base station arranged hierarchically. The framework encompasses schemes for establishing and managing trust between these different entities. We demonstrate that the proposed framework helps to minimize the memory, computation and communication overheads involved in trust management in wireless sensor networks. Our framework takes into account direct and indirect (group) trust in trust evaluation as well as the energy associated with sensor nodes in service selection. It also considers the dynamic aspect of trust by introducing a trust varying function which could be adjusted to give greater weight to the most recently obtained trust values in the trust calculation. The architecture also has the ability to deal with the inter-cluster movement of sensor nodes using a combination of certificate based trust and behaviour based trust.

Security and trust are fundamental challenges when it comes to the deployment of large wireless sensor networks. In this paper, we propose a novel hierarchical trust management scheme that minimizes communication and storage overheads. Our scheme takes into account direct and indirect (group) trust in trust evaluation as well as the energy associated with sensor nodes in service selection. It also considers the dynamic aspect of trust by introducing a trust varying function which could give greater weight to the most recently obtained trust values in the trust calculation. The proposed framework can be extended to such dynamic mobile inter-cluster wireless sensor network environments.

Mobile ad hoc networks (MANETs) are self-organizing and adaptive, and securing such networks is non-trivial. Most security schemes suggested for MANETs tend to build upon some fundamental assumptions regarding the trustworthiness of the participating hosts and the underlying networking systems without presenting any definite scheme for trust establishment. If MANET is to achieve the same level of acceptance as traditional wired and wireless network, then a formal specification of trust and a framework for trust management must become an intrinsic part of its infrastructure. The goal of this paper is to highlight issues relating to trust in MANETs and describe a context-aware, reputation-based approach for establishing trust that assesses the trustworthiness of the participating nodes in a dynamic and uncertain MANET environment.

In this paper we propose a dynamically invoked service based access control (SBAC) model to efficiently deal with the distributed denial of service (DDoS) attacks. The main idea of the SBAC is based on the observation that if the routers have information about the services that are running on the end host and can identify the upper layer traffic from the IP packet payload, then it becomes easy to differentiate between legitimate and attack traffic for that particular victim server. To minimise the overhead on the routers, the SBAC model is invoked during the attack times only and the victimpsilas traffic is processed separately. The boundary routers in SBAC model validate each incoming packet to the victim on a per server basis. Only the packets that are considered to be accessing the legitimate services are passed and the remaining packets are dropped. Hence, at this stage the victimpsilas network is immune to any dynamic changes in attack pattern if the attack packets are not accessing the legitimate services at the victim end. The packets that are considered to be accessing legitimate services of the victim machine/network are marked with a unique ID and destined to the victim. If any of the received packets are found to be malicious, the unique ID enables the victim to identify service specific attack signature for each ingress SBAC router and prevent the attack traffic at that particular router. We will also discuss how the SBAC model deals with attacks on the infrastructure of the autonomous system.

Trusted computing attestation mechanism relies on hash measurements to realize remote party attestation in distributed systems. Property based attestation enables more meaningful attestation by abstracting low level binary values to high level security properties or functions of systems. The contribution of this paper is two fold. In the first part of the paper, we provide an analysis of the different types of property based attestation mechanisms that have been proposed in the recent years. We categorize these mechanisms as derivation based, delegation based and enforcement based and analyze each of them with a particular focus on their limitations. In the second part, we provide a list of challenges for property based attestation. We believe this to be an useful exercise to help better understand the issues that limit the practical applicability of property based attestation in real world systems.

In these uncertain economic times, two key ingredients which are in short supply are trust and confidence. The concept of trust has been around for many decades (if not for centuries) in different disciplines such as business, psychology, philosophy as well as in security technology. The current financial climate gives a particularly prescient example. As financial journalist Walter Bagehot wrote some 135 years ago, "after a great calamity, everybody is suspicious of everybody" and "credit, the disposition of one man to trust another, is singularly varying." The problem, as Bagehot observed it, was trust, or rather the lack of it, and it's as true today as it was in his time. Financial mechanisms aren't the only entities that must deal with trust--today's social networking communities such as Facebook, Wikipedia, and other online communities have to constantly reconcile trust issues, from searching and locating credible information, to conveying and protecting personal information. Furthermore with ever increasing reliance on digital economy, most business and government activities today depend on networked information systems for their operations. In this talk, we'll take a short journey through the concept and evolution of trust in the secure computing technology world, and examine some of the challenges involved in trusted computing today.

