Privacy Policies and Measurement - The Function-as-a-Service cloud computing paradigm has made large-scale application development convenient and efficient as developers no longer need to deploy or manage the necessary infrastructure themselves. However, as a consequence of this abstraction, developers lose insight into how their code is executed and data is processed. Cloud providers currently offer little to no assurance of the integrity of customer data. One approach to robust data integrity verification is the analysis of data provenance—logs that describe the causal history of data, applications, users, and non-person entities. This paper introduces ProProv, a new domain-specific language and graphical user interface for specifying policies over provenance metadata to automate provenance analyses.

Outsourced Database Security - The growing power of cloud computing prompts data owners to outsource their databases to the cloud. In order to meet the demand of multi-dimensional data processing in big data era, multi-dimensional range queries, especially over cloud platform, have received extensive attention in recent years. However, since the third-party clouds are not fully trusted, it is popular for the data owners to encrypt sensitive data before outsourcing. It promotes the research of encrypted data retrieval. Nevertheless, most existing works suffer from single-dimensional privacy leakage which would severely put the data at risk. Up to now, although a few existing solutions have been proposed to handle the problem of single-dimensional privacy, they are unsuitable in some practical scenarios due to inefficiency, inaccuracy, and lack of support for diverse data. Aiming at these issues, this paper mainly focuses on the secure range query over encrypted data. We first propose an efficient and private range query scheme for encrypted data based on homomorphic encryption, which can effectively protect data privacy. By using the dualserver model as the framework of the system, we not only achieve multi-dimensional privacy-preserving range query but also innovatively realize similarity search based on MinHash over ciphertext domains. Then we perform formal security analysis and evaluate our scheme on real datasets. The result shows that our proposed scheme is efficient and privacy-preserving. Moreover, we apply our scheme to a shopping website. The low latency demonstrates that our proposed scheme is practical.

Network Security Resiliency - Distributed cyber-infrastructures and Artificial Intelligence (AI) are transformative technologies that will play a pivotal role in the future of society and the scientific community. Internet of Things (IoT) applications harbor vast quantities of connected devices that collect a massive amount of sensitive information (e.g., medical, financial), which is usually analyzed either at the edge or federated cloud systems via AI/Machine Learning (ML) algorithms to make critical decisions (e.g., diagnosis). It is of paramount importance to ensure the security, privacy, and trustworthiness of data collection, analysis, and decision-making processes. However, system complexity and increased attack surfaces make these applications vulnerable to system breaches, single-point of failures, and various cyber-attacks. Moreover, the advances in quantum computing exacerbate the security and privacy challenges. That is, emerging quantum computers can break conventional cryptographic systems that offer cyber-security services, public key infrastructures, and privacy-enhancing technologies. Therefore, there is a vital need for new cyber-security paradigms that can address the resiliency, long-term security, and efficiency requirements of distributed cyber infrastructures.

Network Security Resiliency - The 5G ecosystem is designed as a highly sophisticated and modularized architecture that decouples the radio access network (RAN), the multi-access edge computing (MEC) and the mobile core to enable different and scalable deployments. It leverages modern principles of virtualized network functions, microservices-based service chaining, and cloud-native software stacks. Moreover, it provides built-in security and mechanisms for slicing. Despite all these capabilities, there remain many gaps and opportunities for additional capabilities to support end-toend secure operations for applications across many domains. Although 5G supports mechanisms for network slicing and tunneling, new algorithms and mechanisms that can adapt network slice configurations dynamically to accommodate urgent and mission-critical traffic are needed. Such slices must be secure, interference-aware, and free of side channel attacks. Resilience of the 5G ecosystem itself requires an effective means for observability and (semi-)autonomous self-healing capabilities. To address this plethora of challenges, this paper presents the SECurity and REsiliency TEchniques for Differentiated 5G OPerationS (SECRETED 5G OPS) project, which is investigating fundamental new solutions that center on the zero trust, network slicing, and network augmentation dimensions, which together will achieve secure and differentiated operations in 5G networks. SECRETED 5G OPS solutions are designed to be easily deployable, minimally invasive to the existing infrastructure, not require modifications to user equipment other than possibly firmware upgrades, economically viable, standards compliant, and compliant to regulations.

