Open Access. Powered by Scholars. Published by Universities.®

Information Security Commons™

Open Access. Powered by Scholars. Published by Universities.®

Singapore Management University

Discipline
Keyword
Publication Year
Publication
Publication Type

Articles 271 - 300 of 1102

Full-Text Articles in Information Security

Automated Reverse Engineering Of Role-Based Access Control Policies Of Web Applications, Ha Thanh Le, Lwin Khin Shar, Domenico Bianculli, Lionel C. Briand, Cu Duy Nguyen Feb 2022

Automated Reverse Engineering Of Role-Based Access Control Policies Of Web Applications, Ha Thanh Le, Lwin Khin Shar, Domenico Bianculli, Lionel C. Briand, Cu Duy Nguyen

Research Collection School Of Computing and Information Systems

Access control (AC) is an important security mechanism used in software systems to restrict access to sensitive resources. Therefore, it is essential to validate the correctness of AC implementations with respect to policy specifications or intended access rights. However, in practice, AC policy specifications are often missing or poorly documented; in some cases, AC policies are hard-coded in business logic implementations. This leads to difficulties in validating the correctness of policy implementations and detecting AC defects.In this paper, we present a semi-automated framework for reverse-engineering of AC policies from Web applications. Our goal is to learn and recover role-based access …

Go to article

Lightweight And Expressive Fine-Grained Access Control For Healthcare Internet-Of-Things, Shengmin Xu, Yingjiu Li, Robert H. Deng, Yinghui Zhang, Xiangyang Luo, Ximeng Liu Jan 2022

Lightweight And Expressive Fine-Grained Access Control For Healthcare Internet-Of-Things, Shengmin Xu, Yingjiu Li, Robert H. Deng, Yinghui Zhang, Xiangyang Luo, Ximeng Liu

Research Collection School Of Computing and Information Systems

Healthcare Internet-of-Things (IoT) is an emerging paradigm that enables embedded devices to monitor patients vital signals and allows these data to be aggregated and outsourced to the cloud. The cloud enables authorized users to store and share data to enjoy on-demand services. Nevertheless, it also causes many security concerns because of the untrusted network environment, dishonest cloud service providers and resource-limited devices. To preserve patients' privacy, existing solutions usually apply cryptographic tools to offer access controls. However, fine-grained access control among authorized users is still a challenge, especially for lightweight and resource-limited end-devices. In this paper, we propose a novel …

Go to article

Secure Cloud Data Deduplication With Efficient Re-Encryption, Haoran Yuan, Xiaofeng Chen, Jin Li, Tao Jiang, Jianfeng Wang, Robert H. Deng Jan 2022

Secure Cloud Data Deduplication With Efficient Re-Encryption, Haoran Yuan, Xiaofeng Chen, Jin Li, Tao Jiang, Jianfeng Wang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Data deduplication technique has been widely adopted by commercial cloud storage providers, which is both important and necessary in coping with the explosive growth of data. To further protect the security of users' sensitive data in the outsourced storage mode, many secure data deduplication schemes have been designed and applied in various scenarios. Among these schemes, secure and efficient re-encryption for encrypted data deduplication attracted the attention of many scholars, and many solutions have been designed to support dynamic ownership management. In this paper, we focus on the re-encryption deduplication storage system and show that the recently designed lightweight rekeying-aware …

Go to article

A Blockchain-Based Self-Tallying Voting Protocol In Decentralized Iot, Yannan Li, Willy Susilo, Guomin Yang, Yong Yu, Dongxi Liu, Xiaojiang Du, Mohsen Guizani Jan 2022

A Blockchain-Based Self-Tallying Voting Protocol In Decentralized Iot, Yannan Li, Willy Susilo, Guomin Yang, Yong Yu, Dongxi Liu, Xiaojiang Du, Mohsen Guizani

Research Collection School Of Computing and Information Systems

The Internet of Things (IoT) is experiencing explosive growth and has gained extensive attention from academia and industry in recent years. However, most of the existing IoT infrastructures are centralized, which may cause the issues of unscalability and single-point-of-failure. Consequently, decentralized IoT has been proposed by taking advantage of the emerging technology called blockchain. Voting systems are widely adopted in IoT, for example a leader election in wireless sensor networks. Self-tallying voting systems are alternatives to unsuitable, traditional centralized voting systems in decentralized IoT. Unfortunately, self-tallying voting systems inherently suffer from fairness issues, such as adaptive and abortive issues caused …

