Email security remains crucial in todays digital information exchange, with Pretty Good Privacy (PGP), which is one of the widely used encryption techniques for email. However, PGPs key distribution vulnerabilities persist as a significant challenge. We previously integrated blockchain technology with Elliptic Curve Cryptography (ECC) and zero-knowledge proofs (zk-SNARKs) to enhance PGP key distribution. This approach utilized blockchains immutability for secure key sharing and zk-SNARKs for efficient verification without exposing sensitive data. While our initial implementation improved key distribution security, it utilized a fixed ECC key length, which did not address the diverse security needs of users across various contexts. Email communications range from simple personal messages to highly sensitive corporate or government correspondence, each requiring different levels of encryption strength. Additionally, users operate on devices with varying computational capabilities, from smartphones to high-performance workstations. This paper introduces a flexible key length mechanism to our blockchain-based PGP key distribution system. We implement support for multiple ECC key lengths (ECC-256, ECC-384, and ECC-521), allowing users to dynamically adjust encryption strength based on message sensitivity, recipient requirements, and device capabilities. We evaluate this approach by analyzing blockchain performance metrics, including gas consumption, transaction costs, and memory requirements, through case studies of three different scenarios: casual personal email, professional communication, and highly confidential government communication.
The development of fully autonomous, software-defined vehicles has recently become a hot topic. This advancement paves the way for service-oriented and software-centric approaches to in-vehicle computation. However, it also increases the hardware requirement for the ever-growing software demands. As more hardware components are added to the computing system, resource management and security for mixed-criticality operating environments become increasingly challenging, and virtualization has emerged as a promising technology for managing and isolating heterogeneous computing resources in vehicles. However, a major drawback of virtualization is performance degradation and how application processes communicate efficiently with low latencies via a portable application programming interface (API) in a virtualized environment remains a challenge. In this work, we propose a framework, Zenoh Virtualization Link, or ZVLink, that integrates efficient virtualization with a lightweight open-source pub/sub API, Zenoh, to achieve efficient and real-time interprocess communications across colocated virtual machines (VMs). Experimental results demonstrate that an unoptimized Zenoh delivers messages across VMs at 15 MB/s, which is 82
This paper addresses the security challenges in Federated Learning (FL) by proposing FLARE (Federated Learning with Autonomous Robust Enhancements), a blockchain-based solution. While FL enables collaborative model training without sharing raw data, existing systems often rely on a centralized server for aggregation, creating vulnerabilities and a single point of failure. FLARE integrates blockchain to decentralize trust, ensuring that model updates are securely validated, recorded, and tamper-resistant. By leveraging a hierarchical network structure, FLARE enhances scalability, robustness, and client security. The proposed method mitigates risks like model poisoning and malicious clients in real-world federated learning systems.
With the increasing popularity of high-bandwidth applications, the need for applications capable of multi-path aggregation transmission has risen. These applications enhance bandwidth utilization and network redundancy, simultaneously optimizing network performance by employing multiple network paths. However, deploying such technology involves complex processes and necessitates advanced equipment. We propose a solution that leverages an open-source routing platform combined with multi-path aggregation transmission, aiming to enhance network performance through software upgrades rather than hardware replacement. The system comprises a proxy router and an aggregation server, which facilitate the conversion of traditional TCP traffic into multi-path aggregation transmission traffic. Experiments demonstrate that the system substantially improves transmission efficiency and network reliability for users possessing single network interfaces that lack native support for the protocol, thereby broadening the potential applications of multi-path aggregation transmission.
Proxy re-encryption (PRE) enables a semi-trusted entity, known as a proxy, to convert a ciphertext under one public key into a ciphertext under another public key without learning the underlying plaintext. This functionality has numerous applications, including e-mail forwarding and encrypted file systems. Most existing post-quantum PRE schemes are based on lattice assumptions. In this paper, we propose a novel post-quantum PRE scheme based on isogenies. Our scheme is multi-hop bidirectional PRE and provides security against chosen plaintext attacks. We construct the PRE using a natural public key encryption (PKE) derived from CSIDH group actions.
