Search

Public Acceptance is a prerequisite forgaining the intended benefits of Connected and Au-tonomous Vehicles (CAVs). This paper proposes anidea of digital labels for CAVs so as to increaseconsumers trust and awareness regarding the se-curity level of their vehicle. We come up with anarchitecture named Cybersecurity Box (CSBox) inwhich digital labels display and inform the CAVconsumers and passengers about its cybersecurityhealth status. We also highlight requirements andchallenges in developing digital security labels forCAVs

The booming Internet of Things makes smart healthcare a reality, while cloud-based medical storage systems solve the problems of large-scale storage and real-time access of medical data. The integrity of medical data outsourced in cloud-based medical storage systems has become crucial since only complete data can make a correct diagnosis, and public auditing protocol is a key technique to solve this problem. To guarantee the integrity of medical data and reduce the burden of the data owner, we propose an efficient privacy-preserving public auditing protocol for the cloud-based medical storage systems, which supports the functions of batch auditing and dynamic update of data. Detailed security analysis shows that our protocol is secure under the defined security model. In addition, we have conducted extensive performance evaluations, and the results indicate that our protocol not only remarkably reduces the computational costs of both the data owner and the third-party auditor (TPA), but also significantly improves the communication efficiency between the TPA and the cloud server. Specifically, compared with other related work, the computational cost of the TPA in our protocol is negligible and the data owner saves more than 2/3 of computational cost. In addition, as the number of challenged blocks increases, our protocol saves nearly 90% of communication overhead between the TPA and the cloud server.

The continuous innovation and progression in hardware, software and communication technologies helped the expansion and accelerated growth in Internet of Things based drone networks (IoD), for the devices, applications and people to communicate and share data. IoD can enhance comfort in many applications including, daily life, commercial, and military/rescue operations in smart cities. However, this growth in infrastructure smartness is also subject to new security threats and the countermeasures require new customized solutions for IoD. Many schemes to secure IoD environments are proposed recently; however, some of those were proved as insecure and some degrades the efficiency. In this article, using elliptic curve cryptography, we proposed a new authentication scheme to secure the communication between a user and a drone flying in some specific flying zone. The security of the proposed scheme is solicited using formal Random oracle method along with a brief discussion on security aspects provided by proposed scheme. Finally, the comparisons with some related and latest schemes is illustrated.

Recent technological evolution in the Internet of Things (IoT) age supports better solutions to magnify the management of the power quality and reliability concerns, and imposes the measures of a smart grid. In smart grid environment, a smart meter needs to securely access the services from a service provider via insecure channel. However, since the communication is via public channel, it imposes various security threats by an adversary. To deal with this, in this article we design a new anonymous signature-based authenticated key exchange scheme for IoT-enabled smart grid environment, called AAS-IoTSG. The dynamic smart meter addition phase is also permissible in AAS-IoTSG after initial deployment. The security of AAS-IoTSG has been tested rigorously using formal security analysis under the real-or-random (ROR) model which is one of the broadly-accepted standard random oracle models, formal security verification under the broadly-used automated validation of Internet security protocols and applications (AVISPA) tool and also using informal security analysis. Finally, an exhaustive comparative study unveils that AAS-IoTSG supports better security and functionality features and requires less communication and computation overheads as compared to the existing state-of-art authentication mechanisms in smart grid systems.

Autonomous and connected vehicles are a collection of smart components such as sensors, Radar/Lidar, Electronic Control Units (ECUs), and cameras programmed through voluminous lines of codes, which enable a seamless communication system between the user, vehicle, and infrastructure. The concept of autonomous vehicles is gaining significant traction in the global markets, generating higher revenues, and witnessing high market penetration, thus attracting entrepreneurs to make new and disruptive innovations. However, the underlying technology and communication system of autonomous and connected vehicles are prone to the cybersecurity threats, which circumvent any product that uses sensors, transmits data over the network, and can be controlled through a remote computer or a mobile application. In this article, we attempt to outline the concerns that an aspiring entrepreneur should be aware of before entering into the autonomous vehicle industry, followed by innovative recommendations that can guide addressing the article's issues. The presented recommendations and guidelines are based on the cybersecurity principles of confidentiality, integrity, and availability.