Go to article

Orchestration Or Automation: Authentication Flaw Detection In Android Apps, Siqi Ma, Juanru Li, Surya Nepal, Diethelm Ostry, David Lo, Sanjay K. Jha, Robert H. Deng, Elisa Bertino Jan 2022

Orchestration Or Automation: Authentication Flaw Detection In Android Apps, Siqi Ma, Juanru Li, Surya Nepal, Diethelm Ostry, David Lo, Sanjay K. Jha, Robert H. Deng, Elisa Bertino

Research Collection School Of Computing and Information Systems

Passwords are pervasively used to authenticate users' identities in mobile apps. To secure passwords against attacks, protection is applied to the password authentication protocol (PAP). The implementation of the protection scheme becomes an important factor in protecting PAP against attacks. We focus on two basic protection in Android, i.e., SSL/TLS-based PAP and timestamp-based PAP. Previously, we proposed an automated tool, GLACIATE, to detect authentication flaws. We were curious whether orchestration (i.e., involving manual-effort) works better than automation. To answer this question, we propose an orchestrated approach, AUTHEXPLOIT and compare its effectiveness GLACIATE. We study requirements for correct implementation of PAP …

Go to article

Lessons Learnt Conducting Capture The Flag Cybersecurity Competition During Covid-19, Kee Hock Tan, Eng Lieh Ouh Jan 2022

Lessons Learnt Conducting Capture The Flag Cybersecurity Competition During Covid-19, Kee Hock Tan, Eng Lieh Ouh

Research Collection School Of Computing and Information Systems

This innovative practice full paper describes our experiences conducting cybersecurity capture the flag (CTF) competition for cybersecurity enthusiast participants (inclusive of both tertiary students and working professionals) local and abroad during the COVID-19 pandemic. Learning and appreciation of cybersecurity concepts for our participants with little to no technical background can be challenging. Gamification methods such as capture the flag competition style is a popular form of cybersecurity education to help participants overcome this challenge and identify talents. Participants get to apply theoretical concepts in a controlled environment, solve hands-on tasks in an informal, game-like setting and gain hands-on active learning …

Go to article

Authenticated Data Redaction With Accountability And Transparency, Jinhua Ma, Xinyi Huang, Yi Mu, Robert H. Deng Jan 2022

Authenticated Data Redaction With Accountability And Transparency, Jinhua Ma, Xinyi Huang, Yi Mu, Robert H. Deng

Research Collection School Of Computing and Information Systems

A common practice in data redaction is removing sensitive information prior to data publication or release. In data-driven applications, one must be convinced that the redacted data is still trustworthy. Meanwhile, the data redactor must be held accountable for (malicious) redaction, which could change/hide the meaning of the original data. Motivated by these concerns, we present a novel solution for authenticated data redaction based on a new Redactable Signature Scheme with Implicit Accountability (RSS - IA). In the event of a dispute, not only the original data signer but also the redactor can generate an evidence tag to unequivocally identify …

Go to article

Defining Smart Contract Defects On Ethereum, Jiachi Chen, Xin Xia, David Lo, John Grundy, Xiapu Luo, Ting Chen Jan 2022

Defining Smart Contract Defects On Ethereum, Jiachi Chen, Xin Xia, David Lo, John Grundy, Xiapu Luo, Ting Chen

Research Collection School Of Computing and Information Systems

Smart contracts are programs running on a blockchain. They are immutable to change, and hence can not be patched for bugs once deployed. Thus it is critical to ensure they are bug-free and well-designed before deployment. A Contract defect is an error, flaw or fault in a smart contract that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. The detection of contract defects is a method to avoid potential bugs and improve the design of existing code. Since smart contracts contain numerous distinctive features, such as the gas system. decentralized, it is important …

Go to article

Novel Secure Outsourcing Of Modular Inversion For Arbitrary And Variable Modulus, Chengliang Tian, Jia Yu, Hanlin Zhang, Haiyang Xue, Cong Wang, Kui Ren Jan 2022

