Threats to physical layer security from jamming attacks make wireless cognitive communication systems vulnerable. Global Positioning System signal is vulnerable to these attacks. Over the last decade, several types of jamming detection techniques have been proposed, antijamming‐based classical and machine learning (ML) techniques. Most of these techniques are inefficient in detecting jammers. Thus, there is a great need for efficient and quickest jamming detection technique‐based classifier using receiver operating characteristic (ROC) curve for different threshold values with high accuracy. In this work, we compare the efficiency of the proposed orthogonal distance (OD) and score distance (SD) method‐based robust principal component analysis (PCA) in ML classification in detecting jamming signals. Two hypotheses are proposed to distinguish between the presence and absence attack problem. Using this compressed data matrix obtained from modulated wideband converter (MWC) structure via centralized cooperation directly as input of the proposed classifier combined‐based ROC curve for real‐time detection scenarios. The performance of this proposed algorithm‐based robust PCA was evaluated and compared using the detection anomaly rate (DAR%), and false alarm rate (FAR%), area under curve (AUC), and accuracy. The performance of obtained results is good.
干扰攻击对物理层安全的威胁使无线认知通信系统变得脆弱。全球定位系统信号很容易受到这些攻击。在过去十年中，已经提出了几种干扰检测技术，包括基于反干扰的经典技术和机器学习（ML）技术。这些技术在检测干扰器方面大多效率低下。因此，亟需基于干扰检测技术的高效、快速分类器，针对不同的阈值，使用接收器操作特征曲线（ROC）进行高精度检测。在这项工作中，我们比较了基于正交距离（OD）和分数距离（SD）方法的鲁棒主成分分析（PCA）在检测干扰信号的 ML 分类中的效率。提出了两种假设来区分存在和不存在攻击问题。将通过集中合作从调制宽带转换器（MWC）结构中获得的压缩数据矩阵直接作为建议的分类器的输入，结合基于实时检测场景的 ROC 曲线。使用检测异常率（DAR%）、误报率（FAR%）、曲线下面积（AUC）和准确率对所提出的基于鲁棒 PCA 算法的性能进行了评估和比较。所获得的结果性能良好。
{"title":"Intelligent jamming detection‐based robust principal components analysis in communication system for security and defense","authors":"Ahmed Moumena, Imane Saim Haddache","doi":"10.1002/spy2.399","DOIUrl":"https://doi.org/10.1002/spy2.399","url":null,"abstract":"Threats to physical layer security from jamming attacks make wireless cognitive communication systems vulnerable. Global Positioning System signal is vulnerable to these attacks. Over the last decade, several types of jamming detection techniques have been proposed, antijamming‐based classical and machine learning (ML) techniques. Most of these techniques are inefficient in detecting jammers. Thus, there is a great need for efficient and quickest jamming detection technique‐based classifier using receiver operating characteristic (ROC) curve for different threshold values with high accuracy. In this work, we compare the efficiency of the proposed orthogonal distance (OD) and score distance (SD) method‐based robust principal component analysis (PCA) in ML classification in detecting jamming signals. Two hypotheses are proposed to distinguish between the presence and absence attack problem. Using this compressed data matrix obtained from modulated wideband converter (MWC) structure via centralized cooperation directly as input of the proposed classifier combined‐based ROC curve for real‐time detection scenarios. The performance of this proposed algorithm‐based robust PCA was evaluated and compared using the detection anomaly rate (DAR%), and false alarm rate (FAR%), area under curve (AUC), and accuracy. The performance of obtained results is good.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-04-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140700117","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Big data has attracted extensive attention from industries and universities during the past few years. Big data is crucial in many fields, such as business analytics, healthcare, the Internet of Things (IoT), smart home, supply chain, transportation, and fraud detection. Nevertheless, some challenges must be addressed, such as decentralization, integration, data sharing, privacy, and security. On the other hand, blockchain has numerous potential for improving big data services and applications because of its decentralized, verifiable, and anti‐tamper features. We apply the Systematic Literature Review (SLR) approach in this study to investigate blockchain integrity in big data and understand the different topics and significant areas already presented. This paper aims to analyze studies on blockchain integration in big data published between 2017 and 2022. A technical taxonomy is presented for blockchain integration into big data, including data storage, security, and applications based on the field of articles selected by the SLR method. Finally, the achievements and shortcomings of each study are discussed, and future research challenges and open issues related to blockchain integration in big data are highlighted.
