A novel smart multilevel security approach for secure data outsourcing in crisis

Introduction

Anonymous data outsourcing during a crisis have become a challenge these days because of the following reasons (i) the daily amount of data produced and exchanged on the Internet; (ii) the ethical and unethical surveillance; (iii) the complexity of internetworking management; and (iv) the broken protocol designs and architectures. In fact, our world has become data-driven due to such factors as the digitization in society and economy and the advances in disruptive technologies, including unmanned aerial vehicle (UAV), artificial intelligence (AI), big data, the Internet of Things (IoT), blockchain, and robots (Al-Gburi et al., 2022; Ali et al., 2022). Another factor is the diversity of technological platforms and social services, such as YouTube, Google, Facebook, cloud computing, and mobile devices. Such services and technologies have produced enormous volumes of Internet traffic that enable information exchange and inspire the world to become data-driven (Luo, 2022; Casado et al., 2006).

However, the endless increase in information accessibility has become a challenge thus bringing several issues to the available data, such as analysis, transmission, security, and privacy. Moreover, the imperfections of the existing Internet protocol (IP) network architecture make it difficult to address all the issues related to any data-driven model. Scalability, security, energy-saving, quality of service, and mobility are the significant issues inherited in the IP network architecture. For example, information exchange in traditional computer networks relies on the Open System Interconnection (OSI) model. The exchange of information among the OSI computing systems is separated into seven abstraction layers: application, presentation, session, transport, network, data link, and physical layers. An underlying communication routing protocols manage each layer. Thus, internetworking management is complex because each router device is responsible for routing, controlling, forwarding, and filtering packets (Sarhan, Jemmali & Ben Hmida, 2021). Furthermore, the IP addresses and domain name systems (DNS) are not decentralized which is a single point of failure (Kärkkäinen, 2015). Such a complicated, insecure traditional model needs to be secure and simplified. Several technologies have been proposed to simplify such a complex paradigm (Sarhan, Jemmali & Ben Hmida, 2021; Sawalmeh & Othman, 2018) for instance, Delay-tolerant Networking (DTN), and Software-Defined Networking (SDN).

The idea of fixing the Internet by dealing with the broken design and architecture of the current internetworking and building a new network from the scratch has launched several funded projects as cited in (Lan et al., 2022). The projects are as follows: the Future Internet Design (FIND), the Global Environment for Networking Innovations (GENI), the future Internet research and experimentation (FIRE), AKARI of Japan, Named Data Networking (NDN), 4WARD, MobilityFirst, ChoiceNet, FIRST, NEBULA, and the Service-Customized Networking (SCN) research projects (Lan et al., 2022; Lemin, 2013; Zhang et al., 2010; Raychaudhuri, Nagaraja & Venkataramani, 2012; Harai, 2009; Brunner et al., 2010; Wolf et al., 2014; Jinho, Bongtae & Kyungpyo, 2009; Anderson et al., 2014; Liu et al., 2014; Greenberg et al., 2005). Consequently, future network architecture should include several core characteristics, openness, reliability, robustness, controllability, scalability, adaptability, high performance, availability, security, credibility, manageability, highly cost-effective, and ubiquitous services, to name a few, (Lan et al., 2022).

Because of the emerging technologies and the broad technological and research advancements in computer networks and communications, network security, vulnerability, risks and threats are gradually expanding. Consequently, the rising number of cyber security attacks, including ransomware, denial-of-service, password, and phishing attacks, led to massive data breaches and losses in several reputable financial and industrial businesses, including government and military networks. This advancement in computer networks makes people distrust enterprises, which, in turn, leads firms to mistrust traditional tools and safeguards (Xue, Tang & Fang, 2022; Fedele & Roner, 2022; Kärkkäinen, 2015).