Novel Secure Outsourcing Of Modular Inversion For Arbitrary And Variable Modulus, Chengliang Tian, Jia Yu, Hanlin Zhang, Haiyang Xue, Cong Wang, Kui Ren

Research Collection School Of Computing and Information Systems

In cryptography and algorithmic number theory, modular inversion is viewed as one of the most common and time-consuming operations. It is hard to be directly accomplished on resource-constrained clients (e.g., mobile devices and IC cards) since modular inversion involves a great amount of operations on large numbers in practice. To address the above problem, this paper proposes a novel unimodular matrix transformation technique to realize secure outsourcing of modular inversion. This technique makes our algorithm achieve several amazing properties. First, to the best of our knowledge, it is the first secure outsourcing computation algorithm that supports arbitrary and variable modulus, …

Go to article

A Practical Fog-Based Privacy-Preserving Online Car-Hailing Service System, Jianfei Sun, Guowen Xu, Tianwei Zhang, Mamoun Alazab, Robert H. Deng Jan 2022

A Practical Fog-Based Privacy-Preserving Online Car-Hailing Service System, Jianfei Sun, Guowen Xu, Tianwei Zhang, Mamoun Alazab, Robert H. Deng

Research Collection School Of Computing and Information Systems

Aiming for minimizing passengers’ waiting time and vehicles’ vacancy rate, online car-hailing service systems with fog computing has been deployed in various scenarios. In this paper, we focus on addressing the security and privacy issues in such a promising system by customizing a new cryptographic primitive to provide the following security guarantees: (1) private, finegrained and bilateral order matching between passengers and drivers; (2) authenticity verification of passengers’ orders in the form of ciphertext, and (3) temporal assurance of passengers’ ciphertext orders. To the best of our knowledge, no previous system has been designed to meet all three requirements. Existing …

Go to article

Video Snapshot: Single Image Motion Expansion Via Invertible Motion Embedding, Qianshu Zhu, Chu Han, Guoqiang Han, Tien-Tsin Wong, Shengfeng He Dec 2021

Video Snapshot: Single Image Motion Expansion Via Invertible Motion Embedding, Qianshu Zhu, Chu Han, Guoqiang Han, Tien-Tsin Wong, Shengfeng He

Research Collection School Of Computing and Information Systems

Unlike images, finding the desired video content in a large pool of videos is not easy due to the time cost of loading and watching. Most video streaming and sharing services provide the video preview function for a better browsing experience. In this paper, we aim to generate a video preview from a single image. To this end, we propose two cascaded networks, the motion embedding network and the motion expansion network. The motion embedding network aims to embed the spatio-temporal information into an embedded image, called video snapshot. On the other end, the motion expansion network is proposed to …

Go to article

Hrpdf: A Software-Based Heterogeneous Redundant Proactive Defense Framework For Programmable Logic Controller, Ke Liu, Jing-Yi Wang, Qiang Wei, Zhen-Yong Zhang, Jun Sun, Rong-Kuan Ma, Rui-Long Deng Dec 2021

Hrpdf: A Software-Based Heterogeneous Redundant Proactive Defense Framework For Programmable Logic Controller, Ke Liu, Jing-Yi Wang, Qiang Wei, Zhen-Yong Zhang, Jun Sun, Rong-Kuan Ma, Rui-Long Deng

Research Collection School Of Computing and Information Systems

Programmable logic controllers (PLCs) play a critical role in many industrial control systems, yet face increasingly serious cyber threats. In this paper, we propose a novel PLC-compatible software-based defense mechanism, called Heterogeneous Redundant Proactive Defense Framework (HRPDF). We propose a heterogeneous PLC architecture in HRPDF, including multiple heterogeneous, equivalent, and synchronous runtimes, which can thwart multiple types of attacks against PLC without the need of external devices. To ensure the availability of PLC, we also design an inter-process communication algorithm that minimizes the overhead of HRPDF. We implement a prototype system of HRPDF and test it in a real-world PLC …

Go to article

Data Fusion For Trust Evaluation, Zheng Yan, Qinghua Zheng, Laurence T. Yang, Robert H. Deng Dec 2021

