Topic overview

Cryptography and Security

7258 works19448 researchers

Open map Browse papers

Map preview

Start with the graph, then narrow the list

7258works

19448researchers

Next steps

Use the topic as a working map

Open the full map for clusters, then return here to scan ranked papers and people.

Inspect nearby papers, researchers, institutions and communities without opening a separate graph page.

Building this map preview

BZPEER is loading the nearby papers, people, topics and institutions for this page.

preprint2017arXiv

The Key to Intelligent Transportation: Identity and Credential Management in Vehicular Communication Systems

Vehicular Communication (VC) systems will greatly enhance intelligent transportation systems. But their security and the protection of their users' privacy are a prerequisite for deployment. Efforts in industry and academia brought forth a multitude of diverse proposals. These have now converged to a common view, notably on the design of a security infrastructure, a Vehicular Public Key Infrastructure (VPKI) that shall enable secure conditionally anonymous VC. Standardization efforts and industry readiness to adopt this approach hint to its maturity. However, there are several open questions remaining, and it is paramount to have conclusive answers before deployment. In this article, we distill and critically survey the state of the art for identity and credential management in VC systems, and we sketch a roadmap for addressing a set of critical remaining security and privacy challenges.

preprint2016arXiv

Cryptanalysis and Improvement of an Improved Two Factor Authentication Scheme for Telecare Medicine Information Systems

Telecare medical information systems (TMIS) aim to provide healthcare services remotely. Efficient and secure mechanism for authentication and key agreement is required in order to guarantee the security and privacy of patients in TMIS.

preprint2016arXiv

Ontology-based Access Control in Open Scenarios: Applications to Social Networks and the Cloud

Thanks to the advent of the Internet, it is now possible to easily share vast amounts of electronic information and computer resources (which include hardware, computer services, etc.) in open distributed environments. These environments serve as a common platform for heterogeneous users (e.g., corporate, individuals etc.) by hosting customized user applications and systems, providing ubiquitous access to the shared resources and requiring less administrative efforts; as a result, they enable users and companies to increase their productivity. Unfortunately, sharing of resources in open environments has significantly increased the privacy threats to the users. Indeed, shared electronic data may be exploited by third parties, such as Data Brokers, which may aggregate, infer and redistribute (sensitive) personal features, thus potentially impairing the privacy of the individuals. A way to palliate this problem consists on controlling the access of users over the potentially sensitive resources. Specifically, access control management regulates the access to the shared resources according to the credentials of the users, the type of resource and the privacy preferences of the resource

preprint2017arXiv

Study and Development of a Symmetric protocol to secure communications in WSN

Wireless Sensor Network (WSN) is consisting of independent and distributed sensors to monitor physical or environmental conditions, such as temperature, sound, pressure, etc. The most crucial and fundamental challenge facing WSN is security. Due to minimum capacity in-term of memory cost, processing and physical accessibility to sensors devices the security attacks are problematic. They are mostly deployed in open area, which expose them to different kinds of attacks. In this paper, we present an illustration of different attacks and vulnerabilities in WSN. Then we proposed a new lightweight cryptography algorithm for identifying compromised node in WSN called Leap Enhanced. Our evaluations on TOSSIM give a precise and detailed idea of the extra cost of consumption of resources needed to ensure the high level of expected security compared to other cryptography schemes in literature.

preprint2017arXiv

EIP - Preventing DDoS with Ephemeral IP Identifiers Cryptographically Generated

Nowadays, denial of service (DoS) attacks represent a significant fraction of all attacks that take place in the Internet and their intensity is always growing. The main DoS attack methods consist of flooding their victims with bogus packets, queries or replies, so as to prevent them from fulfilling their roles. Preventing DoS attacks at network level would be simpler if end-to-end strong authentication in any packet exchange was mandatory. However, it is also likely that its mandatory adoption would introduce more harm than benefits. In this paper we present an end-point addressing scheme and a set of security procedures which satisfy most of network level DoS prevention requirements. Instead of being known by public stable IP addresses, hosts use ephemeral IP Identifiers cryptographically generated and bound to its usage context. Self-signed certificates and challenge-based protocols allow, without the need of any third parties, the implementation of defenses against DoS attacks. Communication in the open Internet while using these special IP addresses is supported by the so-called Map/Encap approaches, which in our point of view will be sooner or later required for the future In