Military networks use the public network as the primary means of communication. Thus, it is targetable for several threats, including vulnerabilities and cyber security attacks. However, developing a military-based Network-enabled capability in a reasonable time is unrealistic due to the complexity of global internet governance. For example, in 2019, the US government banned Huawei—a major telecom giant company, to prevent China from having superior control over cyberspace governance (Kärkkäinen, 2015; Tang, 2020). Hence, there is a need for a partial resolution like designing secure network architectures that can provide a timely solution in response to the urgent protection needs in such a critical armed force environment. This network should provide multilevel security, privacy protection, and delay-tolerant networking (Kärkkäinen, 2015).

This article proposes a two-router network-based cyber security architecture that offers private and secure multilevel data sharing. Hence, we develop a number of algorithms to achieve the goal of this article. The proposed algorithms can be applied to enhance the monitoring system developed by (Melhim et al., 2020; Melhim, Jemmali & Alharbi, 2019). On the other hand, the algorithms developed by Jemmali (2019a); Jemmali (2019b); Jemmali (2022); Alharbi & Jemmali (2020); Jemmali (2021a); Jemmali (2021b); Jemmali, Otoom & Al Fayez (2020); Jemmali, Melhim & Al Fayez (2022) can be enhanced then applied to address the proposed problem. Our solution suggests enhancing the current IP network architecture by providing multilevel data security and privacy protection. Even though other issues in the existing IP network architecture are outside the scope of this research, our approach has the following pros: (i) it employs algorithmic techniques for future private networks; (ii) it provides support for anonymous communication and secure and anonymous data sharing during a crisis and in various domains like the military, pandemics, journalism, and news coverage; (iii) it presents several approximate algorithms for an NP-hard problem and uses it for secure data dissemination; (iv) it uses known and unknown algorithmic techniques such as randomization method, iterative approach and probabilistic method; (v) it presents good optimal time for the problem as it shown in the Result section.

To be more specific, let’s take the example of a journalist wants to report private information about a violation anonymously during a military disaster, natural disaster, health pandemic, earthquake, flood, etc. suppose such confidential information demands to be communicated anonymously and promptly. In this case, there will be a need for a novel architecture that minimizes the risk of such highly confidential information breaches. Our scheme includes the following drawbacks. (1) The proposed problem is difficult; hence solving it via n-hopes might be complex and requires advanced algorithmic techniques of big O complexities. (2) There is a need to use a lower bound in a branch-and-bound algorithm to develop an exact solution for the problem.

The current research includes the following sections: the first discusses the related literature. The second defines the problem. The third describes the architecture and design of the proposed approach. that the fourth, introduces the proposed algorithms, reports the results, and discusses the performance measurement. The last section is summary of the article and a discussion of future work.

Literature Review

Problem Formulation

The current research focuses on the problem of protecting multilevel packets by controlling the packets’ path and transmission time, which is essential in a private network. We assume that the network packets are classified into several category levels so that packets belonging to the identical classification level are prohibited from being transmitted at the same time over the two routers. This problem is a difficult problem that we handle using approximate solutions. Furthermore, we impose a security constraint that prevents two packets originating from the same confidential level from being transited simultaneously to maximize the level of outsourced data protection and minimize the chances of data leaks.

The objective of this article is to create numerous near-optimal solutions for the studied problem. We refer to Pt as a group of packets and mark nas their number. We denote R1for router1 and denote R2 for router 2. When packet Pt_j is sent to router R1, the cumulative transmission time is denoted as $C{t}_j^1$ and when packet Pt_j is assigned to the router R2, the cumulative transmission time is denoted as $C{t}_j^2$. We denote t_j for packet Pt_j estimated transmission time. See Table 1 for more details. We denote T₁ and T₂ for the total time of transmission on R1 and R2, and T_m for therouters’ maximum time, so T_m = max(T₁, T₂).Cg_i denotes the categories such that i = 1, …, n_Cg and n_Cg is the number of categories fixed by the administrator. The objective is to minimize T_m.

Architecture and Design

This section provides the proposed solution architecture details and its objective design.

