Under the emerging network coding paradigm, intermediate nodes in the network are allowed not only to store and forward packets but also to process and mix different data flows. We propose a low-complexity cryptographic scheme that exploits the inherent security provided by random linear network coding and offers the advantage of reduced overhead in comparison to traditional end-to-end encryption of the entire data. Confidentiality is achieved by protecting (or "locking") the source coefficients required to decode the encoded data, without preventing intermediate nodes from running their standard network coding operations. Our scheme can be easily combined with existing techniques that counter active attacks.
Wireless Sensor Networks have emerged as one of the leading technologies. These networks are designed to monitor crucial environmental parameters of humidity, temperature, wind speed, soil moisture content, UV index, sound, etc. and then transfer the required information to the base station. However, security remains the key challenge of such networks as critical data is being transferred. Most sensor nodes currently deployed have constraints on memory and processing power and hence operate without an efficient security protocol. Hereby a protocol which is lightweight and is secure for wireles…
By allowing intermediate nodes to perform non-trivial operations on packets, such as mixing data from multiple streams, network coding breaks with the ruling store and forward networking paradigm and opens a myriad of challenging security questions. Following a brief overview of emerging network coding protocols, we provide a taxonomy of their security vulnerabilities, which highlights the differences between attack scenarios in which network coding is particularly vulnerable and other relevant cases in which the intrinsic properties of network coding allow for stronger and more efficient secu…
Arithmetic Coding is an efficient lossless compression scheme applied for many multimedia standards such as JPEG, JPEG2000, H.263, H.264 and H.265. Due to nonlinearity, high error propagation and high error sensitivity of arithmetic coders, many techniques have been developed for extending the usage of arithmetic coders for security as a lightweight joint compression and encryption solution for systems with limited resources. Through this paper, we will describe how to upgrade these techniques to achieve an additional low cost authentication and integrity capabilities with arithmetic coders. C…
Traditional network security protocols depend mainly on developing cryptographic schemes and on using biometric methods. These have led to several network security protocols that are unbreakable based on difficulty of solving untractable mathematical problems such as factoring large integers. In this paper, Security of Networks Employing Encoding and Decoding (SNEED) is developed to mitigate single and multiple link attacks. Network coding and shared capacity among the working paths are used to provide data protection and data integrity against network attackers and eavesdroppers. SNEED can be…
Java platform and third-party libraries provide various security features to facilitate secure coding. However, misusing these features can cost tremendous time and effort of developers or cause security vulnerabilities in software. Prior research was focused on the misuse of cryptography and SSL APIs, but did not explore the key fundamental research question: what are the biggest challenges and vulnerabilities in secure coding practices? In this paper, we conducted a comprehensive empirical study on StackOverflow posts to understand developers' concerns on Java secure coding, their programmin…
Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguration vulnerabilities in the light of Spring security, which is relatively understudied in the existing literature. Towards that goal, we identify 6 types of security anti-patterns and 4 insecure vulnerable defaults by conducting a measurement-based approach on 28 Spring applications. Our analysis shows that security risks associated with the identified security anti-patterns and insecure defaults can leave the enterpris…
Carnegie Mellon University（卡内基梅隆大学）；Microsoft Research（微软研究院）；University of Virginia, Charlottesville（弗吉尼亚大学夏洛茨维尔分校）；University of California, San Diego（加利福尼亚大学圣迭戈分校）
In this paper, we show that a recently published lightweight adaptation of a Fingerprint matching algorithm called the Minutia Cylinder-Code may not be secure as intruders may be able to illegitimately yet successfully authenticate themselves to the system under consideration. We also show that the lightweight adaptation has other privacy related vulnerabilities that make it unsuitable for use in Biometrics. We make it clear that we are neither investigating nor commenting on the security of the original Minutia Cylinder-Code algorithm by itself, rather we highlight the vulnerabilities of the …
Recently, physical layer security in the optical layer has gained significant traction. Security treats in optical networks generally impact the reliability of optical transmission. Linear Network Coding (LNC) can protect from both the security treats in form of eavesdropping and faulty transmission due to jamming. LNC can mix original data to become incomprehensible for an attacker and also extend original data by coding redundancy, thus protecting a data from errors injected via jamming attacks. In this paper, we study the effectiveness of LNC to balance reliable transmission and security in…
Security aspects of the Index Coding with Side Information (ICSI) problem are investigated. Building on the results of Bar-Yossef et al. (2006), the properties of linear coding schemes for the ICSI problem are further explored. The notion of weak security, considered by Bhattad and Narayanan (2005) in the context of network coding, is generalized to block security. It is shown that the coding scheme for the ICSI problem based on a linear code C of length n, minimum distance d and dual distance d^\perp, is (d-1-t)-block secure (and hence also weakly secure) if the adversary knows in advance t \…
In this paper we describe a new, lightweight security mechanism for PSTN-VoIP cooperation that is based on two information hiding techniques: digital watermarking and steganography. Proposed scheme is especially suitable for PSTN-IP-PSTN (toll-by-passing) scenario which nowadays is very popular application of IP Telephony systems. With the use of this mechanism we authenticate end-to-end transmitted voice between PSTN users. Additionally we improve IP part traffic security (both media stream and VoIP signalling messages). Exemplary scenario is presented for SIP signalling protocol along with S…
Two recently published papers propose some very simple key distribution schemes designed to enable two or more parties to establish a shared secret key with the aid of a third party. Unfortunately, as we show, most of the schemes are inherently insecure and all are incompletely specified - moreover, claims that the schemes are inherently lightweight are shown to be highly misleading. We also briefly critique a somewhat related very recent paper by the same authors that uses similar techniques to achieve what are claimed to be secure multiparty computations.
