Search

The increasing number of edge layer devices connected to fog servers in fog computing environments has led to a rise in vulnerable and unauthorized actions. Implementing authorized access control with secure key management is essential to address this issue. As the traditional key management methods rely on third-party involvement, which suffers from drawbacks such as single points of failure and inconsistent key management in centralized architecture, so establishing efficient and secure key management between edge devices while ensuring effective access control is the main challenge in the digital environment. This study introduces a novel Blockchain-Based Access Control Protocol in IoT-Enabled Fog Computing (BACP-IeFC) environment for intra-network, inter-network, and mobile device communication models. The BACP-IeFC protocol eliminates the necessity for third-party intermediaries by leveraging Elliptic Curve Cryptography (ECC) for secure data sharing and hash chains for key pair generation. The BACP-IeFC protocol utilizes session keys generated by fog servers, which are securely recorded on a blockchain, ensuring robust authentication at edge devices. A Permissioned Blockchain is also used for secure key storage at the fog layer. The BACP-IeFC security has undergone comprehensive evaluation, including testing its session key (SK) security under the Real-or-Random (ROR) model, confirming its effectiveness in achieving SK security. An informal security analysis confirms the BACP-IeFC protocol resilience against known attacks. For the formal security verification, the BACP-IeFC protocol utilized the ProVerif security tool, and the results show that it is secure against major attacks. Additionally, the performance analysis of the proposed protocol using MIRACL shows a significant improvement in computation overhead, communication, storage cost, and energy consumption cost compared to existing protocols. The scalability and latency analysis of the BACP-IeFC protocol demonstrates that it supports high scalability with low latency costs. The BACP-IeFC protocol is implemented on Truffle Blockchain using Ethereum 2.0, and a lightweight Proof of Authority (PoA) consensus algorithm demonstrates that the BACP-IeFC protocol significantly outperformed existing protocols in terms of average response time for edge device registration time, authentication time, and block preparation time. [ABSTRACT FROM AUTHOR]

The modern medical system is convergence of cutting-edge technologies and advancements in the healthcare environment. In the modern medical system, the storage of electronic health records is generally leased out to third-party cloud service providers (CSPs). But, CSPs cannot be entirely relied upon due to the potential security and privacy issues. This article presents Multi-Authority and Hierarchical Attribute-Based Encryption Scheme (MH-ABE) scheme to promote secure information sharing and protect patient's privacy. The utilization of CP-ABE in conjunction with multiple Attribute Authorities within the proposed MH-ABE scheme presents a scalable and fine-grained approach to data access control. The proposed MH-ABE scheme incorporates the utilization of a Hierarchical Access Tree to effectively encrypt numerous files concurrently, hence reducing the computational and storage cost. The proposed scheme has also been evaluated using a comparative analysis with existing schemes, emphasizing the assessment of computational and storage costs. The findings of this analysis demonstrate improved performance and efficiency of the proposed ciphertext policy based encryption scheme. The proposed MH-ABE scheme incorporates features such as policy hiding and revocation, and it exhibits resilience against attacks, including collusion resistance, Indistinguishability under chosen-plaintext attack and forward secrecy. [ABSTRACT FROM AUTHOR]

In the rapidly evolving IT industry, containerization has introduced new security challenges including cloud data breaches. DL-HIDS explores the application of Deep Learning (DL) techniques for detecting such attacks. Various system call-based features, including the sequence, frequency, and metadata of system calls, as well as images, derived from these calls were explored. While using images as features is effective for DL models, determining the optimal image feature size can be challenging and requires extensive experimentation. The existing approach uses pre-trained Convolutional Neural Networks (CNNs) that incorporate system call parameters with metadata that are redundant resulting in a low detection rate. To address these limitations, we employ a deep CNN that takes images generated from system call logs as input. Our experimentation involves varying image size, system call parameters, and CNN architecture using the Leipzig Intrusion Detection DataSet-2019 dataset containing recent containerized cloud environment attack data. Our results demonstrate improvement over state-of-the-art methods toward accuracy, precision, recall, F1 score, and false-positive rate. [ABSTRACT FROM AUTHOR]

