Search

A cyber-physical infrastructure system (CPIS) is a system that controls and manages critical infrastructure such as smart manufacturing, water treatment facilities, power generation, and distribution facilities. Although these CPISs focus on the security of air-gapped network environments, strict isolation from the outside network is difficult to achieve, leading to various attacks. CPISs also comprise various devices and proprietary communication protocols that are used exclusively for each domain and site. Therefore, experts have to adopt a customized strategy to enhance security in CPIS networks after analyzing each domain, device, and protocol in advance. These methods require a significant amount of time, cost, and manpower; consequently, they are difficult to apply existing security methods in the real field. As a solution, a method is proposed herein that includes the following: 1) inferencing the CPIS protocol format and field semantics based on the characteristics of CPIS networks and protocols; 2) multilevel anomaly detection based on the meaning and values of each inferred field. The proposed method does not require knowledge of each site and protocol. In addition, the inference method can be used to analyze the payload field, including the state and measurement value, as well as the header field. Finally, we validate the proposed technique using an open-source CPIS network dataset including response injection, command injection, denial-of-service, and reconnaissance attacks. In addition, in the aspect of detection efficiency, the proposed technique exhibits comparable performance to that of existing knowledge-based anomaly detection methods.

The introduction of the cyber-physical system (CPS) into power systems has created a variety of communication requirements and functions that existing legacy systems do not support. To this end, the IEEE 1815.1 standard defines the mapping between existing distributed network protocol networks and IEC 61850 networks that reflect new requirements. However, advanced CPS cyberattacks have been reported, and in order to address cyberattacks, security research on new power systems that use network devices and heterogeneous communication is necessary. In this study, we propose an intrusion detection system for an IEEE 1815.1-based power system using CPS. We 1) analyze an IEEE 1815.1-based power system network and propose a suitable application method for an intrusion detection system, 2) suggest a bidirectional recurrent neural network-based anomaly detection system for an IEEE 1815.1-based network, and 3) demonstrate the verification of the proposed technique using various power system-specific attack data, including real power system using CPS network traffic, CPS malware behavior (CMB), false data injection (FDI), and disabling reassembly (DR) attacks. Proposed technique successfully detected five types of CMB attacks, three types of FDI and DR attacks.

Vehicle systems have been one of the fastest-growing fields in recent years. Vehicles are extremely helpful for understanding driver behaviors and have received significant attention from a forensic perspective. Extensive forensic research was previously conducted on on-board vehicle systems, such as an event data recorders, located in the electronic control unit or manufacturer-based infotainment systems. However, unlike previous vehicles that used only manufacturer-based infotainment systems, most vehicles today are equipped with infotainment systems such as Android Auto and Apple CarPlay. These in-vehicle infotainment (IVI) systems connect to mobile devices such as smartphones and tablets. The vehicle can periodically communicate with a smartphone and thus a network outside the vehicle. Drivers can use more services in their vehicles than ever before. Accordingly, an increasing number of diverse data are being stored in vehicles, with mobile devices connected to both the vehicle and the cloud. Such data include information that can be of significant help to investigators in solving problems during forensic investigations. Therefore, forensics of IVI systems such as Android Auto and Apple CarPlay are becoming increasingly important. We analyzed various forensic studies conducted on Android Auto and Apple CarPlay. Most of the research was mainly focused on mobile devices connected through a wired USB connection. The use of wireless-based IVI systems has recently been increasing. However, the analysis of Android Auto and Apple CarPlay from this point of view is insufficient. Therefore, we proposed a forensic methodology that fully considers such limitations. A forensic analysis was conducted on various IVI systems. We also developed an IVI system forensics tool that works based on the proposed methodology.

