Substation security mechanism based on SDN and MMS

This paper covers the design and implementation of a generic model, based upon Mobile Agents, to perform PVC configuration management functions in multi-vendor ATM networks. The paper introduces an alternative or complement to existing ATM configuration management solutions. In it, an autonomous mobile agent travels from switch to switch to perform its configuration duties. A prototype implementation written in the Java programming language was developed for the validation of the proposed solution and was tested using a simulation testbed also written in Java.KeywordsMobile AgentNetwork ManagementAsynchronous Transfer ModeObject Management GroupJava Virtual MachineThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

It is our great pleasure to welcome you to the 2nd ACM SIGCOMM Workshop on Programmable Routers for Extensible Services of TOmorrow -- PRESTO'09. There continues to be great interest in the networking research community in re-architecting the distribution of functions in IP networks. These efforts can be described as a dis-aggregation of router and switch functionality into various components and well-defined interfaces, towards the goals of deploying richer services and easing management of the network. Efforts in this space span the range from more sophisticated configuration interfaces, to open application programming interfaces (APIs) that allow specialized control and data plane functions on commercial routers, to open software, open firmware, and open hardware platforms that enable tremendous flexibility in the functionality of network equipment. While these open interfaces continue to evolve, many have reached a level of maturity that allow practitioners to create holistic network-centric functions and services by leveraging the available low-level per-device mechanisms. Indeed, programmable network elements hold the promise of accelerating innovation and service deployment. At the same time, programmability could exacerbate already challenging network management tasks. The PRESTO workshop provides a forum for the exchange of ideas between researchers and industry practitioners, with a goal of driving service innovation in IP networks using novel extensible router and switch architectures. The call for papers attracted 23 submissions from Asia, Canada, Europe, and the United States. The program committee accepted 12 papers that cover a variety of topics including primitives for service creation and measurement, data path programmability, platform refactoring, network configuration, and network management. In addition, each session of the program includes a mini-panel aimed at stimulating discussion and providing a broader perspective. We hope that these proceedings will serve as a valuable reference for researchers and developers interested in programmable router architectures.

A dynamic and multi-level key management method in wireless sensor networks (WSNs)

This article presents a comprehensive analysis of automated security configuration management for enterprise networking products, addressing the growing challenges in maintaining secure network configurations across complex modern infrastructures. It examines the evolution of network configuration management from traditional manual approaches to automated solutions, highlighting the critical role of automation in maintaining security posture and compliance. Through analysis of recent research and industry reports, the article explores the challenges posed by increasing network complexity, particularly in hybrid environments combining on-premises and cloud-based services. It investigates the components of automated configuration analysis systems, including scanning engines, security rule engines, and remediation recommendation systems. The article demonstrates the benefits of automated configuration management, including improved security consistency, reduced human error, enhanced proactive risk management, and streamlined compliance processes. It also provides detailed implementation considerations for organizations adopting automated configuration management solutions, emphasizing the importance of establishing clear security baselines, robust change management procedures, and regular updates to security rules and best practices.

Software defined network (SDN) is an emerging network architecture which offloads the control logic of the network from the underlying forwarding devices to a centralized controller. This centralized control intelligence software defines the behavior of the network. However, the programmability and centralization of the SDN architecture introduce potential security concerns. In this paper, we first investigate the threats of denial of service (DoS) attacks on the SDN control channel. Then, we evaluate the impact of DoS by simulating a DoS attack against the network controller. Our results show that it is possible to exhaust the controller resources in the absence of an authentication mechanism. Finally, we propose a lightweight information hiding authentication mechanism to prevent DoS attacks in the SDN control channel.

The increasing reliance on web applications across domains such as e-commerce, banking, healthcare, and enterprise systems has significantly amplified the importance of secure and reliable authentication mechanisms. Traditional password-based authentication methods are increasingly vulnerable to modern cyber threats, including phishing, brute force attacks, and credential stuffing, thereby necessitating the adoption of more advanced and robust authentication strategies. This study presents a comprehensive comparative analysis of modern authentication mechanisms in web applications, including Multi-Factor Authentication (MFA), OAuth 2.0, JSON Web Tokens (JWT), Single Sign-On (SSO), and biometric-based authentication systems. The research evaluates these mechanisms based on critical parameters such as security strength, usability, scalability, performance, and implementation complexity. It further examines architectural models, token-based frameworks, and federated identity systems that support secure user authentication in distributed environments. Additionally, the study reviews common vulnerabilities, threat mitigation techniques, and real-world deployment scenarios to assess the effectiveness of each approach. The findings highlight a growing shift toward hybrid authentication models that integrate multiple techniques to achieve enhanced security and user experience. However, challenges remain in balancing security with usability, ensuring interoperability across platforms, and maintaining privacy in decentralized systems. The paper concludes by identifying future research directions focused on passwordless authentication, zero-trust security models, and adaptive authentication systems for next-generation web applications.Keywords : Authentication mechanisms, Web application security, Multi-Factor Authentication (MFA), OAuth 2.0, JSON Web Tokens (JWT), Single Sign-On (SSO), Biometric authentication, Passwordless authentication, Zero Trust security, Cybersecurity