Cloud Computing offers on-demand infrastructure, platform and software services over the Internet on a pay-as-you-use model. Many e-commerce businesses and social networking sites are moving towards the cloud. Security breaches have also started to grow along with their popularity. The malicious processes can target virtualization-based cloud infrastructure and harm virtual resources, thereby becoming a threat to the cloud. Several Intrusion Detection Systems (IDSs) have been developed to detect attacks based on predefined behavior patterns. However, malicious processes can hide their behavior in the presence of security mechanisms on a Virtual Machine (VM). With the increasing frequency of such attacks, IDSs must be improved using Machine Learning (ML) and Deep Learning (DL) techniques. This study proposes a novel intrusion detection framework that can detect known and unknown attacks by system call sequence analysis. The framework analyzes the system call sequences of VMs with a hybrid model of Long Short Term Memory (LSTM) and system call frequency-based anomaly detection techniques. The proposed framework is evaluated using the Australian Defence Force Academy-Linux Dataset (ADFA-LD) dataset. Compared to the existing frameworks, the highest accuracy of 97.2% and a false positive rate of 2.4% are achieved for our proposed framework. [ABSTRACT FROM AUTHOR]

Electronic healthcare based on medical sensors is now developing to incorporate a significant amount of the Internet of Things (IoT) to communicate between sensors and intended recipients. The key requirements in this domain are to exchange messages safely and to provide confidentiality during communication. Designing and implementing an authentication strategy is essential for resolving security concerns, but it is also challenging to work with constrained computing and processing resources during group communication. Standard one-to-one authentication models do not consider the scalability of resource-limited nodes, which is a vital factor to deal with. However, group authentication presents a unique concept for IoT nodes that verify group members concurrently. The conventional group authentication methods based on the IoT are vulnerable to security risks and cannot defend against attacks like replay attacks, forgery attacks, or unauthorized key distribution by the group manager. In this paper, we propose a dynamic and provable group authentication scheme (GAS) based on a secret sharing scheme that can withstand the dishonest behavior of group managers. We introduced a key updating scenario with a provable group authentication model for dynamic node leaving and joining. Our system complies with the requirements for secrecy and accuracy, and based on security analysis, it is resistant to attacks, as mentioned earlier. Performance analysis and security proof show that our approach performs well in terms of computation cost for group members while maintaining security. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is becoming an essential aspect of digital healthcare information; the goal is to monitor various health parameters regularly to make healthcare management more efficient and convenient. Gateway devices can broadcast/multicast messages securely to sensors or intended recipients to guarantee the confidentiality of medical readings in the healthcare environment utilizing IoT sensors. In this context, designing and executing a key management framework is critical for the healthcare environment, and working with limited computing and processing capacities is also challenging. The literature on IoT key management is inclined toward centralized solutions, provides solutions with heavy computation and communication costs, and partially addresses resource-constrained devices that guarantee forward and backward secrecy in the healthcare domain. This paper constructs a group key management scheme with node joining and leaving scenarios to provide forward and backward secrecy focusing on lightweight computation. We use the concept of one-way accumulation for secret message exchange by combining elliptic curve cryptography. We designed a scheme that refreshed the established group key as the group's size grows or shrinks, and the approach also applies to classical ciphers conveniently for the number of message exchanges for healthcare nodes. To demonstrate innovation in our method, we mathematically proved the soundness of our session key management scheme for the network model, and simulation findings show that the method is feasible as the processing and communication costs are reduced compared to related schemes. [ABSTRACT FROM AUTHOR]

