Search

Edited by Jaroslaw Watrobski, Wojciech Salabun, Carlos Toro, Cecilia Zanni-Merk, Robert J. Howlett, Lakhmi C. Jain; International audience; Nowadays, special attention is directed to trust issues in the Decentralized Online Social Network (DOSN). In a distributed system for social networking, interactions and collaborations can be unreliable because some users resort to malicious behaviors in order to increase their trust values in the network to be chosen later by others, and launch trust-related attacks. In this unreliable situation, users will not be able to estimate the trustworthiness of the received social services’ list of recommendations. Hence, a trust management model becomes a necessity in order to overcome its trust-related attacks and to recommend trustworthy social services. In this respect, we propose a new trust management model that helps prevent trust-related attacks in order to ensure a reliable environment. Towards this end, our suggested model implements a new technology, called blockchain. Based on the studied trust-related attacks, we intend to add logical security to blockchain since this technology takes into account only the physical security. Evaluation values show the effectiveness of our model.

23 páginas, 4 figuras, 1 tabla, Well-known international security frameworks try to eliminate or mitigate different kinds of risks on the assets covered by their scopes (e.g., people, goods, information, and reputation). To date, to the best of our knowledge, any of these approaches neither provide a comprehensive perspective on security (considered as the merge of physical and logical security) nor consider sustainability as one of the levers for their design, implementation, and execution. This work presents a comprehensive security proposal through a framework that fits to the organizational security needs and contributes to the achievement of the sustainability objectives of an organization by avoiding duplicities and large security gaps from disjointed approaches. The work is supported by a methodology, which is the result of the wide and long work experience of the co-authors on security over the years in different organizations, businesses, and scopes. As it is shown in the theoretical exemplification included in the paper, the proposed framework combines the complementary and joint action of various actors for the protection of assets capable of achieving efforts and dedication efficiency, by merging the aspects of physical and logical security., This research has been partially supported by the Institute of Physical and Information Technologies (ITEFI), Spanish National Research Council (CSIC). The authors would like to thank the anonymous reviewers for their valuable comments.

One primary goal of a computer system and data network security program is to prevent unauthorized access to computer systems and facilities. Another goal, should unauthorized access occur, is to prevent the misuse of, or damage to, computer and network assets. This chapter brings together fundamental security concepts to provide data center managers and data network managers with an overview of the data security function. Computer systems and data networks must be secured against three types of violations: unauthorized access, misuse, and damage. When customers are granted direct access to the organization’s computer systems via the company’s or a third party’s data network, the usual credit checks and business viability verifications need to be performed. The trend is toward much broader access to an organization’s computer systems. Examples are students and staff having direct access to college computer systems, customers and suppliers connecting into companies’ systems, and private citizens accessing government data.

Electronic payment protocols play a vital role in electronic commerce security, which is essential for secure operation of electronic commerce activities. Formal method is an effective way to verify the security of protocols. But current formal method lacks the description and analysis of timeliness in electronic payment protocols. In order to improve analysis ability, a novel approach to analyze security properties such as accountability, fairness and timeliness in electronic payment protocols is proposed in this paper. This approach extends an existing logical method by adding a concise time expression and analysis method. It enables to describe the event time, and extends the time characteristics of logical inference rules. We analyzed the Netbill protocol with the new approach and found that the fairness of the protocol is not satisfied, due to timeliness problem. The result illustrates the new approach is able to analyze the key properties of electronic payment protocols. Furthermore, the new approach can be introduced to analyze other time properties of cryptographic protocols.

Security is an important success factor for the digital workplace. As the EXP manages a lot of confidential employee information, it is imperative to ensure that the proper security standards are adopted. A comprehensive security framework covers all aspects of security such as logical security, functionality security, application security, security event tracking, and such.

We introduce VisIDAC presented in Song at al (In: Nguyen, P.Q., Zhou, J. (eds.) Information Security—20th International Conference, ISC 2017, Security and Cryptology, vol. 10599. Springer International Publishing, 2017), which is a 3-D real-time visualization of security event log collection detected by intrusion detection systems installed in multiple networks. VisIDAC consists of three parallel plane-squares which represent global source networks, target networks, and global destination networks. Security events are displayed in different shapes, colors and spaces, according to their main features. It helps security operators to immediately understand the key properties of security events. We also apply VisIDAC to a public cyber security operations center, Science and Technology Cyber Security Center (ST whether they are inbound or outbound traffic; whether they are momentary or continuous; and what protocol and port number are mainly used.

