|
|
 |
Search published articles |
 |
|
Morteza Asadi, Mohammad Reza Zamani, Kasra Tawakoli, Volume 13, Issue 1 (8-2024)
Abstract
Passwords have been utilized as the primary means of authentication since the inception of the World Wide Web and the introduction of online services. The security risks associated with the use of passwords and their vulnerabilities to various types of cyberattacks have rendered this method no longer secure. In recent years, online service providers have sought to protect their users and data from cyber threats by implementing various multi-factor authentication methods. Although these methods have been successful in reducing the incidence of security breaches, they have generally resulted in increased complexity for users. The FIDO standard employs asymmetric encryption, mandates the storage of the private key on the user’s device, and combines it with biometric factors, thereby enabling the most secure authentication method for systems while simplifying the process for users [1-4]. This standard monitors the entire authentication process and prevents potential risks by establishing regulations within operating systems, browsers, and authentication tools. Rahavard Samanehaye Amn Company has implemented this standard locally, offering FIDO authentication under the product name ”Neshane” for smart phones. This article discusses the applications, specifications, and capabilities of this standard and the developed product.
Nasrin Taaj, Amir Mansour Yadegari, Abouzar Arabsorkhi, Reza Kalantari, Volume 13, Issue 1 (8-2024)
Abstract
The development of the country's infrastructure as an independent, safe and stable infrastructure is one of the strategic priorities of the country, the realization of which, in addition to the technological requirements in the field of information and communication technology, laying the foundation for the establishment, development and supply of various services and content of the country's cyber space, requires the provision of secure communications. And the vital infrastructure of the country is also stable.
Based on the conceptual model contained in the resolution of the 66th meeting of the Supreme Council of Cyberspace, the communication and information infrastructure of the country consists of a series of main modules, whose risk analysis is in line with the reversibility in accidents, protection against threats, monitoring and intelligent response from the basic needs of communication access. It is safe and secure. Due to the space limitations of this article, the author intends to explain how to achieve multi-sample risk analysis from these basic modules and then based on the results, how to exploit the emerging knowledge in the form of a diagram to identify the type of threat and its source and extract Explain the mentioned preventive requirements.
Babak Siabi, Parvin Rastegari, Volume 13, Issue 1 (8-2024)
Abstract
Due to the increasing amount of data collection and processing in today’s digital world, preserving individual and organizational privacy has become an undeniable necessity. In this regard, alongside the efforts of scientific and research centers to address privacy issues, several laws have been established in different countries. Among these, the General Data Protection Regulation (GDPR) at the European level is widely regarded by researchers as the most significant change in the field of privacy laws in recent decades and serves as a strong model for managing personal data. Based on this, in this article, to explore the multifaceted nature of privacy, we first review the history of privacy protection, then focus on the GDPR law. Some of the most important points and considerations regarding the nature and structure of this law, as well as the necessity and challenges of compliance with it, are presented. Additionally, the extensive measures outlined in this law for the implementation and enforcement of privacy protection mechanisms are discussed. Finally, by mapping the discussed content to the current state of privacy in Iran, some key points for the practical implementation of privacy laws in Iran are highlighted.
Ghodsieh Karimi , Morteza Adeli, Mohammad Ali Hadavi, Volume 13, Issue 2 (12-2024)
Abstract
With the increasing use of RFID tags, there is a need for specific protocols to communicate with these tags. Among these protocols, the ownership transfer stands out as it ensures the security and privacy of objects for the new owner after a change of ownership. Recently, a lightweight object ownership transfer protocol has been proposed for RFID networks. This protocol utilizes a lightweight linear function for security. The designers of the protocol claim that it is secure against known attacks while also being lightweight. In this paper, we identify vulnerabilities in the function used in this protocol and demonstrate that it is susceptible to the secret disclosure attack. We show that with at most 4 × L executions of the protocol (where L is the key length), one can obtain the necessary information from intercepted data to execute the attack and subsequently recover the shared keys used in the protocol.