In the distributed cloud-edge continuum (CEC), high unpredictability and variability of workloads is a major challenge for an edge service provider (ESP), who wants to achieve an optimal trade-off between the quality of experience (QoE) it offers to its heterogeneous edge users (EUs) and the cost for dynamically renting edge resources. In this paper, we propose QoE-aware spot pricing schemes that align edge users’ incentives with ESP’s system-level objectives. In particular, the proposed personalized spot pricing scheme (PSP) deals with the “tragedy of the commons” phenomenon by applying personalized discounts to elastic EUs according to each one’s individual contribution to overall system’s cost reduction. Simulation results show that PSP affects EUs’ behavior much more efficiently than the state-of-the-art spot pricing scheme by: i) ensuring fair allocation of financial benefits among EUs so that inelastic users do not benefit from the actions of elastic users, ii) considerably reducing system’s cost (from 15
As artificial intelligence technology rapidly evolves, data security and privacy protection have become paramount concerns. Federated Learning, a privacy-preserving distributed machine learning approach, facilitates model training without the need for data to leave local devices, significantly reducing the risk of data breaches. However, the variability in network conditions and the heterogeneity of data across devices can lead to performance disparities, introducing biases in the model transmission process and potentially compromising the effectiveness of privacy preservation. To mitigate this issue, we propose CAFL, a novel method for node feature extraction that combines node clustering based on Contrastive Learning with Self-Attention. CAFL is designed to optimize task allocation and model aggregation by carefully assessing node characteristics. We select nodes with high performance and stability (termed "strong node") to build a robust Federated Learning system. Experimental results demonstrate that CAFL outperforms its stochastic static counterparts in terms of network communication efficiency.hin
Side-channel attacks, which leverage physical information during encryption, are a significant threat to cryptographic hardware systems. One widely used countermeasure against such attacks is Threshold Implementation that employs randomness to disrupt the correlation between intermediate values and side-channel information. It consumes a massive amount of fresh randomness every clock for the refreshing process, which adds randomness to intermediate values to obtain uniformity. Thus, reducing the cost of randomness generation is a huge implementation challenge. This paper investigates the impact on the side-channel resistance of AES with threshold implementation when altering the conditions of input sharing or the PRNG algorithm used in refreshing. Furthermore, we meticulously conduct a comparative analysis of the hardware implementation cost of PRNGs based on either Keccak, XORSHIFT-ADD, or Linear Feedback Shift Register. This comprehensive study provides a clear understanding of the strengths and weaknesses of each PRNG, aiding in selecting the most suitable implementation for a given application. Then, we demonstrate that a key-recovery attack is possible when TI is implemented with unshared input values and that side-channel leakage occurs when the PRNG used in refreshing has a very short period.
In the evolving landscape of mobile security threats, traditional detection methods often struggle to effectively identify and mitigate the risks posed by malicious APKs. This study introduces an integrated approach that combines the strengths of Snort and Wireshark with the dynamic response capabilities of Wazuh Manager. Initially, we leverage Snort's robust network intrusion detection capabilities, enhanced through a custom plugin in Wireshark, to monitor and analyze APK file transfers. This setup allows for effective capture and initial screening of APKs based on known malicious signatures and anomalous network patterns. We then employed Wazuh Manager to facilitate an active response strategy. It automates the response to threats detected by Snort, for instance, isolating the affected systems, alerting administrators, and preventing the execution of suspicious APKs. This proactive approach not only aims to stop malware before it causes harm but also adaptively handles the evolving threat landscape by continuously updating detection rules and response strategies based on new intelligence. Our research indicates that an effective defense against malicious APKs involves monitoring, detecting, and actively responding to these threats. The integration of these tools provides a scalable and adaptable framework that can evolve with emerging threats, offering practical solutions for both organizational and individual security needs. This research investigates the potential of combining network and detection tools, which have been proven effective in computer settings, with active response systems. It establishes a foundation for future advancements in mobile security methodologies using a layered defense approach, making it highly relevant to the broader field of mobile internet security.