Owing to the high value of business data, sophisticated cyber-attacks targeting enterprise networks have become more prominent, with attackers trying to penetrate deeper into and reach wider from the compromised machines. An important security requirement is that domain experts and network administrators have a common vocabulary to share security knowledge and quickly help each other respond to new threats. We propose an innovative ontology and graph-based approach for security assessment. An ontology is designed to represent security knowledge such as that of assets, vulnerabilities, and attacks in a common form. Using the inference abilities of the ontological model, an efficient system framework is proposed to generate attack graphs and assess network security. The performance of the proposed system is evaluated on test networks of differing sizes and topologies.

Rapidly changing in Information Technology initiates various innovation that aims to provide convenience for enterprises, organizations, and institutions. Innovation is created to ease users in completing tasks and activities. Unfortunately, easiness in innovation gives chances of fraud and disruption to happen. This paper discusses how countermeasures on those issues are done in Salatiga Library and Archive Office using 4 (four) control aspects in Information System Audit: environtment security control, physical security control, logical security control, and IS operation control. This paper use three step of method, they are: planning and preparation, implementation, and reporting. The aim of this research is to examine the Information System security level in Salatiga Library and Archive Office.

This paper explains various security issues in the existing home automation systems and proposes the use of logic-based security algorithms to improve home security. This paper classifies natural access points to a home as primary and secondary access points depending on their use. Logic-based sensing is implemented by identifying normal user behavior at these access points and requesting user verification when necessary. User position is also considered when various access points changed states. Moreover, the algorithm also verifies the legitimacy of a fire alarm by measuring the change in temperature, humidity, and carbon monoxide levels, thus defending against manipulative attackers. The experiment conducted in this paper used a combination of sensors, microcontrollers, Raspberry Pi and ZigBee communication to identify user behavior at various access points and implement the logical sensing algorithm. In the experiment, the proposed logical sensing algorithm was successfully implemented for a month in a studio apartment. During the course of the experiment, the algorithm was able to detect all the state changes of the primary and secondary access points and also successfully verified user identity 55 times generating 14 warnings and 5 alarms.

Traffic volumes in mobile networks are rising and end-user needs are rapidly changing. Mobile network operators need more flexibility, lower network operating costs, faster service roll-out cycles, and new revenue sources. The 5th Generation (5G) and future networks aim to deliver ultra-fast and ultra-reliable network access capable of supporting the anticipated surge in data traffic and connected nodes in years to come. Several technologies have been developed to meet these emergent demands of future mobile networks, among these are software defined networking, network function virtualization, and cloud computing. In this paper, we discuss the security challenges these new technologies are prone to in the context of the new telecommunication paradigm. We present a multi-tier component-based security architecture to address these challenges and secure 5G software defined mobile network (SDMN), by handling security at different levels to protect the network and its users. The proposed architecture contains five components, i.e., secure communication, policy-based communication, security information and event management, security defined monitoring, and deep packet inspection components for elevated security in the control and the data planes of SDMNs. Finally, the proposed security mechanisms are validated using test bed experiments.

The frequency of unauthorized actions to information systems (IS) in the process of their integration is steadily increasing, which inevitably leads to huge financial and material losses. According to statistics, internal users of IS, commit more than half of all violations. All of this forms a dangerous group of risk. Existing approaches for IS security are mainly provided by specialized tools of differentiation of user access to information resources. At the same time each user is assigned certain rights, in accordance with which it is permitted/prohibited local access to information is stored in PC, or remote access via communication links to information available on other PC.After analyzing we identified 2 major vulnerabilities: tools of differentiation of local access are not able to provide protection against the actions of offenders are not directly related to obtaining unauthorized access to IS resources and tools of differentiation of remote access does not provide protection from network by internal users of the system.The results of this research will lead to an improvement of the process of ensuring effective protection against threats to information security in the IS.

