Cellular automata based user authentication scheme using identity-bits commitment for wireless sensor network

In Wireless Sensor Network (WSN) communication, authentication between the communicating nodes is an important aspect and has gained intensive interest from the researcher all around the world. With the advance of the technology where the communication devices are all in small form factor, high speed and low cost authentication scheme for generating Message Authentication Code (MAC) is definitely a demand. This paper introduces a new fast and lightweight authentication scheme based on Cellular Automata (CA) utilizing a so called Identity-bits Commitment embedded in a temper resistance chip inside the wireless sensors. The security analysis shows that our scheme is secure against thwart replay attack and lightweight for fast implementation

Contrast-distorted image quality assessment based on curvelet domain features

Contrast is one of the most popular forms of distortion. Recently, the existing image quality assessment algorithms (IQAs) works focusing on distorted images by compression, noise and blurring. Reduced-reference image quality metric for contrast-changed images (RIQMC) and no reference-image quality assessment (NR-IQA) for contrast-distorted images (NR-IQA-CDI) have been created for CDI. NR-IQA-CDI showed poor performance in two out of three image databases, where the pearson correlation coefficient (PLCC) were only 0.5739 and 0.7623 in TID2013 and CSIQ database, respectively. Spatial domain features are the basis of NR-IQA-CDI architecture. Therefore, in this paper, the spatial domain features are complementary with curvelet domain features, in order to take advantage of the potent properties of the curvelet in extracting information from images such as multiscale and multidirectional. The experimental outcome rely on K-fold cross validation (K ranged 2-10) and statistical test showed that the performance of NR-IQA-CDI rely on curvelet domain features (NR-IQA-CDI-CvT) significantly surpasses those which are rely on five spatial domain features

Improve of contrast-distorted image quality assessment based on convolutional neural networks

Many image quality assessment algorithms (IQAs) have been developed during the past decade. However, most of them are designed for images distorted by compression, noise and blurring. There are very few IQAs designed specifically for Contrast Distorted Images (CDI), e.g. Reduced-reference Image Quality Metric for Contrast-changed images (RIQMC) and NR-IQA for Contrast-Distorted Images (NR-IQA-CDI). The existing NR-IQA-CDI relies on features designed by human or handcrafted features because considerable level of skill, domain expertise and efforts are required to design good handcrafted features. Recently, there is great advancement in machine learning with the introduction of deep learning through Convolutional Neural Networks (CNN) which enable machine to learn good features from raw image automatically without any human intervention. Therefore, it is tempting to explore the ways to transform the existing NR-IQA-CDI from using handcrafted features to machine-crafted features using deep learning, specifically Convolutional Neural Networks (CNN).The results show that NR-IQA-CDI based on non-pre-trained CNN (NR-IQA-CDI-NonPreCNN) significantly outperforms those which are based on handcrafted features. In addition to showing best performance, NR-IQA-CDI-NonPreCNN also enjoys the advantage of zero human intervention in designing feature, making it the most attractive solution for NR-IQA-CDI

Enhancing Federated Learning with spectrum allocation optimization and device selection

Machine learning (ML) is a widely accepted means for supporting customized services for mobile devices and applications. Federated Learning (FL), which is a promising approach to implement machine learning while addressing data privacy concerns, typically involves a large number of wireless mobile devices to collect model training data. Under such circumstances, FL is expected to meet stringent training latency requirements in the face of limited resources such as demand for wireless bandwidth, power consumption, and computation constraints of participating devices. Due to practical considerations, FL selects a portion of devices to participate in the model training process at each iteration. Therefore, the tasks of efficient resource management and device selection will have a significant impact on the practical uses of FL. In this paper, we propose a spectrum allocation optimization mechanism for enhancing FL over a wireless mobile network. Specifically, the proposed spectrum allocation optimization mechanism minimizes the time delay of FL while considering the energy consumption of individual participating devices; thus ensuring that all the participating devices have sufficient resources to train their local models. In this connection, to ensure fast convergence of FL, a robust device selection is also proposed to help FL reach convergence swiftly, especially when the local datasets of the devices are not independent and identically distributed (non-iid). Experimental results show that (1) the proposed spectrum allocation optimization method optimizes time delay while satisfying the individual energy constraints; (2) the proposed device selection method enables FL to achieve the fastest convergence on non-iid datasets.Comment: This paper is accepted by IEEE/ACM Transactions on Networkin

