Information Security Commons^™

Privacy-Preserving Outsourced Calculation Toolkit In The Cloud, Ximeng Liu, Robert H. Deng, Kim-Kwang Raymond Choo, Yang Yang, Hwee Hwa Pang

Research Collection School Of Computing and Information Systems

In this paper, we propose a privacy-preserving outsourced calculation toolkit, Pockit, designed to allow data owners to securely outsource their data to the cloud for storage. The outsourced encrypted data can be processed by the cloud server to achieve commonly-used plaintext arithmetic operations without involving additional servers. Specifically, we design both signed and unsigned integer circuits using a fully homomorphic encryption (FHE) scheme, construct a new packing technique (hereafter referred to as integer packing), and extend the secure circuits to its packed version. This achieves significant improvements in performance compared with the original secure signed/unsigned integer circuit. The secure integer …

A Lattice-Based Key-Insulated And Privacy-Preserving Signature Scheme With Publicly Derived Public Key, Wenling Liu, Zhen Liu, Khoa Nguyen, Guomin Yang, Yu Yu

Research Collection School Of Computing and Information Systems

As a widely used privacy-preserving technique for cryptocurrencies, Stealth Address constitutes a key component of Ring Confidential Transaction (RingCT) protocol and it was adopted by Monero, one of the most popular privacy-centric cryptocurrencies. Recently, Liu et al. [EuroS&P 2019] pointed out a flaw in the current widely used stealth address algorithm that once a derived secret key is compromised, the damage will spread to the corresponding master secret key, and all the derived secret keys thereof. To address this issue, Liu et al. introduced Key-Insulated and Privacy-Preserving Signature Scheme with Publicly Derived Public Key (PDPKS scheme), which captures the functionality, …

Attribute-Based Encryption For Cloud Computing Access Control: A Survey, Yinghui Zhang, Robert H. Deng, Shengmin Xu, Jianfei Sun, Qi Li, Dong Zheng

Research Collection School Of Computing and Information Systems

Attribute-based encryption (ABE) for cloud computing access control is reviewed in this article. A taxonomy and comprehensive assessment criteria of ABE are first proposed. In the taxonomy, ABE schemes are assorted into key-policy ABE (KP-ABE) schemes, ciphertext-policy ABE (CP-ABE) schemes, anti-quantum ABE schemes, and generic constructions. In accordance with cryptographically functional features, CP-ABE is further divided into nine subcategories with regard to basic functionality, revocation, accountability, policy hiding, policy updating, multi-authority, hierarchy, offline computation, and outsourced computation. In addition, a systematical methodology for discussing and comparing existing ABE schemes is proposed. For KP-ABE and each type of CP-ABE, the corresponding …

Cryptography, Passwords, Privacy, And The Fifth Amendment, Gary C. Kessler, Ann M. Phillips

Journal of Digital Forensics, Security and Law

Military-grade cryptography has been widely available at no cost for personal and commercial use since the early 1990s. Since the introduction of Pretty Good Privacy (PGP), more and more people encrypt files and devices, and we are now at the point where our smartphones are encrypted by default. While this ostensibly provides users with a high degree of privacy, compelling a user to provide a password has been interpreted by some courts as a violation of our Fifth Amendment protections, becoming an often insurmountable hurdle to law enforcement lawfully executing a search warrant. This paper will explore some of the …

A Two-Stage Model For Social Network Investigations In Digital Forensics, Anne David, Sarah Morris, Gareth Appleby-Thomas

Journal of Digital Forensics, Security and Law

This paper proposes a two-stage model for identifying and contextualizing features from artefacts created as a result of social networking activity. This technique can be useful in digital investigations and is based on understanding and the deconstruction of the processes that take place prior to, during and after user activity; this includes corroborating artefacts. Digital Investigations are becoming more complex due to factors such as, the volume of data to be examined; different data formats; a wide range of sources for digital evidence; the volatility of data and the limitations of some of the standard digital forensic tools. This paper …

Snitch Application: Addressing Cyber Trust In Future Living Spaces, Russell Moore