The main goal of the research consists in the elaboration of a system concerning the investigation of security communication, which regards a set of security factors, such as: the degree of encryption, the freshness of nonces, intruder activation, the lifetime of keys, secrets, etc. This paper is devoted to the presentation of systematization formalisms describing the functioning of a security model. In our variant, we investigate the changes of all chosen factors (security attributes) during the realization of protocol operations. The security attributes should be systematically corrected in this process. It changes the general security level of communication. The audit system strategy leads us to one of the most noticeable security in fluence characteristics that refer to time parameters. We can introduce the notation concerning the lifetime of elements (key, message, nonces, secret, etc.). When the value of time activity of an element exceeds its lifetime, then the communication security is definitely threatened. By using special rules presented in the works of Burrows, and Needham2, among other authors, and by creating additional logic formulas, we can estimate intermediate security probability parameters. Finally, we propose a certain kind of probability time automata in order to investigate and predicate different types of communication threats. These automata are built on the basis of a colored Petri net. In addition, this investigation consists in checking communication security (or a kind of threats) and making a threat prediction about possible cases that are connected with losing information. We also included in the model a procedure of security modification with respect to time (the activity of some parameters depends on time). We define the finite set of states by using the LU - technique (interval attribute activity) of a date notation. The proposed system resolves security problem in more comprehensive (multifaceted) way. Ingredient security factors can be grouped in different combinations. This approach increased the range of investigated threaten structures to even unknown hacker algorithm inventions.

Successful execution of future network-centric military operations relies on effective enforcement of both need-to-know and responsibility- to-share principles. In modern military missions and coalitions, which have an increasingly agile character, a promising solution is to enforce security policies based on the properties of individual information objects - we call this approach content-based security. This article discusses the enforcement of content-based security policies at the different layers of the TCP/ IP model, and introduces a proof-of-concept implementation of a content-based protection and release mechanism in a software-defined networking environment. Our aim is to provide consistent enforcement of security policies across multiple system layers and multiple security dimensions (confidentiality, integrity, and availability). The results of an analysis of a concrete example of a software-defined network emulated in Mininet are encouraging and confirm the effectiveness of our approach with respect to improving protection of data in transit. The work presented in this article offers a basis for further research in this area.

The security of computer systems often relies upon decisions and actions of end users. In this paper, we set out to investigate users’ susceptibility to cybercriminal attacks by concentrating at the most fundamental component governing user behavior—the human brain. We introduce a novel neuroscience-based study methodology to inform the design of user-centered security systems as it relates to cybercrime. In particular, we report on an functional magnetic resonance imaging study measuring users’ security performance and underlying neural activity with respect to two critical security tasks: 1) distinguishing between a legitimate and a phishing website and 2) heeding security (malware) warnings. We identify the neural markers that might be controlling users’ performance in these tasks, and establish relationships between brain activity and behavioral performance as well as between users’ personality traits and security behavior. Our results provide a largely positive perspective on users’ capability and performance vis-a-vis these crucial security tasks. First, we show that users exhibit significant brain activity in key regions associated with decision-making, attention, and problem-solving (phishing and malware warnings) as well as language comprehension and reading (malware warnings), which means that users are actively engaged in these security tasks. Second, we demonstrate that certain individual traits, such as impulsivity measured via an established questionnaire, are associated with a significant negative effect on brain activation in these tasks. Third, we discover a high degree of correlation in brain activity (in decision-making regions) across phishing detection and malware warnings tasks, which implies that users’ behavior in one task may potentially be predicted by their behavior in the other. Fourth, we discover high functional connectivity among the core regions of the brain, while users performed the phishing detection task. Finally, we discuss the broader impacts and implications of our work on the field of user-centered security, including the domain of security education, targeted security training, and security screening.

Cryptographic algorithms rely on the strengths of all their fundamental components and expect them to be harmonious in accomplishing desired levels of security in applications. In order for a security solution to be sophisticated and to provide high security (measured in terms of the security goals it satisfies), the solution needs to typically involve complex mathematical operations and/or multiple stages of operation. While these might offer increased security, such solutions might not be applicable to all systems. We refer to resource-constrained wireless networks, such as radio frequency identification and wireless body area networks, where the resources available on-chip are often decided by the balance between device costs, requirements of longevity and usability. The constraints, thus, require designing solutions that use simple logical operations and are based on reuse of functions, while introducing sufficient unpredictability to increase security. In this paper, we present a key management and message signature generation scheme called HiveSec, whose design is inspired by the symmetry in beehives and the nature of bee swarms, and which offers security through unpredictability and reduced resource usage. We validate our work through simulation studies and security analysis.