The Android platform accounts for 85% of the global smartphone operating-system market share, and recently, it has also been installed on Internet-of-Things (IoT) devices such as wearable devices and vehicles. These Android-based devices store various personal information such as user IDs, addresses, and payment information and device usage data when providing convenient functions to users. Insufficient security for the management and deletion of data stored in the device can lead to various cyber security threats such as personal information leakage and identity theft. Therefore, research on the protection of personal information stored in the device is very important. However, there is a limitation that the current research for protection of personal information on the existing Android platform was only conducted on Android platform 6 or lower. In this paper, we analyze the deleted data remaining on the device and the possibility of recovery to improve user privacy for smartphones using Android platforms 9 and 10. The deleted data analysis is performed based on three data deletion scenarios: data deletion using the app’s own function, data deletion using the system app’s data and cache deletion function, and uninstallation of installed apps. It demonstrates the potential user privacy problems that can occur when using Android platforms 9 and 10 due to the leakage of recovered data. It also highlights the need for improving the security of personal user information by erasing the traces of deleted data that remain in the journal area and directory entry area of the filesystem used in Android platforms 9 and 10.

Through the active development of industrial internet of things (IIoT) technology, there has been a rapid increase in the number of different industrial wireless sensor networks (IWSNs). Accordingly, the security of IWSNs is also of importance, as many security problems related to IWSN protocols have been raised and various studies have been conducted to solve these problems. However, the provisioning process is the first step in introducing a new device into the IIoT network and a starting point for IIoT security. Therefore, leakage of security information in the provisioning process makes exposure of secret keys and all subsequent security measures meaningless. In addition, using the exploited secret keys, the attacker can send false command to the node or send false data to the network manager and it can cause serious damage to industrial infrastructure depending on the IWSN. Nevertheless, a security study on the provisioning process has not been actively carried out, resulting in a provisioning process without guaranteed security. Therefore, in this paper, we analyzed security issues of the provisioning process in IWSN by researching prominent IWSN standards, including ISA 100.11a, WirelessHART, and Zigbee, and also an ISA 100.11a-certified device and provisioning process-related studies. Then, we verified the security issues of the provisioning process through testing and analyzing the provisioning process using the ISA 100.11a standard-implemented devices and ISA 100.11a-certified devices. Finally, we discuss security considerations and the direction of future research on provisioning security for IWSN in the IIoT era.

Nowadays, with wireless sensor networks (WSNs) being widely applied to diverse applications, heterogeneous sensor networks (HSNs), which can simultaneously support multiple sensing tasks in a common sensor field, are being considered as the general form of WSN system deployment. In HSNs, each application generates data packets with a different size, thereby resulting in fairness issues in terms of the network performance. In this paper, we present the design and performance evaluation of a differentiated channel access scheme (abbreviated to DiffCA) to resolve the fairness problem in HSNs. DiffCA achieves fair performance among the application groups by providing each node with an additional backoff counter, whose value varies according to the size of the packets. A mathematical model based on the discrete time Markov chain is presented and is analyzed to measure the performance of DiffCA. The numerical results show that the performance degradation of disadvantaged application groups can be effectively compensated for by DiffCA. Simulation results are given to verify the accuracy of the numerical model.

Mobility of sensor node in Wireless Sensor Networks (WSN) brings security issues such as re-authentication and tracing the node movement. However, current security researches on WSN are insufficient to support such environments since their designs only considered the static environments. In this paper, we propose the efficient node authentication and key exchange protocol that reduces the overhead in node re-authentication and also provides untraceability of mobile nodes. Compared with previous protocols, our protocol has only a third of communication and computational overhead. We expect our protocol to be the efficient solution that increases the lifetime of sensor network.

This paper suggests an obstacle avoidance scheme that enables a group of micro-UAV (Unmanned Aerial Vehicles) to avoid colliding with an obstacle that is found in the course of the flight. This scheme considers a method for UAVs to avoid colliding with such obstacles and a plan of action for when the UAVs in the group lose connectivity during flight. The main goal is for UAVs to reach the target without colliding with any obstacles. To achieve this goal, directly after the UAVs avoid the obstacle at a raised altitude above it, they fly at a higher altitude for a while and then descend to their original height. When this approach is judged to be inefficient because the height of the obstacle is too high, the UAVs divide into two groups and move to either side of it while continuing to fly at the same altitude, thereby avoiding the obstacle. Afterwards, they gather into one group again. We verify the proposed scheme and do the performance evaluation by ns-2.

