Journal of Information Security and Applications最新文献

{"title":"CRASHED: Cyber risk assessment for smart home electronic devices","authors":"Georgios Paparis ,&nbsp;Apostolis Zarras ,&nbsp;Aristeidis Farao ,&nbsp;Christos Xenakis","doi":"10.1016/j.jisa.2025.104054","DOIUrl":"10.1016/j.jisa.2025.104054","url":null,"abstract":"<div><div>The rapid proliferation of Internet of Things (IoT) technology has enriched modern households with smart home devices, enhancing convenience, but simultaneously increasing vulnerability to cyber threats. This paper introduces <em>CRASHED</em>, an innovative cyber risk assessment methodology specifically designed for smart home ecosystems. Compared to existing approaches, <em>CRASHED</em> integrates the MITRE ATT&amp;CK and CAPEC frameworks to systematically identify and analyze threats, vulnerabilities, and potential impacts. By employing device-specific profiling, quantitative metrics, and sophisticated weighting mechanisms, it delivers a multilayered assessment of cyber risks that accounts for asset criticality and threat severity, distinguishing it from conventional methods lacking such granularity. The novelty of <em>CRASHED</em> lies in its comprehensive evaluation of systemic vulnerabilities and domestic repercussions. Case studies on various smart home configurations demonstrate its effectiveness in modeling, analyzing, and mitigating risks compared to existing frameworks. This work represents a significant advancement in safeguarding smart home environments, underscoring the urgent need for specialized cyber risk assessment models in our interconnected era. The proposed methodology not only enhances threat detection and response, but also addresses critical gaps in vulnerability databases and risk calculation processes, offering a transformative solution to the evolving challenges of smart home cybersecurity.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"91 ","pages":"Article 104054"},"PeriodicalIF":3.8,"publicationDate":"2025-04-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143844120","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Fully homomorphic encryption-based optimal key encryption for privacy preservation in the cloud sector","authors":"Sonam Mittal","doi":"10.1016/j.jisa.2025.104048","DOIUrl":"10.1016/j.jisa.2025.104048","url":null,"abstract":"<div><div>Cloud computing infrastructure has been specifically designed to handle vast amounts of data as well as relevant details that are most basic for data-intensive applications. However, cloud computing has been exposed to various internal and external security threats along with privacy concerns. Therefore, an intelligent framework named privacy preservation in the cloud sector (PPCS) is implemented in this work. The main phases taken up in the proposed security model are data sanitization and restoration. The data stored in the cloud infrastructure is subjected to a data sanitization operation. In the data sanitization process, the data is transformed into another form, where the confidential data has been preserved by the optimal key generation operation. An improved meta-heuristic algorithm called Improved Class Topper Optimization (ICTO) derived from existing Class Topper Optimization (CTO) is designed for performing the optimal key generation. This algorithm aids in optimizing the key generated in the data sanitization technique. To offer more security to the cloud environment, the encryption of the generated optimal key is done by fully homomorphic encryption (FHE). It permits the preservation of confidentiality in sensitive data. The performance results of the designed approach illustrated the ability of this technique to prevent attacks without increasing energy consumption and latency.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"91 ","pages":"Article 104048"},"PeriodicalIF":3.8,"publicationDate":"2025-04-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143834635","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Wi-Spoof: Generating adversarial wireless signals to deceive Wi-Fi sensing systems","authors":"Aryan Sharma ,&nbsp;Deepak Mishra ,&nbsp;Sanjay Jha ,&nbsp;Aruna Seneviratne","doi":"10.1016/j.jisa.2025.104052","DOIUrl":"10.1016/j.jisa.2025.104052","url":null,"abstract":"<div><div>The rise of Wi-Fi sensing applications leveraging Channel State Information (CSI) from ambient wireless signals has opened up extensive opportunities for human activity and identity recognition. However, this advancement raises serious privacy concerns, as sensitive personal data can be inferred by applying advanced Machine Learning (ML) algorithms to CSI data. In response, researchers have explored adversarial techniques to degrade Wi-Fi sensing accuracy and protect privacy, often by