Cybersecurity Undergraduate Research Showcase

The future of smart homes is filled with excitement and ample opportunity to live in an environment that features extraordinary convenience and energy efficiency. Devices such as Amazon Alexa and Roku Smart TV’s feature voice interaction options that provide the user with enhanced functionality. While voice-activated devices are accommodating, it is imperative to acknowledge how they work on the backend. The problem is that these devices collect and share a large amount of data from users who are oftentimes unaware that it’s even happening. The Snitch App is being developed in order to inform the user of what exactly is …

Resource Optimization In Support Of Iot Applications, Ihab Ahmed Mohammed

Dissertations

With the rise of the Internet of Things (IoT) and smart communities, managing computation and communication resources required by billions of smart devices becomes a concern. To tackle this problem, we develop algorithms for resource management to ensure better Quality of Service (QoS), safety, and performance. We focus our efforts on three problems.

In the first problem, we studied the strict QoS requirements of applications and differentiated service requirements in different situations of vehicular networks. We propose a generic prioritization and resource management algorithm that can be used to prioritize the processing of received packets in vehicular networks. We formulate …

A Comprehensive Security Approach On Data Race Detection And Deepfake Defense, Yu Guo

Dissertations

In the past decades, even the computer techniques have a significant improvement. The topic about security will be never out of date.

To meet with the requirement of computation, the number of CPU cores has changed from single core to multi-cores. At the same time, the multi-thread programs are also proposed to maximize the advantages of multi-core computing power. While even the performance has been improved, but it also brings some new issues which were never happened on sequential programs called current bugs. Data race is a major type of current bugs, it is happened when multiple threads access the …

Maia And Admonita: Mandatory Integrity Control Language And Dynamic Trust Framework For Arbitrary Structured Data, Wassnaa Al-Mawee

Dissertations

The expansion of attacks against information systems of companies that operate nuclear power stations and other energy facilities in the United States and other countries, are noticeable with potential catastrophic real-world implications. Data integrity is a fundamental component of information security. It refers to the accuracy and the trustworthiness of data or resources. Data integrity within information systems becomes an important factor of security protection as the data becomes more integrated and crucial to decision-making. The security threats brought by human errors whether, malicious or unintentional, such as viruses, hacking, and many other cybersecurity threats, are dangerous and require mandatory …

Cyber-Assets At Risk (Car): Monetary Impact Of Personally Identifiable Information Data Breaches On Companies, Omer Ilker Poyraz

Engineering Management & Systems Engineering Theses & Dissertations

Cyber-systems provide convenience, ubiquity, economic advantage, and higher efficiency to both individuals and organizations. However, vulnerabilities of the cyber domain also offer malicious actors with the opportunities to compromise the most sensitive information. Recent cybersecurity incidents show that a group of hackers can cause a massive data breach, resulting in companies losing competitive advantage, reputation, and money. Governments have since taken some actions in protecting individuals and companies from such crime by authorizing federal agencies and developing regulations. To protect the public from losing their most sensitive records, governments have also been compelling companies to follow cybersecurity regulations. If companies …

Privacy Preserving Search Services Against Online Attack, Yi Zhao, Jianting Nian, Kaitai Liang, Yanqi Zhao, Liqun Chen, Bo Yang

Research Collection School Of Computing and Information Systems

Searchable functionality is provided in many online services such as mail services or outsourced data storage. To protect users privacy, data in these services is usually stored after being encrypted using searchable encryption. This enables the data user to securely search encrypted data from a remote server without leaking data and query information. Public key encryption with keyword search is one of the research branches of searchable encryption; this provides privacy-preserving searchable functionality for applications such as encrypted email systems. However, it has an inherent vulnerability in that the information of a query may be leaked using a keyword guessing …

A Generalised Bound For The Wiener Attack On Rsa, Willy Susilo, Joseph Tonien, Guomin Yang

Research Collection School Of Computing and Information Systems

Since Wiener pointed out that the RSA can be broken if the private exponent d is relatively small compared to the modulus N, it has been a general belief that the Wiener attack works for d

Measuring Privacy Concerns With Government Surveillance And Right-To-Be-Forgotten In Nomological Net Of Trust And Willingness-To-Share, Gaurav Bansal, Fiona Fui-Hoon Nah