Wireless sensor networks (WSN) are ad-hoc mobile networks in which the sensors have limited resources and communication capabilities. Secure communications in some wireless sensor networks are critical. Recently, several secure schemes for wireless sensor networks have been proposed. Localized combinatorial keying (LOCK) proposed by Mohamed Eltoweissy is secure wireless sensor network scheme based on the dynamical key management. In this paper, we present a new wireless sensor network security scheme. Our scheme is based on LOCK scheme and employees ID-based secure group key management. Our scheme have several advantages over the existing LOCK scheme. This scheme improves the wireless sensor network system security. It minimizes the number of key storage requirement and the number of the communication messages for rekeying. In addition, one unique advantage is that it does not affect any other nodes when evicting compromised node or moving the node from one location to another.

In this paper, we propose a novel approach for Web search based on the statistical information of local setting data of web browsers in a community. The members of the community share their local setting data of browsers and this enables them to take advantage of the peer community members's opinions in their Web search. Then we develop a new scheme that combines PageRank's link-based ranking scores with our proposed community based popularity scores for web sites. This hybrid scheme provides a rank- ordering method for search query results that integrates the content consumers' opinions with the content producers' opinions in a balanced manner. The users' opinions of web sites provide a solid starting point of trust for combatting web spam and improving the quality of Web search.

In this paper, we propose a comprehensive trust management approach for Web services that covers the analysis/modelling of trust relationships and the development of trust management layer in a consistent manner. The specific characteristics of trust relationships in Web services are discussed. We introduce a separated trust management layer for Web services that can hold computing components for trust management tasks. A trust management architecture for Web services is proposed for building up the trust management layer. The proposed trust management architecture for Web services deals with trust requirements, trust evaluation, and trust consumption in Web services under a unified umbrella and it provides a solid foundation upon which may evolve the trust management layer for Web services.

In last five years, several trust models have been proposed to enhance the security of Mobile Ad hoc Networks (MANET). Nevertheless, these trust models fail to express the notion of ignorance during the establishment of trust relationships between mobile nodes. Furthermore, they lack a well-defined approach to defend against the issues resulting from recommendations. In this paper, we propose a novel subjective logic based trust model that enables mobile nodes to explicitly represent and manage ignorance as uncertainty during the establishment of trust relationships with other nodes. Our model defines additional operators to subjective logic in order to address the ignorance introduced between mobile nodes (which have already established trust relationships) as a result of mobility-induced separation. Second, we demonstrate on how mobile nodes formulate their opinions for other nodes based on the evidence collected from the benign and malicious behaviors of those nodes. We then describe on how mobile nodes establish trust relationships with other nodes using the opinions held for those nodes. Depending on the policies defined, these relationships are then used by our model to enhance the security of mobile communications. Third, we propose a novel approach to communicate recommendations by which no explicit packets or additional headers are disseminated as recommendations. This allows our model to defend against recommendation related issues such as free-riding, honest-elicitation, and recommender's bias. Finally, we demonstrate the performance of our model through NS2 simulations.

We propose a hybrid trust model for enhancing security in distributed applications by combining the "hard" and "soft" trust relationships. The motivation is to compensate for the drawbacks associated with individual hard trust and soft trust models. We develop a formal hybrid trust model for specifying the hybrid trust relationships and associated operations. The new model provides a flexible way for specifying the security relevant trust requirements which compensate the drawbacks of the individual trust models while preserving their advantages. We provide application guidelines on how the hybrid trust relationships can be applied to achieve mutual improvements between the individual models

Web services specification provides an open standard for the distributed service oriented architecture. It is widely used in Internet and pervasive networks supporting wireless mobile devices. A mobile agent is a composition of computer software and data which is able to migrate from one host to another autonomously and continue its execution on the destination host. Mobile agent technology can reduce the bandwidth requirement and tolerate the network faults - able to operate without an active connection between clients and server. Hence, the applications of the combination of mobile agents and web service have been widely investigated in recent years. However, the security issue is still of a major concern. In this paper, we propose a novel agent-based web service security scheme. This scheme provides a new authentication protocol without using the user- name/password pair, which is infeasible for mobile agent, and gives an alternative method to current security mechanism without using Certification Authorities (CA) based public key infrastructure. With this scheme, we can simplify the key management and reduce the computation particularly for group-oriented web services.

