Coprocessor-based hierarchical trust management for software integrity and digital identity protection

Malware and rootkits are serious security threats. They can be designed to be resistant to anti-virus and security software and even remain totally undetectable. This paper describes a hierarchical...

Hierarchical coherency management for shared virtual memory multicomputers

Background: Software testing and software security have become one of the most important parts of an application. Many studies have explored each of these topics but there is a gap wherein the relation of software security and software testing in general has not been explored. Objective: This study aims to conduct a systematic literature review to capture the current state-of-the-art in software testing related to security. Methods: The search strategy obtains relevant papers from IEEE Xplore and ScienceDirect. The results of the search are filtered by applying inclusion and exclusion criteria. Results: The search results identified 50 papers. After applying the inclusion/exclusion criteria, we identified 15 primary studies that discuss software security and software testing. We found approaches, aspects, references, and domains that are used in software security and software testing. Conclusion: We found certain approach, aspect, references, and domain are used more often in software security testing Keywords: Software security, Software testing, Security testing approach, Security threats, Systematic literature review

Security software, commonly known as Antivirus, has evolved from simple virus scanners to become multi-functional security suites. To combat ever-growing malware threats, modern security software utilizes both static and dynamic analysis to assess malware threats, inevitably leading to occasional false positive and false negative reports. To mitigate this, existing state-of-the-art security software offers the feature of Exclusion Lists to allow users to exclude specified files and folders from being scanned or monitored. Through rigorous evaluation, however, we found that some of such products stored their Exclusion Lists as unencrypted cleartexts either in known or predictable locations. In this paper we empirically demonstrate how easy it is to exploit the Exclusion Lists by launching masquerade attacks. We argue that the Exclusion Lists should be better implemented such as using application whitelisting, the contents of the lists to be better safeguarded, and only be readable by authorized entities within a strong access control scheme.

To guarantee the quality of software, specifying security requirements (SRs) is essential for developing systems, especially for security-critical software systems. However, using security threat to determine detailed SR is quite difficult according to Common Criteria (CC), which is too confusing and technical for non-security specialists. In this paper, we propose a Co-occurrence Recommend Model (CoRM) to automatically recommend software SRs. In this model, the security threats of product are extracted from security target documents of software, in which the related security requirements are tagged. In order to establish relationships between software security threat and security requirement, semantic similarities between different security threat is calculated by Skip-thoughts Model. To evaluate our CoRM model, over 1000 security target documents of 9 types software products are exploited. The results suggest that building a CoRM model via semantic similarity is feasible and reliable.

In this paper., a hierarchical energy management strategy for a community of multiple smart homes is proposed. This strategy reduces the stress on the power grid caused by uncoordinated energy scheduling of smart homes. Different stochastic operational conditions for plug-in electric vehicles (PEVs)and household battery storages are considered. First., cost-effective day-ahead energy schedules under these operational conditions are calculated by individual home energy management systems (HEMSs). Then., a centralized decision making unit determines the day-ahead schedule for each household with the aim of reducing the stress on the grid. Comprehensive results obtained from simulations show that the proposed hierarchical energy management strategy not only maintains a low energy purchase cost for each individual household., but also smooths the overall grid power profile requested by all smart homes combined.

For 5G base stations equipped with multiple energy sources, such as energy storage systems (ESSs) and photovoltaic (PV) power generation, energy management is crucial, directly influencing the operational cost. Hence, aiming at increasing the utilization rate of PV power generation and improving the lifetime of the battery, thereby reducing the operating cost of the base station, a hierarchical energy management strategy based on the improved dung beetle optimization (IDBO) algorithm is proposed in this paper. The first control layer provides bus voltage control to each power module. In the second control layer, a dynamic balance control strategy calculates the power of the ESSs using the proportional–integral (PI) controller and distributes power based on the state of charge (SOC) and virtual resistance. The third control layer uses the IDBO algorithm to solve the DC microgrid’s optimization model in order to achieve the minimum daily operational cost goal. Simulation results demonstrate that the proposed IDBO algorithm reduces the daily cost in both scenarios by about 14.64% and 9.49% compared to the baseline method. Finally, the feasibility and effectiveness of the proposed hierarchical energy management strategy are verified through experimental results.