preprint2016arXiv

On The Security Evaluation of Partial Password Implementations

A partial password is a mode of password-based authentication that is widely used, especially in the financial sector. It is based on a challenge-response protocol, where at each login attempt, a challenge requesting characters from randomly selected positions of a pre-shared secret is presented to the user. This model could be seen as a cheap way of preventing for example a malware or a key-logger installed on a user's device to learn the full password in a single step. Despite of the widespread adoption of this mechanism, especially by many UK banks, there is limited material in the open literature. Questions like how the security of the scheme varies with the sampling method employed to form the challenges or what are the existing server-side implementations are left unaddressed. In this paper, we study questions like how the security of this mechanism varies in relation to the number of challenge-response pairs available to an attacker under different ways of generating challenges. In addition, we discuss possible server-side implementations as "unofficially" listed in different online forums by information security ex- perts. To the best of our knowledge there is n

preprint2017arXiv

Optimized, Direct Sale of Privacy in Personal-Data Marketplaces

Very recently, we are witnessing the emergence of a number of start-ups that enables individuals to sell their private data directly to brokers and businesses. While this new paradigm may shift the balance of power between individuals and companies that harvest data, it raises some practical, fundamental questions for users of these services: how they should decide which data must be vended and which data protected, and what a good deal is. In this work, we investigate a mechanism that aims at helping users address these questions. The investigated mechanism relies on a hard-privacy model and allows users to share partial or complete profile data with broker companies in exchange for an economic reward. The theoretical analysis of the trade-off between privacy and money posed by such mechanism is the object of this work. We adopt a generic measure of privacy although part of our analysis focuses on some important examples of Bregman divergences. We find a parametric solution to the problem of optimal exchange of privacy for money, and obtain a closed-form expression and characterize the trade-off between profile-disclosure risk and economic reward for several interesting cases.

preprint2016arXiv

Two factor authentication using EEG augmented passwords

The current research with EEG devices in the user authentication context has some deficiencies that address expensive equipment, the requirement of laboratory conditions and applicability. In this paper we address this issue by using widely available and inexpensive EEG device to verify its capability for authentication. As a part of this research, we developed two phase authentication that enables users to enhance their password with the mental state by breaking the password into smaller, marry them with mental state, and generate one time pad for a secure session.

preprint2016arXiv

The Balance Attack Against Proof-Of-Work Blockchains: The R3 Testbed as an Example

In this paper, we identify a new form of attack, called the Balance attack, against proof-of-work blockchain systems. The novelty of this attack consists of delaying network communications between multiple subgroups of nodes with balanced mining power. Our theoretical analysis captures the precise tradeoff between the network delay and the mining power of the attacker needed to double spend in Ethereum with high probability. We quantify our probabilistic analysis with statistics taken from the R3 consortium, and show that a single machine needs 20 minutes to attack the consortium. Finally, we run an Ethereum private chain in a distributed system with similar settings as R3 to demonstrate the feasibility of the approach, and discuss the application of the Balance attack to Bitcoin. Our results clearly confirm that main proof-of-work blockchain protocols can be badly suited for consortium blockchains.

preprint2016arXiv

Study and Development of a New Symmetric Key Management Scheme for Wireless Sensor Networks

Wireless Sensor Network (WSN) is consisting of independent and distributed sensors to monitor physical or environmental conditions, such as temperature, sound, pressure, etc. However, the limited resources of sensors and hostile environments in which they could be deployed, make this type of networks vulnerable to several types of attacks similar to those occurring in ad hoc networks. The most crucial and fundamental challenge that WSN is facing is security. The primary subject of all my work is to address this issue. Due to minimum capacity in term of memory cost, processing and physical accessibility to sensors devices the security attacks are problematic. They are mostly deployed in open area so are more exposed to different kinds of attacks. They must be designed in a way to successfully recover itself from different kinds of attacks. In this paper, we proposed a new lightweight cryptography algorithm based on LEAP+. Our evaluations on TOSSIM give a precise and detailed idea of the extra cost of consumption of resources needed to ensure the high level of expected security.