The concept of trusted computing technology is becoming significant in that such technologies are being increasingly available in PCs and mobile devices. With the advent of this technology, one can move from traditional user-only based trust management systems to user and platform-based trust management systems. In this paper, we propose a TCP based trust management and negotiation framework for better security decision making. In this regard, we outline a 3-stage property model that can be leveraged to define policies of different granularities. We then propose how Trust Policy Language (TPL) can be used to create compositions of properties. Finally, the paper discusses the different architectural design choices (such as push, pull and delegation based models) in negotiating trust using these policies and their implications in a distributed Web service based environment.

This paper proposes an authorisation architecture for web services. It describes the architectural framework, the administration and runtime aspects of our architecture and its components for secure authorisation of web services as well as the support for the management of authorisation information. The paper then describes the implementation aspects of the architecture. The architecture has been implemented and integrated within the .NET framework. The authorisation architecture for web services is demonstrated using a case study in the healthcare domain. The proposed architecture has several benefits. First and foremost, the architecture supports multiple access control models and mechanisms; it supports legacy applications exposed as web services as well as new web service-based applications built to leverage the benefits offered by the Service-Oriented Architecture; it is decentralised and distributed and provides flexible management and administration of web services and related authorisation information. The proposed architecture can be integrated into existing middleware platforms to provide enhanced security to web services deployed on those platforms.

Security measures alone are not sufficient for counteracting malicious behaviors in distributed systems. The new trend is to use economical models (mainly game-theoretic models) to characterize such malicious behaviors in the security context with the aim to mitigate the risk introduced by such malicious behaviors. However, there is a general lack in the integration of risk and security and this hinders the effectiveness of these existing economical models when applied in the security context for distributed systems. Recently, utility has become an important consideration for information security. We show that the decisions by security mechanisms, such as the authorization decisions in a distributed system can have a direct impact on the utility of the underlying system. However there is little work done on utility maximization when designing secure distributed systems. To address this gap, we present in this paper a new approach through integrating risk management into security with the help of a trust model. Furthermore, we show that the proposed trust based security model with risk management can be applied to maximize the utility of the underlying distributed systems. The new model possesses a unique feature - the ability to use trust evaluation to not only "weed out" malicious entities, but also allocate appropriate access permissions to the benevolent entities according to the risk levels. Using a mobile agent system as an example, we study the properties of the proposed model through simulation and present the experimental results which confirm the mew feature of the proposal.

The mobile agent computing model violates some of the fundamental assumptions of conventional security techniques. Consequently, this has rendered many of the existing conventional security countermeasures less effective for mobile agents. In this paper, we propose a new philosophy of trust enhanced security, which advocates a paradigm shift for mobile agent security solutions: from security-centric to trust-centric with the aim of providing improved security and performance of mobile agents. We first examine the problem of uncertainty in behavior induced by the security assumption violations by mobile agents; we then propose a trust enhanced security approach and argue for the need for a paradigm shift to trust-centric solutions. Next we identify a list of general design requirements for the trust-centric solutions and outline the new architectural design which supports the new trust enhanced security philosophy in practice. Finally we discuss the emergent properties of the new architecture and introduce the experimental results for validating the properties

In this paper, we propose an obligation-based model called fellowship to mitigate the flooding and packet drop attacks. We also explain how the fellowship model identifies and penalizes both the malicious and selfish nodes respectively in mobile ad hoc networks (MANET). The main advantages of our model are: it unifies the framework to defend both flooding and packet drop attacks, it identifies and expels the malicious and selfish nodes that fail to contribute their resources, and rejoins the repenting malicious and selfish nodes into the network. In addition, our technique does not rely on any centralized authority or tamper-proof hardware