Recently, Thumbur et al. introduced a paring-free certifcateless signature scheme to resolve security and efficiency issues in resource-constrained devices and claimed it was secure. However, we find that their scheme is vulnerable to signature forgery attack. To solve the above security challenges, we present a new pairing-free certificateless signature scheme and then formally prove its security under the ECDLP assumption, and finally we conduct a performance analysis and comparison. Security analysis and performance evaluation demonstrate that our new proposal can enjoy a higher level of security with a lower computation cost and communication cost, it is more practical in resource-constrained scenarios.

Wireless sensor networks (WSNs) accomplish a key aspect in the Industrial Internet of Things (IIoT) that has turned out to be the most flourishing perception for computerizations in an industrial maneuver. IIoT environment is a significant application of the Internet of Things (IoT) that facilitate the professionals related to industries for remote supervision of factory, warehouses, etc. In this environment, the data must constantly be analyzed to take important real-time decisions. It makes remote confirmation most essential to secure the data transmission through insure channel so that alteration, interception, modifications of data cannot occur. As a result, there remains an immense requirement of remote user authentication protocol to restrict any illicit access to the data. In this scenario, to eradicate all the security attacks, it is aimed to design a robust provable-secure privacy-preserving three-factor authentication protocol for IIoT in this research. Our scheme is analyzed using both informal and formal security reviews using broadly known random oracle models, BAN logic as well as simulated using a well-accepted ProVerif simulation tool that confirms that the protocol is well-secured against all existing security threats. It is exhibited in the performance estimation that the proposed scheme is more efficient as well as lightweight than other existing schemes. To conclude it can be said that the proposed scheme is easy to be realized in the resource-constrained IIoT environment.

The radical progress in web services has drained more attraction towards escalating the security of several applications that serve and interact with the Internet users. In order to get authenticated from servers, the users must disclose their secret information to the server such as password and username so that they can access distinct applications on the Web. Due to distinct security attacks, such secret credentials should be discouraged from being revealed. Moreover, it is vibrant to secure the systems from known attacks. In contrast to all known security attacks, the insider attack is considered devastating because the privileged insiders of a system can violate the secret credentials, which may lead towards irrecoverable damage to both the system and the user. Therefore, to ensure the security of the system from insider attacks, different protocols have been proposed. Very recently, Rajamanickam et al. “Insider attack protection: Lightweight password-based authentication techniques using ECC,” presented novel authentication scheme for insider attack protection. They claimed that their protocol not only prevents insider attack but it is also immune to several known security attacks. This comment discloses the non-trivial weaknesses in the authentication phase between client and server. We have identified that the adversary can successfully impersonate the entities communicating with each other through this protocol. Moreover, their protocol fails to offer forward and backward secrecy. Consequently, we suggest possible solution for attack resilience.

Internet of Things (IoT) devices are becoming ubiquitous in our lives, with applications spanning from the consumer domain to commercial and industrial systems. The steep growth and vast adoption of IoT devices reinforce the importance of sound and robust cybersecurity practices during the device development life-cycles. IoT-related vulnerabilities, if successfully exploited can affect, not only the device itself, but also the application field in which the IoT device operates. Evidently, identifying and addressing every single vulnerability is an arduous, if not impossible, task. Attack taxonomies can assist in classifying attacks and their corresponding vulnerabilities. Security countermeasures and best practices can then be leveraged to mitigate threats and vulnerabilities before they emerge into catastrophic attacks and ensure overall secure IoT operation. Therefore, in this paper, we provide an attack taxonomy which takes into consideration the different layers of IoT stack, i.e., device, infrastructure, communication, and service, and each layer's designated characteristics which can be exploited by adversaries. Furthermore, using nine real-world cybersecurity incidents, that had targeted IoT devices deployed in the consumer, commercial, and industrial sectors, we describe the IoT-related vulnerabilities, exploitation procedures, attacks, impacts, and potential mitigation mechanisms and protection strategies. These (and many other) incidents highlight the underlying security concerns of IoT systems and demonstrate the potential attack impacts of such connected ecosystems, while the proposed taxonomy provides a systematic procedure to categorize attacks based on the affected layer and corresponding impact., Comment: IEEE Internet of Things Journal