Abouzar Arabsorkhi, Tala Tafazoli, Volume 13, Issue 2 (12-2024)
Abstract
One of the most important issues in information technology era is data protection; If this issue is not considered, confidence and usability and extension of information and communication technology will be threatened. In this way, politiceans and decision makers in organizations, industry and governments want to regulate the information and communication era. This regularization is performed based on decision making considerations and variables, while forgetting them may rise challenges and cause crisis. In management sciences they are called strategic issues. Current research identifies, defines, and analyzes strategic issues that different goverments, use them to reinfornce information governance structures like maintenance and governance of data and information security. These strategic issues are in the range of national documents, reference standards and documentation related to general data protection regulations (GDPR). In this research, we investigate documents and references related to data protection regulations using content analysis, to identify strategic issues.
Seyed Hesam Odin Hashemi, Mohammad Hassan Majidi, Volume 13, Issue 2 (12-2024)
Abstract
With the ever-increasing growth of the Internet and the expansion of imaging tools, digital images are a huge part of the information we work with. This information often contains sensitive data that requires protection. This paper presents a chaotic image encryption method that effectively safeguards the information contained within digital images. The IEPS encryption system is an image encryption scheme based on a Piecewise linear chaotic map (PWLCM) and the SHA-512 hashing function. This design incorporates two operations: permutation and substitution of image pixels. In the permutation stage, the PWLCM map is employed, and the features of the SHA-512 are utilized to substitute the pixels. The experimental results demonstrate that the PWLCM encryption algorithm successfully encrypts the information within the image and exhibits robust performance against various analyses, including the entropy, histogram, key sensitivity criterion, and resistance to differential attacks.
Farnoosh Karimi, Behrouz Tork Ladani, Behrouz Shahgholi Ghahfarokhi, Volume 13, Issue 2 (12-2024)
Abstract
As the intensity of global cybersecurity threats continues to rise, the need for training security professionals has gained greater significance. Educational programs, complemented by laboratories and the execution of cybersecurity exercises, play a fundamental role in enhancing both offensive and defensive capabilities. The execution of such exercises is particularly crucial in operational networks, where testing cyberattacks may not be feasible. Cyber ranges offer an appropriate platform for conducting these exercises. A primary challenge in cybersecurity education is aligning training programs with the diverse skill levels of learners. Adaptive learning, powered by artificial intelligence and recommendation systems, can provide an effective solution for delivering personalized instruction. This study focuses on the KYPO Cyber Range to examine the potential of substituting or augmenting the role of the instructor with an AI-based recommendation agent. The objective of this research is to minimize human intervention and improve the efficiency of the training process. To this end, data collected from the KYPO Cyber Range, developed by Masaryk University, has been utilized, and various machine learning models have been applied to automate and optimize the training process. The results of this research indicate that the integration of artificial intelligence can enhance the performance of educational systems and reduce evaluation time.
Fateme Pishdad, Reza Ebrahimi Atani, Volume 13, Issue 2 (12-2024)
Abstract
With the advancement and development of Internet of Things (IoT) applications, the need for securing infrastructure in this domain has gained particular importance due to the limitations of computational and storage resources. Botnets are among IoT security challenges in which, by infecting computational nodes of this technology, they are capble of turning the network into a collection of compromised machines under the control of attackers. This paper proposes an anomaly detection system based on ensemble learning to prevent and identify IoT botnet attacks at the initial scanning stage and DDoS attacks. This system uses feature selection and optimal hyperparameter tuning for each classifier to increase model accuracy and prevent overfitting. The data used in this paper is taken from the BoT-IoT dataset, which covers activities related to different stages of the botnet lifecycle. For feature selection and classification, two ensemble learning algorithms, LightGBM and Random Forest, are used, and hyperparameter optimization is performed using the TPE method. Results demonstrated that the LightGBM algorithm achieved an error rate of 0.98% and an accuracy of 99.02%, while the Random Forest algorithm exhibited an error rate of 0.01% and an accuracy of 99.99%, indicating highly satisfactory performance in attack detection. The proposed models, with increased training and prediction time, have offered significantly higher accuracy compared to previous models.