Due to the meteoric rise of cloud computing and the Internet of Things (IoT) concepts, remote monitoring of patients in real-time has become possible, and patients can now get healthcare services at home. To accomplish this, the patient's medical records must be stored on a server on the cloud. However, patient medical records kept on a server are extremely sensitive, making the Cloud-enabled IoT (CE-IoT) network vulnerable to several threats. Therefore, it must ensure that patient's medical records are not exposed to malicious users. Therefore, advanced fine-grained access control systems are required to protect data for authorized users. To realize the full potential of IoT healthcare, flexible access control schemes are a current field of research. We propose the Attribute-Based Access Control (ABAC) model with completely flexible and programmable delegation capabilities to satisfy the aforementioned requirements. In our addressed delegation model, a delegator may delegate fully or partially, depending on the situation. The delegator can delegate read, write, and edit permissions for a given resource. Our proposed scheme manages this permission delegation further by the Quality Factor (QF) of authorized users. The proposed scheme can provide multi-level access delegation by restricting the number of further delegations of a particular attribute. Each delegator can manage further delegations by delegatee to compensate for suitable user behaviors. Thus, a user can gain access to cloud-based healthcare data by presenting evidence that they hold the relevant attribute set (attributes may be assigned or delegated) according to the access policies. The proposed scheme also includes a mechanism for attribute revocation on demand. Theoretical and practical analyses demonstrate that the proposed scheme is computationally efficient, safe against attribute collusion, impersonation attacks, and replay attacks, and meets its stated goals. We have demonstrated that the proposed access control scheme has greater delegation capabilities than the existing ABAC scheme with access delegation capabilities. [ABSTRACT FROM AUTHOR]

Routing protocol for low power and lossy networks (RPL) serves the routing process in Internet Protocol version 6 over low-power wireless personal area network protocol stack. RPL protocol is deployed on sensor nodes and is vulnerable to many attacks due to the resource-constrained and non-tamper-resistant nature of these nodes. Many attacks on RPL-based networks can be carried out by an attacker using either an insider or an outsider attack method. The concerns associated with the RPL protocol regarding security and privacy may restrict its global adaption. Therefore, it is necessary to conduct a thorough investigation of RPL-specific attacks and their effects on the underlying network. To this end, our work provides a detailed investigation of the rank attack, a type of denial-of-service attack and its effect on the RPL network. We made an in-depth experimental study on four different RPL network topologies and analysed the impact of rank attack. To analyse the effect of rank attack, we use both grid and random variants of the network topologies. Based on the location of the sink node, we classify the grid topology as grid corner and grid centre, whereas, based on mobility, we classify the random topology as random topology with static nodes and random topology with mobile nodes. Under the attack scenario, the average number of packets received in grid topology with sink node at centre degrades by 10%. For grid topology having the sink node at the corner, the average number of packets received degraded by 13.44%. The percentage degradation of the average number of packets received at the sink node with random topology is nearly 8%. Random topology with mobile nodes has 7.4% lesser number of packets received at the sink node. Next, the value of average inter-packet time with random mobile topology has the highest increase of about 19% under attack. At the same time, we notice an increase in average inter-packet time of about 6.4% with random topology, 3.7% with grid topology having the sink node at the corner, and 0.7% with grid topology having the sink node at the centre. Further, when the rank attack is mounted, we notice a hike of 24% in message count with random mobile and 28% with grid corner topology. Moreover, both random topology and grid topology with sink at the centre have a hike of about 13% in message count. Furthermore, when average power consumption is considered under attack scenario, random topology with mobile nodes and grid topology with the sink node placed at the corner demonstrate an increase of 11% under attack. At the same time, random and grid topologies with the sink node at the centre have a rise of nearly 2% as compared to normal RPL. The results of our experiments show that the rank attack considerably degrades network performance in terms of packets received at the sink node, inter-packet time, control message count, and average power consumption. Further, our investigation also confirms that the position of the attacker node in the network topology has a significant impact on the effect of the rank attack. Furthermore, we also suggest some potential solutions to mitigate this attack. [ABSTRACT FROM AUTHOR]

Online Social Networks (OSNs) have gained popularity in recent years. Millions of people use Facebook, Instagram, Twitter, and LinkedIn. Malicious users can target users using security weaknesses like cloning and Sybil attacks and join their friend list or trusted network. Malicious people can send unwanted friend requests to other users. Before communicating with dubious users, users should know their trust level. In addition, existing social networks do not provide any system to assess the trustworthiness of people that make friend requests. Also, several existing trust models assume that participants' direct trust ties are known and only focus on particular characteristics. Hence, a holistic model is required to measure explicit trust and infer indirect trust between participants. Using comprehensive feature similarity, we offer a unique OSN trust prediction technique. We choose features based on user interactions, relationships, preferences, behaviours, and activities. The retrieved features are utilised to measure direct and indirect trust between neighbours and non-neighbours. To compare the proposed trust prediction approach to existing approaches, we implement cloning and Sybil attack detection as exemplary applications. The empirical findings and comparisons with other methodologies verify the proposed approach's effectiveness, efficiency, and superiority. [ABSTRACT FROM AUTHOR]

