Information Security Commons^™

Possession Of Child Exploitation Material In Computer Temporary Internet Cache, Sungmi Park, Yunsik Jake Jang, Joshua I. James

Journal of Digital Forensics, Security and Law

When considering the possession of child exploitation material U.S. and German courts have the same focus, but slightly different interpretations. This slight difference in interpretation could mean that in one country a defendant will be found guilty of possession while in the other country he or she could be found not guilty. In this work we examine the standards courts in Germany and the United States have used to combat child pornography, and analyze the approaches specifically related to viewing and possession of CEM. A uniform solution is suggested that criminalizes “knowing access with the intention to view” as a …

Public Security & Digital Forensics In The United States: The Continued Need For Expanded Digital Systems For Security, Deborah G. Keeling, Michael Losavio

Journal of Digital Forensics, Security and Law

Digital Forensics is one of the latest challenges for the use of forensics in the investigative process in the United States. Some of the challenges are created by conditions and circumstances present for law enforcement around the world. However, many are unique to the United States and created by the standards of evidence within our courts, nature of our law enforcement organizations, and structure of our judicial and prosecutorial systems. It is essential for the preservation of public security and individual safety that competent systems of digital forensics are developed for law enforcement at all levels. The failure to do …

Secure And Efficient Delegation Of A Single And Multiple Exponentiations To A Single Malicious Server, Matluba Khodjaeva

Dissertations, Theses, and Capstone Projects

Group exponentiation is an important operation used in many cryptographic protocols, specifically public-key cryptosystems such as RSA, Diffie Hellman, ElGamal, etc. To expand the applicability of group exponentiation to computationally weaker devices, procedures were established by which to delegate this operation from a computationally weaker client to a computationally stronger server. However, solving this problem with a single, possibly malicious, server, has remained open since a formal cryptographic model was introduced by Hohenberger and Lysyanskaya in 2005. Several later attempts either failed to achieve privacy or only achieved constant security probability.

In this dissertation, we study and solve this problem …

On-Demand Time Blurring To Support Side-Channel Defense, Weijie Liu, Debin Gao, Michael K. Reiter

Research Collection School Of Computing and Information Systems

Side-channel attacks are a serious threat to multi-tenant public clouds. Past work showed how secret information in one virtual machine (VM) can be leaked to another, co-resident VM using timing side channels. Recent defenses against timing side channels focus on reducing the degree of resource sharing. However, such defenses necessarily limit the flexibility with which resources are shared. In this paper, we propose a technique that dynamically adjusts the granularity of platform time sources, to interfere with timing side-channel attacks. Our proposed technique supposes an interface by which a VM can request the temporary coarsening of platform time sources as …

An Efficient Privacy-Preserving Outsourced Computation Over Public Data, Ximeng Liu, Baodong Qin, Robert H. Deng, Yingjiu Li

Research Collection School Of Computing and Information Systems

In this paper, we propose a new efficient privacy preserving outsourced computation framework over public data, called EPOC. EPOC allows a user to outsource the computation of a function over multi-dimensional public data to the cloud while protecting the privacy of the function and its output. Specifically, we introduce three types of EPOC in order to tradeoff different levels of privacy protection and performance. We present a new cryptosystem called Switchable Homomorphic Encryption with Partial Decryption (SHED) as the core cryptographic primitive for EPOC.We introduce two coding techniques, called message pre-coding and message extending and coding respectively, for messages encrypted …

Personal Data Protection Act 2012: Understanding The Consent Obligation, Man Yip

Research Collection Yong Pung How School Of Law

The Personal Data Protection Act 20121 (“PDPA”) provides the baseline standards of protection of personal data and works in tandem with existing law to provide comprehensive protection. The birth of the legislation clearly signals Singapore’s commitment to protect the collection, use and disclosure of personal data in the age of big data and its awareness of the importance of such protection in strengthening Singapore’s position as a leading commercial hub. Significantly, the PDPA protection model balances “both the rights of individuals to protect their personal data” against “the needs of organisations to collect, use or disclose personal data for legitimate …

A Novel Privacy Preserving User Identification Approach For Network Traffic, Nathan Clarke, Fudong Li, Steven Furnell

Research outputs 2014 to 2021

The prevalence of the Internet and cloud-based applications, alongside the technological evolution of smartphones, tablets and smartwatches, has resulted in users relying upon network connectivity more than ever before. This results in an increasingly voluminous footprint with respect to the network traffic that is created as a consequence. For network forensic examiners, this traffic represents a vital source of independent evidence in an environment where anti-forensics is increasingly challenging the validity of computer-based forensics. Performing network forensics today largely focuses upon an analysis based upon the Internet Protocol (IP) address – as this is the only characteristic available. More typically, …

Analysis Of Security In Big Data Related To Healthcare, Isabel De La Torre, Begoña García-Zapirain, Miguel López-Coronado

Journal of Digital Forensics, Security and Law

Big data facilitates the processing and management of huge amounts of data. In health, the main information source is the electronic health record with others being the Internet and social media. Health-related data refers to storage in big data based on and shared via electronic means. Why are criminal organisations interested in this data? These organisations can blackmail people with information related to their health condition or sell the information to marketing companies, etc. This article analyses healthcare-related big data security and proposes different solutions. There are different techniques available to help preserve privacy such as data modification techniques, cryptographic …

Editorial

Journal of Digital Forensics, Security and Law

No abstract provided.