The rapid proliferation of personal wearable as well as embedded devices point to the emergence of networks of unprecedented size and complexity in the near future. Unfortunately, traditional network security solutions fall short of addressing the unique security requirements of the emerging environment given their general emphasis on administratively managed, preconfigured security context and strong physical security mechanisms. To cope with the security challenges of this emerging environment, novel cognitive-inspired security architectures have been proposed that emphasize dynamic, autonomous trust management. Cognitive security systems take advantage of sensing and computing capabilities of smart devices to analyze raw sensor data and apply machine learning techniques to make security decisions. In this article, we present a canonical representation of cognitive security architectures and examine the practicality of using these architectures to address the security challenges of rapidly growing networks of mobile/embedded autonomous devices including the ability to identify threats simply based on symptoms, without necessarily understanding attack methods. Using authentication as the main focus, we introduce our canonical representation and define various categories of contextual information commonly used by cognitive security architectures to handle authentication requirements, and highlight key advantages and disadvantages of each category. We then examine three grand challenges facing the cognitive security research including the tension between automation and security, the unintended consequences of using machine learning techniques as a basis for making security decisions, and the revocation problem in the context of cognitive security. We conclude by offering some insight into solution approaches to these challenges.

The adoption of the cloud paradigm to access IT resources and services has posed many security issues which need to be cared of. Security becomes even a much bigger concern when services built on top of many commercial clouds have to interoperate. Among others, the value of the service delivered to end customers is strongly affected by the security of network which providers are able to build in typical SOA contexts. Currently, every provider advertises its own security strategy by means of proprietary policies, which are sometimes ambiguous and very often address the security problem from a non-uniform perspective. Even policies expressed in standardized languages do not appear to fit a dynamic scenario like the SOA's, where services need to be sought and composed on the fly in a way that is compatible with the end-to-end security requirements. We then propose an approach that leverages on the semantic technology to enrich standardized security policies with an ad-hoc content. The semantic annotation of policies enables machine reasoning which is then used for both the discovery and the composition of security-enabled services. In the presented approach the semantic enrichment of policies is enforced by an automatic procedure. We further developed a semantic framework capable of matchmaking in a smart way security capabilities of providers and security requirements of customers, and tested it on a use case scenario. Semantic matchmaking of security policies in cloud environments.Security ontology for modeling security concepts.Automatic semantic annotation of WS-SecurityPolicy policies.

The fact that the security facilities within a system are closely coupled and the security facilities between systems are unconnected results in an isolated protection structure for systems, and gives rise to a serious challenge to system security integrations and system controls. Also, the need for diversified services and flexible extensions of network security asks for more considerations and contributions from the perspective of software engineering in the process of designing and constructing security systems. Based on the essence of the virtualization technique and the idea of software-defined networks, we in this paper propose a novel software-defined security architecture for systems. By abstracting the traditional security facilities and techniques, the proposed security architecture provides a new, simple, effective, and programmable framework in which security operations and security controls can be decoupled, and thereby reduces the software module sizes, decreases the intensity of software developments, and improves the security extensibility of systems.

We exhaustively discuss the security threats of LTE access network.The scheme boosts the security level and improves performance of the network.We contribute to the methods of security protocols verification.The bandwidth consumption of exchange of authentication vectors is reduced by 79%.The computational, communication and storage overheads are significantly reduced. Display Omitted In recent years, Long Term Evolution has been one of the promising technologies of current wireless communication systems. Quality of service and data rate contribute for the robustness of the field. These two factors are the sum up of transmission rate, security delay, delay variation and some other communication factors. Despite its high data rate and quality of service, Long Term Evolution has some drawbacks as far as the security of this technology is concerned. Particularly, there are some security holes in authenticating users for access in the domain of Access Network. For instance, when User Equipment requests for attachment, the International Mobile Subscriber Identity (IMSI) is sent over network without security protection, hence privacy does not hold. In addition, many parameters are generated by invoking a function with only one input key by which compromising this key results in the whole failure of the system security. So as to mitigate these and some other huge security problems, the researchers, propose an improved approach without adding extra cost so that it can be implemented within the same environment as the existing security system (Evolved Packet System Authentication and Key agreement). As one of the performance enhancements, fetching authentication vectors from foreign network is enabled instead of fetching from home network, which significantly reduces the authentication delay and message overhead. Generally, the purpose is to boost the security level and performance of the protocol keeping the architecture of the system as similar as the conventional security system. These has been exhaustively analyzed and verified under network as well as security verification and simulation tools.