Nowadays, Online Social Networks (OSNs) are becoming more and more popular means of communication as they are easily accessible and offer advanced features to their users. The quantity of social network users is radically expanding each year. The increase in the number of users has also led to a tremendous increase in security threats such as the profile cloning attack. In profile cloning attacks, attackers create the exact or similar duplicate fake profiles as victims with malicious intention and deceive target individuals on OSNs. Current social networks do not offer any active security services to verify the authenticity of users who send friend requests; hence incautious users can quickly become victims of profile cloning attacks. The literature lacks effective, efficient and accurate protection techniques. This paper proposes a novel defense mechanism to protect users from profile cloning attacks on OSNs. Our scheme is based on attribute similarity, friend list similarity and strength of ties measures. We analyze user profiles, identify the key attributes and friend lists, and measure the attribute similarity and friend list similarity between profiles. Relationship strength among users can help authenticate users on OSNs. We include the relationship strength measure with the attribute and friend list similarity to distinguish between cloned and genuine profiles. The proposed defense scheme is tested with the synthetic and real-world datasets, and the results are compared with the current method. The empirical results validate the scheme's effectiveness, efficacy, and accuracy. Our scheme outperforms the existing method and has low false rates. [ABSTRACT FROM AUTHOR]

With the digital revolution and the Web 2.0 era, web-based social networks such as Facebook and others have become popular mediums for users to do various activities. While social networks are becoming increasingly popular, concerns about trust and trust-related issues are also growing among users. There are many applications where trust plays a vital role in users' decision-making, requiring trust evaluation. There are several trust evaluation approaches for online social networks in the literature. However, the existing approaches focus only on certain aspects and believe that direct trust between participants is known. Thus, there is a need for a comprehensive trust evaluation approach that infers indirect trust and strives to measure direct trust. This paper proposes an interaction-based and graph-based hybrid approach that attempts to measure direct trust and infer indirect trust among users. Our direct trust measure method utilizes the most important features and similarities between users to measure direct trust. The proposed indirect trust inference method uses the graph theory concept to infer indirect trust. We implement the friend-request identification and the Sybil attack detection applications using the proposed direct trust measure method. Both the applications are evaluated on synthetic and real-world datasets. The empirical results show that the friend-request identification application achieves a high accuracy of 96.17%, and the Sybil attack detection application obtains a high detection rate of 93.20%. The false rates of both applications are very low. The proposed indirect trust inference method is efficient, and it outperforms the existing approach. [ABSTRACT FROM AUTHOR]

Along with significant benefits to the end-users, the Internet-of-Things (IoT) technology also brings unprecedented security challenges. IoT requires many embedded and resource-constrained devices that are usually deployed in an insecure and remote environment. This is where a White-box (WB) attack paradigm, where the attacker has complete control over the execution environment, comes into the picture. Accordingly, the possible capture of these devices makes the entire built-in cryptosystem visible to the adversary. Thus, the adversary gains complete control over the system and can potentially hinder the used cryptographic implementation. A White-box cryptographic (WBC) encryption scheme is employed to counter such WB attacks. Accordingly, we provide a scheme for hiding the private key used in the Elliptic curve encryption scheme considering the WB attack context. Precisely, we use Residue Number System (RNS)-based lookup tables to hide the private key. To show the practicality of the proposed scheme, we deploy it over a widely adopted Message Queuing Telemetry Transport for Sensor Networks (MQTT-SN) protocol. Further, we discuss the WB security goals and analyze the security and performance of the proposed scheme using the Cooja simulator. We demonstrate the feasibility of the proposed approach by comparing it with the traditional Elliptic curve encryption scheme over parameters like end-to-end delay, network throughput, average power consumption, and computational time. The obtained simulation results show that the proposed scheme provides a consistent computational cost and network efficiency, which is practical in deployments demanding a higher level of security. [ABSTRACT FROM AUTHOR]