{"title":"Blockchain integration in big data: Review, vision, and opportunities","authors":"Vahid Bakhtiary, AmirMasoud Rahmani","doi":"10.1002/spy2.392","DOIUrl":"https://doi.org/10.1002/spy2.392","url":null,"abstract":"Big data has attracted extensive attention from industries and universities during the past few years. Big data is crucial in many fields, such as business analytics, healthcare, the Internet of Things (IoT), smart home, supply chain, transportation, and fraud detection. Nevertheless, some challenges must be addressed, such as decentralization, integration, data sharing, privacy, and security. On the other hand, blockchain has numerous potential for improving big data services and applications because of its decentralized, verifiable, and anti‐tamper features. We apply the Systematic Literature Review (SLR) approach in this study to investigate blockchain integrity in big data and understand the different topics and significant areas already presented. This paper aims to analyze studies on blockchain integration in big data published between 2017 and 2022. A technical taxonomy is presented for blockchain integration into big data, including data storage, security, and applications based on the field of articles selected by the SLR method. Finally, the achievements and shortcomings of each study are discussed, and future research challenges and open issues related to blockchain integration in big data are highlighted.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-03-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140229845","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
This paper aims to provide a guideline for identifying the most suitable online voting system under the given requirements and acceptable tradeoffs. We have selected twelve (more or less) well‐known online voting systems that rely on distinct cryptographic mechanisms for achieving security. For each of the systems, we summarized the key architectural and cryptographic ideas behind their design. Then, we analyzed the required trust assumptions for achieving the three most important security properties (i.e., verifiability, divided between cast‐as‐intended, recorded‐as‐cast, and tallied‐as‐recorded verifiabilities, privacy, and receipt‐freeness). To make a fair comparison, we did our analysis based on identical security definitions. Note that we selected wildly known and well‐accepted definitions, which are scheme‐neutral, to avoid any biases. Also, we discussed some of the most critical practical aspects of those systems, such as–the necessity for secure or anonymous channels, reliance on secure printer facilities and so forth. To facilitate the comparison, we suggested a unified naming convention for system elements based on their roles and functions. Then, based on the unified naming convention, we compared all twelve online voting systems for both the security properties and practical aspects. Finally, we summarized our observations regarding patterns and dependencies we observed, provided guidelines for selecting the online voting system, and gave recommendations regarding system design. We hope our work contributes to the online literature and facilitates the process of selecting the most suitable e‐voting system depending on the requirements of a specific election.
{"title":"Selective comparison of verifiable online voting systems","authors":"T. Finogina, Jordi Cucurull Juan, Nuria Costa","doi":"10.1002/spy2.394","DOIUrl":"https://doi.org/10.1002/spy2.394","url":null,"abstract":"This paper aims to provide a guideline for identifying the most suitable online voting system under the given requirements and acceptable tradeoffs. We have selected twelve (more or less) well‐known online voting systems that rely on distinct cryptographic mechanisms for achieving security. For each of the systems, we summarized the key architectural and cryptographic ideas behind their design. Then, we analyzed the required trust assumptions for achieving the three most important security properties (i.e., verifiability, divided between cast‐as‐intended, recorded‐as‐cast, and tallied‐as‐recorded verifiabilities, privacy, and receipt‐freeness). To make a fair comparison, we did our analysis based on identical security definitions. Note that we selected wildly known and well‐accepted definitions, which are scheme‐neutral, to avoid any biases. Also, we discussed some of the most critical practical aspects of those systems, such as–the necessity for secure or anonymous channels, reliance on secure printer facilities and so forth. To facilitate the comparison, we suggested a unified naming convention for system elements based on their roles and functions. Then, based on the unified naming convention, we compared all twelve online voting systems for both the security properties and practical aspects. Finally, we summarized our observations regarding patterns and dependencies we observed, provided guidelines for selecting the online voting system, and gave recommendations regarding system design. We hope our work contributes to the online literature and facilitates the process of selecting the most suitable e‐voting system depending on the requirements of a specific election.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-03-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140234621","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ethereum smart contracts are a special type of computer programs. Once deployed on the blockchain, they cannot be modified. This presents a significant challenge to the security of smart contracts. Previous research has proposed static and dynamic detection tools to identify vulnerabilities in smart contracts. These tools check contract vulnerabilities based on predefined rules, and the accuracy of detection strongly depends on the design of the rules. However, the constant emergence of new vulnerability types and strategies for vulnerability protection leads to numerous false positives and false negatives by tools. To address this problem, we analyze the characteristics of vulnerabilities in smart contracts and the corresponding protection strategies. We convert the contracts' bytecode into an intermediate representation to extract semantic information of the contracts. Based on this semantic information, we establish a set of detection rules based on semantic facts and implement a vulnerability detection tool SafeCheck using static program analysis methods. The tool is used to detect six common types of vulnerabilities in smart contracts. We have extensively evaluated SafeCheck on real Ethereum smart contracts and compared it to other tools. The experimental results show that SafeCheck performs better in smart contract vulnerability detection compared to other typical tools, with a high F‐measure (up to 83.1%) for its entire dataset.
