Rapid growth of Internet of Things (IoT) devices dealing with sensitive data has led to the emergence of new access control technologies in order to maintain this data safe from unauthorized use. In particular, a dynamic IoT environment, characterized by a high signaling overhead caused by subscribers’ mobility, presents a significant concern to ensure secure data distribution to legitimate subscribers. Hence, for such dynamic environments, group key management (GKM) represents the fundamental mechanism for managing the dissemination of keys for access control and secure data distribution. However, existing access control schemes based on GKM and dedicated to IoT are mainly based on centralized models, which fail to address the scalability challenge introduced by the massive scale of IoT devices and the increased number of subscribers. Besides, none of the existing GKM schemes supports the independence of the members in the same group. They focus only on dependent symmetric group keys per subgroup communication, which is inefficient for subscribers with a highly dynamic behavior. To deal with these challenges, we introduce a novel Decentralized Lightweight Group Key Management architecture for Access Control in the IoT environment (DLGKM-AC). Based on a hierarchical architecture, composed of one Key Distribution Center (KDC) and several Sub Key Distribution Centers (SKDCs), the proposed scheme enhances the management of subscribers’ groups and alleviate the rekeying overhead on the KDC. Moreover, a new master token management protocol for managing keys dissemination across a group of subscribers is introduced. This protocol reduces storage, computation, and communication overheads during join/leave events. The proposed approach accommodates a scalable IoT architecture, which mitigates the single point of failure by reducing the load caused by rekeying at the core network. DLGKM-AC guarantees secure group communication by preventing collusion attacks and ensuring backward/forward secrecy. Simulation results and analysis of the proposed scheme show considerable resource gain in terms of storage, computation, and communication overheads.

Current flow-based Network Intrusion Detection Systems (NIDSs) have the drawback of detecting attacks only once the flow has ended, resulting in potential delays in attack detection and increasing the risk of damage due to the infiltration of a greater number of malicious packets. Moreover, the delay provides attackers with an extended period of presence within the network, enabling them to execute subsequent attacks. To overcome this drawback, this work addresses the issue of early flow classification in NIDSs that incorporates a Deep Learning (DL) model. This model leverages Recurrent Neural Networks (RNNs), including Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU), coupled with attention mechanisms. This strategic combination allows the system to harness the inherent sequential nature of packets within network flows, enhancing the efficiency of early flow classification. We conducted experiments on two up-to-date network intrusion datasets, namely CIC-IDS2017 and 5G-NIDD. Our findings demonstrate the effectiveness and accuracy of the proposed NIDS in classifying network flows. Additionally,our approach showcases its efficacy by promptly identifying and detecting attacks in their early stages without the need for flow termination. This results in a reduction in both the number of initial packets required for classification and the time needed for detection.

Protecting the location privacy is one of the main challenges in vehicular ad-hoc networks (VANETs). Although, standardization bodies, such as IEEE and ETSI, have adopted a pseudonym-based scheme as a solution for this problem, an efficient pseudonym changing and management is still an open issue. In this paper, we propose PRIVANET, a complete and efficient pseudonym changing and management framework. The PRIVANET has a hierarchical structure and considers the vehicular geographic area as a grid. Each cell of this grid contains one or many logical zones, called vehicular location privacy zones (VLPZs). These zones can easily be deployed over the widespread roadside infrastructures (RIs), such as gas stations, to provide a secure changing and management of pseudonyms. The proposed framework consists of different building blocks: 1) an effective VLPZ-based pseudonym changing strategy; 2) a reputation-based mechanism to motivate selfish vehicles to enter VLPZs; 3) an adapted user-centric privacy model; 4) a secure hybrid mechanism for the distribution of pseudonyms sets and CRLs; 5) a method to generate the IP and MAC addresses from the pseudonym; 6) a stochastic model to estimate the number of VLPZs required at a given cell; and 7) a mathematical model for an optimal placement of the VLPZs over RIs to reduce the transportation cost of vehicles in terms of time. An extensive simulation study using a realistic map and with real traffic mobility measurements is carried out to evaluate and validate the performance of the PRIVANET. The simulation results demonstrate the effectiveness of the proposed framework.