System model

This sub-section discusses the components of the proposed two-router network-based cyber security architecture. In Fig. 1, the constructed architecture assumes the transmissions of packets using two routers. The processes are as follows: first, the data owner and decision maker (e.g., machine learning engine or agent) categorize the data into several classified levels. Next, the categorized data will be waited in a buffer and processed by a scheduler via a selected algorithm from a pool, which intelligently controls the packet transmitted to the two routers. The scheme is composed of several components which are described as follows:

(1) Data owner: this component manages the transmitted data’s classified level, specifies the files to be sent to the key decision maker, and fixes the data level categories.

(2) Decision maker: this component represents a key decision maker, or security policy maker, who categorizes the transmitted data and their level of importance.

(3) Smart engine: this component represents a software agent that manages data transmission to the data buffer. It controls this component, administers the data and its transmission, and links the sent files with their categories after being classified.

(4) Data collection engine: this component groups all files for the transmitted data.

(5) Data buffer engine: this component collects, verifies, and links the sent files within a category.

(6) Scheduler: this component is essential for solving a scheduling problem related to data disclosure through two routers. The scheduler provides several algorithms and selects the best one to solve a particular scheduling problem. It receives the files sent from the Data buffer engine.

(7) Receiving buffer: this component stores or groups the transmitted files in the ‘Receiver buffer.’

(8) Routers: this component represents the two routers.

(9) Receiver: this component represents a user expecting to receive confidential information.

Proposed Algorithms

This section presents five newly designed algorithms that solve the studied problem (Sarhan, Jemmali & Ben Hmida, 2021; Sarhan & Jemmal, 2023) in a remarkable time. The proposed algorithms use different techniques to enhance the transmitted time and reduce the algorithmic complexity. The first discussed algorithm is the “longest transmission time with excluding the first and last packet” (LTFL). In LTFL, packets are arranged in a descending sequence to exclude the longest and shortest packets with estimated transmission time and then to schedule all remaining packets. Second, we describe “the shortest transmission time with excluding the first and the last packet” (STFL) algorithm. In STFL, we arrange packets in an ascending sequence to exclude the longest and shortest packets with estimated transmission time, so the obtained schedule will be used to calculate the result. Third, we discuss the Shortest-Grouped classification (SG) algorithm. In SG, we arrange packets in an ascending sequence based on their estimated transmission time, and then we divide them into groups to schedule them through several variants to find a better solution than others. After that, we talk about the Random-Grouped classification with longest scheduling (RGL) algorithm, and finally, we present the Random-Grouped classification with shortest scheduling (RGS) algorithm. Unlike SG, In RGL and RGS sorting, the packets are delayed until the end to get the best solution.

Results & Discussion

The current section describes the experimental findings of the created algorithms and compares the results with those presented in works of (Sarhan, Jemmali & Ben Hmida, 2021; Sarhan & Jemmal, 2023) to find the best algorithm. A summary of the core experimental variables and performance results is in Tables 2–6. Table 2 presents an overview of the performance of the proposed algorithms in this article. Our observation is that the best algorithm is the Random-Grouped Classification with Shortest Scheduling Algorithms (RGS) since its first and fourth variants (RGS₁ and RGS₄) achieved the best results recording 37.7%, an average gap of 0.03, and an estimated transmission time of 0.001 s. The algorithm based on the grouping method gives better results because there is a classification of the packets into several groups, especially when we start with the increasing order of the packets.

We also noticed that the worst algorithm is STFL, rating 18.3%, a gap of 0.04, and an estimated transmission time of 0.001, and the lowest average gap algorithm is SG₂. The STFL algorithm is a dispatching rule method, which gives priority to the packet with the shortest total transmission time. This priority makes the packet with the maximum transmission time scheduled the last. This makes it a problem to find a long packet to be transmitted in a router that has the minimum total transmission time.

Table 3 compares the variations of the average gap of all proposed algorithms when n changes. We observe that both algorithms’ STFL, and SG₁ average gap variations are the same regardless of the number of packets n. Moreover, algorithm SG₂ has the lowest average gap variation of 0.01 in two scenarios when n = 45 and n = 55. For this algorithm, it is clear that the average gap decreases when the number of packets increases. This means that the problem becomes simpler, and there are many packets, reflecting that more choices can be derived for the scheduling.