以太坊智能合约是一种特殊的计算机程序。一旦部署到区块链上，就无法修改。这对智能合约的安全性提出了巨大挑战。以往的研究提出了静态和动态检测工具来识别智能合约中的漏洞。这些工具根据预定义的规则检查合约漏洞，而检测的准确性在很大程度上取决于规则的设计。然而，新的漏洞类型和漏洞保护策略的不断涌现，导致工具出现大量的误报和误判。为了解决这个问题，我们分析了智能合约中的漏洞特征和相应的保护策略。我们将合约字节码转换为中间表示法，以提取合约的语义信息。基于这些语义信息，我们建立了一套基于语义事实的检测规则，并利用静态程序分析方法实现了漏洞检测工具 SafeCheck。该工具用于检测智能合约中六种常见类型的漏洞。我们在真实的以太坊智能合约上对 SafeCheck 进行了广泛评估，并将其与其他工具进行了比较。实验结果表明，与其他典型工具相比，SafeCheck 在智能合约漏洞检测方面表现更好，其整个数据集的 F 测量值很高（达 83.1%）。
{"title":"SafeCheck: Detecting smart contract vulnerabilities based on static program analysis methods","authors":"Haiyue Chen, Xiangfu Zhao, Yichen Wang, Zixian Zhen","doi":"10.1002/spy2.393","DOIUrl":"https://doi.org/10.1002/spy2.393","url":null,"abstract":"Ethereum smart contracts are a special type of computer programs. Once deployed on the blockchain, they cannot be modified. This presents a significant challenge to the security of smart contracts. Previous research has proposed static and dynamic detection tools to identify vulnerabilities in smart contracts. These tools check contract vulnerabilities based on predefined rules, and the accuracy of detection strongly depends on the design of the rules. However, the constant emergence of new vulnerability types and strategies for vulnerability protection leads to numerous false positives and false negatives by tools. To address this problem, we analyze the characteristics of vulnerabilities in smart contracts and the corresponding protection strategies. We convert the contracts' bytecode into an intermediate representation to extract semantic information of the contracts. Based on this semantic information, we establish a set of detection rules based on semantic facts and implement a vulnerability detection tool SafeCheck using static program analysis methods. The tool is used to detect six common types of vulnerabilities in smart contracts. We have extensively evaluated SafeCheck on real Ethereum smart contracts and compared it to other tools. The experimental results show that SafeCheck performs better in smart contract vulnerability detection compared to other typical tools, with a high F‐measure (up to 83.1%) for its entire dataset.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140252435","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sachin Kumar, Akshit Tyagi, Kadambri Agarwal, Saru Kumari, Chien-Ming Chen
In smart cities, a substantial amount of data is collected for analytics and a better life for the citizens. The schemes based on data collection through mobile vehicles (MV) and further verification of that data through unmanned aerial vehicles (UAV) are popular. Many trust‐based schemes of the MV have been proposed recently. However, these schemes suffered from recognition accuracy, judgment trust, and collusion attack problems. In this paper, we propose a Gompetz function‐based trust evaluation scheme. In this scheme, the direct trust of the MV is computed by comparing the data provided by the MV and the same reported by the UAV. Since the UAV can collect only limited data, indirect trust of the vehicle is computed by comparing the data reported by the MV and the same reported by the MV having the highest trust. We also applied the variable trust, which considers the recent Trust of the MVs. Then, combining all these trusts with significant weight, the final trust score of the MV is computed. After experimenting, our proposed scheme is more credible and removes the shortcomings of the existing methods by providing better recognition, accuracy, judgment, and trust.