Due to extensive use of Cloud services and newly evolving security threats, most cloud service providers (CSP) deploy varieties of security devices such as, firewalls, IPSec, IDS, etc. for controlling resource accesses based on the data centre security requirements. Today CSPs are looking for systematically hardening the security by incorporating multiple security devices in the network in a cost-effective way. In this paper, we present an automated framework for synthesizing data centre security configurations. We take a dummy data centre topology, CSP security (connectivity and isolation) requirements and business constraints (usability and cost) as input; and then synthesizes the correct and optimal data centre security. It determines the optimal placement of different security devices in the data centre.

Real-time multimedia sharing in Consumer-centric Multimedia Network (CMN) requires usability anywhere, anytime and from any device. However, CMNs are usually located or implemented on application layer, which makes CMNs subjected to their fixed substrate security framework. A fundamental diversifying attribute for the customized security experiences of CMNs is pressing. This paper proposes a programmable network structure which is named Service Processing Chain (SPC) based on network function combination. The SPC is established by the ordinal combination of network functions in substrate switches dynamically, and therefore constructs a special channel for each CMN with required security. The construction and reconfiguration algorithms of SPC are also discussed in this paper. Evaluations and implementation show that above approaches are effective in providing multilevel security with flexibility and expansibility. It is believed that the SPC could provide customized security service and drive participative real-time multimedia sharing for CMNs.

We detected limits of SIEM systems while being used to protect critical infrastructures from sophisticated cyberattacks.We developed a new data collection and pre-correlation framework named "GET".GET links physical to logical security and exploits knowledge of the Business Process.The GET framework has been integrated into the open-source SIEM OSSIM.We validated the GET in a dam control system and a mobile phone based payment service. Security Information and Event Management (SIEM) is a consolidated technology that relies on the correlation of massive amounts of security-relevant information in order to detect ongoing attacks and intrusions. This correlation process is usually fed with logs generated by network devices and equipment, thus proving to be ineffective against attacks that affect multiple domains (e.g. physical, logical) or different architectural levels (e.g. network, operating system, application) of a service infrastructure. To bridge the gap, we propose a flexible framework for event collection and correlation, namely the Generic Event Translator, which is able to process heterogeneous data and spot evidence of security issues by using complex event pattern detectors that correlate information from multiple architectural layers and domains of the monitored infrastructure. The framework has been integrated into the open-source SIEM OSSIM, and validated in two challenging case studies, namely a dam infrastructure control system and a mobile phone based payment service. Display Omitted

The main objective of this work is to analyze and extend security model of mobile devices running on Android OS. Provided security extension is a Linux kernel security module that allows the system administrator to restrict program's capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. Module supplements the traditional Android capability access control model by providing mandatory access control (MAC) based on path. This extension increases security of access to system objects in a device and allows creating security sandboxes per application.

Lately, the Internet of Things (IoT) has opened up new opportunities to business and enterprises, however, the cost of providing security and privacy best practices is preventing numerous organizations from adopting this innovation. With the proliferation of connecting devices in IoT, significant increases have been recorded in energy use, harmful contamination and e-waste. A new paradigm of green IoT is aimed at designing environmentally friendly protocols by reducing the carbon impact and promote efficient techniques for energy use. There is a consistent effort of designing distinctive security structures to address vulnerabilities and attacks. However, most of the existing schemes are not energy efficient. To bridge the gap, we propose the hybrid logical security framework (HLSF), which offers authentication and data confidentiality in IoT. HLSF uses a lightweight cryptographic mechanism for unique authentication. It enhances the level of security and provides better network functionalities using energy-efficient schemes. With extensive simulation, we compare HLSF with two existing popular security schemes, namely, constrained application protocol (CoAP) and object security architecture for IoT (OSCAR). The result shows that HLSF outperforms CoAP and OSCAR in terms of throughput with low computational, storage and energy overhead, even in the presence of attackers.