The Internet of Things (IoT) enables all objects to connect to the Internet and exchange data via different emerging technologies, which makes the intelligent identification and management a reality. Wireless sensor networks (WSNs), as a crucial basis of IoT, have been applied in many fields like smart health care and smart transportation. With the development of WSNs, data security has attracted more and more attention, and user authentication is a popular mechanism to ensure the information security of WSNs. Recently, many authentication mechanisms for wireless medical sensor networks (WMSNs) have been proposed, but most of the protocols cannot achieve the features of local password change and forward secrecy while resisting stolen smart card attack. To enhance the security based on previous work, an ECC-based secure three-factor authentication protocol with forward secrecy for WMSN is proposed in this paper. It utilizes a fuzzy commitment scheme to handle the biometric information. Meanwhile, fuzzy verifier and honey_list techniques are used to solve the contradiction of local password verification and mobile device lost attack. The security of our protocol is evaluated by provable security, Proverif tool, and information analysis. Besides, the comparisons with the relevant protocols are given, and the results indicate that our protocol is robust and secure for WMSN systems.

Industrial Internet of Things (IIoT) refers to all kinds of equipment in industrial production, whether it is machine equipment in factories or engine in automobiles and airplanes, on which sensors are installed and connected to wireless network terminals to collect and share data. At present, because IIoT system is an open, distributed and heterogeneous system, it is a great challenge to implement trusted communication in IIoT. Blockchain technology has become a new way to solve the cooperative trust issues of industrial Internet of Things. Using blockchain, a tamper-proof system can be built, which can be used as an audit tool for hardware products of industrial Internet of Things from chip to whole equipment. Blockchain improve productivity and operational efficiency of IIoT through smart contract, allowing machines to manage themselves. To apply blockchain technology in IIoT, one of the main issues is to solve the security and efficiency problems of consensus protocols. In this paper, a reputation scheme is proposed to encourage normal nodes and abnormal nodes both to participate in network collaboration in a good way. In order to guide the behavior, a credit based incentive approach is proposed. The reward and punishment factor is designed in the revenue payment function of reputation. The effectiveness is that the cooperative behavior is rewarded, and the non cooperative behavior is punished. The main advantage of our scheme is that our reputation based incentive module can be implemented on state-of-the-art PoX protocols, which is called PoRX,and can make PoX protocols achieve better consensus states. Therefore, it would benefit the applications of IIoT with blockchain. A prototype has been implemented and the experimental results shows that our scheme can effectively encourage the cooperative behavior of the nodes in IIoT, that can benefit the network.

© 2020 The Authors. Published by IEEE. This is an open access article available under a Creative Commons licence. The published version can be accessed at the following link on the publisher’s website: https://doi.org/10.1109/ACCESS.2020.3011259 Cybercrimes are cases of indictable offences and misdemeanors that involve computers or communication tools as targets and commission instruments or are associated with the prevalence of computer technology. Common forms of cybercrimes are child pornography, cyberstalking, identity theft, cyber laundering, credit card theft, cyber terrorism, drug sale, data leakage, sexually explicit content, phishing, and other forms of cyber hacking. They mostly lead to a privacy breach, security violation, business loss, financial fraud, or damage in public and government properties. Thus, this study intensively reviews cybercrime detection and prevention techniques. It first explores the different types of cybercrimes and discusses their threats against privacy and security in computer systems. Then, it describes the strategies that cybercriminals may utilize in committing these crimes against individuals, organizations, and societies. It also reviews the existing techniques of cybercrime detection and prevention. It objectively discusses the strengths and critically analyzes the vulnerabilities of each technique. Finally, it provides recommendations for the development of a cybercrime detection model that can detect cybercrimes effectively compared with the existing techniques.