Network Security Resiliency - The 5G ecosystem is designed as a highly sophisticated and modularized architecture that decouples the radio access network (RAN), the multi-access edge computing (MEC) and the mobile core to enable different and scalable deployments. It leverages modern principles of virtualized network functions, microservices-based service chaining, and cloud-native software stacks. Moreover, it provides built-in security and mechanisms for slicing. Despite all these capabilities, there remain many gaps and opportunities for additional capabilities to support end-toend secure operations for applications across many domains. Although 5G supports mechanisms for network slicing and tunneling, new algorithms and mechanisms that can adapt network slice configurations dynamically to accommodate urgent and mission-critical traffic are needed. Such slices must be secure, interference-aware, and free of side channel attacks. Resilience of the 5G ecosystem itself requires an effective means for observability and (semi-)autonomous self-healing capabilities. To address this plethora of challenges, this paper presents the SECurity and REsiliency TEchniques for Differentiated 5G OPerationS (SECRETED 5G OPS) project, which is investigating fundamental new solutions that center on the zero trust, network slicing, and network augmentation dimensions, which together will achieve secure and differentiated operations in 5G networks. SECRETED 5G OPS solutions are designed to be easily deployable, minimally invasive to the existing infrastructure, not require modifications to user equipment other than possibly firmware upgrades, economically viable, standards compliant, and compliant to regulations.

Network Security Resiliency - Recently, Cloud Computing became one of today’s great innovations for provisioning Information Technology (IT) resources. Moreover, a new model has been introduced named Fog Computing, which addresses Cloud Computing paradigm issues regarding time delay and high cost. However, security challenges are still a big concern about the vulnerabilities to both Cloud and Fog Computing systems. Man- in- the- Middle (MITM) is considered one ofthe most destructive attacks in a Fog Computing context. Moreover, it’s very complex to detect MiTM attacks as it is performed passively at the SoftwareDefined Networking (SDN) level, also the Fog Computing paradigm is ideally suitable for MITM attacks. In this paper, a MITM mitigation schemewill be proposed consisting of an SDN network (Fog Leaders) which controls a layer of Fog Nodes. Furthermore, Multi-Path TCP (MPTCP) has been used between all edge devices and Fog Nodes to improve resource utilization and security. The proposed solution performance evaluation has been carried out in a simulation environment using Mininet, Ryu SDN controller and Multipath TCP (MPTCP) Linux kernel. The experimental results showed thatthe proposed solution improves security, network resiliency and resource utilization without any significant overheads compared to the traditional TCP implementation.

Network Control Systems Security - The huge advantages of cloud computing technology and the bottlenecks in the development of traditional network control systems have prompted the birth of cloud control systems to address the shortcomings of traditional network control systems in terms of bandwidth and performance. However, the information security issues faced by cloud control systems are more complex, and distributed denial-of-service (DDoS) attacks are a typical class of attacks that may lead to problems such as latency in cloud control systems and seriously affect the performance of cloud control systems. In this paper, we build a single-capacity water tank cloud control semi-physical simulation system with heterogeneous controllers and propose a DDoS attack detection method for cloud control systems based on bidirectional long short-term memory neural network (BiLSTM), study the impact of DDoS attacks on cloud control systems. The experimental results show that the BiLSTM algorithm can effectively detect the DDoS attack on the cloud control system.

Network Intrusion Detection - Under the background of the continuous improvement of Chinese social modernization and development level and the comprehensive popularization of information technology, data mining technology is becoming more and more widely used, but the corresponding network security problems occur frequently, which causes serious constraints to the improvement of data mining technology level.Therefore, this paper analyzes the simulation measures of cloud computing network security intrusion detection model based on data mining technology, to ensure that under the cloud computing environment, network intrusion effectively prevents concealment, degeneration, unpredictable, effectively realize the real-time monitoring network intrusion target, and improve the application value of relevant technologies.