{"title":"A trustworthy data collection approach from sensor nodes using trust score of mobile vehicles for smart city","authors":"Sachin Kumar, Akshit Tyagi, Kadambri Agarwal, Saru Kumari, Chien-Ming Chen","doi":"10.1002/spy2.382","DOIUrl":"https://doi.org/10.1002/spy2.382","url":null,"abstract":"In smart cities, a substantial amount of data is collected for analytics and a better life for the citizens. The schemes based on data collection through mobile vehicles (MV) and further verification of that data through unmanned aerial vehicles (UAV) are popular. Many trust‐based schemes of the MV have been proposed recently. However, these schemes suffered from recognition accuracy, judgment trust, and collusion attack problems. In this paper, we propose a Gompetz function‐based trust evaluation scheme. In this scheme, the direct trust of the MV is computed by comparing the data provided by the MV and the same reported by the UAV. Since the UAV can collect only limited data, indirect trust of the vehicle is computed by comparing the data reported by the MV and the same reported by the MV having the highest trust. We also applied the variable trust, which considers the recent Trust of the MVs. Then, combining all these trusts with significant weight, the final trust score of the MV is computed. After experimenting, our proposed scheme is more credible and removes the shortcomings of the existing methods by providing better recognition, accuracy, judgment, and trust.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140253120","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
The Internet of Vehicles (IoV) revolutionizes vehicle communication in dynamic networks. Message dissemination in IoV involves sharing critical information for the safety and convenience of the IoV network. It is very crucial to secure message dissemination due to potential cyber‐attacks, traffic disruptions, and privacy breaches. Data integrity, authentication, and privacy are vital to maintaining trust and safety in the IoV network. This network consists of resource‐constrained IoV devices with limited resources due to the availability of embedded components in vehicular systems. Therefore, optimizing algorithms and protocols is crucial for efficient vehicle‐to‐everything (V2X) communication, enhancing safety and transportation efficiency. Solutions often include lightweight protocols and secure message exchange. This paper proposes a machine learning (ML) based secure and lightweight message dissemination framework for resource‐constrained IoV. First, we present an ML‐based threat classification model capable of effectively categorizing adversarial and nonadversarial data streams and delivering an optimized model with superior accuracy. Furthermore, we also propose a secure message dissemination scheme using lightweight cryptographic primitives, which significantly reduces computational, communication, and energy overhead. To validate the robustness of our proposed ML‐based secure and lightweight message dissemination framework, we evaluate it using various security parameters and performance measures such as computation cost, communication cost, energy cost, accuracy, precision, recall, and F1‐score. Our contributions promise to significantly enhance the security and efficiency of message dissemination in IoV environments and advance lightweight, secure, and reliable transportation systems for the future.