Blockchain, a distributed ledger technology, can potentially be deployed in a wide range of applications. Among these applications, decentralized payment systems (e.g. Bitcoin) have been one of the most mature blockchain applications with widespread adoption. While the early designs (e.g. Bitcoin) are often the currency of choice by cybercriminals (e.g., in ransomware incidents), they only provide pseudo-anonymity, in the sense that anyone can deanonymize Bitcoin transactions by using information in the blockchain. To strengthen the privacy protection of decentralized payment systems, a number of solutions such as Monero and Zerocash have been proposed. However, completely Decentralized Anonymous Payment (DAP) systems can be criminally exploited, for example in online extortion and money laundering activities. Recognizing the importance of regulation, we present a novel definition of Decentralized Conditional Anonymous Payment (DCAP) and describe the corresponding security requirements. In order to construct a concrete DCAP system, we first design a Condition Anonymous Payment (CAP) scheme (based on our proposed signature of knowledge), whose security can be demonstrated under the defined formal semantic and security models. To demonstrate utility, we compare the performance of our proposal with that of Zerocash under the same parameters and testing environment.

The traditional methods used for the identification of individuals such as personal identification numbers (PINs), identification tags, etc., are vulnerable as they are easily compromised by the hackers. In this paper, we aim to focus on the existing multibiometric systems that use hand based modalities for the identification of individuals. We cover the existing multibiometric systems in the context of various feature extraction schemes, along with an analysis of their performance using one of the performance measures used for biometric systems. Later, we cover the literature on template protection including various cancelable biometrics and biometric cryptosystems and provide a brief comment about the methods used for multibiometric template protection. Finally, we discuss various open issues and challenges faced by researchers and propose some future directions that can enhance the security of multibiometric templates.

In the advanced technological world, vehicular communications are used in numerous business and safety applications for smart traffic management. With the help of vehicle-to-vehicle (V2V) communication, users can transfer substantial information directly to the reachable vehicles. Generally, the movement of vehicles on the highway is faster than crossroads, thus, to communicate securely and efficiently, a robust vehicular communication system is required. Therefore, a number of message dissemination protocols have been designed by the researchers, but distinct interests (i.e, storage cost, high communication overhead, more execution time, and security threats) are sought in these systems, which lead toward unreliability for on-the-fly communication. Very recently, Limbasiya-Das ( Ieee System Journal , pp 1937–9234, 10.1109/JSYST.2019.2932807) introduced a hash-based secure and efficient V2V data dissemination protocol to transfer significant information at the receiver end. Limbasiya-Das claimed the security of their protocol against numerous security attacks. However, in this comment, we highlight the loopholes of Limbasiya-Das protocol and show that their protocol is vulnerable to impersonation attack. Moreover, it has irrelevant usage of timestamp and does not offer user's anonymity. In addition, it lacks message confidentiality because an adversary can determine and view the messages exchanged among the legitimate vehicles by intercepting the messages disseminated over public channel. Finally, we provide probable remedy to mitigate the deficiencies of Limbasiya-Das protocol.

Ciphertext-policy attribute-based encryption (CP-ABE) scheme can be deployed in a mobile cloud environment to ensure that data outsourced to the cloud will be protected from unauthorized access. Since mobile devices are generally resource-constrained, CP-ABE schemes designed for a mobile cloud deployment should have constant sizes for secret keys and ciphertexts. However, most existing CP-ABE schemes do not provide both constant size ciphertexts and secret keys. Thus, in this paper, we propose a new pairing-based CP-ABE scheme, which offers both constant size ciphertexts and secret keys (CSCTSK) with an expressive AND gate access structure. We then show that the proposed CP-ABE-CSCTSK scheme is secure against chosen-ciphertext adversary in the selective security model, and present a comparative summary to demonstrate the utility of the scheme. Since mobile devices are generally resource-constrained and cloud services are Internet-based and pay-by-use, a key feature in ciphertext-policyAttribute-based encryption (CP-ABE) should be constant sizes for secret keys and ciphertexts.In this paper, we propose a new pairing-based CP-ABE scheme, which offers both constant size ciphertexts and secret keys (CSCTSK) with an expressive AND gate access structure.We then show that the proposed CP-ABE-CSCTSK scheme is secure against chosen-ciphertext adversary in the selective security model, and demonstrate its utility.

