Information Security Commons^™

Cross-Spectral Biometric Performance Analysis On High-Resolution Face Images, Praveen Kumar Pandian Shanmuganathan

Theses and Dissertations

Biometrics is increasingly being used to authenticate the identity of individuals in critical use case devices like smart phones, laptops, and several other access-control systems in our day-to-day lives. Additionally, biometrics is also used in forensic and security sensitive areas to detect and identify suspects involved in bombings, robberies, and several police investigations. In each of these critical scenarios, the high-quality full-frontal face images of the subjects are not accurately captured as those subjects do not intend to register their identity to the Closed-Circuit Cameras. Hence in such cases, identification of the suspects becomes difficult even though we have the …

Security Testing With Misuse Case Modeling, Samer Yousef Khamaiseh

Boise State University Theses and Dissertations

Having a comprehensive model of security requirements is a crucial step towards developing a reliable software system. An effective model of security requirements which describes the possible scenarios that may affect the security aspects of the system under development can be an effective approach for subsequent use in generating security test cases.

Misuse case was first proposed by Sinder and Opdahl as an approach to extract the security requirements of the system under development [1]. A misuse case is a use case representing scenarios that might be followed by a system adversary in order to compromise the system; that is …

Developing An Abac-Based Grant Proposal Workflow Management System, Milson Munakami

Boise State University Theses and Dissertations

In the advent of the digital transformation, online business processes need to be automated and modeled as workflows. A workflow typically involves a sequence of coordinated tasks and shared data that need to be secured and protected from unauthorized access. In other words, a workflow can be described simply as the movement of documents and activities through a business process among different users. Such connected flow of information among various users with different permission level offers many benefits along with new challenges. Cyber threats are becoming more sophisticated as skilled and motivated attackers both insiders and outsiders are equipped with …

A Certificateless One-Way Group Key Agreement Protocol For Point-To-Point Email Encryption, Srisarguru Sridhar

Boise State University Theses and Dissertations

Over the years, email has evolved and grown to one of the most widely used form of communication between individuals and organizations. Nonetheless, the current information technology standards do not value the significance of email security in today's technologically advanced world. Not until recently, email services such as Yahoo and Google started to encrypt emails for privacy protection. Despite that, the encrypted emails will be decrypted and stored in the email service provider's servers as backup. If the server is hacked or compromised, it can lead to leakage and modification of one's email. Therefore, there is a strong need for …

Soteria: A Persuasive Esecurity Assistant, Punica Bhardwaj

Theses and Dissertations

“…security is only as good as the weakest link, and people are the weakest link in the chain.” – B Schneier, 2002 Humans are often referred to as the “weakest link” in the security chain because of the poor security decisions taken by them. There can be many reasons for these decisions, such as lack of understandability of the software, lack of education, and lack of relevant information required to do that particular action. In this Thesis, we focus on the lack of relevant information required at the time of performing the action. In order to provide the user with …

An Interview With The Scorpion: Walter O’Brien, Walter O'Brien

The Transdisciplinary STEAM+ Journal

An interview with Walter O'Brien (hacker handle: "Scorpion"), known as a businessman, information technologist, executive producer, and media personality who is the founder and CEO of Scorpion Computer Services, Inc. O'Brien is also the inspiration for and executive producer of the CBS television series, Scorpion.

Personal Privacy: A Study To Determine Views On Privacy As It Relates To Technology Acceptance, Keith A. Wuotinen

Master's Theses and Doctoral Dissertations

This descriptive correlation study sought to learn the relationships, if any, between a person’s concern for privacy and their acceptance of technology, in conjunction with the control factors of the Big Five personality factors. The study employed a modified Concern for Information Privacy (CFIP) scale and a modified Technology Acceptance Model (TAM) approach in conjunction with the Big Five personality factors using a 51-question survey.