Research Collection School Of Computing and Information Systems

In the post Snowden revelations era, concerns related to government surveillance and oversight have come to the forefront. The ability of the Internet to remember “everything” (or forget anything) also raises a privacy concern associated with the “right to be forgotten”. Hence, in this paper, we propose and examine privacy concerns by extending the Hong and Thong’s (2013) model with the addition of two dimensions: right to be forgotten as well as government surveillance and oversight. We tested two different measurement models using privacy concerns as a second-order and a third-order construct within a nomological net that includes trusting beliefs …

Detecting Undisclosed Paid Editing In Wikipedia, Nikesh Joshi

Boise State University Theses and Dissertations

Wikipedia is a free and open-collaboration based online encyclopedia. The website has millions of pages that are maintained by thousands of volunteer editors. It is part of Wikipedia’s fundamental principles that pages are written with a neutral point of view and are maintained by volunteer editors for free with well-defined guidelines in order to avoid or disclose any conflict of interest. However, there have been several known incidents where editors intentionally violate such guidelines in order to get paid (or even extort money) for maintaining promotional spam articles without disclosing such information.

This thesis addresses for the first time the …

Recent Advances In Smart Contracts: A Technical Overview And State Of The Art, Victor Youdom Kemmoe, William Stone, Jeehyeong Kim, Daeyoung Kim, Junggab Son

School of Computing Faculty Scholarship and Creative Works

Smart contracts, as an added functionality to blockchain, have received increased attention recently. They are executable programs whose instance and state are stored in blockchain. Hence, smart contracts and blockchain enable a trustable, trackable, and irreversible protocol without the need for trusted third parties which generally constitute a single point of failure. If a user creates and distributes a smart contract, others will be able to interact with it while the underlying blockchain ensures a trustable execution. In this paper, we aim to introduce state-of-the-art technologies of the smart contract protocol. We firstly introduce the history of blockchain and smart …

Human Behavior Is A Significant Flaw In Maintaining Cyber Security, Elizabeth Jackson

Cybersecurity Undergraduate Research Showcase

Human behavior and data security utilization must be intertwined; in order to mitigate the negative effects of cyber attacks. No consumer wants their data hacked, breached, stolen, shared or wiped out. It is imperative to survey the type of education is needed to keep users safe and interested in securing their data. This can be done by simply seeking out the consumer's view of data security. The information obtained would allow the cybersecurity community to offer a simple way for consumers to protect their mobile data. There is a constant interaction between human behavior and the need for increased data …

Designing Leakage-Resilient Password Entry On Head-Mounted Smart Wearable Glass Devices, Yan Li, Yao Cheng, Wenzhi Meng, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the boom of Augmented Reality (AR) and Virtual Reality (VR) applications, head-mounted smart wearable glass devices are becoming popular to help users access various services like E-mail freely. However, most existing password entry schemes on smart glasses rely on additional computers or mobile devices connected to smart glasses, which require users to switch between different systems and devices. This may greatly lower the practicability and usability of smart glasses. In this paper, we focus on this challenge and design three practical anti-eavesdropping password entry schemes on stand-alone smart glasses, named gTapper, gRotator and gTalker. The main idea is to …

Search Me In The Dark: Privacy-Preserving Boolean Range Query Over Encrypted Spatial Data, Xiangyu Wang, Jianfeng Ma, Ximeng Liu, Robert H. Deng, Yinbin Miao, Dan Zhu, Zhuoran Ma

Research Collection School Of Computing and Information Systems

With the increasing popularity of geo-positioning technologies and mobile Internet, spatial keyword data services have attracted growing interest from both the industrial and academic communities in recent years. Meanwhile, a massive amount of data is increasingly being outsourced to cloud in the encrypted form for enjoying the advantages of cloud computing while without compromising data privacy. Most existing works primarily focus on the privacy-preserving schemes for either spatial or keyword queries, and they cannot be directly applied to solve the spatial keyword query problem over encrypted data. In this paper, we study the challenging problem of Privacy-preserving Boolean Range Query …