This research presents an improved hierarchical key management scheme (IHKMS) with three phase technique for secure group communications in Mobile Ad-hoc Networks (MANETs). It extends two previously proposed models named enhanced hierarchical key agreement scheme (EHKMS) and EHKMS with three phase technique which suffer from two main problems. The first one which exists in both models is that, the main subgroup controller (L1-head) is heavily loaded and has a lot of responsibilities which may lead to its failure. The second problem that exists only in EHKMS is intrusion attacks which may appear in two aspects; frank intrusion and selfish attack. This problem is a fatal one which threatens the security of the system. The proposed IHKMS with three phase technique solves the above mentioned problems. First, it decreases the memory load on the main subgroup header to save its memory resources by distributing a major part of subgroup keys storage into the second level of subgroups headers. Second, it immunizes the IHKMS against intrusions by employing the three phase technique. Applying the three phase technique integrates a certification authentication system in addition to the hierarchal key system used in the IHKMS. The proposed IHKMS with three phase technique enhances EHKMS and EHKMS with three phase technique. It improves the system's reliability in EHKMS, and EHKMS with three phase technique by minimizing the subgroup header's load. Also, it overcomes the intrusion problem that exists only in EHKMS. On the other hand, the complexity of the proposed IHKMS with three phase technique is higher than that of EHKMS. This is anticipated result as the proposed model integrates the three phase technique with the IHKMS.

There has been a surge in number of software security threats and vulnerabilities in recent times. At the same time, expectations towards software and data security are growing. Thus there is a need to ensure that security-related tasks are effectively integrated in the software development process. However, integrating security practices with agile software development is not trivial due to, for instance, differences in process dynamics and concentration on functional vs non-functional requirements. In this short paper we present a literature review on challenges and solutions when adopting security in agile software development contexts. Our findings show that there are ongoing efforts to integrate security-practices in agile methods, but more research is needed to make the processes more optimized and simpler for developers.

Aim. Threats of a non-physical nature have a significant effect on the security of intelligent transportation systems (ITS). They may have the form of unlawful interference in the development and implementation of ITS. The creation of a trusted framework for the development and implementation of ITS is examined as in the case of intelligent water transportation systems (IWTS). Problems. By decree of the President of the Russian Federation, ITS, telecommunications and security of information processing are among the priority areas of scientific and technological development. ITS technologies, as well as those involved in the creation of trusted, secure system and application software are among the most important critical high technologies. The operation of ITS involves wide use of computerised systems that implement the latest information and telecommunication technologies, automated and automatic control technologies, artificial intelligence that can pose security threats. ITS are to be developed and operated in a trusted environment. Methods. The paper used the methodology for ensuring the security of IWTS, development of secure hardware and software platforms for secure automated systems, methods of system analysis, dependability theory, information protection, and law. Results. The paper defines the problem of creating a trusted framework for the development and implementation of IWTS, the applicable terminology is developed. The author examined the effect of IWTS on the security of critical information infrastructure (CII) and national security, developed a model of relationships between the IWTS security domains taking into account threats of physical and non-physical origin. Examples of computer incidents within IWTS that caused consequences at the national and international levels are given. The composition of the IWTS facilities attributed to CII is defined, critical processes implemented by standard CII facilities as part of the IWTS are set forth. The author lists conceptual problems of IWTS security, defines the principles of creating a trusted framework for the development and implementation of IWTS. Conclusion. Ensuring the security of IWTS against modern threats requires solving a number of problems associated with the creation of a trusted framework for the development and implementation of IWTS. For the purpose of improving the timeliness and quality of their solution, the paper proposes an intuitive terminology that reflects the subject area and helps finding a common understanding of the security domain by experts from various industries. IWTS facilities have an effect on CII security and national security in general. That is taken into account in the model of relationships between IWTS security domains, demonstrated using cases of computer incidents within IWTS that caused consequences at the national and international level. Given the above, the paper lists IWTS facilities attributed to CII and sets forth examples of critical processes implemented by standard CII facilities as part of the IWTS. The defined list of conceptual IWTS security problems take into account the growing landscape of IWTS security threats that includes insecure software, hardware and software platforms, software and hardware systems and emerging technologies. When developing the principles for the creation of a trusted IWTS development and implementation framework, the author took into account the best practice of implementing the methodology for creating national secure hardware and software platforms of CII facilities that enables the creation of secure automated systems for various applications that are based on domestically-developed solutions. The examined matters are of a systemic nature, which allows using the findings in the development and implementation of ITS in other modes of transportation.