Cybersecurity Vulnerabilities in Smart Grids with Solar Photovoltaic: A Threat Modelling and Risk Assessment Approach

Cybersecurity is a growing concern for smart grids, especially with the integration of solar photovoltaics (PVs). With the installation of more solar and the advancement of inverters, utilities are provided with real-time solar power generation and other information through various tools. However, these tools must be properly secured to prevent the grid from becoming more vulnerable to cyber-attacks. This study proposes a threat modeling and risk assessment approach tailored to smart grids incorporating solar PV systems. The approach involves identifying, assessing, and mitigating risks through threat modeling and risk assessment. A threat model is designed by adapting and applying general threat modeling steps to the context of smart grids with solar PV. The process involves the identification of device assets and access points within the smart grid infrastructure. Subsequently, the threats to these devices were classified utilizing the STRIDE model. To further prioritize the identified threat, the DREAD threat-risk ranking model is employed. The threat modeling stage reveals several high-risk threats to the smart grid infrastructure, including Information Disclosure, Elevation of Privilege, and Tampering. Targeted recommendations in the form of mitigation controls are formulated to secure the smart grid’s posture against these identified threats. The risk ratings provided in this study offer valuable insights into the cybersecurity risks associated with smart grids incorporating solar PV systems, while also providing practical guidance for risk mitigation. Tailored mitigation strategies are proposed to address these vulnerabilities. By taking proactive measures, energy sector stakeholders may strengthen the security of their smart grid infrastructure and protect critical operations from potential cyber threats

Forecasting number of vulnerabilities using long short-term neural memory network

Cyber-attacks are launched through the exploitation of some existing vulnerabilities in the software, hardware, system and/or network. Machine learning algorithms can be used to forecast the number of post release vulnerabilities. Traditional neural networks work like a black box approach; hence it is unclear how reasoning is used in utilizing past data points in inferring the subsequent data points. However, the long short-term memory network (LSTM), a variant of the recurrent neural network, is able to address this limitation by introducing a lot of loops in its network to retain and utilize past data points for future calculations. Moving on from the previous finding, we further enhance the results to predict the number of vulnerabilities by developing a time series-based sequential model using a long short-term memory neural network. Specifically, this study developed a supervised machine learning based on the non-linear sequential time series forecasting model with a long short-term memory neural network to predict the number of vulnerabilities for three vendors having the highest number of vulnerabilities published in the national vulnerability database (NVD), namely microsoft, IBM and oracle. Our proposed model outperforms the existing models with a prediction result root mean squared error (RMSE) of as low as 0.072

New Differential Cryptanalysis Results for the Lightweight Block Cipher BORON

BORON is a 64-bit lightweight block cipher based on the substitution-permutation network that supports an 80-bit (BORON-80) and 128-bit (BORON-128) secret key. In this paper, we revisit the use of differential cryptanalysis on BORON in the single-key model. Using an SAT/SMT approach, we look for differentials that consist of multiple differential characteristics with the same input and output differences. Each characteristic that conforms to a given differential improves its overall probability. We also implemented the same search using Matsui\u27s algorithm for verification and performance comparison purposes. We identified high-probability differentials which were then used in key recovery attacks against BORON-80/128. We first show that the previous differential cryptanalysis attack against 9-round of BORON was at most an 8.5 round attack due to the omission of the final block XOR layer. Then, we used 8-round differentials with a probability of $2^{-58.156}$ and $2^{-62.415}$ in key recovery attacks against 9 and 10 rounds of BORON-80 and BORON-128 with time/data/memory complexities of {$2^{63.63}/2^{62}/2^{55}$ and $2^{100.28}/2^{64}/2^{71}$} respectively. Our key recovery framework provides a more accurate estimate of the attack complexity as compared to previous work. The attacks proposed in this paper are the best differential attacks against BORON-80/128 in the single-key model to date

A novel secret key generation based on image link

One of the main problems with symmetric encryption is key distribution especially when involving large number of users i.e to generate identical keys at different locations. To address this challenge, we proposed a novel algorithm of secret key infusion protocol (SKIP) to generate an identical secret key. While, the key is generated based on a provided image link, starting pattern and string length which must be kept in secret as the algorithm is publicly known. The image from website must be a static image and used as the input of random bits to produce string of hexadecimal values. In a case where image link is compromised, the adversary has to guess other layers of parameters in starting pattern and string length. The generated secret keys were identical at two different locations. In other observation, different secret keys were generated even with the same image link and pattern length but different starting pattern

