Information Security Commons^™

Improved Construction For Inner Product Functional Encryption, Qingsong Zhao, Qingkai Zeng, Ximeng Liu

Research Collection School Of Computing and Information Systems

Functional encryption (FE) is a vast new paradigm for encryption scheme which allows tremendous flexibility in accessing encrypted data. In a FE scheme, a user can learn specific function of encrypted messages by restricted functional key and reveals nothing else about the messages. Besides the standard notion of data privacy in FE, it should protect the privacy of the function itself which is also crucial for practical applications. In this paper, we construct a secret key FE scheme for the inner product functionality using asymmetric bilinear pairing groups of prime order. Compared with the existing similar schemes, our construction reduces …

Strong Identity-Based Proxy Signature Schemes, Revisited, Weiwei Liu, Yi Mu, Guomin Yang, Yangguang Tian

Research Collection School Of Computing and Information Systems

Proxy signature is a useful cryptographic primitive that has been widely used in many applications. It has attracted a lot of attention since it was introduced. There have been lots of works in constructing efficient and secure proxy signature schemes. In this paper, we identify a new attack that has been neglected by many existing proven secure proxy signature schemes. We demonstrate this attack by launching it against an identity-based proxy signature scheme which is proven secure. We then propose one method that can effectively prevent this attack. The weakness in some other proxy signature schemes can also be fixed …

Efficient And Privacy-Preserving Outsourced Calculation Of Rational Numbers, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng, Rongxing Lu, Jian Weng

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for efficient and privacy-preserving outsourced calculation of rational numbers, which we refer to as POCR. Using POCR, a user can securely outsource the storing and processing of rational numbers to a cloud server without compromising the security of the (original) data and the computed results. We present the system architecture of POCR and the associated toolkits required in the privacy preserving calculation of integers and rational numbers to ensure that commonly used outsourced operations can be handled on-the-fly. We then prove that the proposed POCR achieves the goal of secure integer and rational …

Defense In Depth Network Perimeter Security, Anuoluwapo Ope Fatokun

Masters Theses

Defense in depth network perimeter security has always be a topic of discussion for a long time as an efficient way of mitigating cyber-attacks. While there are no 100% mitigating method against cyber-attacks, a layered defense in depth network perimeter security can be used to mitigate against cyber-attacks. Research have shown a massive growth in cyber-crimes and there are limited number of cyber security expert to counter this attacks. EIU as an institution is taking up the responsibility of producing cyber security graduates with the new Master of Science in Cyber Security program that started in Fall 2017.

This research …

Gpu Accelerated Risk Quantification, Forrest L. Ireland

EWU Masters Thesis Collection

Factor Analysis of Information Risk (FAIR) is a standard model for quantitatively estimating cybersecurity risks and has been implemented as a sequential Monte Carlo simulation in the RiskLens and FAIR-U applications. Monte Carlo simulations employ random sampling techniques to model certain systems through the course of many iterations. Due to their sequential nature, FAIR simulations in these applications are limited in the number of iterations they can perform in a reasonable amount of time. One method that has been extensively used to speed up Monte Carlo simulations is to implement them to take advantage of the massive parallelization available when …

If I Had A Million Cryptos: Cryptowallet Application Analysis And A Trojan Proof-Of-Concept, Trevor Haigh, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Cryptocurrencies have gained wide adoption by enthusiasts and investors. In this work, we examine seven different Android cryptowallet applications for forensic artifacts, but we also assess their security against tampering and reverse engineering. Some of the biggest benefits of cryptocurrency is its security and relative anonymity. For this reason it is vital that wallet applications share the same properties. Our work, however, indicates that this is not the case. Five of the seven applications we tested do not implement basic security measures against reverse engineering. Three of the applications stored sensitive information, like wallet private keys, insecurely and one was …

Big Networks: Analysis And Optimal Control, Hung The Nguyen

Theses and Dissertations

The study of networks has seen a tremendous breed of researches due to the explosive spectrum of practical problems that involve networks as the access point. Those problems widely range from detecting functionally correlated proteins in biology to finding people to give discounts and gain maximum popularity of a product in economics. Thus, understanding and further being able to manipulate/control the development and evolution of the networks become critical tasks for network scientists. Despite the vast research effort putting towards these studies, the present state-of-the-arts largely either lack of high quality solutions or require excessive amount of time in real-world …

Privacy In Iot Cloud, Aftab Ahmad, Ravi Mukkamala, Karthik Navuluri

Computer Science Faculty Publications

We present a framework for privacy preservation in an information cloud of IoT devices. We contend that privacy provisioning should be located in the user device and must protect the user, the information, and the device from breaches in privacy. We elaborate on how the layered privacy model can ensure such privacy provisioning, and justify the device being the provisioning point instead of the cloud alone. We present the point of view that, due to resource limitations of the IoT devices in general, the privacy preserving measures need to be hard-coded in the device technology. We fall short of suggesting …

A Framework For Development Of Android Mobile Electronic Prescription Transfer Applications In Compliance With Security Requirements Mandated By The Australian Healthcare Industry, Kyaw Kyaw Htat

Theses: Doctorates and Masters

This thesis investigates mobile electronic transfer of prescription (ETP) in compliance with the security requirements mandated by the Australian healthcare industry and proposes a framework for the development of an Android mobile electronic prescription transfer application. Furthermore, and based upon the findings and knowledge from constructing this framework, another framework is also derived for assessing Android mobile ETP applications for their security compliance.