Embedded terminal devices are widely used in security-critical systems such as financial payments, and the security of their confidential data is becoming a concern for people. This paper presents a design method of embedded secure dual-core processor for smart terminal devices. The method uses a combination of physical security design and logical security design to protect the confidential data. In the physical security design, a physical isolation between the two cores is implemented through the interconnection network and the dual-core communication module, so that the confidential data runs in a closed environment completely isolated from the actual application to prevent the possibility of the confidential data being drawn at the application development terminal. In the logical security design, using the advantages of dual core, a combination of software and hardware is adopted to implement two-core cooperative encryption to prevent side-channel attacks from leaking confidential data. The proposed processor has very little hardware overhead and performance penalty.

Intelligent transportation systems and the advent of smart cities have created a renewed research interest in vehicular networks (VANET). These ad-hoc networks are the key technology for new collaborative approaches to increase the efficiency and safety of our roads. In effect, city-scale field trials are being conducted by major high-tech companies to explore the capabilities and limitations of vehicle-to-infrastructure and vehicle-to-vehicle communication. Initial advances have led to safety enhancing applications like the electronic emergency brake light, cooperative collision avoidance and cooperative adaptive cruise control. In IEEE standard 1609.2, security measures to guarantee the integrity and authenticity of VANET messages are specified. However, physical properties like spatial proximity and driving direction are not considered. These become notably important when vehicles make decisions that concern the safety of users for example to avoid a collision. We propose a novel approach to verify the ongoing copresence of two vehicles. Our method is based on the observation that the trajectory through a road network can be used to uniquely define a vehicle's location as well as its driving direction. Our system provides a protocol to authenticate VANET messages for a group of vehicles driving in succession and to de-authenticate vehicles that have left the formation. To demonstrate the feasibility of trajectories as proof for co-presence, we implemented a smartphone application and conducted driving experiments under real-world conditions. We analyze the road network of several major cities from different continents to show the generalizability of our approach. Additionally, we systematically evaluate the security properties of our system by performing city-scale simulations under realistic conditions.

Password cracking tools have given hackers the ability to solve hashes in minutes. These same tools can also be used for penetration testing to determine weak passwords within our own infrastructure. In using products, such as, Cain and Abel or Ophcrack, organizations can gain insight and awareness that could be the stronghold in keeping accounts and personal health information (PHI) safe. Cain and Abel, and Ophcrack, which are the two password cracking tools tested, can be both useful and very dangerous at the same time. While many can learn from these products, so can their adversaries. In using these products to test our own password strengths we can foresee vulnerabilities that we may have been overlooked. As new software is created, passwords will become easier to crack. Technology knows no boundaries in many aspects, which is why securing our networks, strengthening our physical and logical security, and mitigating every risk possible, becomes of utmost importance in this technology-ridden world.

As ICT is incorporated into the existing electrical grid, security threats can also be unintentionally introduced to the Smart Grid, as has happened with conventional information and communication networks. To avoid this, a new security architecture design addressing the particular characteristics of ICT is required. This paper proposes a logical architecture considering the case of electric vehicle telecommunication, which is one of the core Smart Grid services and one closely related to actual users. Based on that architecture, we analyzed the security threats and the respective security measures required to respond to them. By analyzing the security techniques and algorithms applicable to the Smart Grid environment and applying them to address its security requirements and threats we proposed a new security architecture for Smart Grid.

The history of computing shows simple ideas that caught on: personal computers, the Internet, cloud computing, and smartphones were timely inventions that became successful, sometimes beyond the expectations of their original designers and developers. But ideas that work for one mode of use sometimes show serious limitations in other environments. Creators must anticipate unintended uses, even though predicting change is difficult. Designers must document expectations and limitations of products so that adapters will know when an expanded use threatens security. And developers must accept responsibility for the security of their products. The relatively small group of security professionals can no longer be assumed responsible for anticipating and countering all security threats.