Since hash functions are cryptography's most widely used primitives, efficient hardware implementation of hash functions is of critical importance. The proposed high performance hardware implementation of the hash functions used sponge construction which generates desired length digest, considering two key design metrics: throughput and power consumption. Firstly, this paper introduces unfolding transformation which increases the throughput of hash function and pipelining and parallelism design techniques which reduce the delay. Secondly, we propose a frequency trade-off technique which can give us a scope of frequency value for making a trade-off between low dynamic power consumption and high throughput. Finally, we use load-enable based clock gating scheme to eliminate wasted toggle rate of signals in the idle mode of hash encryption system. We demonstrated the proposed design techniques by using 45 nm CMOS technology at 10 MHz. The results show that we can achieve up to 47.97 times higher throughput, 6.31% delay reduction, and 13.65% dynamic power reduction.

The rapid growth in the use of smartphones and tablets has changed the software distribution ecosystem. The trend today is to purchase software through application stores rather than from traditional offline markets. Smartphone and tablet users can install applications easily by purchasing from the online store deployed in their device. Several systems, such as Android or PC-based OS units, allow users to install software from multiple sources. Such openness, however, can promote serious threats, including malware and illegal usage. In order to prevent such threats, several stores use online authentication techniques. These methods can, however, also present a problem whereby even licensed users cannot use their purchased application. In this paper, we discuss these issues and provide an authentication method that will make purchased applications available to the registered user at all times.

A smart grid is a large, consolidated electrical grid system that includes heterogeneous networks and systems. Based on the data, a smart grid system has a potential security threat in its network connectivity. To solve this problem, we develop and apply a novel scheme to measure the vulnerability in a smart grid domain. Vulnerability quantification can be the first step in security analysis because it can help prioritize the security problems. However, existing vulnerability quantification schemes are not suitable for smart grid because they do not consider network vulnerabilities. We propose a novel attack route-based vulnerability quantification scheme using a network vulnerability score and an end-to-end security score, depending on the specific smart grid network environment to calculate the vulnerability score for a particular attack route. To evaluate the proposed approach, we derive several attack scenarios from the advanced metering infrastructure domain. The experimental results of the proposed approach and the existing common vulnerability scoring system clearly show that we need to consider network connectivity for more optimized vulnerability quantification.

In this paper, a data aggregation gateway framework (DA-GW) for constrained application protocol (CoAP) group communications is proposed. The DA-GW framework is designed to improve the throughput performance and energy efficiency of group communication to monitor and control multiple sensor devices collectively with a single user terminal. The DA-GW consists of four function blocks—the message analyzer, group manager, message scheduler and data handler—and three informative databases—the client database, resource database and information database. The DA-GW performs group management and group communication through each functional block and stores resources in the informative databases. The DA-GW employs international standard-based data structures and provides the interoperability of heterogeneous devices used in various applications. The DA-GW is implemented using a Java-based open source framework called jCoAP to evaluate the functions and performance of the DA-GW. The experiment results showed that the DA-GW framework revealed better performance than existing group communication methods in terms of throughput and energy consumption.

Of the range of wireless communication technologies, wireless sensor networks (WSN) will be one of the most appropriate technologies for the Microgrid and Grid-enabled Vehicles in the Smartgrid. To ensure the security of WSN, the detection of attacks is more efficient than their prevention because of the lack of computing power. Malicious packet drops are the easiest means of attacking WSNs. Thus, the sensors used for constructing a WSN require a packet drop monitoring agent, such as Watchdog. However, Watchdog has a partial drop problem such that an attacker can manipulate the packet dropping rate below the minimum misbehaviour monitoring threshold. Furthermore, Watchdog does not consider real traffic situations, such as congestion and collision, and so it has no way of recognizing whether a packet drop is due to a real attack or network congestion. In this paper, we propose a malicious packet drop monitoring agent, which considers traffic conditions. We used the actual traffic volume on neighbouring nodes and the drop rate while monitoring a sending node for specific period. It is more effective in real network scenarios because unlike Watchdog it considers the actual traffic, which only uses the Pathrater. Moreover, our proposed method does not require authentication, packet encryption or detection packets. Thus, there is a lower likelihood of detection failure due to packet spoofing, Man-In-the Middle attacks or Wormhole attacks. To test the suitability of our proposed concept for a series of network scenarios, we divided the simulations into three types: one attack node, more than one attack nodes and no attack nodes. The results of the simulations meet our expectations.