interfering with or corrupting CSI. This paper introduces Wi-Spoof, a novel approach for spoofing CSI to deceive Wi-Fi-based Human Activity Recognition (HAR) systems. Wi-Spoof manipulates Wi-Fi transmission power to inject noise into the CSI and employs a pseudo-Pulse Width Modulation (PWM) scheme to generate controlled, adversarial CSI. Using commercially available hardware, we experimentally demonstrate that Wi-Spoof can achieve targeted misclassification in a state-of-the-art HAR system with a 93% success rate. Our approach is validated on a widely recognised public dataset and further supported by extensive local experiments, underscoring Wi-Spoof’s effectiveness in steering HAR predictions to specified outcomes.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"91 ","pages":"Article 104052"},"PeriodicalIF":3.8,"publicationDate":"2025-04-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143829377","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Efficient lightweight anonymous authentication scheme with certificateless aggregation for VANETs","authors":"Abdullahi Yahya Imam ,&nbsp;Fagen Li","doi":"10.1016/j.jisa.2025.104053","DOIUrl":"10.1016/j.jisa.2025.104053","url":null,"abstract":"<div><div>Recent developments in Internet of Things (IoT) and vehicular ad hoc networks (VANETs) technologies have improved traffic management and safety in several ways. Due to their unique nature, VANET communications still face certain challenges related to achieving basic security requirements and efficiency. Many researchers proposed different authentication schemes based on certificateless aggregate signature (CLAS-based) as the solutions to achieving the security requirements such as privacy-preserving authentication, integrity, unlinkability and non-repudiation as well as attaining high efficiency in VANETs. However, most of the proposed schemes were revealed insecure or highly inefficient in one way or the other. Recently, a CLAS-based authentication scheme in VANETs using fuzzy extractor functions was proposed by Zhou et al.. They claimed that their proposed scheme achieved various security requirements. However, after thorough review and analysis, we demonstrate that the Zhou et al.’s scheme is vulnerable to signatures linkability attacks which can lead to illegal tracking of vehicles in the VANETs. Subsequently, we propose an improved authentication scheme based on CLAS that mitigates the discovered flaws. Besides improving the security, our proposed scheme introduced the utilization of precomputed values in entities with computational and energy constraints. The use of precomputed values which are usually generated offline prior to authentication process enables our scheme attain very lightweight vehicular authentication. Eventually, we demonstrate that our improved scheme is unforgeable in the random oracle model (ROM) under the intractability of elliptic curve discrete logarithm problem (ECDLP). Moreover, we demonstrated the security of our proposed scheme against signatures linkability attacks under the assumption of strong collision-resistance property of the hash functions. Lastly, results of the efficiency analysis have shown that our improved scheme is comparatively better than the other related schemes.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"91 ","pages":"Article 104053"},"PeriodicalIF":3.8,"publicationDate":"2025-04-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143829376","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Interpolation data hiding schemes based on center folding strategy and well-turned embedded positions","authors":"Thanh Nhan Vo ,&nbsp;Tzu Chuen Lu","doi":"10.1016/j.jisa.2025.104055","DOIUrl":"10.1016/j.jisa.2025.104055","url":null,"abstract":"<div><div>In the realm of steganography, payload and Peak Signal-to-Noise Ratio (PSNR) are pivotal metrics for evaluating the efficacy of data hiding techniques. While addressing security concerns, researchers have been striving to optimize one or both assessment indicators. As indicated by Lu et al. (2020), a reversible data hiding method can achieve high PSNR and payload capacity. This method employs a multi-layer center folding strategy for message concealment in interpolated images. In our study, the secret message is transformed into a code pair consisting of an index and code, utilizing Lu's scheme. Our proposed approach reorganizes these indexes and applies two distinct strategies, termed EnMCFS-8 and EnMCFS-9, aiming to refine data hiding quality through strategic embeddable position arrangements. In each 4 × 4 block of the cover image, EnMCFS-8 focuses on embedding eight indexes at the four locations, minimizing image distortion. Conversely, EnMCFS-9 distributes nine indexes across three diagonal locations to augment the hiding capacity. Each method serves specific objectives effectively. The experimental outcomes demonstrate the enhancements in hiding performance our proposed methods when compared to existing techniques.