preprint2016arXiv

Posting with credibility in Micro-blogging systems using Digital Signatures and Watermarks: A case study on Twitter

Micro-blogs are contemporary broadcasting services for exchanging small elements of content, including video and images. Despite its popularity, micro-blogging is not without issues. So far, various security concerns, such as: privacy and confidentiality of micro-blogging systems have attracted the interest of the scientific community. Nevertheless, in this document we refer to a security issue that is concerned with the posting and circulation of fake messages. With the aim to make micro-blogs a credible source of information, in this work we propose a protocol, as a solution, that can be easily adapted to existing services such as: Twitter and Facebook. With the main keys of the solution being the employment of digital signatures and watermarks, the protocol can serve postings of various types of content. Finally, the solution serves the dual purpose of proofing the fake messages as well as the repudiation of postings.

preprint2017arXiv

Toward sensitive document release with privacy guarantees

Privacy has become a serious concern for modern Information Societies. The sensitive nature of much of the data that are daily exchanged or released to untrusted parties requires that responsible organizations undertake appropriate privacy protection measures. Nowadays, much of these data are texts (e.g., emails, messages posted in social media, healthcare outcomes, etc.) that, because of their unstructured and semantic nature, constitute a challenge for automatic data protection methods. In fact, textual documents are usually protected manually, in a process known as document redaction or sanitization. To do so, human experts identify sensitive terms (i.e., terms that may reveal identities and/or confidential information) and protect them accordingly (e.g., via removal or, preferably, generalization). To relieve experts from this burdensome task, in a previous work we introduced the theoretical basis of C-sanitization, an inherently semantic privacy model that provides the basis to the development of automatic document redaction/sanitization algorithms and offers clear and a priori privacy guarantees on data protection; even though its potential benefits C-sanitization still prese

preprint2017arXiv

Security-related Research in Ubiquitous Computing -- Results of a Systematic Literature Review

In an endeavor to reach the vision of ubiquitous computing where users are able to use pervasive services without spatial and temporal constraints, we are witnessing a fast growing number of mobile and sensor-enhanced devices becoming available. However, in order to take full advantage of the numerous benefits offered by novel mobile devices and services, we must address the related security issues. In this paper, we present results of a systematic literature review (SLR) on security-related topics in ubiquitous computing environments. In our study, we found 5165 scientific contributions published between 2003 and 2015. We applied a systematic procedure to identify the threats, vulnerabilities, attacks, as well as corresponding defense mechanisms that are discussed in those publications. While this paper mainly discusses the results of our study, the corresponding SLR protocol which provides all details of the SLR is also publicly available for download.

preprint2017arXiv

Classification of Smartphone Users Using Internet Traffic

Today, smartphone devices are owned by a large portion of the population and have become a very popular platform for accessing the Internet. Smartphones provide the user with immediate access to information and services. However, they can easily expose the user to many privacy risks. Applications that are installed on the device and entities with access to the device's Internet traffic can reveal private information about the smartphone user and steal sensitive content stored on the device or transmitted by the device over the Internet. In this paper, we present a method to reveal various demographics and technical computer skills of smartphone users by their Internet traffic records, using machine learning classification models. We implement and evaluate the method on real life data of smartphone users and show that smartphone users can be classified by their gender, smoking habits, software programming experience, and other characteristics.

preprint2016arXiv

Toward Smart Moving Target Defense for Linux Container Resiliency

This paper presents ESCAPE, an informed moving target defense mechanism for cloud containers. ESCAPE models the interaction between attackers and their target containers as a "predator searching for a prey" search game. Live migration of Linux-containers (prey) is used to avoid attacks (predator) and failures. The entire process is guided by a novel host-based behavior-monitoring system that seamlessly monitors containers for indications of intrusions and attacks. To evaluate ESCAPE effectiveness, we simulated the attack avoidance process based on a mathematical model mimicking the prey-vs-predator search game. Simulation results show high container survival probabilities with minimal added overhead.