The centralised exchange model-based ETP solution currently used in the Australian healthcare industry is an expensive solution for on-going use. With challenges such as an aging population and the rising burden of chronic disease, the cost of …

User-Friendly Deniable Storage For Mobile Devices, Bing Chang, Yao Cheng, Bo Chen, Fengwei Zhang, Wen-Tao Zhu, Yingjiu Li, Zhan. Wang

Research Collection School Of Computing and Information Systems

Mobile devices are prevalently used to process sensitive data, but traditional encryption may not work when an adversary is able to coerce the device owners to disclose the encryption keys. Plausibly Deniable Encryption (PDE) is thus designed to protect sensitive data against this powerful adversary. In this paper, we present MobiPluto, a user-friendly PDE scheme for denying the existence of sensitive data stored on mobile devices. A salient difference between MobiPluto and the existing PDE systems is that any block-based file systems can be deployed on top of it. To further improve usability and deniability of MobiPluto, we introduce a …

Smartwatch-Based Early Gesture Detection & Trajectory Tracking For Interactive Gesture-Driven Applications, Tran Huy Vu, Archan Misra, Quentin Roy, Kenny Tsu Wei Choo, Youngki Lee

Research Collection School Of Computing and Information Systems

The paper explores the possibility of using wrist-worn devices (specifically, a smartwatch) to accurately track the hand movement and gestures for a new class of immersive, interactive gesture-driven applications. These interactive applications need two special features: (a) the ability to identify gestures from a continuous stream of sensor data early–i.e., even before the gesture is complete, and (b) the ability to precisely track the hand’s trajectory, even though the underlying inertial sensor data is noisy. We develop a new approach that tackles these requirements by first building a HMM-based gesture recognition framework that does not need an explicit segmentation step, …

A Lightweight Policy Preserving Ehr Sharing Scheme In The Cloud, Zuobin Ying, Lu Wei, Qi Li, Ximeng Liu, Jie Cui

Research Collection School Of Computing and Information Systems

Electronic Health Record (EHR) is a digital health documentary. It contains not only the health-related records but also the personal sensitive information. Therefore, how to reliably share EHR through the cloud is a challenging issue. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptography prototype, which can achieve fine-grained access control as well as one-to-many encryption. In CP-ABE, access policy is attached to the ciphertext, and however, the access policy is not protected, which will also cause some privacy leakage. In this paper, we propose a policy preserving EHR system on the basis of CP-ABE. Specifically, we designed an algorithm, which …

Online/Offline Traceable Attribute-Based Encryption [In Chinese], Kai Zhang, Jianfeng Ma, Junwei Zhang, Zuobin Ying, Tao Zhang, Ximeng Liu

Research Collection School Of Computing and Information Systems

Attribute-based encryption (ABE), as a public key encryption, can be utilized for fine-grained access control. However, there are two main drawbacks that limit the applications of attribute-based encryption. First, as different users may have the same decryption privileges in ciphertext-policy attribute-based encryption, it is difficult to catch the users who sell their secret keys for financial benefit. Second, the number of resource-consuming exponentiation operations required to encrypt a message in ciphertext-policy attribute-based encryption grows with the complexity of the access policy, which presents a significant challenge for the users who encrypt data on mobile devices. Towards this end, after proposing …

Simulation-Based Security Of Function-Hiding Inner Product Encryption, Qingsong Zhao, Qingkai Zeng, Ximeng Liu, Huanliang Xu

Research Collection School Of Computing and Information Systems

Functional encryption (FE) [1,2] is a modern type of encryption scheme that extends several previous notions and allows tremendous flexibility in controlling and computing on encrypted data. FE enables an authority to derive constrained decryption keys that are used by a user to obtain specific functions of encrypted messages. Informally, the authority generates a secret key skf for a function f from a master secret key. Then, the user can only learn f(x) from a ciphertext Enc(x) with skf and reveal nothing else about x.