Cloud computing emerges as a way to dynamically increase the capacity or capabilities in infrastructure architectures, software delivery, and development models. However, security is one of the major issues with mobile applications as they can be attacked by malicious users which reduces the growth of cloud computing and complications with data privacy and data protection. In this paper, a mobile-based security agent is presented which provides security mechanisms to security agents as well as hosts. This type of security agent is significant in providing security mechanism to security risks in cloud computing due to its ability to migrate from one host to another where it can resume its processing and service provisioning. Additionally, some of the current attacks are created that attackers may initiate. A fault tolerance at a high level was enabled for mobile-based distributed transaction processing in the cloud. The results show that most of the attack messages were detected and identified, and the type of attack was identified within a specific period of time.

Network security management is becoming more and more complicated in recent years, considering the need of deploying more and more network security devices/middle-boxes at various locations inside the already complicated networks. A grand challenge in this situation is that current management is inflexible and the security resource utilization is not efficient. The flexible deployment and utilization of proper security devices at reasonable places at needed time with low management cost is extremely difficult. In this paper, we present a new concept of network security virtualization, which virtualizes security resources/functions to network administrators/users, and thus maximally utilizing existing security devices/middle-boxes. In addition, it enables security protection to desirable networks with minimal management cost. To verify this concept, we further design and implement a prototype system, NETSECVISOR, which can utilize existing pre-installed (fixed-location) security devices and leverage software-defined networking technology to virtualize network security functions. At its core, NETSECVISOR contains: 1) a simple script language to register security services and policies; 2) a set of routing algorithms to determine optimal routing paths for different security policies based on different needs; and 3) a set of security response functions/strategies to handle security incidents. We deploy NETSECVISOR in both virtual test networks and a commercial switch environment to evaluate its performance and feasibility. The evaluation results show that our prototype only adds a very small overhead while providing desired network security virtualization to network users/administrators.

The Internet of Things (IoT) will feature pervasive sensing and control capabilities via a massive deployment of machine-type communication (MTC) devices. The limited hardware, low-complexity, and severe energy constraints of MTC devices present unique communication and security challenges. As a result, robust physical-layer security methods that can supplement or even replace lightweight cryptographic protocols are appealing solutions. In this paper, we present an overview of low-complexity physical-layer security schemes that are suitable for the IoT. A local IoT deployment is modeled as a composition of multiple sensor and data subnetworks, with uplink communications from sensors to controllers, and downlink communications from controllers to actuators. The state of the art in physical-layer security for sensor networks is reviewed, followed by an overview of communication network security techniques. We then pinpoint the most energy-efficient and low-complexity security techniques that are best suited for IoT sensing applications. This is followed by a discussion of candidate low-complexity schemes for communication security, such as on–off switching and space-time block codes. The paper concludes by discussing open research issues and avenues for further work, especially the need for a theoretically well-founded and holistic approach for incorporating complexity constraints in physical-layer security designs.

Software Defined Networking (SDN) is rapidly emerging as a new paradigm for managing and controlling the operation of networks ranging from the data center to the core, enterprise, and home. The logical centralization of network intelligence presents exciting challenges and opportunities to enhance security in such networks, including new ways to prevent, detect, and react to threats, as well as innovative security services and applications that are built upon SDN capabilities. In this paper, we undertake a comprehensive survey of recent works that apply SDN to security, and identify promising future directions that can be addressed by such research.

Software Defined Networking (SDN) has emerged as a new network architecture for dealing with network dynamics through software-enabled control. While SDN is promoting many new network applications, security has become an important concern. This paper provides an extensive survey on SDN security. We discuss the security threats to SDN according to their effects, i.e., Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service, and Elevation of Privilege. We also review a wide range of SDN security controls, such as firewalls, IDS/IPS, access control, auditing, and policy management. We describe several pathways of how SDN is evolving. We presented an extensive survey on Software Defined Networks with focus on security.We majorly divided survey in two categories or perspectives; security attacks and controls or countermeasures.We presented our own vision on how security may evolve in future based on SDN.

Searching and Security plays a major role in cloud computing. Providing encryption for the outsourced data is security concern in cloud computing. Service providers will take care of security for the data stored by the users. In this paper, the new security is provided by the service providers and data is authorized by the data owners and finally encrypted data searched by the users and decrypt the data for usage. In this paper, advanced attribute keyword search is used to provide security and data can access only by owner's permission. Results will show the performance of the data security.