In recent years, security in MANET is anticipated as the pre-establishment of specific information among the participating nodes, so that the future communications can be secured through a newly designed protocol, which deploys cryptographic mechanisms over the pre-established information. In this paper, we suggest three dimensions to secure the communications in wireless mobile ad hoc networks. Then we demonstrate the issues that might creep out in the security design, when a cryptographic technique alone is involved. Also, we suggest how to counter those issues through the combination of trust management with cryptographic mechanisms. Moreover, we propose the need to introduce the notion of heterogeneity resource management in the security design to address the divergence among the nodes, which can be taken advantage to diminish the packet drop attacks.

Security issues are paramount in mobile ad hoc networks even more so than in wired networks. Though there have been many works in the recent years on secure routing protocols for mobile ad hoc networks still ad hoc networks are prone to specific attacks such as packet drop attacks. In this paper, we bring out the vulnerabilities and seriousness of the packet drop attacks. We propose an obligation based enforcement approach called “fellowship” to defend the packet drop attacks in mobile ad hoc networks.

XML has been becoming popular for data store, document representation and exchange over the Web. Security mechanisms for the protection of XML document sources and their distribution are essential. Author-X is a Java based system specifically conceived for the protection of XML documents. It supports a range of protection granularity levels and subject credentials, but also supports push distribution for documents broadcast. However, the proposed system has certain disadvantages in terms of both security and dynamic key management. For example, a sender has to distribute the secret keys to all correspondent users for different XML documents. Also, if one of the users leave or a credential is changed, then the sender has to re-encrypt all related documents and redistribute the secret keys to all correspondent users. In this paper, we present a scheme for securing XML documents and their distribution. Our scheme has several advantages over Author-X such as: (a) one user needs only one private key; (b) even when the user leaves or a credential is changed, all the other users will be unaffected; (c) there is no need to establish a secure channel for key distribution; and (d) there is no need for checking the XML documents for access control policies applied. These make the security model more efficient and robust as well as simplifying the programming and the generation of the encrypted document base.

We propose modifications to the automated model to counteract TCP SYN distributed denial of service (DDoS) attacks nearest to the attacking source and also discuss the prototype implementation of our technique. It should be noted that we do not solve the TCP SYN problem, but we enable the victim to differentiate between the traffic originating from good and bad network domains, trace the router that is nearest to the attacking source with a single packet, even if the source address of the packet is spoofed, and prevent the attack traffic at the router which is nearest to the attacking source. Since our model is invoked only during attack times, it has much less overhead, and the main advantage of this technique is that the victim can provide better service for traffic originating from good network domains and completely eliminate or provide limited service for the traffic originating from the bad network domain.

We propose an approach to channel key management in the architecture S-SSM, we designed to secure SSM communication. S-SSM defines two mechanisms for access control and content protection. The first one is carried out through subscriber authentication and access permission. The second is realized through the management of a unique key, called the channel key, k/sub ch/, shared among the sender and subscribers. The management of k/sub ch/ is based on a novel distributed encryption scheme that enables an entity to efficiently add and remove a subscriber without affecting other subscribers.

In this paper, we introduce the authorization issues for Web Services. We introduce the authorization service provided by Microsoft/spl reg/ .NET MyServices and then briefly describe our proposed modifications and extensions to the authorization service. We discuss the application of the extended authorization model to a healthcare system built using Web Services. We used the XML access control language (XACL) to specify policies in XML and control access to the patient records stored in XML format. We then evaluated the suitability of XACL as an authorization policy language for Web Services.

Existing routing algorithms treat quality of service (QoS) parameters and secure routing as completely separate entities requiring separate algorithms. In this paper we propose secure QoS distance vector and secure Bellman-Ford-Moore routing algorithms that meet QoS requirements and satisfy security concerns. Security is achieved by placing filters in the network. The routing algorithms generate routes through these filters to meet the specified QoS requirements. Simulation results indicate that secure QoS distance vector algorithm performs the better of the two algorithms. Moreover, the density of filters and the placement strategy of filters affect the length of the route generated.