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"91 ","pages":"Article 104055"},"PeriodicalIF":3.8,"publicationDate":"2025-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143820275","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Data flow security in Role-based access control","authors":"Luigi Logrippo","doi":"10.1016/j.jisa.2025.103997","DOIUrl":"10.1016/j.jisa.2025.103997","url":null,"abstract":"<div><div>We show how data security concepts such as data flow, secrecy (or confidentiality) and integrity can be defined for RBAC, Role-Based Access Control. In contrast to the prevailing literature that uses a lattice model to express such concepts, we demonstrate the use of a partial order model that is more general. This is done by using the concepts of “partial order of equivalence classes” and of “security labels” that can be associated with RBAC subjects and objects and determine their mutual data flows, as well as their secrecy and integrity properties. Our model allows to reason on RBAC configurations with different assignments of roles to subjects. On the converse, we demonstrate a method for obtaining RBAC configurations from data security requirements or security label assignments. These results are supported by a proof showing that three methods for defining data flow: by access control matrices or lists, by labels and by roles, are equivalent and mutually convertible by efficient algorithms. We show how RBAC state changes, or “reconfigurations” can be defined in this framework, and what are the effects of elementary reconfigurations on data flow, secrecy and integrity of data.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"90 ","pages":"Article 103997"},"PeriodicalIF":3.8,"publicationDate":"2025-04-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143791414","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Secure medical data sharing with verifiable outsourced decryption and cryptographic reverse firewalls","authors":"Xin Liu ,&nbsp;Hao Wang ,&nbsp;Bo Zhang ,&nbsp;Yongjun Zhang ,&nbsp;Bin Zhang","doi":"10.1016/j.jisa.2025.104050","DOIUrl":"10.1016/j.jisa.2025.104050","url":null,"abstract":"<div><div>In the current era of smart healthcare, patients’ electronic health records (EHR) are typically stored in the cloud. However, healthcare institutions require a patient-centric access control mechanism to securely share EHR and prevent information leaks. While attribute-based encryption (ABE) holds potential for EHR access control, it often faces risks such as single-point failures and lacks verifiability for outsourced decryption. Backdoor programs can also compromise system security, threatening patient privacy. To address these challenges, we extended Lewko et al.’s multi-authority ABE scheme to create an online/offline ciphertext policy attribute-based key encapsulation mechanism with verifiable outsourced decryption and cryptographic reverse firewalls (OO-CP-AB-KEM-OD-CRF). Building on this mechanism, we developed a multi-authority EHR access control system to prevent the exfiltration of sensitive information. Compared with similar schemes, the OO-CP-AB-KEM-OD-CRF scheme supports user authentication and verifiable outsourced decryption, providing resilience against insider threats. Both theoretical evaluation and empirical testing indicate that our scheme surpasses similar ones in functionality and security while maintaining comparable performance despite the additional security features.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"90 ","pages":"Article 104050"},"PeriodicalIF":3.8,"publicationDate":"2025-04-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143785956","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An alignment-free secure fingerprint authentication integrated with elliptic curve signcryption scheme","authors":"Jignesh Kukadiya ,&nbsp;Mulagala Sandhya ,&nbsp;Dilip Kumar Vallabhadas ,&nbsp;I HHNTV Prasad ,&nbsp;Rithvik Mooda","doi":"10.1016/j.jisa.2025.104049","DOIUrl":"10.1016/j.jisa.2025.104049","url":null,"abstract":"<div><div>Fingerprint authentication is a widely used method to verify someone’s identity by analysing unique fingerprint features, such as ridges and specific points called minutiae. However, there are concerns about its vulnerability to fake fingerprints and privacy issues. Cancellable biometrics is a promising solution to tackle these concerns. It transforms fingerprint features into secure forms that cannot be reversed back to the original, even if someone gets hold of them. This paper proposes an alignment-free secure fingerprint authentication method that integrates minutiae point descriptors and Scale Invariant Feature Transform (SIFT) keypoint descriptors, enhanced with Elliptic Curve signcryption, aiming to fortify security without compromising authentication accuracy. Experimental evaluations were conducted using the Fingerprint Verification Competition (FVC) 2002 dataset, showcasing the efficacy of the proposed approach. Experimental results demonstrate a significant reduction in security risks while upholding authentication accuracy, thus affirming the effectiveness of our methodology in enhancing fingerprint authentication security.