A distributed authentication and authorization scheme for in-network big data sharing

Big data has a strong demand for a network infrastructure with the capability to support data sharing and retrieval efficiently. Information-centric networking （ICN） is an emerging approach to satisfy this demand, where big data is cached ubiquitously in the network and retrieved using data names. However, existing authentication and authorization schemes rely mostly on centralized servers to provide certification and mediation services for data retrieval. This causes considerable traffic overhead for the secure distributed sharing of data. To solve this problem, we employ identity-based cryptography （IBC） to propose a Distributed Authentication and Authorization Scheme （DAAS）, where an identity-based signature （IBS） is used to achieve distributed verifications of the identities of publishers and users. Moreover, Ciphertext-Policy Attribnte-based encryption （CP-ABE） is used to enable the distributed and fine-grained authorization. DAAS consists of three phases： initialization, secure data publication, and secure data retrieval, which seamlessly integrate authentication and authorization with the in- terest/data communication paradigm in ICN. In particular, we propose trustworthy registration and Network Operator and Authority Manifest （NOAM） dissemination to provide initial secure registration and enable efficient authentication for global data retrieval. Meanwhile, Attribute Manifest （AM） distribution coupled with automatic attribute update is proposed to reduce the cost of attribute retrieval. We examine the performance of the proposed DAAS, which shows that it can achieve a lower bandwidth cost than existing schemes.

BLS-identification:A device fingerprint classification mechanism based on broad learning for Internet of Things

The popularity of the Internet of Things(IoT)has enabled a large number of vulnerable devices to connect to the Internet,bringing huge security risks.As a network-level security authentication method,device fingerprint based on machine learning has attracted considerable attention because it can detect vulnerable devices in complex and heterogeneous access phases.However,flexible and diversified IoT devices with limited resources increase dif-ficulty of the device fingerprint authentication method executed in IoT,because it needs to retrain the model network to deal with incremental features or types.To address this problem,a device fingerprinting mechanism based on a Broad Learning System(BLS)is proposed in this paper.The mechanism firstly characterizes IoT devices by traffic analysis based on the identifiable differences of the traffic data of IoT devices,and extracts feature parameters of the traffic packets.A hierarchical hybrid sampling method is designed at the preprocessing phase to improve the imbalanced data distribution and reconstruct the fingerprint dataset.The complexity of the dataset is reduced using Principal Component Analysis(PCA)and the device type is identified by training weights using BLS.The experimental results show that the proposed method can achieve state-of-the-art accuracy and spend less training time than other existing methods.

A Physical Layer Authentication Mechanism for IoT Devices

When Internet of Things(IoT)nodes access the network through wireless channels,the network is vulnerable to spoofing attacks and the Sybil attack.However,the connection of massive devices in IoT makes it difficult to manage and distribute keys,thus limiting the application of traditional high-level authentication schemes.Compared with the high-level authentication scheme,the physical layer authentication scheme realizes the lightweight authentication of users by comparing the wireless channel characteristics of adjacent packets.However,traditional physical layer authentication schemes still adopt the one-to-one authentication method,which will consume numerous network resources in the face of large-scale IoT node access authentication.In order to realize the secure access authentication of IoT nodes and regional intrusion detection with low resource consumption,we propose a physical layer authentication mechanism based on convolution neural network(CNN),which uses the deep characteristics of channel state information(CSI)to identify sending nodes in different locations.Specifically,we obtain the instantaneous CSI data of IoT sending nodes at different locations in the pre-set area,and then feed them into CNN for training to procure a model for IoT node authentication.With its powerful ability of data analysis and feature extraction,CNN can extract deep Spatio-temporal environment features of CSI data and bind them with node identities.Accordingly,an authentication mechanism which can distinguish the identity types of IoT nodes located in different positions is established to authenticate the identity of unknown nodes when they break into the pre-set area.Experimental results show that this authentication mechanism can still achieve 94.7%authentication accuracy in the case of a low signalto-noise ratio(SNR)of 0 dB,which means a significant improvement in authentication accuracy and robustness.

A Multi-Factor Authentication-Based Framework for Identity Management in Cloud Applications

User’s data is considered as a vital asset of several organizations.Migrating data to the cloud computing is not an easy decision for any organization due to the privacy and security concerns.Service providers must ensure that both data and applications that will be stored on the cloud should be protected in a secure environment.The data stored on the public cloud will be vulnerable to outside and inside attacks.This paper provides interactive multi-layer authentication frameworks for securing user identities on the cloud.Different access control policies are applied for verifying users on the cloud.A security mechanism is applied to the cloud application that includes user registration,granting user privileges,and generating user authentication factor.An intrusion detection system is embedded to the security mechanism to detect malicious users.The multi factor authentication,intrusion detection,and access control techniques can be used for ensuring the identity of the user.Finally,encryption techniques are used for protecting the data from being disclosed.Experimental results are carried out to verify the accuracy and efficiency of the proposed frameworks and mechanism.The results recorded high detection rate with low false positive alarms.

Survey on key security technologies for space information networks

SIN(Space Information Network)is expected to play an increasing role in providing real-time,flexible,and integrated communication and data transmission services in an efficient manner.Nowadays,SIN has been widely developed for position navigation,environment monitor,traffic management,counter-terrorism,etc.However,security is a major concern in SIN,since the satellites,spacecrafts,and aircrafts are susceptible to a variety of traditional/specific network-based attacks,including eavesdropping,session hijacking,and illegal accessing.The network architecture and security issues of SIN were reviewed.Various security requirements were discussed that should be considered when designing SIN.And existing solutions proposed to meet these requirements were surveyed.The key challenges and key technologies that still require extensive research and development for securing SIN were indentifed.