The study surveyed students at Eastern Michigan University in Ypsilanti, Michigan, who were enrolled in the College of Technology. The results indicated that there was a significant positive relationship between the CFIP and the TAM. …

Automated Verification Of Timed Security Protocols With Clock Drift, Li Li, Jun Sun

Research Collection School Of Computing and Information Systems

Time is frequently used in security protocols to provide better security. For instance, critical credentials often have limited lifetime which improves the security against brute-force attacks. However, it is challenging to correctly use time in protocol design, due to the existence of clock drift in practice. In this work, we develop a systematic method to formally specify as well as automatically verify timed security protocols with clock drift. We first extend the previously proposed timed applied ππ -calculus as a formal specification language for timed protocols with clock drift. Then, we define its formal semantics based on timed logic rules, …

Early Packet Rejection Using Dynamic Binary Decision Diagram, Vasiqullah Molvizadah

Theses

A firewall is a hardware or software device that performs inspection on a given incoming/outgoing packets and decide whether to allow/deny the packet from entering/leaving the system. Firewall filters the packets by using a set of rules called firewall policies. The policies define what type of packets should be allowed or discarded. These policies describe the field values that the packet header must contain in order to match a policy in the firewall. The decision for any given packet is made by finding the first matching firewall policy, if any.

In a traditional firewall, the packet filter goes through each …

On The Security Of Two Identity-Based Conditional Proxy Re-Encryption Schemes, Kai He, Jian Weng, Robert H. Deng, Joseph K. Liu

Research Collection School Of Computing and Information Systems

Proxy re-encryption allows a semi-trusted proxy with a re-encryption key to convert a delegator's ciphertext into a delegatee's ciphertext, and the semi-trusted proxy cannot learn anything about the underlying plaintext. If a proxy re-encryption scheme is indistinguishable against chosen-ciphertext attacks, its initialized ciphertext should be non-malleable. Otherwise, there might exist an adversary who can break the chosen-ciphertext security of the scheme. Recently, Liang et al. proposed two proxy re-encryption schemes. They claimed that their schemes were chosen-ciphertext secure in the standard model. However, we find that the original ciphertext in their schemes are malleable. Thus, we present some concrete attacks …

Privacy-Preserving Outsourced Calculation On Floating Point Numbers, Ximeng Liu, Robert H. Deng, Wenxiu Ding, Rongxing Lu

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for privacy-preserving outsourced calculation on floating point numbers (POCF). Using POCF, a user can securely outsource the storing and processing of floating point numbers to a cloud server without compromising on the security of the (original) data and the computed results. In particular, we first present privacy-preserving integer processing protocols for common integer operations. We then present an approach to outsourcing floating point numbers for storage in a privacy-preserving way, and securely processing commonly used floating point number operations on-the-fly. We prove that the proposed POCF achieves the goal of floating point number …

One-Round Attribute-Based Key Exchange In The Multi-Party Setting, Yangguang Tian, Guomin Yang, Yi Mu, Kaitai Liang, Yong Yu

Research Collection School Of Computing and Information Systems

Attribute-based authenticated key exchange (AB-AKE) is a useful primitive that allows a group of users to establish a shared secret key and at the same time enables fine-grained access control. A straightforward approach to design an AB-AKE protocol is to extend a key exchange protocol using attribute-based authentication technique. However, insider security is a challenge security issue for AB-AKE in the multi-party setting and cannot be solved using the straightforward approach. In addition, many existing key exchange protocols for the multi-party setting (e.g., the well-known Burmester-Desmedt protocol) require multiple broadcast rounds to complete the protocol. In this paper, we propose …

Achieving Ind-Cca Security For Functional Encryption For Inner Products, Shiwei Zhang, Yi Mu, Guomin Yang