Network Accountability - Important for cloud services the cloud computing share throw multiple clients , and it is more important to allocate resources for cloud service provider , cloud computing is an infrastructure that provides on demand network services , in relation , the most important feature of the cloud services is that user’s data are hosted in remote . While taking benefit of this new emerging technology, users’ fear of losing command of their own data, is becoming a noteworthy hurdle to the extensive implementation of cloud services. Cloud service provider module is to process data owner request for storing data files and application and provides cloud users log details to data owner for audit purpose, to address this problem framework based on information accountability to keep track and trial of the authentic handling of the users’ data in the cloud. The system proposed that the Data can be fully tracked by the owner and follow up the service agreements by depending on many items which access, usage control and management.

Nearest Neighbor Search - One of the most significant and widely used IT breakthroughs nowadays is cloud computing. Today, the majority of enterprises use private or public cloud computing services for their computing infrastructure. Cyber-attackers regularly target Cloud resources by inserting malicious code or obfuscated malware onto the server. These malware programmes that are obfuscated are so clever that they often manage to evade the detection technology that is in place. Unfortunately, they are discovered long after they have done significant harm to the server. Machine Learning (ML) techniques have shown to be effective at finding malware in a wide range of fields. To address feature selection (FS) challenges, this study uses the wrapperbased Binary Bat Algorithm (BBA), Cuckoo Search Algorithm (CSA), Mayfly Algorithm (MA), and Particle Swarm Optimization (PSO), and then k-Nearest Neighbor (kNN), Random Forest (RF), and Support Vector Machine (SVM) are used to classify the benign and malicious records to measure the performance in terms of various metrics. CIC-MalMem-2022, the most recent malware memory dataset, is used to evaluate and test the proposed approach and it is found that the proposed system is an acceptable solution to detect malware.

Nearest Neighbor Search - With the rise and development of cloud computing, more and more companies try to outsource computing and storage to cloud in order to save storage and computing cost. Due to the rich information contained in images, the explosion of images is booming the image outsourcing. However, images may contain a lot of sensitive information and cloud servers are always not trusted. Directly outsourcing may lead to data breaches and incur privacy and security concerns. This has partly led to renewed interest in privacy-preserving encrypted image retrieval. However, there are still many challenges, such as low search accuracy and inefficiency due to the hundreds of high dimensional features extracted from a single image and the large scale of images. To address these challenges, in this paper, we propose an efficient, scalable and privacy-preserving image retrieval scheme via ball tree. First, the pre-trained Convolutional Neural Network (CNN) model is employed to extract image feature vectors to improve search accuracy. Next, an encrypted ball tree is constructed by using Learning With Errors(LWE)based secure k-Nearest Neighbor (kNN) algorithm. Finally, we conduct comprehensive experiments on real-world datasets and give a brief security analysis. The results show that our scheme is practical in terms of security, accuracy, and efficiency.

Multifactor Authentication - Cloud computing is a breakthrough advancement that provides ubiquitous services over the internet in an easy way to distribute information offering various advantages to both society and individuals. Recently, cloud technology has eased everyone’s life more favorable. However, privacy-preservation is an important issue to be tackled effectively in cloud environment while retrieving data services. Numerous techniques have been developed so far to verify user identity by exploiting authentication factor, whereas such techniques are inefficient and they are easily susceptible to unknown users and attacks. In order to address such problems, a multifactor authentication scheme is proposed using Hashing, Chebyshev polynomial, Key and OneTime Token (HCK-OTT) based multifactor authentication scheme for privacy-preserved data security in cloud. The entities involved in this proposed approach for effective authentication are user, cloud server, and data owner. The model is developed by considering various functionalities, such as encryption, Elliptic Curve Cryptography (ECC), XOR, and hashing function. The proposed HCK-OTT-based multifactor authentication scheme has achieved a minimum value of 22.654s for computational time, 70.5MB for memory usage, and 21.543s for communication cost with 64 bit key length.