车联网（IoV）彻底改变了动态网络中的车辆通信。IoV 中的信息传播涉及 IoV 网络安全和便利性的关键信息共享。由于潜在的网络攻击、交通中断和隐私泄露，确保信息传播安全至关重要。数据完整性、身份验证和隐私对于维护 IoV 网络的信任和安全至关重要。该网络由资源受限的物联网设备组成，由于车辆系统中嵌入式组件的可用性，这些设备的资源十分有限。因此，优化算法和协议对于高效的车对物（V2X）通信、提高安全性和运输效率至关重要。解决方案通常包括轻量级协议和安全信息交换。本文为资源受限的物联网提出了一种基于机器学习（ML）的安全轻量级信息传播框架。首先，我们提出了一种基于 ML 的威胁分类模型，该模型能够有效地对对抗性和非对抗性数据流进行分类，并提供具有卓越准确性的优化模型。此外，我们还提出了一种使用轻量级加密原语的安全信息传播方案，大大降低了计算、通信和能源开销。为了验证我们提出的基于 ML 的安全轻量级信息传播框架的稳健性，我们使用各种安全参数和性能指标（如计算成本、通信成本、能源成本、准确度、精确度、召回率和 F1 分数）对其进行了评估。我们的贡献有望大大提高物联网环境中信息传播的安全性和效率，并推动未来轻量级、安全和可靠的交通系统的发展。
{"title":"Secure and lightweight message dissemination framework for internet of vehicles","authors":"Umesh Bodkhe, S. Tanwar","doi":"10.1002/spy2.387","DOIUrl":"https://doi.org/10.1002/spy2.387","url":null,"abstract":"The Internet of Vehicles (IoV) revolutionizes vehicle communication in dynamic networks. Message dissemination in IoV involves sharing critical information for the safety and convenience of the IoV network. It is very crucial to secure message dissemination due to potential cyber‐attacks, traffic disruptions, and privacy breaches. Data integrity, authentication, and privacy are vital to maintaining trust and safety in the IoV network. This network consists of resource‐constrained IoV devices with limited resources due to the availability of embedded components in vehicular systems. Therefore, optimizing algorithms and protocols is crucial for efficient vehicle‐to‐everything (V2X) communication, enhancing safety and transportation efficiency. Solutions often include lightweight protocols and secure message exchange. This paper proposes a machine learning (ML) based secure and lightweight message dissemination framework for resource‐constrained IoV. First, we present an ML‐based threat classification model capable of effectively categorizing adversarial and nonadversarial data streams and delivering an optimized model with superior accuracy. Furthermore, we also propose a secure message dissemination scheme using lightweight cryptographic primitives, which significantly reduces computational, communication, and energy overhead. To validate the robustness of our proposed ML‐based secure and lightweight message dissemination framework, we evaluate it using various security parameters and performance measures such as computation cost, communication cost, energy cost, accuracy, precision, recall, and F1‐score. Our contributions promise to significantly enhance the security and efficiency of message dissemination in IoV environments and advance lightweight, secure, and reliable transportation systems for the future.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-03-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140260049","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
In the last decade, Internet of Things opened the door to applications of unmanned aerial vehicles (UAVs). Since the data is transferred on a public channel, therefore security, privacy, and efficiency are the main concerns of UAVs communication. Signcryption is a technique to execute encryption and signature in one step. However, the usual signcryption is not applicable to UAVs with constrained nature of resources and ground station. Moreover, in particular, UAVs and ground station need a heterogeneous signcryption for UAVs to establish communication with the ground station. But, the bilinear bilinear mapping is a very costly operation, so we need pairless identity based heterogeneous signcryption. The proposed design is unforgeable and secure against chosen message attacks. The experiment shows the efficiency of the proposed method. It takes less communication and computation costs.
{"title":"A secure and efficient heterogeneous ID‐based signcryption for unmanned aerial vehicular networking system","authors":"Ashutosh Aithekar, Pratik Gupta, Dharminder Chaudhary","doi":"10.1002/spy2.389","DOIUrl":"https://doi.org/10.1002/spy2.389","url":null,"abstract":"In the last decade, Internet of Things opened the door to applications of unmanned aerial vehicles (UAVs). Since the data is transferred on a public channel, therefore security, privacy, and efficiency are the main concerns of UAVs communication. Signcryption is a technique to execute encryption and signature in one step. However, the usual signcryption is not applicable to UAVs with constrained nature of resources and ground station. Moreover, in particular, UAVs and ground station need a heterogeneous signcryption for UAVs to establish communication with the ground station. But, the bilinear bilinear mapping is a very costly operation, so we need pairless identity based heterogeneous signcryption. The proposed design is unforgeable and secure against chosen message attacks. The experiment shows the efficiency of the proposed method. It takes less communication and computation costs.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-03-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140261334","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sonam Yadav, Vivek Dabra, Pradeep Malik, Saru Kumari
Satellite communication is becoming an increasingly important component of the communication process, as all forms of communication are sent over open networks. As a result, there is an increase in the number of security concerns, and several protocols have been established with this consideration in mind. Recently, Dharminder et al. proposed a post‐quantum secure authentication protocol for satellite communication. The protocol is an improved version of Kumar and Garg's protocol. The authors claimed that the protocol resists the vulnerability of Kumar and Garg's protocol and provides post‐quantum security for satellite communication. Despite their claims, we have found that the protocol is vulnerable to a key mismatch attack and an offline dictionary attack. Further, we have improved Dharminder et al.'s proposed protocol that resists the key mismatch attack and offline dictionary attack and have provided the condition for the correctness of the improved protocol. Our formal security proof and implementation results demonstrate that the improved protocol is secure against quantum attacks.