Research Collection School Of Computing and Information Systems

Functional encryption allows the authorised parties to reveal partial information of the plaintext hidden in a ciphertext while in conventional encryption decryption is all-or-nothing. Focusing on the functionality of inner product evaluation (i.e. given vectors xxxx and yyyy, calculate ⟨xx,yy⟩⟨xx,yy⟩), Abdalla et al. (PKC 2015) proposed a functional encryption scheme for inner product functionality (FE-IP) with s-IND-CPA security. In some recent works by Abdalla et al. (eprint: Report 2016/11) and Agrawal et al. (CRYPTO 2016), IND-CPA secure FE-IP schemes have also been proposed. In order to achieve Indistinguishable under Chosen Ciphertext Attacks (IND-CCA security) for FE-IP, in this paper, we …

M(2)-Abks: Attribute-Based Multi-Keyword Search Over Encrypted Personal Health Records In Multi-Owner Setting, Yinbin Miao, Jianfeng Ma, Ximeng Liu, Fushan Wei, Zhiquan Liu, Xu An Wang

Research Collection School Of Computing and Information Systems

Online personal health record (PHR) is more inclined to shift data storage and search operations to cloud server so as to enjoy the elastic resources and lessen computational burden in cloud storage. As multiple patients' data is always stored in the cloud server simultaneously, it is a challenge to guarantee the confidentiality of PHR data and allow data users to search encrypted data in an efficient and privacy-preserving way. To this end, we design a secure cryptographic primitive called as attribute-based multi-keyword search over encrypted personal health records in multi-owner setting to support both fine-grained access control and multi-keyword search …

A Provably Secure Aggregate Signature Scheme For Healthcare Wireless Sensor Networks, Limin Shen, Jianfeng Ma, Ximeng Liu, Meixia Miao

Research Collection School Of Computing and Information Systems

Wireless sensor networks (WSNs) are being used in a wide range of applications for healthcare monitoring, like heart rate monitors and blood pressure monitors, which can minimize the need for healthcare professionals. In medical system, sensors on or in patients produce medical data which can be easily compromised by a vast of attacks. Although signature schemes can protect data authenticity and data integrity, when the number of users involved in the medical system becomes huge, the bandwidth and storage cost will rise sharply so that existing signature schemes are inapplicability for WSNs. In this paper, we propose an efficient aggregate …

A Study On A Feasible No-Root Approach On Android, Yao Cheng, Yingjiu Li, Deng, Robert H., Lingyun Ying, Wei He

Research Collection School Of Computing and Information Systems

Root is the administrative privilege on Android, which is however inaccessible on stock Android devices. Due to the desire for privileged functionalities and the reluctance of rooting their devices, Android users seek for no-root approaches, which provide users with part of root privileges without rooting their devices. Existing no-root approaches require users to launch a separate service via Android Debug Bridge (ADB) on an Android device, which would perform user-desired tasks. However, it is unusual for a third-party Android application to work with a separate native service via sockets, and it requires the application developers to have extra knowledge such …

An Efficient And Expressive Ciphertext-Policy Attribute-Based-Encryption Scheme With Partially Hidden Access Structures, Hui Cui, Deng, Robert H., Guowei Wu, Junzuo Lai

Research Collection School Of Computing and Information Systems

A promising solution to protect data privacy in cloud storage services is known as ciphertext-policy attribute-based encryption (CP-ABE). However, in a traditional CP-ABE scheme, a ciphertext is bound with an explicit access structure, which may leak private information about the underlying plaintext in that anyone having access to the ciphertexts can tell the attributes of the privileged recipients by looking at the access structures. A notion called CP-ABE with partially hidden access structures [14, 15, 18, 19, 24] was put forth to address this problem, in which each attribute consists of an attribute name and an attribute value and the …

Efficient Tag Path Authentication Protocol With Less Tag Memory, Hongbing Wang, Yingjiu Li, Zongyang Zhang, Yunlei Zhao

Research Collection School Of Computing and Information Systems

Logistical management has been advanced rapidly in these years, taking advantage of the broad connectivity of the Internet. As it becomes an important part of our lives, it also raises many challenging issues, e.g., the counterfeits of expensive goods pose a serious threat to supply chain management. As a result, path authentication becomes especially important in supply chain management, since it helps us maintain object pedigree and supply chain integrity. Meanwhile, tag path authentication must meet a series of security requirements, such as authentication, privacy, and unlinkability. In addition, the authentication protocol must be efficient.In 2011, the first tag path …

Editorial: Trust Management For Multimedia Big Data, Zheng Yan, Jun Liu, Deng, Robert H., Francisco Herrera

Research Collection School Of Computing and Information Systems

No abstract provided.