Risk analysis of water grid systems using threat modeling

Critical infrastructure systems consist of physical and cyber assets that are essential to the operation of the economy and the government. As one of the most important critical infrastructures worldwide, the water sector has become vulnerable to new risks in the form of cyber threats that can severely impact public health, and are difficult to detect. A water grid system (WGS) plays an important role in guarding the business processes of the water sector against possible threats and risks. Threat modeling can be used to analyze threats to the WGS. It is applied to identify points of access to the assets and devices of the system, classify threats to them, assess the risks posed by them, and suggest mitigation measures. Each threat is classified based on its type according to the STRIDE methodology, and the results of the threat classification can be used to assess the level of risk by using the DREAD methodology. This yields a risk rating for each threat that can be used to devise mitigation measures to minimize the risk posed by it. Through the threat modeling stage, it is known that the high-risk threats on WGSs are tampering with a risk score of 14, denial of service threats with a risk score of 13, and repudiation threats with a risk score of 12. The results of the ranking are used to formulate recommendations in the form of mitigation controls against these threats

A collision resistant cryptographic hash function based on cellular automata rules

The subject of this thesis is the study of collision resistant hash function. A cryptographic hash function is one of the cryptographic primitives designed to protect the integrity of data such as that in digital signatures and online business transactions. Popular hash functions are Message Digest 4/5 (MD-4/5), Secure Hashing Algorithm (SHA-0/1) and RIPEMD, which are referred to as MDx-class hash functions due to some commonalities in their design with the MD-family. However, recent advances in cryptanalysis have led to the failure of these hash functions in preserving the strongest property called collision resistance. Factors contributing to the failure are a mathematical weakness found in the Boolean functions used by these cryptographic hash functions, linear message expansion and poor difusion in the step operation. This study proposes a design framework for collision resistant hash function. The framework divides requirements for the design of hash function into three classifications namely design requirements, security requirements for Boolean function and analysis requirements. Following the framework introduced here, a dedicated cryptographic hash function named STITCH-256 was introduced. In STITCH-256 design,an improved formula for message expansion and a step operation that employs a novel permutation technique for better bit propagation, which is called the stitching permutation, are introduced. For the improved formula for message expansion,the study shows that the formula produces higher codewords with minimal weight as compared to the existing formula of message expansion. This leads the effort of attackers to construct differential characteristics with high probability becomes more difficult and challenging. In the step operation that employs a novel stitching permutation, the study shows that the bit propagations are higher and no sufficient condition can be given to construct differential characteristics with high probability. Thus, it is very difficult to and inner collisions in the compression function of STITCH-256. For the second classification in the framework, the study examines the cryptographic properties of 256 one-dimensional Cellular Automata (CA) rules to and cryptographically strong Boolean functions. The study shows that 23 of the rules are cryptographically strong where eight of them are used in our hash function design. Following the third classification of the framework, STITCH-256 is analyzed against all the generic attacks and is measured against its avalanche effect and randomness. The security analysis shows that STITCH-256 is resistant against all the generic attacks and it is very difficult to construct a small list of conditions that gives a successful construction of collision path. The experiments to measure the avalanche effect involved 3000 samples of 512-bit input message and it has been shown that the average avalanche factor for STITCH-256 for these 3000 sequences is 0.5, which is the desired avalanche factor in cryptographic primitives. The 3000 sequences of 256-bit hash values are tested for randomness using NIST Statistical Tests and the results show that the output values from STITCH-256 for these sequences are random. This study also includes a comparison between STITCH-256 and other MDx-class hash functions. The comparison shows that STITCH-256 employs fewer operations which lead to faster computation. From the security analysis carried out in this thesis, we believe that STITCH-256 is a strong collision resistant hash function. This is due to its new non-linear recursive function for message expansion that gives higher codewords with minimal weight,its step operation that employs stitching permutation in a target-heavy Balanced Feistel Network that gives no set of conditions for the construction of collision path using established differential attack being constructed, and cryptographically strong Boolean function used in the compression function of STITCH-256 that gives strong non-linearity and diffusion property