Email Data Breach Analysis And Prevention Using Hook And Eye System, Shubhankar Jayant Jathar

Electronic Theses, Projects, and Dissertations

Due to the recent COVID-19 outbreak, there were a lot of data leaks from the health sector. This project is about the increase in data breach incidents that are taking place. In this project, There is an analysis of different types of breaches that are found online and are practiced to steal valuable information. Talking about different aspects that lead to data breaches and which are the main sector or main epicenter for data leaks. The analysis tells that most of the data breaches are done using emails and to overcome this limitation a system has been designed that will …

A Web-Based User-Interface For Internet Of Things Device Management, Leena Mansour Alghamdi

Theses and Dissertations

With the growing advances in the Internet of Things (IoT) technology, which combines various devices with distinct functions, capabilities, and communication protocols, it is essential to provide a platform that enables IoT users to interact with their IoT devices directly and be able to manage them effortlessly via that platform from various locations at any time in order to protect their privacy when using IoT devices. In this study, we are aiming to provide a web-based user interface that can address that challenges and provide real-time data control; hence, we have created a user interface prototype, which can demonstrate the …

Should Judges Have A Duty Of Tech Competence?, John G. Browning

St. Mary's Journal on Legal Malpractice & Ethics

In an era in which lawyers are increasingly held to a higher standard of “tech competence” in their representation of clients, shouldn’t we similarly require judges to be conversant in relevant technology? Using real world examples of judicial missteps with or refusal to use technology, and drawn from actual cases and judicial disciplinary proceedings, this Article argues that in today’s Digital Age, judicial technological competence is necessary. At a time when courts themselves have proven vulnerable to cyberattacks, and when courts routinely tackle technology related issues like data privacy and the admissibility of digital evidence, Luddite judges are relics that …

Camps: Efficient And Privacy-Preserving Medical Primary Diagnosis Over Outsourced Cloud, Jianfeng Hua, Guozhen Shi, Hui Zhu, Fengwei Wang, Ximeng Liu, Hao Li

Research Collection School Of Computing and Information Systems

With the flourishing of ubiquitous healthcare and cloud computing technologies, medical primary diagnosis system, which forms a critical capability to link big data analysis technologies with medical knowledge, has shown great potential in improving the quality of healthcare services. However, it still faces many severe challenges on both users' medical privacy and intellectual property of healthcare service providers, which deters the wide adoption of medical primary diagnosis system. In this paper, we propose an efficient and privacy-preserving medical primary diagnosis framework (CAMPS). Within CAMPS framework, the precise diagnosis models are outsourced to the cloud server in an encrypted manner, and …

Privacy-Enhanced Remote Data Integrity Checking With Updatable Timestamp, Tong Wu, Guomin Yang, Yi Mu, Rongmao Chen, Shengmin Xu

Research Collection School Of Computing and Information Systems

Remote data integrity checking (RDIC) enables clients to verify whether the outsourced data is intact without keeping a copy locally or downloading it. Nevertheless, the existing RDIC schemes do not support the pay-as-you-go (PAYG) payment model, where the payment is decided by the volume and duration of the outsourced data. Specifically, none of the existing works have considered the client’s control over changes in storage duration. In this paper, we propose an RDIC scheme to simultaneously check the data content and storage duration represented by an updatable timestamp via the third-party auditor (TPA). Also, our proposed scheme achieves indistinguishable privacy …

Lightweight And Privacy-Aware Fine-Grained Access Control For Iot-Oriented Smart Health, Jianfei Sun, Hu Xiong, Ximeng Liu, Yinghui Zhang, Xuyun Nie, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the booming of Internet of Things (IoT), smart health (s-health) is becoming an emerging and attractive paradigm. It can provide an accurate prediction of various diseases and improve the quality of healthcare. Nevertheless, data security and user privacy concerns still remain issues to be addressed. As a high potential and prospective solution to secure IoT-oriented s-health applications, ciphertext policy attribute-based encryption (CP-ABE) schemes raise challenges, such as heavy overhead and attribute privacy of the end users. To resolve these drawbacks, an optimized vector transformation approach is first proposed to efficiently transform the access policy and user attribute set into …