Routing Protocol for Low Power and Lossy Networks (RPL) is the only standard protocol that assists the routing process in Low Power and Lossy Networks (LLNs) - based Internet of Things (IoT) applications. However, due to the resource-constrained nature, lack of physical protection and security requirements of the inherent protocol, LLNs are vulnerable to attacks that primarily alter the working of the RPL protocol and disrupt the ongoing communication. Therefore, it is a high profit and desperate target of many attackers. Our work offers a detailed overview of one such significant threat to RPL known as the rank attack. Considering the resource-constrained nature of the IoT devices, we propose and evaluate a lightweight and efficient method to mitigate and isolate the rank attack. Specifically, our approach uses a novel Echelon Metric Based Objective Function (EMBOF) over the default RPL to calculate and check the legitimacy of the advertised rank. The Echelon value is additively determined by the root node and the corresponding parent node(s) in the RPL network topology. Our approach not only detects the attacker node(s) but also isolates it immediately. We implement and evaluate our approach through extensive simulations in Cooja, a Contiki operating system (OS) based simulator. The results of our experiments show the viability of our proposal concerning detection accuracy, isolation latency, packet delivery ratio, end-to-end delay, power consumption and memory overhead. [ABSTRACT FROM AUTHOR]

Internet of things (IoT) is renowned for being a massive revolution led by business leaders and researchers. Routing protocol for low-power and lossy network (RPL) is a standardized protocol that serves the routing need of the IPv6-based low-power and lossy networks, which are the significant enablers of the IoT technology. Despite its many outstanding features, RPL offers very low protection against different routing attacks. In this respect, we mainly emphasize on the sybil attack. Specifically, we focus on three different types of sybil attack on a realistic smart home network topology. Considering the involvement of resource-constraint devices, we propose and evaluate a novel decentralized countermeasure against these attacks. The proposed countermeasure is based on a hybrid approach that involves the use of the geographical location of the nodes and a trust value-based parent selection procedure. Along with this, we use specially configured monitoring nodes that are responsible for the detection of the malicious attacker node(s). Further, we use RPL's multi-instance property to integrate the proposed decentralized architecture into the exiting RPL protocol. We implement the proposed countermeasure in Cooja, the Contiki operating system-based network simulator. The results obtained through our experiments validate the practicality of the proposed countermeasure. [ABSTRACT FROM AUTHOR]

The trends of data mining on healthcare data for improving medical services have increased because of the electronic healthcare record(EHR) system, which collects a massive amount of data on a daily basis. In the current scenario, hospital maintains its EHR system and stores the detailed information of patients. Data mining for healthcare improvement requires the data from all the EHR systems located at a different location to be stored at the central data mining server. Collection of healthcare data at some untrusted central data mining server raises privacy threats. Healthcare data contains patients' private information and sharing this information for data mining creates privacy issues. Most of the previous research either focused on k-anonymity technique which causes information loss and decreases data mining accuracy or privacy preserving data mining which is focused on only specific data mining technique. We adopt source anonymous technique as privacy preserving scheme and present a novel scheme for healthcare data collection and mining in this paper. Our scheme collects data from all EHR systems without any information loss and stores at a single central data mining server, also ensuring privacy is preserved. Central data mining server helps to analyze the collected data with different data mining techniques (Association rule mining, Classification, Clustering, etc.) without the involvement of EHR systems. Our scheme is collusion resilient against central data mining server and EHR systems. Theoretical and experimental analysis show the efficiency of our scheme in terms of computation and communication cost. The experimental results using Heart disease dataset show the advantage to EHR systems using the proposed approach in terms of disease prediction accuracy. [ABSTRACT FROM AUTHOR]