More and more applications are relying on underlying IP multicast facility to disseminate information to several receivers simultaneously with minimum overheads. These include real time applications such as video conferencing and Internet audio as well as non real time services. Concurrently, there is a paradigm shift from wired to wireless communication. As portable computers proliferate, networks rely on a limited number of stationary hosts and aim to provide seamless connectivity to mobile hosts. Hence, there is an urgent need to integrate these two facilities together. However, there are serious security concerns that need to be addressed before one can exploit this combined facility. Security issues in multicasting such as dynamic group management are further aggravated due in the mobile environment. In this paper, we describe the security issues in multicasting and propose a secure multicast framework for Mobile IP.

Web services via wireless technologies, mobile services (M-services), HTTP, and XML have become important for conducting business. W3C XML Protocol Working Group has been developing standard techniques such as Web Services Description Language (WSDL), simple object access protocol (SOAP), universal description discovery and integration (UDDI). However, at this stage, there is no standard technique for access control in M-services. This paper describes a secure and flexible access control scheme and protocol for M-services based on role based access control (RBAC). The access control architecture involves a Trusted Credential Center (TCC), a Trusted Authentication and Registration Center (TARC) and a secure ticket based mechanism for service access. Users and service providers register with the TARC and are authenticated. Based on this, tickets are issued by the TCC to users. Tickets carry authorization information needed for the requested services. In particular, we are able to specify access control polices based on roles. The protocols between the various entities in the model are protected using appropriate security mechanisms such as signatures which are used to verify correctness of the requested service, as well as to direct billing information to the appropriate user. Our architecture supports efficient authentication of users and service providers over different domains and provides a secure access model for services to users. Our model is also able to support anonymity of users. Only the TARC is able to identify misbehaving users. We believe that the proposed architecture forms a good basis for achieving a secure and flexible M-service system.

With the increasing growth in mobile computing devices and wireless networks, users are able to access information from anywhere and at anytime. In such situations, the issues of location management for mobile hosts are becoming increasingly significant. Different location management schemes such as Columbia University's mobile IP scheme and IETF mobile IP have been proposed. In this paper, we propose a new distributed location management scheme and discuss the advantages of the proposed scheme over the others. The paper then considers the issues of multicasting in the proposed architecture.

The paper describes the design of a model as well as an architecture to provide support for distributed advanced workflow transactions. We discuss the application of transaction concepts to activities that involve integrated execution of multiple tasks over different processes. This kind of application is described as transactional workflow. The classical commit protocol, used in many commercial systems, is not suitable for use in multilevel secure distributed workflow database systems that use a locking protocol for concurrency control. The reason is that it is not possible for a locking protocol to guarantee that read locks won't be released by a subtransaction during its window of uncertainty-the period after a participant has voted yes to commit, but before it receives the commit or abort decision from the coordinator, possibly resulting in nonserializable executions. A distinguishing feature of the proposed workflow transaction support system is the ability to manage the arbitrary distribution of business processes over multiple workflow management systems.

With the increasing growth in mobile computing devices and wireless networks, users are able to access information from anywhere and at anytime. In such situations, the issues of location management for mobile hosts are becoming increasingly significant. Different location management schemes such as Columbia University's mobile IP scheme and IETF Mobile IP have been proposed. In this paper, we propose a distributed location management scheme and discuss the advantages of the proposed scheme over the others. It seems that the proposed scheme is easy to implement and achieves optimal routing. The paper then considers the issues of multicasting in the proposed scheme. Finally, the paper describes security protocols for authentication and data privacy for the proposed architecture.

This paper proposes a fair electronic gambling scheme for the Internet. The proposed scheme provides a unique link between payment and gambling outcome so that the winner can be ensured to get the payment. Since an optimal fair exchange method is used in gambling message exchange the proposed system guarantees that no one can successfully cheat during a gambling process. Our system requires an off-line Trusted Third Party (TTP). If a cheating occurs, the TTP can resolve the problem and make the gambling process fair.