The primary objective of this chapter is to evaluate the cybersecurity framework for software security, which has gained significant importance due to the rise in malicious attacks and other hacker-related threats to computer systems in recent years. As a result, numerous researchers have explored security solutions from the earliest stages of requirement engineering. Given the growth of the software industry and the internet, it is essential to understand the security threats associated with each stage of the software development life cycle (SDLC). To address this need, we conducted an industrial empirical study to assess the impact of software security threats at every stage of the SDLC. Cybersecurity has become a top priority for businesses across all industries and sizes as digital technology and data are now integral components of the commercial landscape.

The use of RFID technology in complex and distributed environments often leads to a multi-domain RFID system, in which trust establishment among entities from heterogeneous domains without past interaction or prior agreed policy, is a challenge. The current trust management mechanisms in the literature do not meet the specific requirements in multi-domain RFID systems. Therefore, this paper analyzes the special challenges on trust management in multi-domain RFID systems, and identifies the implications and the requirements of the challenges on the solutions to the trust management of multi-domain RFID systems. A multi-domain trust management model is proposed, which provides a hierarchical trust management framework include a diversity of trust evaluation and establishment approaches. The simulation results and analysis show that the proposed method has excellent ability to deal with the trust relationships, better security, and higher accuracy rate.

A hierarchical power management scheme is proposed in this paper for a typical DC Microgrid. Different from other Microgrids, the DC Microgrid can interface to the distribution system by Solid-State transformer (SST). The hierarchical power management strategy includes three control levels: 1) primary control for DC Microgrid to implement distributed operation 2) secondary control for the DC Microgrid bus voltage recovery to achieve seamless mode switch 3) tertiary control to manage the battery charge and discharge. The DC Microgrid can operate in islanding mode, including the individual control for distributed renewable energy source (DRER) and distributed energy storage device (DESD). In addition, the DC microgrid can operate in SST-enabled mode to interface to the distribution system. The DC Micorgrid can seamlessly switch between islanding mode and SST-enable mode. The consideration of state of charge (SOC) for battery is also involved into the tertiary control. To this end, a lab test-bed is constructed to verify the system performance. Lastly, several typical case studies are carried out and the experimental results verify the proposed power management strategy.

In Mobile IP, the signaling traffic overhead will be too high since the new Care-of-Address (CoA) of the mobile node (MN) is registered all the way with the home agent (HA) whenever the MN has moved into a new foreign network. To complement Mobile IP in better handling local movement, several IP micro protocols have been proposed. These protocols introduce a hierarchical mobility management scheme, which divides the mobility into micro mobility and macro mobility according to whether the host's movement is intra-domain or inter-domain. Thus, the requirements on performance and flexibility are achieved, especially for frequently moving hosts. This paper introduces a routing protocol for multicast source mobility on the basis of the hierarchical mobile management scheme, which provides a unified global architecture for both uni- and multicast routing in mobile networks. The implementation of multicast services adopts an improved SSM (Source Specific Multicast) model, which combines the advantages of the existing protocols in scalability and mobility transparency. Simulation results show that the proposed protocol has better performance than the existing routing protocols for SSM source mobility.

To accommodate the growth in the user population and network size in mobile environments, hierarchical architectures of location databases have been proposed. Recent studies showed that the signaling traffic and processing overhead of location updates is expected to grow tremendously, leading to poor performance. The authors present a Profile based Hierarchical location management Scheme (PHS) that focuses on reducing the cost of updates while keeping the lookup cost low. Our proposal is motivated by the observation that users follow repetitive patterns that can be profiled and predicted with reasonable cost, allowing users to send updates occasionally and not on every move. Further, it deploys a simple prediction technique that reduces the uncertainty of a user's location. We quantify the costs and benefits of PHS for several mobility patterns and show that it can result in up to 60% reduction in the update cost with minimal increase (7%) in lookup cost.