Security Issues and Solutions in Multicast Environment through Tree based Scheme

Multicast is the delivery of a message or information to a group of destination computers simultaneously in a single transmission from the source creating copies automatically in other network elements, such as routers, only when the topology of the network requires it. Multicasting security is hard because of Open group membership, everyone gets same pack ets, Senders need not be members. We first present taxonomy of mu lticast scenarios on the Internet and point out relevant security concerns. Next we address two major security problems of multicast communication: source authentication, and key revocation. Maintaining authenticity in multicast protocols is a much more complex problem than for unicast, in particular known solutions are prohibitively inefficient in many cases. We present a solution that is reasonable for a range of scenarios. Our approach can be regarded as a midpoi nt between traditional Message Authentication Codes and digital signatures. We also present an improved solution to the key revocation problem

Cybersecurity of Online Proctoring Systems

The online proctored examinations are adopted exceedingly in all forms of academic education and professional training. AI with Machine Learning technology take the leading role in supporting authentication, authorization, and operational control of proctored online examination. The paper discusses how administrative, physical, and technical controls can help mitigate related cybersecurity vulnerabilities of online proctoring systems (OPS). The paper considers two classes of OPS: fully automated AI-enabled systems and hybrid systems (automated AI-enabled with an expert live proctor in control). Based on the review of 20 online proctoring systems, the paper discusses methods and techniques of multi-factor authentication and authorizations, including the use of challenge-response, biometrics (face and voice recognition), and blockchain technology. The discussion of operational controls includes the use of lockdown browsers, webcam detection of behavioral signs of fraud, endpoint security, VPN and VM, screen-sharing and keyboard listening programs, technical controls to mitigate the absence of spatial (physical area) controls, compliance with regulations (GDPR), etc. Other topics discussed include confidentiality of the exam content, logging of control data, video and sound recording for auditing, limitations of endpoint-based security protection and detection techniques of behavior-based cheating and the effect of new intrusive technology on students’ privacy. In conclusion, the paper lists advanced features of online proctoring systems

IoT-REX: A Secure Remote-Control System for IoT Devices from Centralized Multi-Designated Verifier Signatures

IoT technology has been developing rapidly, while at the same time, notorious IoT malware such as Mirai is a severe and inherent threat. We believe it is essential to consider systems that enable us to remotely control infected devices in order to prevent or limit malicious behaviors of infected devices. In this paper, we design a promising candidate for such remote-control systems, called IoT-REX (REmote-Control System for IoT devices). IoT-REX allows a systems manager to designate an arbitrary subset of all IoT devices in the system and every device can confirm whether or not the device itself was designated; if so, the device executes a command given from the systems manager. Towards realizing IoT-REX, we introduce a novel cryptographic primitive called centralized multi-designated verifier signatures (CMDVS). Although CMDVS works under a restricted condition compared to conventional MDVS, it is sufficient for realizing IoT-REX. We provide an efficient CMDVS construction from any approximate membership query structures and digital signatures, yielding compact communication sizes and efficient verification procedures for IoT-REX. We then discuss the feasibility of IoT-REX through cryptographic implementation of the CMDVS construction on a Raspberry Pi. Our promising results demonstrate that the CMDVS construction can compress communication size to about 30% and thus its resulting IoT-REX becomes three times faster than a trivial construction over typical low-power wide area networks with an IoT device. It is expected that IoT-REX can control 12,000 devices within a second.Comment: Updated as a whole. 26 page