User-Friendly Deniable Storage For Mobile Devices, Bing Chang, Yao Cheng, Bo Chen, Fengwei Zhang, Wen-Tao Zhu, Yanju Liu, Zhan Wang

Research Collection School Of Computing and Information Systems

Mobile devices are prevalently used to process sensitive data, but traditional encryption may not work when an adversary is able to coerce the device owners to disclose the encryption keys. Plausibly Deniable Encryption (PDE) is thus designed to protect sensitive data against this powerful adversary. In this paper, we present MobiPluto, a user-friendly PDE scheme for denying the existence of sensitive data stored on mobile devices. A salient difference between MobiPluto and the existing PDE systems is that any block-based file systems can be deployed on top of it. To further improve usability and deniability of MobiPluto, we introduce a …

Applying Machine Learning To Advance Cyber Security: Network Based Intrusion Detection Systems, Hassan Hadi Latheeth Al-Maksousy

Computer Science Theses & Dissertations

Many new devices, such as phones and tablets as well as traditional computer systems, rely on wireless connections to the Internet and are susceptible to attacks. Two important types of attacks are the use of malware and exploiting Internet protocol vulnerabilities in devices and network systems. These attacks form a threat on many levels and therefore any approach to dealing with these nefarious attacks will take several methods to counter. In this research, we utilize machine learning to detect and classify malware, visualize, detect and classify worms, as well as detect deauthentication attacks, a form of Denial of Service (DoS). …

Transfer Learning With Convolutional Neural Networks Applied To Periocular Biometrics, Kushal Vangara

Theses and Dissertations

Biometrics technologies are designed for recognition of the unique physiological and behavioral features of an individual for identification and verification applications. There have been noteworthy advances in this field to recognize individuals based on their biometric trait(s) for authentication and verification applications. Despite these advances, there are many challenging issues which impede the potential of biometric systems and therefore limit the systems performance. Traditional biometric system design involves a selection of handcrafted features for recognition tasks which are not efficient as the size of the system scales up. Face and iris biometrics are reliable for many identification and verification applications …

A Survey Of Distributed Certificate Authorities In Manets, Junaid Chaudhry, Kashif Saleem, Paul Haskell-Dowland Dr, Mahdi H. Miraz

Research outputs 2014 to 2021

A Certificate Authority (CA) provides the critical authentication and security services for Public Key Infrastructure (PKI) which are used for the Internet and wired networks. In MANETs (wireless and ad hoc) there is an inability to offer a centralized CA to provide these security services. Recent research has looked to facilitate the use of CAs within MANETs through the use of a Distributed Certificate Authority (DCA) for wireless and ad hoc networks. This paper presents a number of different types of DCA protocols and categorizes them into groups based on their factors and specifications. The paper concludes by proposing the …

A Security Review Of Local Government Using Nist Csf: A Case Study, Ahmed Ibrahim, Craig Valli, Ian Mcateer, Junaid Chaudhry

Research outputs 2014 to 2021

Evaluating cyber security risk is a challenging task regardless of an organisation’s nature of business or size, however, an essential activity. This paper uses the National Institute of Standards and Technology (NIST) cyber security framework (CSF) to assess the cyber security posture of a local government organisation in Western Australia. Our approach enabled the quantification of risks for specific NIST CSF core functions and respective categories and allowed making recommendations to address the gaps discovered to attain the desired level of compliance. This has led the organisation to strategically target areas related to their people, processes, and technologies, thus mitigating …

The Design And Evaluation Of A User-Centric Information Security Risk Assessment And Response Framework, Manal Alohali, Nathan Clarke, Steven Furnell

Research outputs 2014 to 2021

Abstract: The risk of sensitive information disclosure and modification through the use of online services has increased considerably and may result in significant damage. As the management and assessment of such risks is a well-known discipline for organizations, it is a challenge for users from the general public. Users have difficulties in using, understanding and reacting to security-related threats. Moreover, users only try to protect themselves from risks salient to them. Motivated by the lack of risk assessment solutions and limited impact of awareness programs tailored for users of the general public, this paper aims to develop a structured approach …

Application Of 3d Delaunay Triangulation In Fingerprint Authentication System, Wencheng Yang, Ahmed Ibrahim, Junaid Chaudhry, Song Wang, Jiankun Hu, Craig Valli

Research outputs 2014 to 2021

Biometric security has found many applications in Internet of Things (IoT) security. Many mobile devices including smart phones have supplied fingerprint authentication function. However, the authentication performance in such restricted environment has been downgraded significantly. A number of methods based on Delaunay triangulation have been proposed for minutiae-based fingerprint matching, due to some favorable properties of the Delaunay triangulation under image distortion. However, all existing methods are based on 2D pattern, of which each unit, a Delaunay triangle, can only provide limited discrimination ability and could cause low matching performance. In this paper, we propose a 3D Delaunay triangulation based …

Biometrics Based Privacy-Preserving Authentication And Mobile Template Protection, Wencheng Yang, Jiankun Hu, Song Wang, Qianhong Wu