This paper addresses the design of a dedicated homophonic coding for a class of communication systems which, in order to provide both reliability and security, first encode the data before encrypting it, which is referred to as the encoding-encryption paradigm. The considered systems employ error-correction coding for reliability, a stream cipher for encryption, and homophonic coding to enhance the protection of the key used in the stream cipher, on which relies the security of all the system transmissions. This paper presents a security evaluation of such systems from a computational complexi…
Smart metering infrastructure (SMI) is the core component of the smart grid (SG) which enables two-way communication between consumers and utility companies to control, monitor, and manage the energy consumption data. Despite their salient features, SMIs equipped with information and communication technology are associated with new threats due to their dependency on public communication networks. Therefore, the security of SMI communications raises the need for robust authentication and key agreement primitives that can satisfy the security requirements of the SG. Thus, in order to realize the…
This paper applies channel sounding measurements to enable physical-layer security coding. The channel measurements were acquired in an indoor environment and used to assess the secrecy capacity as a function of physical location. A variety of Reed-Muller wiretap codes were applied to the channel measurements to determine the most effective code for the environment. The results suggest that deploying physical-layer security coding is a three-point design process, where channel sounding data guides 1) the physical placement of the antennas, 2) the power settings of the transmitter, and 3) the s…
IoT has enabled the rapid growth of smart remote healthcare applications. These IoT-based remote healthcare applications deliver fast and preventive medical services to patients at risk or with chronic diseases. However, ensuring data security and patient privacy while exchanging sensitive medical data among medical IoT devices is still a significant concern in remote healthcare applications. Altered or corrupted medical data may cause wrong treatment and create grave health issues for patients. Moreover, current remote medical applications' efficiency and response time need to be addressed an…
BlockChain (BC) has attracted tremendous attention due to its immutable nature and the associated security and privacy benefits. BC has the potential to overcome security and privacy challenges of Internet of Things (IoT). However, BC is computationally expensive, has limited scalability and incurs significant bandwidth overheads and delays which are not suited to the IoT context. We propose a tiered Lightweight Scalable BC (LSB) that is optimized for IoT requirements. We explore LSB in a smart home setting as a representative example for broader IoT applications. Low resource devices in a sma…
The Internet of Things, also known as the IoT, refers to the billions of devices around the world that are now connected to the Internet, collecting and sharing data. The amount of data collected through IoT sensors must be completely securely controlled. To protect the information collected by IoT sensors, a lightweight method called Discover the Flooding Attack-RPL (DFA-RPL) has been proposed. The proposed DFA-RPL method identifies intrusive nodes in several steps to exclude them from continuing routing operations. Thus, in the DFA-RPL method, it first builds a cluster and selects the most a…
In recent years, radio frequency identification technology has moved into the mainstream applications that help to speed up handling of manufactured goods and materials. RFID tags are divided into two classes: active and passive. Active tag requires a power source that's why its cost is more than passive tags. However, the low-cost RFID tags are facing new challenges to security and privacy. Some solutions utilize expensive cryptographic primitives such as hash or encryption functions, and some lightweight approaches have been reported to be not secure. This paper describes a lightweight Mutua…
The Internet of Things (IoT) is giving a boost to a plethora of new opportunities for the robust and sustainable deployment of cyber physical systems. The cornerstone of any IoT system is the sensing devices. These sensing devices have considerable resource constraints, including insufficient battery capacity, CPU capability, and physical security. Because of such resource constraints, designing lightweight cryptographic protocols is an opportunity. Remote User Authentication ensures that two parties establish a secure and durable session key. This study presents a lightweight and safe authent…
There is a rich recent literature on how to assist secure communication between a single transmitter and receiver at the physical layer of wireless networks through techniques such as cooperative jamming. In this paper, we consider how these single-hop physical layer security techniques can be extended to multi-hop wireless networks and show how to augment physical layer security techniques with higher layer network mechanisms such as coding and routing. Specifically, we consider the secure minimum energy routing problem, in which the objective is to compute a minimum energy path between two n…
Graph theory has become a very critical component in many applications in the computing field including networking and security. Unfortunately, it is also amongst the most complex topics to understand and apply. In this paper, we review some of the key applications of graph theory in network security. We first cover some algorithmic aspects, then present network coding and its relation to routing.