preprint2017arXiv

Privacy-Preserving Data Analysis for the Federal Statistical Agencies

Government statistical agencies collect enormously valuable data on the nation's population and business activities. Wide access to these data enables evidence-based policy making, supports new research that improves society, facilitates training for students in data science, and provides resources for the public to better understand and participate in their society. These data also affect the private sector. For example, the Employment Situation in the United States, published by the Bureau of Labor Statistics, moves markets. Nonetheless, government agencies are under increasing pressure to limit access to data because of a growing understanding of the threats to data privacy and confidentiality. "De-identification" - stripping obvious identifiers like names, addresses, and identification numbers - has been found inadequate in the face of modern computational and informational resources. Unfortunately, the problem extends even to the release of aggregate data statistics. This counter-intuitive phenomenon has come to be known as the Fundamental Law of Information Recovery. It says that overly accurate estimates of too many statistics can completely destroy privacy. One

preprint2016arXiv

OmniShare: Securely Accessing Encrypted Cloud Storage from Multiple Authorized Devices

Cloud storage services like Dropbox and Google Drive are widely used by individuals and businesses. Two attractive features of these services are 1) the automatic synchronization of files between multiple client devices and 2) the possibility to share files with other users. However, privacy of cloud data is a growing concern for both individuals and businesses. Encrypting data on the client-side before uploading it is an effective privacy safeguard, but it requires all client devices to have the decryption key. Current solutions derive these keys solely from user-chosen passwords, which have low entropy and are easily guessed. We present OmniShare, the first scheme to allow client-side encryption with high-entropy keys whilst providing an intuitive key distribution mechanism to enable access from multiple client devices. Instead of passwords, we use low bandwidth uni-directional out-of-band (OOB) channels, such as QR codes, to authenticate new devices. To complement these OOB channels, the cloud storage itself is used as a communication channel between devices in our protocols. We rely on a directory-based key hierarchy with individual file keys to limit the consequences of key co

preprint2016arXiv

Asynchronous Operations on Qubits in Distributed Simulation Environments using QooSim

Operations on a pair of entangled qubits are conventionally presented as the application of the tensor product of operations. The tensor product is linearly extended to act synchronously across the entire entangled system. When simulating an entangled system, the conventional approach is possible and practical if both parts of the entangled system exist within the same physical simulator. However, if we wish to simulate an entangled system across a distributed network, sending half of the entangled pair to another simulator on another computer system, the synchronous approach becomes difficult. In the first part of this paper, we demonstrate a method of simulating operations on entangled states in a distributed environment which is equivalent to the conventional approach. The advantage to our approach is that we can simulate distributed quantum systems on physically distributed hardware. Such a system advances the possibilities of demonstrating distributed quantum algorithms for research, teaching, and learning. Further, the security of quantum key exchange depends on successfully detecting the presence of an eavesdropper. In most cases this is done by comparing the errors introduc

preprint2016arXiv

Multi-Party Privacy-Preserving Record Linkage using Bloom Filters

Privacy-preserving record linkage (PPRL), the problem of identifying records that correspond to the same real-world entity across several data sources held by different parties without revealing any sensitive information about these records, is increasingly being required in many real-world application areas. Examples range from public health surveillance to crime and fraud detection, and national security. Various techniques have been developed to tackle the problem of PPRL, with the majority of them considering linking data from only two sources. However, in many real-world applications data from more than two sources need to be linked. In this paper we propose a viable solution for multi-party PPRL using two efficient privacy techniques: Bloom filter encoding and distributed secure summation. Our proposed protocol efficiently identifies matching sets of records held by all data sources that have a similarity above a certain minimum threshold. While being efficient, our protocol is also secure under the semi-honest adversary model in that no party can learn any sensitive information about any other parties' data, but all parties learn which of their records have a high simila

preprint2016arXiv

Privacy on the Blockchain: Unique Ring Signatures

Ring signatures are cryptographic protocols designed to allow any member of a group to produce a signature on behalf of the group, without revealing the individual signer's identity. This offers group members a level of anonymity not attainable through generic digital signature schemes. We call this property 'plausible deniability', or anonymity with respect to an anonymity set. We concentrate in particular on implementing privacy on the blockchain, introducing a unique ring signature scheme that works with existing blockchain systems. We implement a unique ring signature (URS) scheme using secp256k1, creating the first implementation compatible with blockchain libraries in this way, so as for easy implementation as an Ethereum smart contract. We review the privacy and security properties offered by the scheme we have constructed, and compare its efficiency with other commonly suggested approaches to privacy on the blockchain.