Multifactor Authentication - With the growth of the number in smart devices based on IoT, keeping a secure data processing among them has become even more significant in cloud computing. However, a high security is needed to protect the huge amount of data privacy. In this regard, many authentication approaches are presented in IoT-Cloud-based Architecture. However, computation, latency, and security strength are major issues to provide authentication for users. We propose the Multifactor Scalable Lightweight Cryptography for IoTCloud to enhance security to protect the user or organization s information. The non-sensitive and sensitive data are generated from IoT devices and stored in our proposed hybrid public and private cloud after the encryptions. Hence, encryptions for public cloud and private cloud data are done by Digital Signature Algorithm and Policy based Attribute encryption algorithm with Moth fly optimization. This optimization is chosen as the key parameter efficiently. The three multifactors are then used to perform the three levels of authentication by Trust based Authentication Scheme. Following this, the proposed multifactor authentication is simulated and compared with existing approaches to analyze the performance in terms of computational and execution time and security strength. As a result, the proposed method is shown 97\% of security strength and minimum computation and execution time than other conventional approaches.

Multicore Computing Security - Physical memories or RAMs are essential components in a computer system to hold temporary information required for both software and hardware to work properly. When a system’s security is compromised (e.g., due to a malicious application), sensitive information being held in the memories can be leaked out for example to “the cloud”. The RISC-V privileged architecture standard adopts a method called Physical Memory Protection (PMP) to segregate a system’s memory into regions with different policy and permissions to prevent unprivileged software from accessing unauthorized regions. However, PMP does not prevent malicious software from hijacking an Input/Output (IO) device with Direct Memory Access (DMA) capability to indirectly gain unauthorized accesses and hence, a similar method commonly termed as “IOPMP” is being worked on in the RISC-V community. This paper describes an early implementation of IOPMP and how it is used to protect physical memory regions in a RISC-V system. Then, the potential performance impact of IOPMP is briefly elaborated. There are still work to be done and this early IOPMP implementation allows various aspects of the protection method such as its scalability, practicality, and effectiveness etc. to be studied for future enhancement.

Metadata Discovery Problem - Millions of connected devices like connected cameras and streaming videos are introduced to smart cities every year, which are valuable source of information. However, such rich source of information is mostly left untapped. Thus, in this paper, we propose distributed deep neural networks (DNNs) over edge visual Internet of Things (VIoT) devices for parallel, real-time video scene parsing and indexing in conjunction with BigQuery retrieval on stored data in the cloud. The IoT video streams parsed into adaptive meta-data of person, attributes, actions, object, and relations using pre-trained DNNs. The meta-data cached at the edge-cloud for real-time analytics and also continuously transferred to the cloud for data fusion and BigQuery batch processing. The proposed distributed deep learning search platform bridges the gap between edge-to-cloud continuum computation by utilizing state-of-the-art distributed deep learning and BigQuery search algorithms for the geo-distributed Visual Internet of Things (VIoT). We show that our proposed system supports real-time event-driven computing at 122 milliseconds on virtual IoT devices in parallel, and as low as 2.4 seconds batch query response time on multi-table JOIN and GROUP-BY aggregation.

Microelectronics Security - The need for safe large data storage services is at an all-time high and confidentiality is a fundamental need of any service. Consideration must also be given to service customer anonymity, one of the most important privacy considerations. As a result, the service should offer realistic and fine-grained [11] encrypted data sharing, which allows a data owner to share a cipher text of data with others under certain situations. In order to accomplish the aforesaid characteristics, our system offers a novel privacy- preserving cipher text multi-sharing technique. In this way, proxy re-encryption and anonymity are combined to allow many receivers to safely and conditionally receive a cipher text while maintaining the confidentiality of the underlying message and the identities of the senders and recipients. In this paper, a logical cloud security scheme is introduced called Modified Data Cipher Policies (MDCP), in which it is a new primitive also protects against known cipher text attacks, as demonstrated by the system.