A wireless multicast delivery architecture for mobile terminals

Content delivery over the Internet to a large number of mobile users offers interesting business opportunities for content providers, intermediaries, and access network operators. A user could receive, for example, music or a digital newspaper directly to a mobile device over wireless networks. Currently, content delivery over the Internet is held back by a number of reasons. Existing network technologies, such as GPRS, have a very limited capacity to transfer large files, such as those required for good-quality pictures in a newspaper. Another problem is security. Content received over the Internet is very vulnerable to being forged. A user who cannot be certain about the source and consistency of the received stock quotes is unlikely to pay for the information. Furthermore, content providers are unwilling to distribute their valuable information over the Internet due to their fear of copyright infringements. Traditionally, content has been considered consumed as soon as it has been downloaded. Content providers have been keen on preventing their content from being transferred over peer-to-peer networks because they consider the delivery itself to be a copyright infringement. In this dissertation, content delivery is separated from content consumption by encrypting the content before delivery. When the users wishes to consume the content, a license which includes the decryption key is provided. The architecture allows content to be delivered to users' devices even before the user commits to consume the content. The user can choose to receive content whenever downloading it is the most convenient and affordable. Thus, the content providers are able to maintain control over the use of their information even after the data has been transferred to the users' terminals. In addition, content received by users can be strongly source authenticated. The architecture allows secure, efficient and reliable delivery of content to a large group of receivers. The architecture does not commit itself to any specific delivery technique, and the content can be delivered using any delivery technique including multicast, broadcast, unicast, and peer-to-peer. This dissertation focuses mostly on multicast as the delivery technique. The efficiency of the multicast delivery over unreliable heterogenous wireless access networks is thoroughly analyzed. Mobile terminals can seamlessly switch between access points and access technologies while continuing to receive data reliably from the network. The multicast delivery uses adaptive error correction and retransmissions to deliver the content as efficiently as possible to a very large number of receivers. The simulations show, that the vast majority of receivers are able to receive the content reliably with a small delay even when the radio network suffers from high packet loss probability. Although the architecture is designed to deliver content to mobile terminals, it is also suitable for delivering content to terminals with fixed Internet connectivity.Digitaalisen sisällön siirtäminen liikkuville käyttäjille Internetin yli tarjoaa uusia liiketoimintamahdollisuuksia niin sisällöntuottajille, välittäjille kuin verkko-operaattoreille. Teknikkaa voidaan käyttää esimerkiksi musiikin tai sähköisten lehtien välittämiseen käyttäjille langattoman verkon kautta. Sisällön välittämistä Internetin kautta hankaloittaa yhä usea seikka. Nykyisin laajassa käytössä olevat verkkotekniikat, kuten GPRS, ovat liian hitaita siirtämään hyvin suuria tiedostoja suurelle määrällä vastaanottajia. Lisäksi väärennetyn tiedon välittäminen Internetin kautta on erittäin helppoa. Sisältö, jonka aitoudesta ja alkuperästä ei ole varmuutta, on usein arvotonta käyttäjälle. Sisällöntuottajat puolestaan ovat haluttomia käyttämään sisältönsä levittämiseen Internetiä mikäli digitaalisesti levitettävän sisällön kopioiminen ja oikeudeton kuluttaminen on liian helppoa. Perinteisesti sisältö ajatellaankin kulutetuksi jo sillä hetkellä, kun se on siirretty käyttäjän laitteeseen. Sen vuoksi sisällön tuottajat ovatkin käyttäneet paljon resursejaan estääkseen sisältönsä välittämisen vertaisverkoissa, koska jo pelkkää sisällön siirtämistä pidetään tekijänoikeusrikkomuksena. Tässä työssä erotetaan sisällön siirtäminen sisällön kuluttamisesta suojaamalla sisältö salauksella ennen sen siirtämistä käyttäjille ja sallimalla vapaa salatun sisällön jakelu. Arkkitehtuuri mahdollistaa sisällön siirtämisen käyttäjien laitteille silloin kun sisällön siirtäminen on edullisinta ja tehokkainta. Vasta käyttäjän halutessa kuluttaa aiemmin lataamaansa sisältöä, tarkistetaan oikeis sisällön käyttöön. Arkkitehtuuri mahdollistaa myös ladatun sisällön alkuperän ja eheyden vahvan tarkistamisen. Arkkitehtuuri mahdollistaa turvallisen, tehokkaan ja luotettavan sisällön siirtämisen suurelle määrälle vastaanottajia. Arkkitehtuuri ei pakota sisällön jakelua käyttämään mitään tiettyä siirtomenetelmää vaan sisältö voidaan siirtää käyttäen esimerkiksi ryhmälähetystä (multicast), joukkolähetystä (broadcast), täsmälähetystä (unicast) tai vertaisverkkoja (peer-to-peer). Tässä työssä on keskitytty analysoimaan ryhmälähetyksen soveltuvuutta tiedon siirtomenetelmänä. Ryhmälähetysmenetelmän tehokkuutta on analysoitu siirrettäessä sisältöä heterogeenisen langattoman liityntäverkon yli. Liikkuvat päätelaitteet voivat siirtyä saumattomasti liityntäverkosta toiseen samalla kun ne vastaanottavat sisältöä. Ryhmälähetys hyödyntää adaptiivista virheenkorjausta ja uudelleenlähetyksiä siirtääkseen sisällönmahdollisimman tehokkaasti suurelle joukolle vastaanottajia. Simulaatiot osoittavat, että erittäin suuri osa vastaanottajista saa sisällön luotettavasti ja pienellä viiveellä vaikka liityntäverkossa pakettien virhetodennäköisyys olisi suuri. Arkkitehtuuri on suunniteltu siirtämään sisältöä liikkuville laitteille, mutta sitä voidaan käyttää yhtä hyvin myös kiinteään verkkoon liitettyjen laitteiden kanssa.reviewe

Using trusted platform module for securing virtual environment access in cloud

With the increasing usage of Cloud and the Virtualization technology, there comes also an increasing demand to ensure the security levels of all computing environments and components associated and accordingly in this work we propose a new machine authentication mechanism using Trusted Platform Module that can be used to provide a secure access to virtual environments in the cloud. The proposed authentication module is aiming to contribute in providing a solution to Poor machine identity, Multi-tenancy as well as Malicious insiders known security problems in the cloud. It is targeting the access security to graphical user interface of virtual machines hosted on VirtualBox hypervisor in a Linux based environment through authenticating clients trying to connect using the client\u27s Trusted Platform Module Public Endorsement key as a pre-authorized signature to the virtual environment in addition to the normal user name and password authentication of the connecting user. Results obtained from the output of this work indicates that it is possible to authenticate the machines based on their Trusted Platform Module signatures and provide them access to VirtualBox environment only based on a pre-defined Access Control List with minimal one time overhead upon establishing the initial connection