Zhiming Zhang

Replica node attacks, a common issue in wireless sensor networks (WSNs), can cause major damage. Most traditional replica node detection protocols are designed for static WSNs and are limited by easy information leakage, high storage and communication overhead, and a short network lifetime. Therefore, this study proposes a multi-point collaborative mobile replica node detection protocol based on key negotiation, referred to as KN-MCDP. The KN-MCDP scheme is designed for use in mobile wireless sensor networks (MWSNs) where a limited number of mobile nodes are deployed in static WSNs. The protocol can not only identify replica nodes in static WSNs but also determine whether a mobile node is a replica, thereby providing enhanced network protection. When cluster head nodes and mobile nodes communicate, they encrypt the exchanged information using digital signature technology, ternary symmetric polynomial technology, and symmetric encryption technology, thus preventing information leakage collected by cluster head nodes. Collecting network information using Bloom filters on cluster head nodes and mobile nodes reduces network storage and communication overhead. In different phases, the protocol employs cluster head nodes, mobile nodes, and the base station to identify and isolate replica nodes. This approach balances the energy overhead of the network and extends its lifetime. The experimental results demonstrate that the KN-MCDP protocol can achieve a high detection rate, reduce the network’s storage and communication overhead, balance energy overhead, and extend the network lifetime.

The IETF 6TiSCH Working Group proposed a highly reliable and low-power industrial wireless network protocol stack, which integrates IEEE 802.15.4e time-slotted channel hopping (TSCH) with IPv6 protocols. Scheduling is crucial in the 6TiSCH protocol stack, as it determines when a node sends or receives network packets on specific timeslots and channels. However, the current resource scheduling suffers from random timeslot selection, channel collisions, and high energy consumption, all of which degrade network performance. In this article, we propose an innovative scheduling function consisting of three core components. First, a multiweight quality evaluation is proposed to enable precise timeslot selection, improving resource allocation efficiency. Second, an improved Q-Learning-based scheduling mechanism is proposed to generate optimal parameters for multiweight evaluations, which is based on the global network state implemented at the edge router. Third, a pseudo-random channel selection strategy is proposed to effectively reduce channel congestion and interference. Extensive experimental results demonstrate that our function achieves a latency improvement of up to 55% compared to state-of-the-art low-latency scheduling, and along with an enhancement of up to 6% in the packet delivery ratio.

RPL(Routing Protocol for Low-Power and Lossy Networks) is a standardized routing protocol of IoT proposed by IETF(Internet Engineering Task Force) Working Group. The escalating surge of cyberattacks targeting IoT systems has exposed critical security vulnerabilities in RPL-based networks. Attackers exploit routing spoofing, resource depletion tactics, and topology manipulation strategies, while inherent constraints of resource-limited devices and scalability challenges in mass deployments amplify these risks. This critical security gap therefore necessitates the deployment of lightweight IDS(Intrusion Detection Systems) to achieve real-time anomaly detection and monitoring However, the current IDS for RPL-based IoT has certain limitations such as routing attacks dataset lack coverage of a sufficient variety of routing attacks and detection methods involve significant computational overhead. To address these problems, we have conducted the following research work. First, a novel routing attacks dataset that covers four RPL routing attack types is constructed through simulation on the Cooja IoT platform. And we develop feature extraction algorithms for dataset to extract 24 features implementing in IDS model training. Second, we propose an efficient routing detection method that accelerates model training speed by using Hybrid Pearson Correlation and GS-PSO(Grid Search-Particle Swarm Optimization) Optimized Random Forest Technique. The Pearson correlation can effectively extract key data features for different routing attacks. And the hybrid GS-PSO algorithm can optimize the hyperparameters of IDS model and enhance the accuracy of the detection mechanism while significantly reducing computational overhead. Finally, we demonstrate our IDS model has higher detection accuracy and lower computation time compared to other existing models through simulation experiments.

The escalating adoption of Internet of Things (IoT) technologies produces vast amounts of real-time data, which can be shared and analyzed to enhance productivity and product quality across various industries. Unfortunately, the current IoT systems rely heavily on cloud servers for centralized data management. These systems not only suffer from the single point of failure problems but also have data security issues. The malicious users may compromise user privacy or inject corrupted data during the data sharing process. In this article, we propose a secure and efficient data sharing scheme for IoT. First, the scheme integrates blockchain with the distributed database, utilizing smart contracts to ensure secure data storage, querying, and sharing in IoT. Second, we incorporate a reputation mechanism into the data sharing process. This allows IoT users to receive reputation feedback from their partners based on their behaviors, which is dynamically updated as a reputation score on the blockchain by smart contracts. Therefore, honest users get more opportunities to share data, while malicious users are held accountable and revoked from the IoT system. We also harness advanced cryptographic techniques to ensure the submission of reputation feedback does not disclose the user’s private information, preventing vindictive actions from malicious users. Finally, we demonstrate the security and effectiveness of the proposed scheme by conducting the security analysis and the detailed experiments.