Data Fusion For Trust Evaluation, Zheng Yan, Qinghua Zheng, Laurence T. Yang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Trust evaluation is a process to quantify trust by analyzing the data related to the factors that affect trust. It has been widely applied in many fields to facilitate decision making, system entity collaboration and security establishment. For example, in social networking, trust evaluation helps users make a social decision, reduce the risk of social interactions, and ensure the quality of a social networking environment. In digital communications, trust evaluation can be applied to detect malicious nodes, filter unwanted traffic and improve communication security. In e-commerce and cloud services, trust evaluation helps users selecting an appropriate product or service from …

Go to article

Broadcast Authenticated Encryption With Keyword Search, Xueqiao Liu, Kai He, Guomin Yang, Willy Susilo, Joseph Tonien, Qiong Huang Dec 2021

Broadcast Authenticated Encryption With Keyword Search, Xueqiao Liu, Kai He, Guomin Yang, Willy Susilo, Joseph Tonien, Qiong Huang

Research Collection School Of Computing and Information Systems

The emergence of public-key encryption with keyword search (PEKS) has provided an elegant approach to enable keyword search over encrypted content. Due to its high computational complexity proportional to the number of intended receivers, the trivial way of deploying PEKS for data sharing with multiple receivers is impractical, which motivates the development of a new PEKS framework for broadcast mode. However, existing works suffer from either the vulnerability to keyword guessing attacks (KGA) or high computation and communication complexity. In this work, a new primitive for keyword search in broadcast mode, named broadcast authenticated encryption with keyword search (BAEKS), is …

Go to article

Deriving Invariant Checkers For Critical Infrastructure Using Axiomatic Design Principles, Cheah Huei Yoong, Venkata Reddy Palleti, Rajib Ranjan Maiti, Arlindo Silva, Christopher M. Poskitt Dec 2021

Deriving Invariant Checkers For Critical Infrastructure Using Axiomatic Design Principles, Cheah Huei Yoong, Venkata Reddy Palleti, Rajib Ranjan Maiti, Arlindo Silva, Christopher M. Poskitt

Research Collection School Of Computing and Information Systems

Cyber-physical systems (CPSs) in critical infrastructure face serious threats of attack, motivating research into a wide variety of defence mechanisms such as those that monitor for violations of invariants, i.e. logical properties over sensor and actuator states that should always be true. Many approaches for identifying invariants attempt to do so automatically, typically using data logs, but these can miss valid system properties if relevant behaviours are not well-represented in the data. Furthermore, as the CPS is already built, resolving any design flaws or weak points identified through this process is costly. In this paper, we propose a systematic …

Go to article

A Fine-Grained Attribute Based Data Retrieval With Proxy Re-Encryption Scheme For Data Outsourcing Systems, Hanshu Hong, Ximeng Liu, Zhixin Sun Dec 2021

A Fine-Grained Attribute Based Data Retrieval With Proxy Re-Encryption Scheme For Data Outsourcing Systems, Hanshu Hong, Ximeng Liu, Zhixin Sun

Research Collection School Of Computing and Information Systems

Attribute based encryption is suitable for data protection in data outsourcing systems such as cloud computing. However, the leveraging of encryption technique may retrain some routine operations over the encrypted data, particularly in the field of data retrieval. This paper presents an attribute based date retrieval with proxy re-encryption (ABDR-PRE) to provide both fine-grained access control and retrieval over the ciphertexts. The proposed scheme achieves fine-grained data access management by adopting KP-ABE mechanism, a delegator can generate the re-encryption key and search indexes for the ciphertexts to be shared over the target delegatee’s attributes. Throughout the process of data sharing, …

Go to article

Functional Signatures: New Definition And Constructions, Qingwen Guo, Qiong Huang, Sha Ma, Meiyan Xiao, Guomin Yang, Willy Susilo Dec 2021

Functional Signatures: New Definition And Constructions, Qingwen Guo, Qiong Huang, Sha Ma, Meiyan Xiao, Guomin Yang, Willy Susilo

Research Collection School Of Computing and Information Systems

Functional signatures (FS) enable a master authority to delegate its signing privilege to an assistant. Concretely, the master authority uses its secret key sk(F) to issue a signing key sk(f) for a designated function f is an element of F-FS and sends both f and sk(f) to the assistant E, which is then able to compute a signature sigma(f) with respect to pk(F) for a message y in the range of f. In this paper, we modify the syntax of FS slightly to support the application scenario where a certificate of authorization is necessary. Compared with the original FS, our …