The universal secure network coding presented by Silva et al. realizes secure and reliable transmission of a secret message over any underlying network code, by using maximum rank distance codes. Inspired by their result, this paper considers the secure network coding based on arbitrary linear codes, and investigates its security performance and error correction capability that are guaranteed independently of the underlying network code. The security performance and error correction capability are said to be universal when they are independent of underlying network codes. This paper introduces…
The current standard of Routing Protocol for Low Power and Lossy Networks (RPL) incorporates three modes of security: the Unsecured Mode (UM), Preinstalled Secure Mode (PSM), and the Authenticated Secure Mode (ASM). While the PSM and ASM are intended to protect against external routing attacks and some replay attacks (through an optional replay protection mechanism), recent research showed that RPL in PSM is still vulnerable to many routing attacks, both internal and external. In this paper, we propose a novel secure mode for RPL, the Chained Secure Mode (CSM), based on the concept of intraflo…
We consider the level of information security provided by random linear network coding in network scenarios in which all nodes comply with the communication protocols yet are assumed to be potential eavesdroppers (i.e. "nice but curious"). For this setup, which differs from wiretapping scenarios considered previously, we develop a natural algebraic security criterion, and prove several of its key properties. A preliminary analysis of the impact of network topology on the overall network coding security, in particular for complete directed acyclic graphs, is also included.
To encrypt sensitive information existing in a color DICOM images, a medical privacy protection scheme (called as MPPS) based on chaos and DNA coding was proposed by using two coupled chaotic systems to produce cryptographic primitives. Relying on some empirical analyses and experimental results, the designers of MPPS claimed that it can withstand a chosen-plaintext attack and some other classic attacking models. However, this statement is groundless. In this paper, we investigate the essential properties of MPPS and DNA coding, and we then propose an efficient chosen-plaintext attack to discl…
In this paper we discuss the ability of channel codes to enhance cryptographic secrecy. Toward that end, we present the secrecy metric of degrees of freedom in an attacker's knowledge of the cryptogram, which is similar to equivocation. Using this notion of secrecy, we show how a specific practical channel coding system can be used to hide information about the ciphertext, thus increasing the difficulty of cryptographic attacks. The system setup is the wiretap channel model where transmitted data traverse through independent packet erasure channels with public feedback for authenticated ARQ (A…
In today's digital age, the ease of data collection, transfer, and storage continue to shape modern society and the ways we interact with our world. The advantages are numerous, but there is also an increased risk of information unintentionally falling into the wrong hands. Finding methods of protecting sensitive information at the hardware level is of utmost importance, and in this paper, we aim to provide a survey on recent developments in attacks on lightweight hardware-based security primitives (LHSPs) designed to do just that. Specifically, we provide an analysis of the attack resilience …
Insecure Coding Preferences in Long-Term Memory: Security Risks for LLM-based Code Generation
Nanjing University（南京大学）；Nanjing University of Aeronautics and Astronautics（南京航空航天大学）；University of Alberta（阿尔伯塔大学）；Singapore Management University（新加坡管理大学）；Nantong University（南通大学）
Data compression combined with effective encryption is a common requirement of data storage and transmission. Low cost of these operations is often a high priority in order to increase transmission speed and reduce power usage. This requirement is crucial for battery-powered devices with limited resources, such as autonomous remote sensors or implants. Well-known and popular encryption techniques are frequently too expensive. This problem is on the increase as machine-to-machine communication and the Internet of Things are becoming a reality. Therefore, there is growing demand for finding trad…
The Controller Area Network (CAN) is considered as the de-facto standard for the in-vehicle communications due to its real-time performance and high reliability. Unfortunately, the lack of security protection on the CAN bus gives attackers the opportunity to remotely compromise a vehicle. In this paper, we propose a Lightweight Encryption and Authentication Protocol (LEAP) with low cost and high efficiency to address the security issue of the CAN bus. LEAP exploits the security-enhanced stream cipher primitive to provide encryption and authentication for the CAN messages. Compared with the sta…
The rapid development of IoT networks has led to a research trend in designing effective security features for them. Due to the power-constrained nature of IoT devices, the security features should remain as lightweight as possible. Currently, most of the IoT network traffic is unencrypted. The leakage of smart devices' unencrypted data can come with the significant cost of a privacy breach. To have a secure channel with encrypted traffic, two endpoints in a network have to authenticate each other and calculate a short-term key. They can then communicate through an authenticated and secure cha…
We show that the capacity region of the broadcast channel with confidential messages does not change when the strong security criterion is adopted instead of the weak security criterion traditionally used. We also show a construction method of coding for the broadcast channel with confidential messages by using an arbitrary given coding for the broadcast channel with degraded message sets.
Advances in manufacturing technologies have enabled System-on-Chip (SoC) designers to integrate an increasing number of cores on a single SoC. Increasing SoC complexity coupled with tight time-to-market deadlines has led to increased utilization of Intellectual Property (IP) cores from third-party vendors. SoC supply chain is widely acknowledged as a major source of security vulnerabilities. Potentially malicious third-party IPs integrated on the same Network-on-Chip (NoC) with the trusted components can lead to security and trust concerns. While secure communication is a well-studied problem …