Information Reuse and Security - The experimental results demonstrated that, With the development of cloud computing, more and more people use cloud computing to do all kinds of things. However, for cloud computing, the most important thing is to ensure the stability of user data and improve security at the same time. From an analysis of the experimental results, it can be found that Cloud computing makes extensive use of technical means such as computing virtualization, storage system virtualization and network system virtualization, abstracts the underlying physical facilities into external unified interfaces, maps several virtual networks with different topologies to the underlying infrastructure, and provides differentiated services for external users. By comparing and analyzing the experimental results, it is clear that virtualization technology will be the main way to solve cloud computing security. Virtualization technology introduces a virtual layer between software and hardware, provides an independent running environment for applications, shields the dynamics, distribution and differences of hardware platforms, supports the sharing and reuse of hardware resources, provides each user with an independent and isolated computer environment, and facilitates the efficient and dynamic management and maintenance of software and hardware resources of the whole system. Applying virtualization technology to cloud security reduces the hardware cost and management cost of "cloud security" enterprises to a certain extent, and improves the security of "cloud security" technology to a certain extent. This paper will outline the basic cloud computing security methods, and focus on the analysis of virtualization cloud security technology

Internet-scale Computing Security - Wireless Sensor networks can be composed of smart buildings, smart homes, smart grids, and smart mobility, and they can even interconnect all these fields into a large-scale smart city network. Software-Defined Networking is an ideal technology to realize Internet-of-Things (IoT) Network and WSN network requirements and to efficiently enhance the security of these networks. Software defines Networking (SDN) is used to support IoT and WSN related networking elements, additional security concerns rise, due to the elevated vulnerability of such deployments to specific types of attacks and the necessity of inter-cloud communication any IoT application would require. This work is a study of different security mechanisms available in SDN for IoT and WSN network secure communication. This work also formulates the problems when existing methods are implemented with different networks parameters.

Internet-scale Computing Security - Cloud computing forms the backbone of the era of automation and the Internet of Things (IoT). It offers computing and storage-based services on consumption-based pricing. Large-scale datacenters are used to provide these service and consumes enormous electricity. Datacenters contribute a large portion of the carbon footprint in the environment. Through virtual machine (VM) consolidation, datacenter energy consumption can be reduced via efficient resource management. VM selection policy is used to choose the VM that needs migration. In this research, we have proposed PbV mSp: A priority-based VM selection policy for VM consolidation. The PbV mSp is implemented in cloudsim and evaluated compared with well-known VM selection policies like gpa, gpammt, mimt, mums, and mxu. The results show that the proposed PbV mSp selection policy has outperformed the exisitng policies in terms of energy consumption and other metrics.

Internet-scale Computing Security - The data of large-scale distributed demand-side iot devices are gradually migrated to the cloud. This cloud deployment mode makes it convenient for IoT devices to participate in the interaction between supply and demand, and at the same time exposes various vulnerabilities of IoT devices to the Internet, which can be easily accessed and manipulated by hackers to launch large-scale DDoS attacks. As an easy-to-understand supervised learning classification algorithm, KNN can obtain more accurate classification results without too many adjustment parameters, and has achieved many research achievements in the field of DDoS detection. However, in the face of high-dimensional data, this method has high operation cost, high cost and not practical. Aiming at this disadvantage, this chapter explores the potential of classical KNN algorithm in data storage structure, K-nearest neighbor search and hyperparameter optimization, and proposes an improved KNN algorithm for DDoS attack detection of demand-side IoT devices.