Research outputs 2014 to 2021

Smart mobile devices are playing a more and more important role in our daily life. Cancelable biometrics is a promising mechanism to provide authentication to mobile devices and protect biometric templates by applying a noninvertible transformation to raw biometric data. However, the negative effect of nonlinear distortion will usually degrade the matching performance significantly, which is a nontrivial factor when designing a cancelable template. Moreover, the attacks via record multiplicity (ARM) present a threat to the existing cancelable biometrics, which is still a challenging open issue. To address these problems, in this paper, we propose a new cancelable fingerprint template …

A Developmental Study On Assessing The Cybersecurity Competency Of Organizational Information System Users, Richard K. Nilsen, Yair Levy, Steven R. Terrell Ph.D., Dawn Beyer

Journal of Cybersecurity Education, Research and Practice

Organizational information system users (OISUs) that are open to cyber threats vectors are contributing to major financial and information losses for individuals, businesses, and governments. Moreover, technical cybersecurity controls may be rendered useless due to a lack of cybersecurity competency of OISUs. The main goal of this research study was to propose and validate, using subject matter experts (SMEs), a reliable hands-on assessment prototype tool for measuring the knowledge, skills, and abilities (KSAs) that comprise the cybersecurity competency of an OISU. Primarily using the Delphi methodology, this study implemented four phases of data collection using cybersecurity SMEs for proposing and …

A Toolkit Approach To Information Security Awareness And Education, Peter Korovessis, Steven Furnell, Maria Papadaki, Paul Haskell-Dowland

Journal of Cybersecurity Education, Research and Practice

In today’s business environment where all operations are enabled by technology, information security has become an established discipline as more and more businesses realize its value. The human component has been recognized to have an important role in information security since the only way to reduce security risks is through making employees more information security aware. Towards this goal the research will appreciate the importance of information security awareness by illustrating the need for more effective user training. Further to that it proposes and develops an information security toolkit as a prototype awareness raising initiative. Apart from the elements of …

From The Editors, Herbert J. Mattord, Michael E. Whitman, Carole L. Hollingsworth

Journal of Cybersecurity Education, Research and Practice

No abstract provided.

Social Media Risk Perceptions Of Human Resource Professionals: Issues Undergraduate Students Should Consider, Julio C. Rivera, Jack Howard, Samuel Goh, James L. Worrell, Paul Di Gangi

Journal of Cybersecurity Education, Research and Practice

This study contrasts the social media risk perceptions of undergraduate students, versus those of certified Human Resource professionals. Social media is widely used by most segments of the population, and particularly among the age group that includes most undergraduate students. Organizations hiring employees are increasingly examining job applicant's social media postings as part of the applicant screening process. In this study we examine how these groups differ in their perceptions of the risks inherent in using social media, and what these differences may mean for students seeking employment. Recommendations are made for raising undergraduate student awareness of these risks.

Synergistic Security: A Work System Case Study Of The Target Breach, Martha Nanette Harrell

Journal of Cybersecurity Education, Research and Practice

Recent publicized security breaches can be used to evaluate information security programs. The processes and procedures that allowed the event to occur can be examined in a case study and then be used to find methods for future mitigation of risk. The Target security breach is used in this study to examine the organization’s information security program using a macro-ergonomic model. This research posits that an information security program should consider the work system design, based in macro-ergonomics, to help mitigate information security risk to the organization and ensure an efficient and effective information security program. Based on a seminal …

Canines For Disabled Kids, Erin Jerrett, Margarita Mnatsakanyan, Colleen Reynolds, Yin Wang

School of Professional Studies

Canines for Disabled Kids have been working on behalf of children and their families to educate communities and promote service dog partnerships for almost twenty years. Their advocacy with local legislatures, business owners, and community leaders highlighted the difficulties encountered when differentiating service dogs from emotional support/comfort dogs. Service dogs are entitled to access by the Americans with Disabilities Act (ADA), while emotional support/comfort dogs are not protected under the federal statute or to the same rights. Canines for Disabled Kids proposed a study to obtain a current count of licensed service dogs in the Commonwealth and investigate the feasibility …

Cover Front

Journal of Digital Forensics, Security and Law

No abstract provided.

Varying Instructional Approaches To Physical Extraction Of Mobile Device Memory, Joan Runs Through, Gary D. Cantrell

Journal of Digital Forensics, Security and Law

Digital forensics is a multidisciplinary field encompassing both computer science and criminal justice. This action research compared demonstrated skill levels of university students enrolled in a semester course in small device forensics with 54 hours of instruction in mobile forensics with an emphasis on physical techniques such as JTAG and Chip-Off extraction against the skill levels of industry professionals who have completed an accelerated 40 hour advanced mobile forensics training covering much of the same material to include JTAG and Chip-Off extraction. Participant backgrounds were also examined to determine if those participants with a background in computer science had an …