This paper describes a security model for mobile agent based systems.The model defines the notion of a security-enhanced agent and outlines security management components in agent platform bases and considers secure migration of agents from one base to another.The security enhanced agent carries a passport that contains its security credentials and some related security code.Then we describe how authentication, integrity and confidentiality, and access control are achieved using the agent's passport and the security infrastructure in the agent bases.We also consider the types of access control policies that can be specified using the security enhanced agents and the policy base in the agent platforms.We discuss the application of the security model in roaming mobile agents and consider a simple scenario involving security auditing in networks.

There has been a considerable interest shown in the area of mobility. With the advent of powerful portable devices such as laptop and palmtop there is a growing trend amongst users to go the nomadic way. This implies that a user can get access to any service at any time without any interruption. Such nomadic computing poses several challenges in multicasting and security. We first consider a framework that has been proposed by Acharya, Bakre and Badrinath (see Rutgers DCS TechReport LCS R-TR 243, 1995) for multicasting in mobile IP networks. We extend this framework to support a secure multicasting service. We describe secure schemes for a mobile host to initiate, join and leave a multicast group. We also discuss the secure movement of mobile hosts in intra and inter campus environments.

We propose two new anonymous secure electronic voting schemes that protect the privacy of the voters and prevent double voting. These schemes do not require any special voting channel and the communications can occur entirely over existing networks such as the Internet. The proposed schemes are based on the ElGamal digital signature algorithm and can be applied to elections in a variety of situations ranging from an election in a small organization to a country.

Asynchronous transfer mode (ATM) is seen to be a technology that allows flexibility, efficiency and manageable bandwidth on demand to be achieved in high-speed networks. ATM is able to support a variety of applications, including voice, video, image and data, with different quality-of-service (QoS) requirements. This paper addresses the design of security services in ATM networks. It considers the placement of a security layer between the ATM adaptation layer (AAL) and the ATM layer that provides confidentiality, integrity and data origin authentication in the user plane. The paper then considers secure signaling and describes a public key-based authentication and key management protocol that can be integrated as part of secure call setup. This protocol is part of an overall public key infrastructure framework for ATM networks. Finally, the paper discusses the issues involved in the provision of an access control service at the connection setup phase and the user data transfer phase.

As companies migrate from a centralized to a distributed computing environment, the administration and management of security policies, in particular authorization policies, is becoming an increasingly difficult task. The paper considers the design of an authorization system that is suitable for distributed applications. It discusses the architectural design principles, describes the constructs of the authorization policy language and outlines the authorization service and components involved. The paper gives some example policy specifications and illustrates how privileges are specified and evaluated, as well as how privilege resolutions are achieved.

The paper describes a new credit card system, which presents a promise for us to develop a new method of protecting secret information, such as credit card number, PIN and identification. Our credit cards are anonymous. That is, the identity of a card holder and credit card information are not revealed during a payment process. One important feature of our system lies in the fact that, unlike normal electronic credit based systems such as SET, iKP and NetCard, the involvement of the online financial institution that runs the payment system is reduced to a minimum.

Proposes two novel cash-based micropayment schemes based on a new technique referred to as the double-locked hash chain technique. Both schemes support the divisibility and transferability of digital coins in a simpler way compared to the existing solutions. The basic scheme allows full or partial use of a coin chain in a transaction; if only part of a coin chain has been used with one vendor, the rest of the chain can be used, for instance in a subsequent transaction with another vendor. The modified scheme extends this to multiple chains, making the scheme particularly suitable for a large number of micropayment transactions.

Current off-line electronic cash systems require a great number of complex online computations by clients during the payment phase. In this paper, we propose a new off-line anonymous cash scheme that greatly reduces the number of online computations that need to be done by the clients for each payment transaction. In particular, except for the first coin in a transaction, the client only needs to perform minimal computations for the remaining coins in the transaction. Our scheme also provides unconditional client anonymity and is able to detect double-spending and is resistant to coin forgery and framing attacks.