Classic McEliece is one of the most promising public key encryption schemes in the NIST PQC Round 4. Thus, there are many researches on cryptanalysis of this cryptosystem. In particular, Hemmert et al. (PQCrypto 2022) proposed a backdoor mechanism for (Classic) McEliece and proved that it is possible to embed a backdoor into this cryptosystem in a single-user setting where a single backdoor holder can embed a backdoor into a cryptosystem. In addition, they also presented how to prevent this backdoor mechanism. In this paper, we prove that this backdoor mechanism for (Classic) McEliece is valid in a multi-user setting where multiple users are allowed to use the backdoor mechanism against (Classic) McEliece. This indicates that backdoor holders can embed a backdoor into Classic McEliece in a more practical security model. Furthermore, we also give a slight variant of (Classic) McEliece so that we can prevent the backdoor mechanism in the multi-user setting.
This research paper presents the experience of the authors in implementing protocols for authentication and authorization, along with secure key exchange mechanisms for accessing remote resources within a computing continuum scenario. The implementation encompasses a comprehensive security framework designed to facilitate secure access control and cryptographic key management across resource-constrained Internet of Things (IoT) devices, edge nodes, and cloud platforms, addressing the unique challenges of distributed computing environments. In particular, this implementation integrates the Authentication and Authorization for Constrained Environments (ACE) framework, Ephemeral Diffie-Hellman Over COSE (EDHOC) protocol, and Object Security for Constrained RESTful Environments (OSCORE) protocol. The proposed model combines ACE for authentication and authorization, EDHOC for secure key exchange, and OSCORE for message security. By facilitating the delegation of authorization management to less constrained trusted hosts, the proposed work optimizes resource utilization while maintaining robust security across the entire continuum.
Deep learning models have achieved significant success in a range of computer vision tasks and object detection, particularly in safety and security applications. However, deploying these models on edge devices, presents unique challenges due to limited computational resources, particularly for those cost-effective edge devices without GPU chips, such as Raspberry Pi 4. This work designed a lightweight object recognition model that can be used on edge computing devices with or without a GPU chip, enabling object recognition functionality. Compared to directly running YOLOv7-tiny model on the Raspberry Pi 4, the speed increased by 14 times.
The growth of data volume and access users in the 5G Internet of Things (IoT) has made network traffic increasingly complicated and diversified. Conventional attack traffic detection has been unable to meet the needs of security assurance. Large Language Model (LLM) technology has demonstrated outstanding efficiency in numerous domains. It's a novel direction to using its potent performance for attack detection. This paper proposes an attack detection method called ADL, which uses the LLM performance to detect DDoS attacks through the cloud edge collaboration in the 5G IoT. For optimal LLM performance and first-time traffic detection, the Multi-Layer Perceptron (MLP) is placed at the edge of the Internet of Things and the LLM is deployed in the cloud center. A personalized model parameter method is proposed, so that the detection results of LLM can be fed back to the edge to provide training basis for MLP. In addition, a traffic processing method is proposed to make the traffic sequential for LLM to understand and process it. The experimental results demonstrate a significant improvement in accuracy, recall rate, and F1 value over the conventional neural network detection scheme in the proposed attack detection methods detection performance for five distinct DDoS attacks.
Formal verification is a method used to verify the security of cryptographic protocols. In formal verification, the specifications of a protocol and its security properties are described using the input language of a software tool called a verification tool, enabling automated verification. However, protocol specifications and security properties are generally described and explained in natural language, and rewriting them in the tool's language requires specialized knowledge and time. This study attempts to efficiently make formal descriptions of cryptographic protocols by utilizing an LLM chatbot. Specifically, it explains the process by which the LLM chatbot understands protocol specifications described in natural language and converts them into formal descriptions. By using this approach, we aim to support the initial step of creating inputs for formal verification tools and reduce the effort required when starting to use such tools.
The rise of cooperative vehicles presents new solutions for tackling traffic challenges, particularly in route optimization for travellers. This paper introduces two innovative modules: Secure Hybrid Authentication and Fusion Algorithm (SHAFA), which form a secure, localized route recommendation system. This work utilizes traffic data-such as vehicle speed and density-gathered from a centralized hub to inform real-time routing through Fusion Algorithm (FA). By combining genetic and heuristic methods, FA evaluates factors to deliver optimal routes to cooperative vehicles. Secure communication is ensured through the SHA framework, maintaining privacy and data integrity. Simulation results demonstrate that SHAFA consistently identifies better routes than the traditional greedy algorithms, highlighting its potential to enhance traffic flow and improve user experience.