Go to article

Concise Mercurial Subvector Commitments: Definitions And Constructions, Yannan Li, Willy Susilo, Guomin Yang, Tran Viet Xuan Phuong, Yong Yu, Dongxi Liu Dec 2021

Concise Mercurial Subvector Commitments: Definitions And Constructions, Yannan Li, Willy Susilo, Guomin Yang, Tran Viet Xuan Phuong, Yong Yu, Dongxi Liu

Research Collection School Of Computing and Information Systems

Vector commitment and its variants have attracted a lot of attention recently as they have been exposed to a wide range of applications in blockchain. Two special extensions of vector commitments, namely subvector commitments and mercurial commitments, have been proposed with attractive features that are desirable in many applications. Nevertheless, to the best of our knowledge, a single construction satisfying all those attractive features is still missing. In this work, we analyze those important properties and propose a new primitive called mercurial subvector commitments, which are efficiently updatable, mercurial hiding, position binding, and aggregatable. We formalize the system model and …

Go to article

Efficient Server-Aided Secure Two-Party Computation In Heterogeneous Mobile Cloud Computing, Yulin Wu, Xuan Wang, Willy Susilo, Guomin Yang, Zoe L. Jiang, Qian Chen, Peng Xu Nov 2021

Efficient Server-Aided Secure Two-Party Computation In Heterogeneous Mobile Cloud Computing, Yulin Wu, Xuan Wang, Willy Susilo, Guomin Yang, Zoe L. Jiang, Qian Chen, Peng Xu

Research Collection School Of Computing and Information Systems

With the ubiquity of mobile devices and rapid development of cloud computing, mobile cloud computing (MCC) has been considered as an essential computation setting to support complicated, scalable and flexible mobile applications by overcoming the physical limitations of mobile devices with the aid of cloud. In the MCC setting, since many mobile applications (e.g., map apps) interacting with cloud server and application server need to perform computation with the private data of users, it is important to realize secure computation for MCC. In this article, we propose an efficient server-aided secure two-party computation (2PC) protocol for MCC. This is the …

Go to article

Leap: Leakage-Abuse Attack On Efficiently Deployable, Efficiently Searchable Encryption With Partially Known Dataset, Jianting Ning, Xinyi Huang, Geong Sen Poh, Jiaming Yuan, Yingjiu Li, Jian Weng, Robert H. Deng Nov 2021

Leap: Leakage-Abuse Attack On Efficiently Deployable, Efficiently Searchable Encryption With Partially Known Dataset, Jianting Ning, Xinyi Huang, Geong Sen Poh, Jiaming Yuan, Yingjiu Li, Jian Weng, Robert H. Deng

Research Collection School Of Computing and Information Systems

Searchable Encryption (SE) enables private queries on encrypted documents. Most existing SE schemes focus on constructing industrialready, practical solutions at the expense of information leakages that are considered acceptable. In particular, ShadowCrypt utilizes a cryptographic approach named “efficiently deployable, efficiently searchable encryption” (EDESE) that reveals the encrypted dataset and the query tokens among other information. However, recent attacks showed that such leakages can be exploited to (partially) recover the underlying keywords of query tokens under certain assumptions on the attacker’s background knowledge. We continue this line of work by presenting LEAP, a new leakageabuse attack on EDESE schemes that can …

Go to article

Efficient Online-Friendly Two-Party Ecdsa Signature, Haiyang Xue, Ho Man Au, Xiang Xie, Hon Tsz Yuen, Handong Cui Nov 2021

Efficient Online-Friendly Two-Party Ecdsa Signature, Haiyang Xue, Ho Man Au, Xiang Xie, Hon Tsz Yuen, Handong Cui

Research Collection School Of Computing and Information Systems

Two-party ECDSA signatures have received much attention due to their widespread deployment in cryptocurrencies. Depending on whether or not the message is required, we could divide two-party signing into two different phases, namely, offline and online. Ideally, the online phase should be made as lightweight as possible. At the same time, the cost of the offline phase should remain similar to that of a normal signature generation. However, the existing two-party protocols of ECDSA are not optimal: either their online phase requires decryption of a ciphertext, or their offline phase needs at least two executions of multiplicative-to-additive conversion which dominates …