Answer Ranking For Product-Related Questions Via Multiple Semantic Relations Modeling, Wenxuan Zhang, Yang Deng, Wai Lam

Research Collection School Of Computing and Information Systems

Many E-commerce sites now offer product-specific question answering platforms for users to communicate with each other by posting and answering questions during online shopping. However, the multiple answers provided by ordinary users usually vary diversely in their qualities and thus need to be appropriately ranked for each question to improve user satisfaction. It can be observed that product reviews usually provide useful information for a given question, and thus can assist the ranking process. In this paper, we investigate the answer ranking problem for product-related questions, with the relevant reviews treated as auxiliary information that can be exploited for facilitating …

Bridging Hierarchical And Sequential Context Modeling For Question-Driven Extractive Answer Summarization, Yang Deng, Wenxuan Zhang, Yaliang Li, Min Yang, Wai Lam, Ying Shen

Research Collection School Of Computing and Information Systems

Non-factoid question answering (QA) is one of the most extensive yet challenging application and research areas of retrieval-based question answering. In particular, answers to non-factoid questions can often be too lengthy and redundant to comprehend, which leads to the great demand on answer sumamrization in non-factoid QA. However, the multi-level interactions between QA pairs and the interrelation among different answer sentences are usually modeled separately on current answer summarization studies. In this paper, we propose a unified model to bridge hierarchical and sequential context modeling for question-driven extractive answer summarization. Specifically, we design a hierarchical compare-aggregate method to integrate the …

Spring 2020

In The Loop

Letter from the Dean: Advancing Past Adversity; Look Who's Talking: Expert Talk Series; Seen and Heard; Keeping It Real: Client Web Projects for Students; OMG, It's DIBS, LOL!; X-ray Vision: Brian Andrews bones up on anthropomorphic entities and virtual realty in an audacious Project Bluelight film; Nothing But Net: Shannon Linares scores a win for female and first-generation college students in network engineering and cybersecurity careers; Mix Master: Claire Rosas blends disciplines and social synergy in her designs, from egg-ceptional typography to adaptive ergs

An Assessment Of Global Research Activities On Children And Adolescent Online Security, Adeola O. Opesade Dr, Omolayo A. Adesina Ms.

Journal of Cybersecurity Education, Research and Practice

The use of the Internet among children and adolescents is now a norm in many parts of the world. As the Internet offers a wide range of benefits to these ones, so does it expose them to possible various risks and harm. Researchers in different countries across the world have engaged in the production of relevant research-based knowledge in order to make the virtual world a safe place for the younger ones. However, while studies have been carried out on the subject of Internet risk among children and adolescents, there is a dearth of information on the assessment of research …

Evaluating And Securing Text-Based Java Code Through Static Code Analysis, Jeong Yang, Young Lee, Amanda Fernandez, Joshua Sanchez

Journal of Cybersecurity Education, Research and Practice

As the cyber security landscape dynamically evolves and security professionals work to keep apace, modern-day educators face the issue of equipping a new generation for this dynamic landscape. With cyber-attacks and vulnerabilities substantially increased over the past years in frequency and severity, it is important to design and build secure software applications from the group up. Therefore, defensive secure coding techniques covering security concepts must be taught from beginning computer science programming courses to exercise building secure applications. Using static analysis, this study thoroughly analyzed Java source code in two textbooks used at a collegiate level, with the goal of …

Malaware Defensive: A Game To Train Users To Combat Malware, Tyler Moon, Tamirat Abegaz, Bryson Payne, Abi Salimi

Journal of Cybersecurity Education, Research and Practice

Several research findings indicate that basic cyber hygiene can potentially deter the majority of cyber threats. One of the ways cybersecurity professionals can prepare users to ensure proper hygiene is to help them develop their ability to spot the difference between normal and abnormal behavior in a computer system. Malware disrupts the normal behavior of a computer system. The lack of appropriate user training has been one of the main reasons behind the exposure of computer systems to threats, from social engineering to viruses, trojans, and ransomware. Basic knowledge about common behavioral characteristics of malware could help users identify potentially …