Over the last years the complexity of mobile communication networks has significantly increased. Therefore, Self-Organizing Network (SON) features have been introduced to automate the process of fault-remedying, configuring Network Elements (NEs), and optimizing their operation. Such features are typically implemented by SON functions which actively perform changes to Configuration Management (CM) parameters in order to achieve certain objectives. However, having such features also requires a mechanism that allows us to verify their actions. In case certain NEs experience an undesired behavior, we have to be able to determine whether it is caused by CM changes and, if so, identify the responsible ones for that to happen. In this paper we propose a novel CM change performance assessment method with dynamic scope management for automated CM undo decision making. Our method includes two key properties: the ability to determine the minimal set of cells that are possibly influenced by a certain CM change, and generate a recommendation to accept or reject it based on the observed network performance. Results from our real data evaluation show our method is able to detect anomalous network behavior and identify the responsible changes.

A Distributed Denial of Service (DDoS) attack is an attack which compromised the bandwidth of the whole network by choking down all the available network resources which are publicly available, thus makes the access of that resource unavailable. The DDoS attack is more vulnerable than a normal Dos attack because here the sources of attack origin are more than one, so users cannot even estimate how to detect and where to take actions so that attacks can be dissolved. DDoS attacks in Smart home could be more severe because in a smart home network the embedded operating system is open and can be easily compromised plus there is always a risk associated with the authentication mechanism in a smart. So, there is a need for a proper mechanism as well as a suitable approach so that a DDoS attack can be mitigated. This Paper suggests that the remedy that must be taken in order to counter-affect the DDoS attack in a smart home network.

Distributed Denial of Service (DDoS) attacks have caused significant disruptions in the operations of Internet-based services. These DDoS attacks use large scale botnets, which often exploit millions of compromised Internet of Things (IoT) devices worldwide. IoT devices are traditionally less secure and are easy to be exploited. The extent of these exploitations has increased after the publication of the Mirai botnet source code on GitHub that provided a foundation for the attackers to develop and launch Mirai botnet variants. The Internet Engineering Task Force (IETF) proposed RFC 8520 Manufacturer Usage Description (MUD) so that an IoT device can convey to the network the level of network access it requires to accomplish its standard functionality. Though MUD is a promising effort, there is a need to evaluate its effectiveness, identify its limitations, and enhance its architecture to overcome its weakness and improve its efficiency. The latest Mirai variant malware is exploiting vulnerabilities of Internet of Things devices. As MUD does not consider identifying and patching vulnerabilities present in the device before the issuance of the MUD profile, a device can be compromised even in the presence of the Manufacturer Usage Description profile by exploiting either the configuration vulnerabilities or firmware vulnerabilities present in the device. This paper presents an evaluation study of the Manufacturer Usage Description (MUD), identifies its weaknesses, and proposed enhancements in its architecture. This research proposed a mechanism for identifying and eliminating the configuration vulnerabilities before creating the MUD profile for a device to minimize the attack surface. This research adopts the OWASP firmware testing methodology for discovering vulnerabilities in the firmware of WiFi home routers. The device is allowed to request the MUD profile only if the identified firmware vulnerabilities are low. The identified firmware vulnerabilities are patched in case the score of the identified firmware vulnerabilities is moderate or high. The device is allowed to request the MUD profile after the vulnerabilities are patched. The firmware vulnerabilities are shared with other peers using blockchain smart contracts. There is a possibility that the MUD URL might be pointing to a corrupted or malicious MUD profile hosted at the attacker file server due to the absence of an authentication mechanism in the MUD process. This research also proposed an authentication mechanism for device MUD profile, MUD file generator, and MUD file server. Implementation results show that proposed enhancements improve the security services provided by the Manufacturer Usage Description (MUD).

Due to the rapid growth in sensor technology and embedded technology, wireless body area network WBANs plays a vital role in monitoring the human body system and the surrounding environment. It supports many healthcare applications on the one hand and are very much help full in pandemic scenarios. It has become the most innovative health care area, which is intriguing to many researchers because of its vast future prospective and potential. Data collected by different wireless sensors or nodes is very personal, critical, and important because of human life involvement. WBANs can minimize human to human contact, which helps stop the spread of severe infectious diseases. The biggest concern is the maintenance of privacy and accuracy of data is still a hot area of research due to nature of attacks, which are changing day by day and increasing, as well as for the sake of better performance. A suitable security mechanism is a way to address above issues, for achieving data security, it is expedient to propose a mechanism. It is essential to update the patient’s regular data. WBANs help to deliver truthful reports related to the patient’s health regularly and individually. This paper proposes an algorithm that shows a better result than the existing algorithm in their previous works. This work is all about proposing a mechanism which needs comparatively less resource. Only authentic entities can interact with the server, which has become obligatory for both sides, keeping data safe. Several authentication schemes have been proposed or discussed by different researchers. This paper has proposed a Secure and Efficient WBANs Authentication Mechanism (SEAM). This security framework will take care of the authentication and the security of transmitted data.