Ownership-Hidden Group-Oriented Proofs Of Storage From Pre-Homomorphic Signatures, Yujue Wang, Qianhong Wu, Bo Qin, Xiaofeng Chen, Xinyi Huang, Jungang Lou

Research Collection School Of Computing and Information Systems

In this paper, we study the problem of secure cloud storage in a multi-user setting such that the ownership of outsourced files can be hidden against the cloud server. There is a group manager for initiating the system, who is also responsible for issuing private keys for the involved group members. All authorized members are able to outsource files to the group’s storage account at some cloud server. Although the ownership of outsourced file is preserved against the cloud server, the group manager could trace the true identity of any suspicious file for liability investigation. To address this issue, we …

A Novel Covert Channel Detection Method In Cloud Based On Xsrm And Improved Event Association Algorithm, Lina Wang, Weijie Liu, Neeraj Kumar, Debiao He, Cheng Tan, Debin Gao

Research Collection School Of Computing and Information Systems

Covert channel is a major threat to the information system security and commonly found in operating systems, especially in cloud computing environment. Owing to the characteristics in cloud computing environment such as resources sharing and logic boundaries, covert channels become more varied and difficult to find. Focusing on those problems, this paper presents a universal method for detecting covert channel automatically. To achieve a global detection, we leveraged a virtual machine event record mechanism in hypervisor to gather necessary metadata. Combining the shared resources matrix methodology with events association mechanism, we proposed a distinctive algorithm that can accurately locate and …

An Efficient Privacy-Preserving Outsourced Calculation Toolkit With Multiple Keys, Ximeng Liu, Robert H. Deng, Kim-Kwang Raymond Choo, Jian Weng

Research Collection School Of Computing and Information Systems

In this paper, we propose a toolkit for efficient and privacy-preserving outsourced calculation under multiple encrypted keys (EPOM). Using EPOM, a large scale of users can securely outsource their data to a cloud server for storage. Moreover, encrypted data belonging to multiple users can be processed without compromising on the security of the individual user's (original) data and the final computed results. To reduce the associated key management cost and private key exposure risk in EPOM, we present a distributed two-trapdoor public-key cryptosystem, the core cryptographic primitive. We also present the toolkit to ensure that the commonly used integer operations …

Virtual Values For Taint And Information Flow Analysis, Prakasam Kannan, Thomas Austin, Mark Stamp, Tim Disney, Cormac Flanagan

Faculty Publications, Computer Science

Security controls such as taint analysis and information flow analysis can be powerful tools to protect against many common attacks. However, incorporating these controls into a language such as JavaScript is challenging. Native implementations require the support of all JavaScript VMs. Code rewriting requires developers to reason about the entire abstract syntax of JavaScript. In this paper, we demonstrate how virtual values may be used to more easily integrate these security controls. Virtual values provide hooks to alter the behavior of primitive operations, allowing programmers to create the desired security controls in a more declarative fashion, facilitating more rapid prototyping. …

A Method For Revealing And Addressing Security Vulnerabilities In Cyber-Physical Systems By Modeling Malicious Agent Interactions With Formal Verification, Dean C. Wardell, Robert F. Mills, Gilbert L. Peterson, Mark E. Oxley

Faculty Publications

Several cyber-attacks on the cyber-physical systems (CPS) that monitor and control critical infrastructure were publically announced over the last few years. Almost without exception, the proposed security solutions focus on preventing unauthorized access to the industrial control systems (ICS) at various levels – the defense in depth approach. While useful, it does not address the problem of making the systems more capable of responding to the malicious actions of an attacker once they have gained access to the system. The first step in making an ICS more resilient to an attacker is identifying the cyber security vulnerabilities the attacker can …