Fatemeh Gholami Sabzevar, Masoumeh Safkhani, Volume 13, Issue 2 (12-2024)
Abstract
Privacy preservation in healthcare monitoring systems has always been a concern for both patients and doctors. To address this issue, many protocols have been designed. In this article, we examine the proposed scheme by Nasr Esfahani and colleagues, evaluating it from a security perspective. Their proposed scheme uses a three-layer hierarchical template chain to store and maintain critical medical information of patients in a centralized and secure manner. Additionally, by using Zero-Knowledge Proof (ZKP) and ring signature methods, they demonstrate that their scheme protects medical data against both internal and external attacks. According to potential scenarios, the Nasr Esfahani et al. protocol has shown good performance against many attacks, such as storage attacks and replay attacks, but it is vulnerable to integrity violation attacks. The success probability of the attacks presented in this article is one, and the complexity is only a single execution of the protocol.
Mahnaz Noroozi, Atiye Sadeghi , Volume 13, Issue 2 (12-2024)
Abstract
Arian Arabnouri, Soheil Eissazadeh, Alireza Shafieinejad, Volume 13, Issue 2 (12-2024)
Abstract
Auditable log is a common approach for monitoring system performance, forensic investigations, and event analysis. Regarding the crucial role of logs in identification of attackers, adversaries often attempt to tamper with these files to hide their traces. As a result, ensuring the secure storage of logs is critical. Blockchain technology, with its immutability feature, provides an ideal solution for secure storing of logs. However, the scalability limitations of existing public blockchains have made blockchain-based solutions impractical. To address this challenge, this paper proposes an approach where logs are categorized into time-based intervals, and a chain of linked entries using Message Authentication Codes (MAC) for each type of log. In addition to MAC, a counter is assigned to each class of log to enable detection of any deletion, insertion, repetition, or even reordering of log records, as the logical chain would be disrupted. At the end of each interval, known as checkpoint, newly verified log is appended to the blockchain. This approach not only ensures the security of logs but also enhances system efficiency by reducing the amount of data stored on the blockchain through batch processing. Our implementation demonstrates that the proposed system offers improved efficiency, requiring fewer computations compared to other methods.
Keivan Khoormehr, Javad Alizadeh, Mohsen Jahanbani, Volume 13, Issue 2 (12-2024)
Abstract
Side-channel attacks, particularly power analysis attacks, pose a significant threat to the security of block cipher applications in hardware. These attacks can be executed using three primary methods: Simple Power Analysis (SPA), Differential Power Analysis (DPA), and Correlation Power Analysis (CPA). This paper examines the vulnerability of the SPEEDY block cipher to such power analysis attacks. In the first section, we demonstrate that the non-linear layer of the SPEEDY block cipher is susceptible to information leakage when subjected to power analysis attacks. By implementing the cipher in hardware and utilizing 1000 input samples, we establish that key-recovery attacks are feasible. The second section focuses on countermeasures to enhance the security of the SPEEDY block cipher against power analysis attacks. We propose a secure implementation method that employs Domain-Oriented Masking (DOM). Using the SILVER tool and the T-test method, we show that the secured version of the SPEEDY block cipher effectively mitigates the vulnerabilities and information leakages present in the original version when exposed to power analysis attacks.
Dr. Marzieh Vahid Dastjerdi, Mr. Majid Rahimi, Volume 14, Issue 1 (9-2025)
Abstract
The objective of this paper is to analyze and evaluate the behaviour of modular addition and subtraction in symmetric cipher attacks. Modular addition is one of the most widely used nonlinear operators in symmetric cryptographic algorithms. In ARX symmetric algorithms, only three operators are utilized: modular addition, rotation, and XOR. In ARX-like algorithms, modular subtraction or a substitution box is employed, in addition to the standard ARX operations. Since modular subtraction exhibits similar behaviour to modular addition, its behaviour against cryptanalytic attacks has not been explicitly studied in the literature. Therefore, this paper aims to provide a comprehensive overview of the behaviour of modular addition and subtraction in differential, linear, integral cryptanalysis based on division property, and rotational attacks, using both manual analysis and automated methods via MILP (Mixed-Integer Linear Programming). We demonstrate that there is no difference between modular addition and subtraction in differential, linear, and rotational cryptanalysis. However, in integral cryptanalysis based on the division property, these two operations behave differently.
|
|