On the other hand, the average gap variation for algorithm LTFL increases when n is low. For example, the highest average gap of 0.07 appears with algorithm LTFL when n = 15.

Table 4, on the other hand, shows that all algorithms have the same average gap variation of 0.01 when n_Cg = 2 except algorithm SGL₂ which is equal to 0.02. The SGL variant consists of the scheduled packets of G2, then the scheduled one of G3,  and finally the scheduled packets of G1. Therefore, starting with the packets of G2 and ending with packets of G1 don’t give good results.

Furthermore, algorithms SGL₃ and SGL₄ have the sameaverage gap variation regardless of the changes in the number of categories n_Cg.

Table 5 presents the time variation for all proposed algorithms when n changes. We observe that the time variation for the algorithm SGL₂ is not influenced by the changes in the number of packets n since it equals 0.001. This variant of SGL consists of the scheduled packets of G2, next packets of G3,  and finally packets of G1. Starting with the packets of G2 and ending with packets of G1 give special results compared with other algorithms.

One can also observe that the time variation for algorithm LTFL gradually decreases when the number of packets n increases, and the time variation for both algorithms SGL₂ and SG₂ are alike or do not change when the number of packets n changes.

Table 6 displays the proposed algorithms’ variation of time when n_Cg changes. It is observable that both algorithms SGS₂ and SG₄ time variation is not influenced by the changes in the number of categories n_Cg variation since SGS₂ = 0.001 and SG₄ = 0.002 regardless of the value of n_Cg.This reflects the complexity of algorithms SGS₂ and SG₄.

One can also observe that the time variation for algorithm LTFL gradually increases when the value of n_Cg increases. Furthermore, the time variation for algorithms SG₂, SG₃, RGS₁ and RGS₂ are alike regardless of the changes in the number of categories n_Cg. Finally, the time variation for algorithms SG₁, SGL₁ are alike regardless of the changes in n_Cg.

In this article, we suggested a group of algorithms that give remarkable results. We compare the results with those of (Sarhan, Jemmali & Ben Hmida, 2021; Sarhan & Jemmal, 2023). We denote Bnew for the algorithm that gives the best value of all proposed algorithms—running the best algorithm MDETA developed in (Sarhan, Jemmali & Ben Hmida, 2021) on the 300 used instances. The experimental results show that for 61 instances, Bnew<MDETA. This result means that Bnew participates in giving a better solution with MDETA. Furthermore, for 134 instances, we have Bnew = MDETA. On the other hand, comparing the results given by the proposed algorithms with the best algorithm $\overline{RLT}$ developed in (Sarhan & Jemmal, 2023), shows that for 13 instances, we have Bnew<$\overline{RLT}$. This means that Bnew participates in giving a better solution with $\overline{RLT}$. In addition, for 116 instances, we have Bnew = $\overline{RLT}$ .Note that the proposed scheme packets protection mechanism is achieved through imposing a constraint or restrictions for the transmission of packets using a smart security policy. The multilevel security policy assigns security levels called categorizations to packets and uses a scheduler to control their dissemination route and dissemination time via the two routers to minimize the chances of breaches. The Packets which belong to the same classification level are prevented from being transmitted at the same time over the two routers.

Conclusions

Multilevel security is one of the essential features required in future and special-purpose networks. In this research, we proposed a multilevel secure network model using two machines that can transmit confidential data in a private environment or in particular circumstances like a crisis based on a security policy. The scheme uses a scheduler to securely minimize the transmitted time when disseminating the multilevel secure packets. We proposed several heuristics for this NP-Hard problem. The experimental results show promising results for the future development of our paradigm. Both RGS₁ and RGS₄ showed promising results. We plan for future work to increase the number of routing machines to n machines and modify our paradigm as network as a service (NaaS). We also plan for future work to demonstrate our approach in the application layer using a private set intersection and agent-based solutions to provide anonymous interaction during crisis management.

Supplemental Information