The Internet Engineering Task Force (IETF) developed a standard wireless communication protocol stack called 6TiSCH to provide low-power and high-reliability communications in harsh industrial environments. However, the current IETF 6TiSCH protocol lacks adequate consideration of inter-device authentication and key management, exposing the IETF 6TiSCH-based wireless network to security risks such as key leakage and malicious attacks. Meanwhile, existing authentication and key management schemes cannot be directly applied to the resource-constrained IETF 6TiSCH industrial wireless network. To address this challenge, we propose a novel scheme called SAKMS, which is tightly integrated with the IETF 6TiSCH network and incorporates the following key components: (i) improved elliptic curve cryptography (ECC) operation, a regular window method is proposed to accelerate the computation of the ECC-related operations; (ii) secure authentication process, SAKMS distributes implicit certificates for each device in the network and adopts the improved ECC algorithm to achieve secure and trustworthy authentication between devices, and the process only consist of hashing, XOR, and a few ECC multiplication operations; (iii) dynamic key update, after successful authentication, devices can negotiate and dynamically update link keys, ensuring resilience against potential key leakage issues. We perform formal and informal security analyses to demonstrate the resilience of SAKMS against various known attacks. Finally, we extensively evaluate the performance of SAKMS in a real 6TiSCH wireless sensor network. The experimental results show a 37% improvement in the computational efficiency of ECC operations compared to existing works, with link key establishment taking only 0.9 s on the OpenMoteSTM platform.

The security technology of digital twin is an important guarantee to ensure the security of digital twin operation, which mainly includes network security technology, data security technology and privacy protection technology. In wireless sensor networks, data aggregation technologies are known as a suitable solution to reduce energy consumption. In addition, due to wireless communications, wireless sensor networks are subject to many attacks. Therefore, it is very important to provide data security in the data aggregation process. In this paper, in order to protect data privacy and verify data integrity, moreover, balance the energy consumption and security during the data aggregation, we present a privacy and integrity–preserving data aggregation scheme for wireless sensor networks based on digital twins technology and homomorphic fingerprinting (HFPIDA). The HFPIDA adopts privacy function to protect data privacy and adopts homomorphic fingerprinting technology to verify the aggregation data integrity. Security analysis shows that the HFPIDA can effectively preserve data privacy and verify data integrity. Simulation results show that the HFPIDA requires less communication and energy overheads, and can achieve higher aggregation accuracy.

The current detection schemes of malicious nodes mainly focus on how to detect and locate malicious nodes in a single path; however, for the reliability of data transmission, many sensor data are transmitted by multipath in wireless sensor networks. In order to detect and locate malicious nodes in multiple paths, in this paper, we present a homomorphic fingerprinting-based detection and location of malicious nodes (HFDLMN) scheme in wireless sensor networks. In the HFDLMN scheme, using homomorphic fingerprint and coding technology, the original data is divided into n packets and sent to the base station along n paths, respectively; the base station determines whether there are malicious nodes in each path by verifying the validity of the packets; if there are malicious nodes in one or more paths, the location algorithm of the malicious node is implemented to locate the specific malicious nodes in the path; if all the packets are valid, the original data is recovered. The HFDLMN scheme does not need any complex evaluation model to evaluate and calculate the trust value of the node, nor any monitoring nodes. Theoretical analysis results show that the HFDLMN scheme is secure and effective. The simulation results demonstrate promising outcomes with respect to key parameters such as the detection probability of the malicious path and the locating probability of the malicious node.

The growing market share of FPGAs motivates the increasing number of attackers to tamper with FPGA systems. The majority of existing research efforts on FPGA security focus on counterfeiting devices, hardware Trojans, reverse engineering hardware designs via decomposing or decrypting bitstream files, and side-channel analysis attacks. Those attacks are typically limited to the FPGA systems implemented in standalone FPGA devices. As more cloud-based FPGA providers, third-party accelerator suppliers, and open-source FPGA design tools are available for prototyping, hardware acceleration, and high-performance computing, new FPGA utilization models are gradually formed. The increasing number of entities involved in the new FPGA use model leads to the emergence of new security threats and attack surfaces. Although the security issues on FPGA systems design and piracy have been widely investigated, there is limited investigation available disclosing the security threats from the FPGA design tools perspective. This work conducts a comprehensive survey on the FPGA tool security and proposes a thorough security threat landscape for the new FPGA utilization model in the era of machine learning and cloud computing.