Internet-scale Computing Security - Cloud computing provides customers with enormous compute power and storage capacity, allowing them to deploy their computation and data-intensive applications without having to invest in infrastructure. Many firms use cloud computing as a means of relocating and maintaining resources outside of their enterprise, regardless of the cloud server s location. However, preserving the data in cloud leads to a number of issues related to data loss, accountability, security etc. Such fears become a great barrier to the adoption of the cloud services by users. Cloud computing offers a high scale storage facility for internet users with reference to the cost based on the usage of facilities provided. Privacy protection of a user s data is considered as a challenge as the internal operations offered by the service providers cannot be accessed by the users. Hence, it becomes necessary for monitoring the usage of the client s data in cloud. In this research, we suggest an effective cloud storage solution for accessing patient medical records across hospitals in different countries while maintaining data security and integrity. In the suggested system, multifactor authentication for user login to the cloud, homomorphic encryption for data storage with integrity verification, and integrity verification have all been implemented effectively. To illustrate the efficacy of the proposed strategy, an experimental investigation was conducted.

Internet-scale Computing Security - The big data platform based on cloud computing realizes the storage, analysis and processing of massive data, and provides users with more efficient, accurate and intelligent Internet services. Combined with the characteristics of college teaching resource sharing platform based on cloud computing mode, the multi-faceted security defense strategy of the platform is studied from security management, security inspection and technical means. In the detection module, the optimization of the support vector machine is realized, the detection period is determined, the DDoS data traffic characteristics are extracted, and the source ID blacklist is established; the triggering of the defense mechanism in the defense module, the construction of the forwarder forwarding queue and the forwarder forwarding capability are realized. Reallocation.

Information Centric Networks - Named in-network computing is an emerging technology of Named Data Networking (NDN). Through deploying the named computing services/functions on NDN router, the router can utilize its free resources to provide nearby computation for users while relieving the pressure of cloud and network edge. Benefitted from the characteristic of named addressing, named computing services/functions can be easily discovered and migrated in the network. To implement named in-network computing, integrating the computing services as Virtual Machines (VMs) into the software router is a feasible way, but how to effectively deploy the service VMs to optimize the local processing capability is still a challenge. Focusing on this problem, we first give the design of NDN-enabled software router in this paper, then propose a service earning based named service deployment scheme (SE-NSD). For available service VMs, SE-NSD not only considers their popularities but further evaluates their service earnings (processed data amount per CPU cycle). Through modelling the deployment problem as the knapsack problem, SE-NSD determines the optimal service VMs deployment scheme. The simulation results show that, comparing with the popularity-based deployment scheme, SE-NSD can promote about 30\% in-network computing capability while slightly reducing the service invoking RTT of user.

Industrial Control Systems - With the introduction of the national “carbon peaking and carbon neutrality” strategic goals and the accelerated construction of the new generation of power systems, cloud applications built on advanced IT technologies play an increasingly important role in meeting the needs of digital power business. In view of the characteristics of the current power industrial control system operation support cloud platform with wide coverage, large amount of log data, and low analysis intelligence, this paper proposes a cloud platform network security behavior audit method based on FP-Growth association rule algorithm, aiming at the uniqueness of the operating data of the cloud platform that directly interacts with the isolated system environment of power industrial control system. By using the association rule algorithm to associate and classify user behaviors, our scheme formulates abnormal behavior judgment standards, establishes an automated audit strategy knowledge base, and improves the security audit efficiency of power industrial control system operation support cloud platform. The intelligent level of log data analysis enables effective discovery, traceability and management of internal personnel operational risks.

Under the situation of regular epidemic prevention and control, teleworking has gradually become a normal working mode. With the development of modern information technologies such as big data, cloud computing and mobile Internet, it's become a problem that how to build an effective security defense system to ensure the information security of teleworking in complex network environment while ensuring the availability, collaboration and efficiency of teleworking. One of the solutions is Zero Trust Network(ZTN), most enterprise infrastructures will operate in a hybrid zero trust/perimeter-based mode while continuing to invest in IT modernization initiatives and improve organization business processes. In this paper, we have systematically studied the zero trust principles, the logical components of zero trust architecture and the key technology of zero trust network. Based on the abstract model of zero trust architecture and information security technologies, a prototype has been realized which suitable for iOS terminals to access enterprise resources safely in teleworking mode.