With the widespread innovation of the Internet of Things, software-defined networking (SDN), and cloud computing, cyber-physical systems (CPSs) have been developed and widely adopted to facilitate our daily life and economy. In particular, modern society heavily relies on all kinds of CPSs, such as smart grids, and transportation systems. So the shutdown of critical services can lead to serious consequences. Meanwhile, distributed denial-of-service (DDoS) attacks are becoming a major threat to the CPSs due to their ease of execution and the devastation they cause. In addition, owing to the constant updating of attack methods, there is an urgent need for a method to defend against both the known and unknown DDoS attacks. In this article, we present an adaptive DDoS attack mitigation (ADAM) scheme to detect and mitigate DDoS attacks in software-defined CPSs. By combining information entropy and unsupervised anomaly detection methods, ADAM can not only automatically determine the current state, but also adaptively identify suspicious features and thereafter precisely mitigate DDoS attacks. We also propose a pipeline filtering mechanism to accurately drop attack traffic, and this method can be implemented in the existing SDN networks without additional devices required. Unlike most of the classification-based DDoS mitigation scenarios, we aim to mitigate a wide spectrum of DDoS attacks without defining attack characteristics in advance. Real data-driven experimental results show that ADAM has an average mitigation accuracy of 99.13% under high-intensity DDoS attacks. Compared to similar work, our method reduces the false-positive rate by 35%-59%.

Industrial Internet-of-Things (IIoT) is the basis of Industry 4.0, which extends Internet connectivity beyond traditional computing devices like computers and smartphones to the physical world for improving efficiency and accuracy while reducing the production cost. However, there are tremendous security threats to IIoT, such as IIoT device hijacking and data leaks. Therefore, a lightweight authenticated key agreement (AKA) protocol is commonly applied to establish a session key for securing the communication between IIoT devices. To protect the previous session keys from being compromised, perfect forward secrecy (PFS) has been one of the most important security properties of AKA. In this work, we present an efficient PFS-enabled AKA protocol for IIoT systems, which is developed based on a new dynamic authentication credential (DAC) framework, without using any public-key cryptographic primitives. It is worth noting that our protocol is also faster than the state-of-the-art DAC-based AKA protocols with PFS. Moreover, we give the formal security result of the proposed protocol in the random oracle model.

Localization based on premeasured WiFi fingerprints is a popular method for indoor localization where satellite based positioning systems are unavailable. In these systems, privacy of the user's location is lost because the location is computed by the service provider. In INFOCOM'14, Li et al. presented PriWFL, a WiFi fingerprint localization system based on additively homomorphic Paillier encryption, that was claimed to protect both the users' location privacy and the service provider's database privacy. In this paper, we demonstrate a severe weakness in PriWFL that allows an attacker to compromise the service provider's database under a realistic attack model and also identify certain other problems in PriWFL that decrease its localization accuracy. Hence, we show that PriWFL does not solve the privacy problems of WiFi fingerprint localization. We also explore different solutions to implement secure privacy-preserving WiFi fingerprint localization and propose two schemes based on Paillier encryption which do not suffer from the weakness of PriWFL and offer the same localization accuracy as the privacy-violating schemes.

Public key cryptographic primitive (e.g., the famous Diffie-Hellman key agreement, or public key encryption) has recently been used as a standard building block in authenticated key agreement (AKA) constructions for wireless sensor networks (WSNs) to provide perfect forward secrecy (PFS), where the expensive cryptographic operation (i.e., exponentiation calculation) is involved. However, realizing such complex computation on resource-constrained wireless sensors is inefficient and even impossible on some devices. In this work, we introduce a new AKA scheme with PFS for WSNs without using any public key cryptographic primitive. To achieve PFS, we rely on a new dynamic one-time authentication credential that is regularly updated in each session. In particular, each value of the authentication credential is wisely associated with at most one session key that enables us to fulfill the security goal of PFS. Furthermore, the proposed scheme enables the principals to identify whether they have been impersonated previously. We highlight that our scheme can be very efficiently implemented on sensors since only hash function and XOR operation are required.