In a multi-user information-sharing system, an authorization policy provides the ability to limit and control access to system, applications and information. In the real world, an authorization policy has temporal properties. That is, it needs to be updated to capture the changing requirements of applications, systems and users. These updates are implemented via transformations of the authorization policies. In this paper, we propose a logic-based approach to specify and to reason about state transformations in authorization policies. An authorization policy is specified using a policy base which comprises a finite set of facts and access constraints. We define the structure of the policy transformation and employ a model-based semantics to perform the transformation under the principle of minimal change. Furthermore, we extend the model-based semantics by introducing preference ordering to resolve possible conflicts during the transformation of policies. We also discuss the implementation of the model-based transformation approach and outline the relevant algorithms.

The paper addresses the design of security services for ATM networks. First various options for the placement of security services within the ATM protocol stack are outlined. Then a security layer between the AAL and ATM layer is considered. The proposed security layer provides confidentiality, integrity and data origin authentication in the user plane. The paper then presents an authentication scheme and a key establishment protocol. This protocol is integrated with the existing ATM signaling protocol, as part of the call setup procedures. The authors also consider the design of protocols between ATM nodes and Certification Authority for initializing retrieving and distributing public key certificates. The developed security design can be transparently integrated into the B-ISDN Protocol Reference Model without violating the existing standards.

Authentication is a key requirement in the establishment of secure interactions between network entities. Several authentication and key establishment protocols have been proposed in recent years. Most of these protocols were designed for an intra-domain environment (i.e. one where the communicating parties reside in a single domain) and then extrapolated to the inter-domain environment. In this paper, the design of inter-domain protocols is investigated. We present the different design choices that need to be carefully considered when designing inter-domain protocols in large distributed systems. We propose three different inter-domain protocols with varying degrees of responsibility placed on the client and the trusted servers. In each case, the assumptions made in the design are explicitly stated. This helps to illustrate the rationale behind the choices made. The proposed protocols use symmetric key systems and are based on Kerberos. The arguments, rationales and designs presented in this paper are also applicable to OSF's Distributed Computing Environment (DCE).

Considers the design of secure electronic credit card based payment schemes for the Internet, and reveals some of the issues that have not been adequately addressed in the proposed protocols to date. This paper proposes additional mechanisms that need to be incorporated as part of the design phase of the scheme to deal efficiently with the disputes that can arise. The design methods described in this paper are applicable to a range of protocols, including iKP (Internet Kaufmannisch Protokoll), STT (Secure Transaction Technology) and SEPP (Secure Electronic Payment Protocol). Based on this discussion, the paper goes on to propose an improved payment scheme and protocol. The new protocol, referred to as the permission-based payment (PBP) protocol, provides a fair treatment of both the client and the merchant involved in the transaction. It separates the purchase request phase from the payment phase, thereby increasing the ability to handle certain class of disputes more efficiently. It removes the need to store the secret private key at the client's machine or the need for a smart card device. This is important as one cannot assume that all the clients connected to the Internet have smart card readers attached to them. The new protocol makes simpler assumptions about the environment, thereby making the scheme practical for securing commercial electronic credit card transactions.

There is a growing interest in the development of broadband services and networks for commercial use in both local area and wide area networks. In particular, connectionless switched multimegabit data service (SMDS) and connection-oriented frame relay based broadband services an being offered by a number of major operators in the US and Europe. This paper considers the issues that need to be addressed in the design of security services for such high speed networks. First the relevant characteristics of broadband network interfaces an discussed, some of the existing security protocols for TCP/IP and OSI networks are reviewed, and their suitability for providing security in broadband networks assessed. Then the developed arguments are applied to design security services for the connectionless SMDS and the connection-oriented frame relay networks.