Directional antennas have the considerable benefits of higher antenna gain, long transmission distance and spatial reuse compared to omni-antennas. To support a directional antenna, IEEE 802.15.3c specifies a high data transmission rate and short frequency range communication based on the characteristics of 60GHz band. However, the contention-based protocol of IEEE 802.15.3c may cause channel collisions and throughput degradation as the number of stations in the network increases. In order to resolve this problem and reduce channel access latency, we propose an adaptive allocation algorithm in which the contention window size for optimal transmission probability is derived after the directional information has been obtained by means of AP control procedures. Extensive simulations demonstrate that the proposed algorithm outperforms the existing channel access scheme in IEEE 802.15.3c wireless personal area networks under different situations, especially when the number of contending stations is large.

The IEEE 802.16 Working Group on Broadband Wireless Access Standards released IEEE 802.16-2004 which is a standardized technology for supporting broadband and wireless communication with fixed and nomadic access. After the IEEE 802.16-2004 standard, a new advanced and revised standard was released as the IEEE 802.16e-2005 amendment which is foundation of Mobile WiMAX network supporting handover and roaming capabilities. In the area of security aspects, compared to IEEE 802.16-2004, IEEE 802.16e, called Mobile WiMAX, adopts improved security architecture—PKMv2 which includes EAP authentication, AES-based authenticated encryption, and CMAC or HMAC message protection. However, there is no guarantee that PKMv2-based Mobile WiMAX network will not have security flaws. In this paper, we investigate the current Mobile WiMAX security architecture focusing mainly on pointing out new security vulnerabilities such as a disclosure of security context in network entry, a lack of secure communication in network domain, and a necessity of efficient handover supporting mutual authentication. Based on the investigation results, we propose a novel Mobile WiMAX security architecture, called RObust and Secure MobilE WiMAX (ROSMEX), to prevent the new security vulnerabilities.

An unmanned aerial vehicle (UAV) must be able to safely reach its destination even, when it can only gather limited information about its environment. When an obstacle is detected, the UAV must be able to choose a path that will avoid collision with the obstacle. For the collision avoidance scheme, we apply the velocity obstacle approach since it is applicable even with the UAV's limited sensing capability. To be able to apply the velocity obstacle approach, we need to know the parameter values of the obstacle such as its size, current velocity and current position. However, due to the UAV's limited sensing capability, such information about the obstacle is not available. Thus, by evaluating sensor readings, we get the changes in the possible positions of the obstacle in order to generate the velocity obstacle and make the UAV choose a collision-free trajectory towards the destination. We performed simulation on different obstacle movements and the collision-free trajectory of the UAV is shown in the simulation results. [ABSTRACT FROM AUTHOR]

Smart grid and Electric Vehicles (EVs) network is one of the typical distributed network with heterogeneous systems and they demand very robust and secure method of communication. Provision of such efficient scheme in this network is a very difficult task. From time to time EVs need to coordinate with smart grid and other entities specially Aggregators, in network for charging/Discharging purposes. For the security and integrity of this communication, a reliable and efficient authentication scheme is essential. Main problems for application of authentication schemes in such a distributed network is that if number of EVs is high, then the authentication delay becomes unbearable for customers. Also communication traffic and computational delay become large in case of peak traffic time. In order to reduce these service degrading factors, we have proposed a hybrid authentication scheme for any number of EVs based on distributed power control network. This authentication schemes constitutes the use of digital signature algorithm and batch authentication scheme. The combination of these schemes makes the aggregators in distribute network to work in different modes based on amount of traffic in the network and the application of different modes in aggregator allows lesser authentication delay and communication traffic as compared to when these two authentication schemes were used separately. In this way we achieve a novel and better strategy for secure and efficient authentication and communication in distributed power control network. [ABSTRACT FROM AUTHOR]