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"90 ","pages":"Article 104049"},"PeriodicalIF":3.8,"publicationDate":"2025-04-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143783122","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Detection of intranet scanning traffic and tool detection based on multi-feature fusion","authors":"Yan Cao ,&nbsp;Xuanren Qu ,&nbsp;Yu Wang ,&nbsp;Tianrui Li ,&nbsp;Jiabin Li","doi":"10.1016/j.jisa.2025.104051","DOIUrl":"10.1016/j.jisa.2025.104051","url":null,"abstract":"<div><div>Network port scanning is a crucial information gathering technique that precedes various types of cyberattacks, and it poses a primary challenge in the network defense process. Detecting port scanning traffic and identifying the types of scanning tools used can help security personnel discover unknown scanning activities, understand the attackers’ intentions, and implement targeted defenses. This paper proposes a multi-feature fusion-based scanning tool identification method, MUST, to address this challenge. First, the core data packets within each network session are extracted and transformed into Traffic Graphs (TGs). These TGs represent the communication behavior of the sessions through their shape and color characteristics. Then, the sliding window and window attention mechanisms of the Swin Transformer model are employed to extract Traffic Graph Features (TGFs) from the TGs. MUST leverages a deep fusion of the typical statistical features of the session traffic and the TGFs to detect intranet scanning traffic and accurately identify the scanning tool types. Comparative evaluations show that the multi-feature fusion approach of MUST effectively distinguishes different scanning tool traffic and achieves superior detection accuracy across various scenarios. Moreover, MUST demonstrates robust detection performance for unknown scanning activities, with accuracy and recall rates exceeding 0.97 on the CICIDS2017 and InSDN dataset.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"90 ","pages":"Article 104051"},"PeriodicalIF":3.8,"publicationDate":"2025-04-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143769087","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Exploring low overhead fingerprint biometric watermark for loop pipelined hardware IPs during behavioral synthesis","authors":"Anirban Sengupta,&nbsp;Aditya Anshul","doi":"10.1016/j.jisa.2025.104041","DOIUrl":"10.1016/j.jisa.2025.104041","url":null,"abstract":"<div><div>Loop based applications form an integral component in several consumer electronics systems as hardware intellectual property (IP) cores. Some powerful examples include finite impulse response filter cores, convolution filters etc. For enhanced performance and increased security of hardware IPs, handling loops efficiently while embedding low-cost security information (watermark) as digital evidence is the key. Robust security watermark embedded as digital evidence in the IP cores of CE systems, ensures sturdy detective countermeasure against piracy and counterfeiting, assuring the safety of end consumer. This paper presents a novel behavioral synthesis/high-level synthesis (HLS) based low-cost fingerprint biometric-watermark embedded security methodology for loop pipelined hardware IPs of CE systems. More explicitly, the paper presents the following novel contributions: a) exploration of low overhead fingerprint biometric-watermark embedded security watermark during HLS; b) embedding low-cost fingerprint based security constraints in loop pipelined IP designs used in CE systems; c) enhanced security against IP piracy (pirated designs) from an SoC integrator's and CE systems designers' perspective in terms of digital evidence (resulting into greater tamper tolerance ability, probability of coincidence and entropy) than prior similar approaches, at nominal design overhead.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"90 ","pages":"Article 104041"},"PeriodicalIF":3.8,"publicationDate":"2025-04-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143746743","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}