The papers in this special section focus on cyber security threats and efforts to ensure secure communications. With rapid and ongoing advances in information and communications technology (ICT) and “expansion” of cyber space, cyber security is, and will continue to be, of crucial importance to the stability of our Internet-connected society. For example, how do we ensure secure communications between servers, network nodes, terminals and user applications across public and private networks, particularly in cyber-physical systems? Defending our cyber space is both a research challenge and an operational challenge. Designing effective security solutions is complicated by the need to carefully balance between security and usability, as well as the amount of efforts and resources required.

User authentication is the process that is exercised millions of times around the globe by using different techniques and methods. The most prominent way of authentication is alphanumerical password forms that have been used for decades. Authorized access is becoming a challenging issue because of the introduction of modern technologies. In addition, traditional alphanumerical passwords have significant security issues, for example, humans forget the combination of keys due to the selection of a difficult key combination. Moreover, when they choose an easy key combination, this helps hackers to crack their passwords easily. Traditional passwords are also vulnerable to several types of attacks, for example, dictionary attack, brute force attack, and malware. To provide an easy and more secure authentication technique, a graphical password has been introduced in this paper for consumer electronic devices, which uses an image or a set of images for authentication. We have categorized the existing graphical password methods into recognition-based, cued-recall-based, pure-recall-based, and hybrid techniques. Due to the limitations of the existing graphical passwords, we have introduced a new technique, named graphical random authentication technique (gRAT), which generates a randomized set of images every time a user tries to authenticate him/herself by maintaining the security and usability at the same time. The gRAT technique is also tested by user-centric evaluation in terms of security, usability, usefulness, and utility, and the experimental results show that the proposed technique is more secure and useful in the real-life authentication applications. Deanship of Scientific Research, King Saud University Scopus

The advancement of the cloud storage technology opens up a wide range of possibilities for adaptable data sharing. When sharing data to an extensive number of users with fuzzy identities, the data proprietor must use an appropriate identity-based encryption technique that satisfies both efficiency and security prerequisites. Identity-based encryption is a promising possibility to ensure fuzzy user data sharing while meeting the security essentials; however, it may encounter efficiency trouble in multi-receiver settings. Recently, identity-based encryption has received much attention, and most of the research has aimed to apply the technique in real-world systems. A major concern about using identity-based encryption is the safety of the private keys, as disclosure of secret keys requires the reissuing of encryptions already doled out. The capability to minimize the risks associated with key disclosure is particularly important due to the increased use of mobile and unprotected devices. In this article, we shall propose a forward-secure identity-based encryption technique based on subtree for fuzzy user data sharing under cloud computing environment, and we shall demonstrate that the technique is semantically secure against a chosen subtree and chosen ciphertext attack (IND-CST–CCA). In addition, we will show the superiority of our new technique over the currently existing methods in terms of security and the length of public key. Then, we will also discuss the potential of our new technique to be deployed in pay TV systems and grid security.

In cyber crimes, attackers are becoming more inventive with their exploits and use more sophisticated techniques to bypass the deployed security system. These attacks are targeted and are commonly referred as Advanced Persistent Threats (APTs). The currently available techniques to tackle these attacks are mostly reactive and signature based. Security Information and Event Management (SIEM), a proactive approach is the best solution. However, the major problem with SIEM is tackling huge amount of data in real time that makes it a time consuming and tedious task for security analyst. The use of threat intelligence caters to such issue by prioritizing the level of threat. In this paper, we assign risk score and confidence value to each feed generated at our product “T-Eye platform”. On the basis of these values, we assign a severity score to each feed type. Severity score assigns a level to the threat means prioritize the threat. The results, we achieved for prioritizing the threat is more apparent and accurate. In addition, we optimize the rules of IBM-Q-Radar by using threat feeds generated at T-Eye platform. Furthermore, a huge amount of false positive alarms generated at IBM Q-Radar is reduced to a certain extent.