Go to article

An Exploratory Study Of Social Support Systems To Help Older Adults In Managing Mobile Safety, Tamir Mendel, Debin Gao, David Lo, Eran Toch Oct 2021

An Exploratory Study Of Social Support Systems To Help Older Adults In Managing Mobile Safety, Tamir Mendel, Debin Gao, David Lo, Eran Toch

Research Collection School Of Computing and Information Systems

Older adults face increased safety challenges, such as targeted online fraud and phishing, contributing to the growing technological divide between them and younger adults. Social support from family and friends is often the primary way older adults receive help, but it may also lead to reliance on others. We have conducted an exploratory study to investigate older adults' attitudes and experiences related to mobile social support technologies for mobile safety. We interviewed 18 older adults about their existing support and used the think-aloud method to gather data about a prototype for providing social support during mobile safety challenges. Our findings …

Go to article

Sylpeniot: Symmetric Lightweight Predicate Encryption For Data Privacy Applications In Iot Environments, Tran Viet Xuan Phuong, Willy Susilo, Guomin Yang, Jongkil Kim, Yangwai Chow, Dongxi Liu Oct 2021

Sylpeniot: Symmetric Lightweight Predicate Encryption For Data Privacy Applications In Iot Environments, Tran Viet Xuan Phuong, Willy Susilo, Guomin Yang, Jongkil Kim, Yangwai Chow, Dongxi Liu

Research Collection School Of Computing and Information Systems

Privacy preserving mechanisms are essential for protecting data in IoT environments. This is particularly challenging as IoT environments often contain heterogeneous resource-constrained devices. One method for protecting privacy is to encrypt data with a pattern or metadata. To prevent information leakage, an evaluation using the pattern must be performed before the data can be retrieved. However, the computational costs associated with typical privacy preserving mechanisms can be costly. This makes such methods ill-suited for resource-constrained devices, as the high energy consumption will quickly drain the battery. This work solves this challenging problem by proposing SyLPEnIoT – Symmetric Lightweight Predicate Encryption …

Go to article

Covid-19 One Year On: Security And Privacy Review Of Contact Tracing Mobile Apps, Wei Yang Ang, Lwin Khin Shar Oct 2021

Covid-19 One Year On: Security And Privacy Review Of Contact Tracing Mobile Apps, Wei Yang Ang, Lwin Khin Shar

Research Collection School Of Computing and Information Systems

The ongoing COVID-19 pandemic caused 3.8 million deaths since December 2019. At the current vaccination pace, this global pandemic could persist for several years. Throughout the world, contact tracing (CT) apps were developed, which play a significant role in mitigating the spread of COVID-19. This work examines the current state of security and privacy landscape of mobile CT apps. Our work is the first attempt, to our knowledge, which provides a comprehensive analysis of 70 CT apps used worldwide as of year Q1 2021. Among other findings, we observed that 80% of them may have handled sensitive data without adequate …

Go to article

Privacy-Preserving Voluntary-Tallying Leader Election For Internet Of Things, Tong Wu, Guomin Yang, Liehuang Zhu, Yulin Wu Oct 2021

Privacy-Preserving Voluntary-Tallying Leader Election For Internet Of Things, Tong Wu, Guomin Yang, Liehuang Zhu, Yulin Wu

Research Collection School Of Computing and Information Systems

The Internet of Things (IoT) is commonly deployed with devices of limited power and computation capability. A centralized IoT architecture provides a simplified management for IoT system but brings redundancy by the unnecessary data traffic with a data center. A decentralized IoT reduces the cost on data traffic and is resilient to the single-point-of failure. The blockchain technique has attracted a large amount of research, which is redeemed as a perspective of decentralized IoT system infrastructure. It also brings new privacy challenges for that the blockchain is a public ledger of all digital events executed and shared among all participants. …

Go to article

On The Usability (In)Security Of In-App Browsing Interfaces In Mobile Apps, Zicheng Zhang, Daoyuan Wu, Lixiang Li, Debin Gao Oct 2021

On The Usability (In)Security Of In-App Browsing Interfaces In Mobile Apps, Zicheng Zhang, Daoyuan Wu, Lixiang Li, Debin Gao