Regarding countless network disorders or invasions happening nowadays from 2014 until 2015, illegal access intended to attack through the communication line provided by ISP (Internet Service Provider) appears to be the source of the problem. As a defensive way to prevent such network-based attacks, not only stabilization structures for network communication but various policies as well as physical security devices and solutions corresponding to those have been realized and established. Therefore, now is the time to gain foundational research data to secure network security sections by producing logical area on communication bandwidth or such, suggest tasks to expand the communication line which is another research topic in the network security market, and recognize the fact that the active communication bandwidth linkage paradigm using network communication bandwidth is needed as one of the areas that can realize physical security. Additionally, it is necessary to limit the data in the forms of organizing visible security structures into a certain range of physical information by re-dividing communication capacity being currently provided by telecommunicators into subdivided organizational areas and applying the logical virtualization of communication capacity in each of the areas divided. By proposing a network security section based on a logical field application in place of the existing physical structure, basic data that designs a stable physical network communication structure will be provided.

In this paper, a method to identify components per unit task system is expressed with node, module, and interface. We define security subject per unit task system and explain node, module, and interface per component. According to the defined security standard in design phase, we also perform to design and elaborate security attributes for node and module as identified security subjects in their defined tables. And then we describe the composition standard for security attribute design with some examples, after classifying it into security subject, access subject, access control area, identification or verification area, and encryption.

In this paper, we present a novel method to verify the financial site and prevent sensitive information disclosure with financial security card and smart phone. This method allows homepage access when user accesses to the valid site with right security card and smart phone. Furthermore, traditional OTP method cannot be secure against to Man in the middle attack, but out method presents the countermeasure of this. User can readily recognize the phishing and pharming sites and even avoid Man in the middle attack by malicious users.

To make cloud computing environments more secure, this paper focuses on the security of virtualized server systems. A security layer is introduced to the secure architecture of a virtualized server as an abstraction. Because the security layer will play a key role in securing the virtualized server, there is a need for it to be sufficiently robust to tackle the most common security threats associated with cloud computing. First, security threats to cloud computing are analysed based on a publication from an international organization and the security issues surrounding virtualized servers are clarified. Following this, the security elements and their functions for each of the security requirements for virtualized servers are defined. The relationship between the security issues and security elements is then presented to verify the effectiveness of the security layer. It is shown that, using the proposed security elements, the security issues facing virtualized server systems in cloud computing are adequately mitigated. Therefore, our research will be helpful in the development of virtualized servers by making cloud computing more secure.

The security of information systems is the most important principle that can also be said that the most difficult, because security must be maintained throughout the system. At the beginning of this article we are going to introduce basic principles of security. The securities of distributed systems are divided into two parts: A portion of the communication between users and processes is concerned with examining issues such as authentication, message integrity and encryption will be discussed. In the next section, we will examine the guaranteed access permissions to resources in distributed systems. In addition to traditional access solutions, access control in mobile codes will be examined.

There have been various security measures that deal with data security in wired or wireless network, where these measures help to make sure that data from one point to another is intact, by identifying, authenticating, authorizing the right users and also encrypting the data over the network. Data communication between computers has brought about countless benefits to users, but the same information technologies have created a gap, a vulnerable space in the communication medium, where the data that’s been exchanged or transferred, thereby causing threats to the data. Especially data on wireless networks are much exposed to threats since the network has been broadcasted unlike a wired network. Data security in the past dealth with integrity, confidentiality and ensuring authorized usage of the data and the system. Less or no focus was placed on the reactive approach or measures to data security which is capable of responding properly to mitigate an attacker and avoid harm and also to prevent future attacks. This research is going to expose the mechanisms and measures of data security in wireless networks from the reactive security approaches point of view and exposes the reactive approaches used to enhance data security.

E-mail security becomes critical issue to research community in the field of information security. Several solutions and standards have been fashioned according to the recent security requirements in order to enhance the e-mail security. Some of the existing enhancements focus on keeping the exchange of data via e-mail in confident and integral way. While the others focus on authenticating the sender and prove that he will not repudiate from his message. This paper will survey various e-mail security solutions. We introduce different models and techniques used to solve and enhance the security of e-mail systems and evaluate each one from the view point of security.