{"title":"Flaw and amendment of Dharminder et al.'s authentication protocol for satellite communication","authors":"Sonam Yadav, Vivek Dabra, Pradeep Malik, Saru Kumari","doi":"10.1002/spy2.383","DOIUrl":"https://doi.org/10.1002/spy2.383","url":null,"abstract":"Satellite communication is becoming an increasingly important component of the communication process, as all forms of communication are sent over open networks. As a result, there is an increase in the number of security concerns, and several protocols have been established with this consideration in mind. Recently, Dharminder et al. proposed a post‐quantum secure authentication protocol for satellite communication. The protocol is an improved version of Kumar and Garg's protocol. The authors claimed that the protocol resists the vulnerability of Kumar and Garg's protocol and provides post‐quantum security for satellite communication. Despite their claims, we have found that the protocol is vulnerable to a key mismatch attack and an offline dictionary attack. Further, we have improved Dharminder et al.'s proposed protocol that resists the key mismatch attack and offline dictionary attack and have provided the condition for the correctness of the improved protocol. Our formal security proof and implementation results demonstrate that the improved protocol is secure against quantum attacks.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-03-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140266002","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Online privacy policies are often lengthy and difficult to understand. This may lead many users to avoid reading them despite increasing concerns about how their personal information is managed. This article presents a structured approach to evaluate the transparency and comprehensiveness of privacy policies using a comprehensive set of evaluation questions within the contextual integrity (CI) framework. We use these questions to identify policies' responses to key privacy concerns. Applying the CI framework, we analyze the clarity and context of these responses, identifying any vagueness and contextual issues that could impede a user's understanding of the privacy policy. Using the CI analysis, we quantify the quality of policies' responses, thereby enabling users to make informed decisions about online services or products. We apply our methodology to two popular messaging apps, Telegram and WhatsApp, using them as case studies to systematically uncover the strengths and weaknesses of their privacy policies. The findings demonstrate that our proposed methodology can effectively identify transparency issues and assess the comprehensiveness of privacy policies. This suggests that our approach could serve as a practical alternative to subjective evaluations typically conducted by privacy experts.
网上隐私政策往往冗长难懂。这可能会导致许多用户回避阅读这些政策，尽管他们对个人信息的管理方式越来越关注。本文提出了一种结构化的方法，在上下文完整性（CI）框架内使用一套全面的评估问题来评估隐私政策的透明度和全面性。我们利用这些问题来确定政策对关键隐私问题的回应。应用 CI 框架，我们分析了这些回应的清晰度和上下文，确定了可能妨碍用户理解隐私政策的任何模糊性和上下文问题。利用 CI 分析，我们可以量化政策回复的质量，从而使用户能够就在线服务或产品做出明智的决定。我们将我们的方法应用于 Telegram 和 WhatsApp 这两款流行的消息应用程序，将它们作为案例研究，系统地揭示其隐私政策的优缺点。研究结果表明，我们提出的方法可以有效识别透明度问题并评估隐私政策的全面性。这表明，我们的方法可以替代通常由隐私专家进行的主观评估。
{"title":"Comprehensive evaluation of privacy policies using the contextual integrity framework","authors":"Shahram Ghahremani, Uyen Trang Nguyen","doi":"10.1002/spy2.380","DOIUrl":"https://doi.org/10.1002/spy2.380","url":null,"abstract":"Online privacy policies are often lengthy and difficult to understand. This may lead many users to avoid reading them despite increasing concerns about how their personal information is managed. This article presents a structured approach to evaluate the transparency and comprehensiveness of privacy policies using a comprehensive set of evaluation questions within the contextual integrity (CI) framework. We use these questions to identify policies' responses to key privacy concerns. Applying the CI framework, we analyze the clarity and context of these responses, identifying any vagueness and contextual issues that could impede a user's understanding of the privacy policy. Using the CI analysis, we quantify the quality of policies' responses, thereby enabling users to make informed decisions about online services or products. We apply our methodology to two popular messaging apps, Telegram and WhatsApp, using them as case studies to systematically uncover the strengths and weaknesses of their privacy policies. The findings demonstrate that our proposed methodology can effectively identify transparency issues and assess the comprehensiveness of privacy policies. This suggests that our approach could serve as a practical alternative to subjective evaluations typically conducted by privacy experts.