The prevalent usage of Location Based Services; where getting any informational service is solely based on the user's current location, have raised an extreme concern over location privacy of the user. The privacy concern becomes paramount when the location tagged data publication like government health care data, district crime record data and the like, are reverse engineered by an adversary to pinpoint the real user against the location given in the specific tuple of the record. Address information is typically considered as a confidential element of the published record and any linkages of this piece of information with publicly available quasi identifier is enough to reveal a lot about a user (which is not apparent otherwise) or hamper the social reputation of the user considering the extreme case. Various geographical masking techniques have been presented and discussed at length in the literature, however, no scheme is able to dispense privacy providing absolute usefulness of the published data. This work is a research attempt to recognize the current state-of-the-art in geographical masking, supportive analysis of the existing masking technique, and come up with a robust solution that serves the purpose of location privacy without making published data worthless. The suggested solution is well suited for geocoded, static, discrete point published data. [ABSTRACT FROM AUTHOR]

Portable devices today are striding computation potential and memory at par and sometimes even significantly higher than those found in desktop machines. Today's lifestyle is more mobile than earlier, offices are open cafe houses and people prefer to work from plug and play office spaces. With the exponential growth of mobile technology and its users, a more astute system is in place called 'location based services' (LBSs). Since client uses these services out of their dynamic or static working behavior and is required to submit the real location (with query) to get the absolute benefits, it is crucial to layout the systems and frameworks which can protect users from the security and privacy threats by keeping the location information private. Existing defense mechanisms based on trusted third party possesses the significant vulnerability to vicinity identification, which in turn end up identifying the real world identity of the query issuer. In this paper, we present a scheme to preserve location privacy, called VIC-PRO, that fortifies the location privacy of the client alongside vicinity protection using geometrical transformations. We experimentally compare the scheme with other existing mechanisms to demonstrate that VIC-PRO is more efficient, safe against vicinity identification attack, and guarantees better user privacy in an LBS setup. [ABSTRACT FROM AUTHOR]

In recent years, a trend of electronic health record (EHR) system can be seen increasingly in the hospitals, which has generated huge amount of electronically stored data of patients. Association rule mining technique is very helpful in the numerous applications of healthcare (e.g., correlation between disease and symptoms, disease and offering effective treatment and predicting risks of disease based on the historical data, etc.). The data collected by an EHR system are very important for the medical research. Currently, a patient health report is derived on the basis of a physician’s own experience and on the association rule mining results of a local EHR system maintained by a particular hospital. Association rule mining results will be more accurate if the data of all local EHR systems are integrated and association rule mining is performed. Integration of local EHR systems requires the sharing of local EHR data. Sharing of patient records violates the privacy of patients. Hence, medical research is focused on the problem of mining association rules without sharing of local private EHR data. Privacy-preserving distributed association rule mining (PPDARM) solves this issue by mining the association rules while preserving the privacy of patients. In this paper, an approach for the PPDARM is proposed for collaboratively performing association rule mining by all local EHR systems while preserving the privacy. The proposed approach is also analysed with the heart disease dataset. [ABSTRACT FROM AUTHOR]

Association rule mining can be used in healthcare data mining to provide solutions to life-threatening diseases like recent COVID-19. Due to healthcare data privacy concerns, privacy preserving distributed healthcare data mining becomes the primary focus of medical science research. Recently, Chahar et al. (Sādhanā 42:1997-2007, 2017) proposed privacy preserving distributed association rule mining scheme with insecure communication channels. They used the concept of an elliptic curve-based paillier cryptosystem to achieve privacy, authenticity, and integrity. We observed some security vulnerabilities in their privacy preserving association rule mining scheme when implemented with insecure communication channels. We observed that the security vulnerabilities will result in the disclosure of private data of sites (or participants). Furthermore, we propose a secure version of their scheme to solve the security vulnerabilities with insecure communication channels. Theoretical and experimental analysis shows that the proposed scheme has almost equal computation and communication complexities with better securities. A case study on the effectiveness of the proposed approach in combating COVID-19 coronavirus and Breast Cancer is also discussed., Competing Interests: Conflict of interestThe authors declare that they have no conflict of interest., (© The Author(s), under exclusive licence to Springer Nature Singapore Pte Ltd 2021.)