This research presents a comparative study of machine learning and deep learning techniques for detecting malicious URLs, a key concern in cybersecurity. While machine learning methods are widely used, limited work has explored the effectiveness of stacked models combining multiple algorithms. This study evaluates the performance of three machine learning models—Random Forest, XGBoost, and LightGBM—and three deep learning models—LSTM, BiLSTM, and GRU. Results show that machine learning models achieved accuracy scores of 91
ChaCha is a widely employed stream cipher in hardware and software applications, including its use in TLS 1.3. It generates a 512-bit keystream using modular addition, constant rotation, and exclusive OR operations. The security of ChaCha primarily depends on modular addition, which serves as the central nonlinear operation in its structure. ChaCha's resistance to conventional differential cryptanalysis increases significantly after 3.5 rounds, making searching for long differential characteristics with a high probability of occurrence more challenging. We focused on identifying short differential characteristics with higher probabilities and launched an attack on ChaCha using amplified boomerang cryptanalysis. In this work, we introduced distinguishers for ChaCha7, ChaCha6, and ChaCha4, with complexities of 235.99, 2(36), and 2(34), respectively. This represents the first amplified boomerang attack and the most effective distinguisher attack on the reduced rounds of ChaCha.
Machine learning based access control (MLBAC) models are emerging as efficient access control systems today that can make accurate access control decisions while reducing the administrative burden on human administrators. With the emergence of MLBAC models, there is an administrative problem that needs to be addressed, updating and revising access control states in a system, such as revoking a user's access to an object. This paper focuses on the administration problem of an instance of the MLBAC model, i.e., environment aware deep learning based access control (DLBAC-Env) model. DLBAC-Env is a deep learning model that makes access control decisions based on user, resource, and environment metadata within a system, providing outputs to either allow or deny access control requests. To address the administration problem in this model, we utilize a non-symbolic machine learning approach to incorporate changes in the access control states. Researchers have shown that non-symbolic approaches outperform symbolic ones. Our experimental results for the DLBAC-Env administration problem demonstrate comparable outcomes to previous work, indicating its feasibility and applicability in real-world scenarios.
Image steganography is one of the prominent technologies in data hiding standards. Its goal is to embed confidential data into images without causing perceptible changes in the original image. Higher embedding capacity is one of the important requirements today, but increasing the hiding capacity distorts the stego's visual quality making the system easily detectable to the eavesdropper. An appropriate embedding technique along with an efficient system may achieve a fair balance between embedding capacity and stego image imperceptibility, but it is challenging. In this article, we present a randomized embedding approach that improves the security and robustness of the system by hiding secrets in RGB images. Instead of using the original cover image, a 5-LSBs modified cover image is subjected to a hybrid edge detection technique by using the Fuzzy, Canny, and Prewitt filters to maximize the payload capacity. The suggested approach embeds data using edge pixels only to reduce visually detectable distortion. The message is randomly incorporated into the edge pixels of the blue channel's LSBs. The experiments showed that the method is sufficiently resilient against statistical attacks and provides an increased hiding capacity for concealing secrets in cover images without compromising the quality of the stego image. Furthermore, the outcomes demonstrated that the suggested algorithm outperformed other comparable strategies in every evaluation criterion.
With the increasing importance of satellite communications in B5G/6G networks, satellite network security has become a critical issue. In this paper, distinct from existing literature that primarily focuses on Distributed Denial of Service (DDoS) attack detection schemes for the uplink between ground nodes and satellite nodes, we propose a detection method specifically targeting low-rate DDoS attacks between satellite nodes in multilayer satellite networks. By combining the AlexNet convolutional neural network and the Random Forest (RF) model to construct an ensemble of small models, the proposed method effectively identifies and classifies low-rate DDoS attack traffic originating from satellite nodes. To adapt to the special characteristics of satellite networks, we designed tunnels based on the Delay-Tolerant Networking (DTN) architecture to enable the conversion between the IP stack and the Bundle Protocol (BP) stack. Experimental results demonstrate that the proposed method outperforms existing models regarding precision and F1 score for attack detection. It provides effective security protection for key nodes of multilayer satellite networks and has good potential for practical application.