Threats To Information Protection - Industry And Academic Perspectives: An Annotated Bibliography, Michael E. Whitman, Herbert J. Mattord

KSU Proceedings on Cybersecurity Education, Research and Practice

Threats to information assets have always been a concern to those responsible for making information useful and defending its value. The concepts of threat, threat agent, threat events and threat sources have evolved in recent years have very precise definitions. The article includes a summary of threat classification models used in academic research is provided along with a summary of recent industry threat assessment reports. Finally, the article shares results from a recent study, 2015 SEC/CISE Threats to Information Protection Report Including a Current Snapshot of the State of the Industry, are given.

The Implementation Of Information Systems In Network Administration: The Improvement Of Intranet Utilization In Higher Education Institutions, Besnik Skenderi, Murat Retkoceri, Rina Sadriu

UBT International Conference

Management Information systems or MIS broadly refers to a Computer system of Information that provides manager the tool to organize, Asses and manage efficiently departments within an organization.

Information System Management serves to assist in the more effective and efficient management of information. These systems make possible the production and preservation.

Nowadays the business, institutions and organization use MIS to certain functions or the entire organization. Some of the most important applicants are in dimensions or functions such as human resources, finance, marketing, manufacturing, asset management etc.

The primary definition shows that the primary task of management information system (MIS. …

The Importance Of Big Data Analytics, Eljona Proko

UBT International Conference

Identified as the tendency of IT, Big Data gained global attention. Advances in data analytics are changing the way businesses compete, enabling them to make faster and better decisions based on real-time analysis. Big Data introduces a new set of challenges. Three characteristics define Big Data: volume, variety, and velocity. Big Data requires tools and methods that can be applied to analyze and extract patterns from large-scale data. Companies generate enormous volumes of poly-structured data from Web, social network posts, sensors, mobile devices, emails, and many other sources. Companies need a cost-effective, massively scalable solution for capturing, storing, and analyzing …

Improving Business Networking Through The Effective Utilisation Of Information Systems, Ylber Limani

UBT International Conference

This Research addresses topics concerned with the enterprise models and information systems. The research is divided into two parts, in the first part is conducted the examination of business information systems in general, while in the second part the main factors of business networking are investigated.

The existing operational business practices and Information Technology infrastructure are not sufficiently used of efficiently sustain the effective business networking. A methodical analysis of the operational systems is performed in order to cover the main elements of the Information Systems and their utilisation for business needs. The implementation of a most important information business …

Traditional Mathematics And New Methods Of Teaching Through Programming Together With Students, Robert Kosova, Teuta Thanasi, Lindita Mukli, Loreta Nakuçi Pëllumbi

UBT International Conference

We are used to the traditional methods of teaching mathematics. The textbook, the blackboard and a chalk have been for centuries a wonderful part of teaching. And, they always will be. Traditional teaching methods of mathematics are a wonderful legacy of our educational system that have educated generations of teachers, engineers, administrators, managers, leaders, and economists. American universities websites, the video- lectures of the best professors of well-known disciplines such as statistics, operational research, number theory, algebra, game theory, show impressing large blackboards, all over the auditor's walls. We always will need and admire traditional mathematics. But, beyond the lessons, …

Cloud Computing And Enterprise Data Reliability, Luan Gashi

UBT International Conference

Cloud services offer many benefits from information and communication technology that to be credible must first be secured. To use the potential of cloud computing, data is transferred, processed and stored in the infrastructures of these service providers. This indicates that the owners of data, particularly enterprises, have puzzled when storing their data is done outside the scope of their control.

Research conducted on this topic show how this should be addressed unequivocally. The provided information on the organization of cloud computing models, services and standards, with a focus on security aspects in protecting enterprise data where emphasis shows how …