The paper considers an access control model and proposes extensions to it to deal with authentication and revocation. The model is then applied to represent access control policy in a mental health system. In the first part of the paper, extensions to the schematic protection model (SPM) are presented. The authentication and revocation extensions are independent of one another in the sense that each one affects a different part of the decision algorithm. The extensions comprise a modification of the syntax to be able to represent the new concepts and, more importantly, a modification of the decision algorithm for the safety problem to take these changes into account. We introduce the concept of conditional tickets and use it to provide authentication. Apart from this, we have found this concept to be useful in modeling systems. Hence we have separated this (syntactical) issue from the definition of the new algorithm. The second part considers the access policy for a mental health application. We have used the extensions of SPM to model part of this access policy. Even with our extensions, SPM still remains a monotonic model, where rights can be removed only in very special cases, and this makes it impossible to represent all the aspects of the problem. Other than to serve as an example for the extensions we propose, the paper also helps to separate aspects of this access control policy which are inherently monotonic from parts which are defined in a non-monotonic way, but can still be represented in a monotonic model.

The Schematic Protection Model, SPM, allows us to specify the protection structure of a system and gives an algorithm to reason about the transmission of privileges in the system. This paper extends the SPM model to include for conditional tickets and to provide authentication. We also extend the decision algorithm of the safety problem to take into account these modifications.>

The access policy to patients' records in a mental health hospital has only a verbal specification, and many formal systems fail to represent all the aspects of this problem. This paper uses an extension of SPM, which can represent revocation and conditional tickets, to model part of this access policy. Even with our extension, SPM still remains a monotonic model, where rights can be removed only in very special cases, and this makes it impossible to represent all the aspects of the problem. Other than to serve as an example for the extensions previously proposed by the authors (1993), this paper also helps to separate aspects of this access control policy which are inherently monotonic from parts which are defined in a non-monotonic way, but can still be represented in a monotonic model.>

This papers gives a precise analysis of some of the delegation protocols described by V. Varadharajan et. al. (1991). They analysed the problem of delegation in distributed systems and proposed three delegation protocols-chained, nested and linked-based on different inter-object trust assumptions in the system. They also considered some delegation protocols for the Kerberos authentication system. The authors give an analysis of the chained, nested, and linked delegation protocols using the calculus for access control by M. Abadi et. al. (1991), and analyse the delegation protocols for Kerberos using the belief logic of R. Kaislar and V.D. Gligor (1991).>

The paper addresses some of the issues related to the problem of composing secure systems to form a composite secure system. The author uses the Petri net based on information flow security model and develops several hook-up schemes for connecting secure information flow nets. He shows that it is possible to produce security composite nets from two component secure information flow nets.>

The authors look at the problem of delegation of rights or proxy in distributed object systems. Two signature-based schemes for achieving delegation which require different inter-object trust assumptions are presented. These schemes have been instantiated using public key and secret key based cryptographic techniques. Additional trust implications which arise from these implementations are also considered. Then the authors consider the issue of revocation of delegations and propose several ways of achieving this. These solutions have been compared with the mechanism found in the Distributed System Security Architecture (M. Gasser et al., 1990). Finally, the authors consider the Kerberos authentication system (J. Steiner et al., 1988) and propose extensions to implement the delegation scheme.>

Distributed systems are vulnerable to a number of security attacks. The authors look at the security problems of object-based distributed systems, and propose a model based on labelling for multilevel security. The purpose of this model is to preserve the information flow security in a distributed object-oriented system. The authors consider the basic concepts of the object paradigm, and also the security threats to such systems. They postulate various modelling possibilities, and produce a specific set of security properties which describe a multilevel secure object model. This particular model should not be considered as a panacea, but rather should demonstrate how the various modelling decisions are reflected in an actual model.>

An extended Petri net formalism which can be used to model information flow security requirements is described. The proposed framework can be used to specify a range of security policies by making specific choices for the components of the model. It is believed that Petri nets provide an elegant way of modeling security policies in a distributed system. The ability to model concurrency, the structural generality of Petri nets, and the existence of powerful analytical techniques make the Petri-net modeling approach even more useful. Two examples are given to illustrate the use of such a model.>

Consideration is given to the development of security policy models for networks which can operate in a multilevel security environment. An outline is presented of an abstract security policy model which addresses the access control and information flow requirements in a multilevel network. The network security policy is formulated by drawing as much parallel as possible with the computer security policy. The model is defined, and the associated security requirements are given. The model is used to prove that the security conditions are not violated by the defined network operations.>