Research Collection School Of Computing and Information Systems

Due to the frequent encountering of web URLs in various application scenarios (e.g., chatting and email reading), many mobile apps build their in-app browsing interfaces (IABIs) to provide a seamless user experience. Although this achieves user-friendliness by avoiding the constant switching between the subject app and the system built-in browser apps, we find that IABIs, if not well designed or customized, could result in usability security risks. In this paper, we conduct the first empirical study on the usability (in)security of in-app browsing interfaces in both Android and iOS apps. Specifically, we collect a dataset of 25 high-profile mobile apps …

Go to article

Revocable Policy-Based Chameleon Hash, Shengmin Xu, Jianting Ning, Jinhua Ma, Guowen Xu, Jiaming Yuan, Robert H. Deng Oct 2021

Revocable Policy-Based Chameleon Hash, Shengmin Xu, Jianting Ning, Jinhua Ma, Guowen Xu, Jiaming Yuan, Robert H. Deng

Research Collection School Of Computing and Information Systems

Policy-based chameleon hash (PCH) is a cryptographic building block which finds increasing practical applications. Given a message and an access policy, for any chameleon hash generated by a PCH scheme, a chameleon trapdoor holder whose rewriting privileges satisfy the access policy can amend the underlying message without affecting the hash value. In practice, it is necessary to revoke the rewriting privileges of a trapdoor holder due to various reasons, such as change of positions, compromise of credentials, or malicious behaviours. In this paper, we introduce the notion of revocable PCH (RPCH) and formally define its security. We instantiate a concrete …

Go to article

Impact Of Digital Nudging On Information Security Behavior: An Experimental Study On Framing And Priming In Cybersecurity, Kavya Sharma, Xinhui Zhan, Fiona Fui-Hoon Nah, Keng Siau, Maggie X. Cheng Oct 2021

Impact Of Digital Nudging On Information Security Behavior: An Experimental Study On Framing And Priming In Cybersecurity, Kavya Sharma, Xinhui Zhan, Fiona Fui-Hoon Nah, Keng Siau, Maggie X. Cheng

Research Collection School Of Computing and Information Systems

Purpose: Phishing attacks are the most common cyber threats targeted at users. Digital nudging in the form of framing and priming may reduce user susceptibility to phishing. This research focuses on two types of digital nudging, framing and priming, and examines the impact of framing and priming on users' behavior (i.e. action) in a cybersecurity setting. It draws on prospect theory, instance-based learning theory and dual-process theory to generate the research hypotheses. Design/methodology/approach: A 3 × 2 experimental study was carried out to test the hypotheses. The experiment consisted of three levels for framing (i.e. no framing, negative framing and …

Go to article

Robust And Ethical Data Governance Critical To Growth In Digital Age, Themin Suwardy, Melvin Yong Sep 2021

Robust And Ethical Data Governance Critical To Growth In Digital Age, Themin Suwardy, Melvin Yong

Research Collection School Of Accountancy

With increasing digitalisation, and companies collecting an ever-increasing amount of their customer and business data, organisations have to become more accountable to stakeholders such as regulators, customers and investors on the issue of data. Observers say expectations are also increasing, with incidents of data breaches capturing much media attention. Just as corporate governance encompasses more than just compliance, experts say data governance is more than just data protection and security but also about creating value.

Go to article

Adversarial Attacks And Mitigation For Anomaly Detectors Of Cyber-Physical Systems, Yifan Jia, Jingyi Wang, Christopher M. Poskitt, Sudipta Chattopadhyay, Jun Sun, Yuqi Chen Sep 2021

Adversarial Attacks And Mitigation For Anomaly Detectors Of Cyber-Physical Systems, Yifan Jia, Jingyi Wang, Christopher M. Poskitt, Sudipta Chattopadhyay, Jun Sun, Yuqi Chen

Research Collection School Of Computing and Information Systems

The threats faced by cyber-physical systems (CPSs) in critical infrastructure have motivated research into a multitude of attack detection mechanisms, including anomaly detectors based on neural network models. The effectiveness of anomaly detectors can be assessed by subjecting them to test suites of attacks, but less consideration has been given to adversarial attackers that craft noise specifically designed to deceive them. While successfully applied in domains such as images and audio, adversarial attacks are much harder to implement in CPSs due to the presence of other built-in defence mechanisms such as rule checkers (or invariant checkers). In this work, we …

Go to article

First Prev Next Last