A stochastic evolutionary coalition game model of secure and dependable virtual service in Sensor-Cloud

This document describes two authentication mechanisms created by Sun Microsystems that are commonly used in conjunction with the ONC Remote Procedure Call (ONC RPC Version 2) protocol. WARNING The DH authentication as defined in Section 2 in this document refers to the authentication mechanism with flavor AUTH_DH currently implemented in ONC RPC. It uses the underlying Diffie-Hellman algorithm for key exchange. The DH authentication defined in this document is flawed due to the selection of a small prime for the BASE field (Section 2.5). To avoid the flaw a new DH authentication mechanism could be defined with a larger prime. However, the new DH authentication would not be interoperable with the existing DH authentication. As illustrated in [10], a large number of attacks are possible on ONC RPC system services that use non-secure authentication mechanisms. Other secure authentication mechanisms need to be developed for ONC RPC. RFC 2203 describes the RPCSEC_GSS ONC RPC security flavor, a secure authentication mechanism that enables RPC protocols to use Generic Security Expires: November 17, 1999 Informational [Page 1]^L INTERNET-DRAFT Authentication Mechanisms for ONC RPC 18-May-99 Service Application Program Interface (RFC 2078) to provide security services, integrity and privacy, that are independent of the underlying security mechanisms. Expires: November 17, 1999 Informational [Page 2]^L INTERNET-DRAFT Authentication Mechanisms for ONC RPC 18-May-99 CONTENTS

Dynamic radio resource management is essential for optimising performance in an open radio access network (RAN). However, traditional methods often struggle with realtime decision-making and resource allocation in dynamic environments. Intelligent solutions, such as xApps running on near-real-time (near-RT) RAN Intelligent Controllers (RICs), offer promising advancements in adaptability and efficiency. This paper evaluates the performance of 5 reinforcement learning (RL) algorithms: Advantage Actor-Critic (A2C), Asynchronous Advantage Actor-Critic (A3C), Proximal Policy Optimisation (PPO), Deep Q-Network (DQN) and Soft Actor Critic (SAC), which were implemented as xApps for dynamic resource allocation in an open RAN setting. We analyse how effectively each algorithm learns to allocate resources by associating user equipment (UE), connected to different service classes: video, voice and data, to base stations as they move through a simulated network environment. Additionally, we evaluate the agents by comparing their throughput, latency and reward performance, and validate the results by examining them over 5 seeds run under the same network configurations. Our findings reveal that DQN achieves the highest rewards and fastest convergence, followed by SAC, PPO offers stable learning at moderate reward levels, while A2C and A3C show slower convergence and lower rewards. These results demonstrate both the advantages and limitations of using RL for dynamic resource management in open RAN systems. Finally, we discuss future directions, such as exploring multiagent systems and deploying xApps in real-world open RAN testbeds, to advance practical applications.

While mobile ad hoc networks offer significant improvements for tactical communications, these networks are vulnerable to node capture and other forms of cyber-attack. In this paper, we evaluated via simulation the impact of a passive attacker, a denial of service (DoS) attack, and a data swallowing attack. We compared two different adaptive network responses to these attacks against a baseline of no response for 10 and 20 node networks. Each response reflects a level of trust assigned to the captured node. Our simulation used a responsive variant of the ad hoc on-demand distance vector (AODV) routing algorithm and focused on the response performance. We assumed that the attacks had been detected and reported. We compared performance tradeoffs of attack, response, and network size by focusing on metrics such as "goodput", i.e. percentage of messages that reach the intended destination untainted by the captured node. We showed, for example, that under general conditions a DoS attack response should minimize attacker impact while a response to a data swallowing attack should minimize risk to the system and trust of the compromised node with most of the response benefit. We show that the best network response depends on the mission goals, network configuration, density, network performance, attacker skill, and degree of compromise.

This paper designs and implements an Internet interface in an embedded POS system based on Webit, an embedded platform and interface for Internet of things which is a self-owned intellectual property of Lab. of Embedded Technology, Northeastern University, China. The Internet interface is designed and implemented on an 8-bit RISC micro-controller and Ethernet Network Interface Controller, with a real-time OS – WebitOS 2.0 strictly conforming to TCP/IP protocol requirements. Then experiments of testing functions and the performance of the embedded POS system are performed. And results show that the POS system based on Webit has a practical application value with properties such as low cost, and capabilities of simple network configuration and remote management.