preprint2016arXiv

Experimental measurement-device-independent quantum random number generation

The randomness from a quantum random number generator (QRNG) relies on the accurate characterization of its devices. However, device imperfections and inaccurate characterizations can result in wrong entropy estimation and bias in practice, which highly affects the genuine randomness generation and may even induce the disappearance of quantum randomness in an extreme case. Here we experimentally demonstrate a measurement-device-independent (MDI) QRNG based on time-bin encoding to achieve certified quantum randomness even when the measurement devices are uncharacterized and untrusted. The MDI-QRNG is randomly switched between the regular randomness generation mode and a test mode, in which four quantum states are randomly prepared to perform measurement tomography in real-time. With a clock rate of 25 MHz, the MDI-QRNG generates a final random bit rate of 5.7 Kbps. Such implementation with an all-fiber setup provides an approach to construct a fully-integrated MDI-QRNG with trusted but error-prone devices in practice.

preprint2016arXiv

Emerging Security Challenges of Cloud Virtual Infrastructure

The cloud computing model is rapidly transforming the IT landscape. Cloud computing is a new computing paradigm that delivers computing resources as a set of reliable and scalable internet-based services allowing customers to remotely run and manage these services. Infrastructure-as-a-service (IaaS) is one of the popular cloud computing services. IaaS allows customers to increase their computing resources on the fly without investing in new hardware. IaaS adapts virtualization to enable on-demand access to a pool of virtual computing resources. Although there are great benefits to be gained from cloud computing, cloud computing also enables new categories of threats to be introduced. These threats are a result of the cloud virtual infrastructure complexity created by the adoption of the virtualization technology. Breaching the security of any component in the cloud virtual infrastructure significantly impacts on the security of other components and consequently affects the overall system security. This paper explores the security problem of the cloud platform virtual infrastructure identifying the existing security threats and the complexities of this virtual infrastructure. The pa

preprint2016arXiv

Optimizing Secure Statistical Computations with PICCO

Growth in research collaboration has caused an increased need for sharing of data. However, when this data is private, there is also an increased need for maintaining security and privacy. Secure multi-party computation enables any function to be securely evaluated over private data without revealing any unintended data. A number of tools and compilers have been recently developed to support evaluation of various functionalities over private data. PICCO is one of such compilers that transforms a general-purpose user program into its secure distributed implementation. Here we assess performance of common statistical programs using PICCO. Specifically, we focus on chi-squared and standard deviation computations and optimize user programs for them to assess performance that an informed user might expect from securely evaluating these functions using a general-purpose compiler.

preprint2016arXiv

Surveillance and Intervention of Infrastructure-Free Mobile Communications: A New Wireless Security Paradigm

Conventional wireless security assumes wireless communications are rightful and aims to protect them against malicious eavesdropping and jamming attacks. However, emerging infrastructure-free mobile communication networks are likely to be illegally used (e.g., by criminals or terrorists) but difficult to be monitored, thus imposing new challenges on the public security. To tackle this issue, this article presents a paradigm shift of wireless security to the surveillance and intervention of infrastructure-free suspicious and malicious wireless communications, by exploiting legitimate eavesdropping and jamming jointly. In particular, {\emph{proactive eavesdropping}} (via jamming) is proposed to intercept and decode information from suspicious communication links for the purpose of inferring their intentions and deciding further measures against them. {\emph{Cognitive jamming}} (via eavesdropping) is also proposed so as to disrupt, disable, and even spoof the targeted malicious wireless communications to achieve various intervention tasks.

535 works