Blockchain, as a decentralized and distributed public ledger technology in peer-to-peer network, has received considerable attention recently. It applies a linked block structure to verify and store data, and applies the trusted consensus mechanism to synchronize changes in data, which makes it possible to create a tamper-proof digital platform for storing and sharing data. It is believed that blockchain can be utilized in diverse Internet interactive systems (e.g., Internet of Things, supply chain systems, identity management, and so on). However, there are some privacy challenges that may hinder the applications of blockchain. The goal of this survey is to provide some insights into the privacy issues associated with blockchain. We analyze the privacy threats in blockchain and discuss existing cryptographic defense mechanisms, i.e., anonymity and transaction privacy preservation. Furthermore, we summarize some typical implementations of privacy preservation mechanisms in blockchain and explore future research challenges that still need to be addressed in order to preserve privacy when blockchain is used.

Recently, Ostad-Sharif et al. pointed out the susceptibility of three different authentication schemes themed for telecare medicine/medical information systems to key compromise impersonation attack (KCIA). To further address this issue, they proposed an ECC-based authentication and key generation scheme for healthcare applications. In this paper, we show that Ostad-Sharif et al.'s scheme is not only affected with key compromise impersonation attack but also suffers from a key compromise password guessing attack. Several papers have been published by the researchers by applying KCIA on existing authentication protocols. Before any further move in research in this direction, researchers must contemplate about KCIA. We conclude this article with a rigorous analysis of KCIA along with two questions to ponderon for the research community working in this field.

Agriculture is a fundamental pillar of society, bearing a crucial role in shaping the economy of the country and provides huge financial prospects and the possibility of employment to the ...

Autonomous vehicles (AVs) offer a wide range of promising benefits by reducing traffic accidents, environmental pollution, traffic congestion and land usage etc. However, to reap the intended benefits of AVs, it is inevitable that this technology should be trusted and accepted by the public. The consumer’s substantial trust upon AVs will lead to its widespread adoption in the real-life. It is well understood that the preservation of strong security and privacy features influence a consumer’s trust on a product in a positive manner. In this paper, we introduce a novel concept of digital labels for AVs to increase consumers awareness and trust regarding the security level of their vehicle. We present an architecture called Cybersecurity Box (CSBox) that leverages digital labels to display and inform consumers and passengers about cybersecurity status of the AV in use. The introduction of cybersecurity digital labels on the dashboard of AVs would attempt to increase the trust level of consumers and passengers on this promising technology.

The Internet of drones (IoD) is a very useful application of the Internet of things (IoT) and it can help the daily life comfort through various functions including the smart city surveillance. The IoD can enhance the comfort to reach inaccessible and hard to access sites and can save lot of effort, time and cost. However, in addition to traditional threats, the IoD may suffer from new threats and requires customized methods to combat the security weaknesses. Very recently, Wazid et al. proposed a security solution for securing IoD application scenario and claimed its security. However, in this paper we show that their scheme cannot resist stolen verifier and traceability attacks. Moreover, an attacker with access to the verifier, can impersonate any user, drone or server of the system. An enhanced scheme is then proposed to cope with these weaknesses. The security claims of proposed scheme are endorsed by formal and informal security analysis. Moreover, the performance and security comparisons show that proposed scheme completes a cycle of authentication with a slight increase in computation time, but it offers all the required security features as compared with the scheme of Wazid et al.

In an Intelligent Precision Agriculture (IPA), several Internet of Things (IoT) smart devices and drones can be deployed to monitor an agricultural environment. The drones can be further utilized to collect the data from smart devices and send to the Ground Station Server ( G S S ) . However, insecure communication among the smart devices, drones and the G S S make the IoT agriculture environment vulnerable to various potential attacks. For this goal, a new authentication and key management scheme for IoT-enabled IPA, called AKMS-AgriIoT, has been put forward with the private blockchain-based solution. The blocks formed with the encrypted transactions and their respective signatures by the G S S are mined by the cloud servers to verify and add the blocks in the private blockchain center. A detailed security analysis and comparative study reveal that the proposed AKMS-AgriIoT supports better security, and provides more functionality features, less communication costs and comparable computation costs as compared to other relevant schemes. In addition, the blockchain-based implementation on the proposed AKMS-AgriIoT has been also carried out.