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-02-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139958248","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
In this paper, we analyze the physical layer security (PLS) performance of nonorthogonal multiple access (NOMA)‐enabled overlay cognitive radio networks (NOMA‐OCRNs) in the presence of an external passive eavesdropper. Here PLS is expressed in terms of the secrecy outage probabilities (SOPs) experienced by the primary user (PU) and secondary user (SU). We obtain approximate expressions for the SOPs of both PU as well as SU assuming a jamming‐free environment, where both primary and secondary destination nodes are half‐duplex devices. To improve the SOP performance, we propose a jamming‐assisted framework, where full‐duplex destination nodes are employed, which are capable of transmitting jamming signals to confound the eavesdropper. Approximate expressions for the SOPs of PU and SU are derived for the jamming‐assisted framework as well. It is demonstrated that the proposed jamming‐assisted framework significantly reduces the SOPs compared to the jamming‐free scenario. We also determine optimal power allocation coefficients (OPACs) for PU and SU at the secondary transmitter that maximizes the total secrecy throughput of the jamming‐assisted NOMA‐OCRN with FD destinations. It is shown that the suggested OPAC significantly enhances the total secrecy throughput, compared to the default selection of the PAC.
本文分析了在外部无源窃听器存在的情况下，支持非正交多址接入（NOMA）的叠加认知无线电网络（NOMA-OCRNs）的物理层安全（PLS）性能。这里的 PLS 用主用户（PU）和次用户（SU）经历的保密中断概率（SOP）来表示。假定在无干扰环境下，主目的节点和次目的节点都是半双工设备，我们得到了主用户和次用户的 SOP 的近似表达式。为了提高 SOP 性能，我们提出了干扰辅助框架，即采用全双工目的节点，这些节点能够发射干扰信号来迷惑窃听者。我们还为干扰辅助框架推导出了 PU 和 SU 的 SOP 近似表达式。结果表明，与无干扰情况相比，建议的干扰辅助框架大大降低了 SOP。我们还确定了副发射机上 PU 和 SU 的最佳功率分配系数 (OPAC)，使带 FD 目的地的干扰辅助 NOMA-OCRN 的总保密吞吐量最大化。结果表明，与默认选择的 PAC 相比，建议的 OPAC 能显著提高总保密吞吐量。
{"title":"Full‐duplex jamming for physical layer security improvement in NOMA‐enabled overlay cognitive radio networks","authors":"P. P. Hema, A. V. Babu","doi":"10.1002/spy2.371","DOIUrl":"https://doi.org/10.1002/spy2.371","url":null,"abstract":"In this paper, we analyze the physical layer security (PLS) performance of nonorthogonal multiple access (NOMA)‐enabled overlay cognitive radio networks (NOMA‐OCRNs) in the presence of an external passive eavesdropper. Here PLS is expressed in terms of the secrecy outage probabilities (SOPs) experienced by the primary user (PU) and secondary user (SU). We obtain approximate expressions for the SOPs of both PU as well as SU assuming a jamming‐free environment, where both primary and secondary destination nodes are half‐duplex devices. To improve the SOP performance, we propose a jamming‐assisted framework, where full‐duplex destination nodes are employed, which are capable of transmitting jamming signals to confound the eavesdropper. Approximate expressions for the SOPs of PU and SU are derived for the jamming‐assisted framework as well. It is demonstrated that the proposed jamming‐assisted framework significantly reduces the SOPs compared to the jamming‐free scenario. We also determine optimal power allocation coefficients (OPACs) for PU and SU at the secondary transmitter that maximizes the total secrecy throughput of the jamming‐assisted NOMA‐OCRN with FD destinations. It is shown that the suggested OPAC significantly enhances the total secrecy throughput, compared to the default selection of the PAC.","PeriodicalId":29939,"journal":{"name":"Security and Privacy","volume":null,"pages":null},"PeriodicalIF":1.9,"publicationDate":"2024-01-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139606417","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：