Legislative Requirements For Cyber Peacekeeping, Nikolay Akatyev, Joshua I. James

Journal of Digital Forensics, Security and Law

Cyber Peacekeeping strives for the prevention, mitigation and cessation of cyber and physical conflicts. The creation of a Cyber Peacekeeping organization, however, has major legal and political implications. In this work we review current international legislation applicable for functions of Cyber Peacekeeping. Specifically, we analyze prominent works which contribute to definitions, law and ethics regulating cyber conflicts from the perspective of the creation of a CPK organization. Legislative and terminological foundations are analyzed and adopted from current practice. Further, this work analyzes guiding principles of global organizations such as ITU IMPACT, INTERPOL and regional organizations such as NATO and the …

The Use Of Information Technologies To Combat Counterfeit Alcohol Products And Ensure The Right To Life In Russia, Pavel Syosoevich Pastukhov, Svetlana Polyakova, Evelina Frolovich

Journal of Digital Forensics, Security and Law

The paper is aimed to analyze implementation of an integrated information system that provides forecasting, monitoring, prevention and elimination of possible threats, such as violation of information support of public authorities, businesses and municipal services and others as well as control of elimination of consequences of emergency situations and offenses with integration under its control action information and control duty subsystems, control, municipal services for their operational cooperation in the interests of of the municipality. In particular, it consideres how this unified system is applied in accounting of production volume and turnover of ethyl alcohol, alcoholic and alcohol-containing products (USAIS) …

Security And The Transnational Information Polity, Michael M. Losavio, Adel Said Elmaghraby

Journal of Digital Forensics, Security and Law

Global information and communications technologies create criminal opportunities in which criminal violation and physical proximity are decoupled. As in all our endeavors, the good become the prey of the bad. Murderous and venal exploitation of ICT has followed from the inception of the Internet, threatening all the good it brings and the trust we need so badly as a people. As the work continues to expand the implementation of Smart Cities and the Internet of Things, there will be more opportunities for exploitation of these technologies. We examine the social and liberty risks our data and technology-driven responses may entail.

Vurle: Automatic Vulnerability Detection And Repair By Learning From Examples, Ma Siqi, Ferdian Thung, David Lo, Cong Sun, Robert H. Deng

Research Collection School Of Computing and Information Systems

Vulnerability becomes a major threat to the security of many systems. Attackers can steal private information and perform harmful actions by exploiting unpatched vulnerabilities. Vulnerabilities often remain undetected for a long time as they may not affect typical systems’ functionalities. Furthermore, it is often difficult for a developer to fix a vulnerability correctly if he/she is not a security expert. To assist developers to deal with multiple types of vulnerabilities, we propose a new tool, called VuRLE, for automatic detection and repair of vulnerabilities. VuRLE (1) learns transformative edits and their contexts (i.e., code characterizing edit locations) from examples of …

Vcksm: Verifiable Conjunctive Keyword Search Over Mobile E-Health Cloud In Shared Multi-Owner Settings, Yinbin Miao, Jianfeng Ma, Ximeng Liu, Qi Jiang, Junwei Zhang, Limin Shen, Zhiquan Liu

Research Collection School Of Computing and Information Systems

Searchable encryption (SE) is a promising technique which enables cloud users to conduct search over encrypted cloud data in a privacy-preserving way, especially for the electronic health record (EHR) system that contains plenty of medical history, diagnosis, radiology images, etc. In this paper, we focus on a more practical scenario, also named as the shared multi-owner settings, where each e-health record is co-owned by a fixed number of parties. Although the existing SE schemes under the unshared multi-owner settings can be adapted to this shared scenario, these schemes have to build multiple indexes,which definitely incur higher computational overhead. To save …

Evopass: Evolvable Graphical Password Against Shoulder-Surfing Attacks, Xingjie Yu, Zhan Wang, Yingjiu Li, Liang Li, Wen Tao Zhu, Li Song

Research Collection School Of Computing and Information Systems

The passwords for authenticating users are susceptible to shoulder-surfing attacks in which attackers learn users' passwords through direct observations without any technical support. A straightforward solution to defend against such attacks is to change passwords periodically or even constantly, making the previously observed passwords useless. However, this may lead to a situation in which users run out of strong passwords they can remember, or they are forced to choose passwords that are weak, correlated, or difficult to memorize. To achieve both security and usability in user authentication, we propose EvoPass, the first evolvable graphical password authentication system. EvoPass transforms a …

Stylizing Face Images Via Multiple Exemplars, Yibing Song, Linchao Bao, Shengfeng He, Qingxiong Yang, Ming-Hsuan Yang

Research Collection School Of Computing and Information Systems

We address the problem of transferring the style of a headshot photo to face images. Existing methods using a single exemplar lead to inaccurate results when the exemplar does not contain sufficient stylized facial components for a given photo. In this work, we propose an algorithm to stylize face images using multiple exemplars containing different subjects in the same style. Patch correspondences between an input photo and multiple exemplars are established using a Markov Random Field (MRF), which enables accurate local energy transfer via Laplacian stacks. As image patches from multiple exemplars are used, the boundaries of facial components on …

Ind-Pca Secure Kem Is Enough For Password-Based Authenticated Key Exchange (Short Paper), Haiyang Xue, Bao Li, Xianhui Lu

Research Collection School Of Computing and Information Systems

There are several frameworks for password-based authenticated key exchange (PAKE) protocols with common reference string following the work of Katz, Ostrovsky and Yung (Eurocrypt’01), and it seems that the IND-CCA secure encryption is inevitable when constructing PAKE in standard model.In this paper, we show that IND-PCA secure key encapsulation mechanism (KEM) is enough for PAKE, which is weaker and easier to be constructed than IND-CCA secure encryption. Our refined PAKE consists of a smooth projective hash function on IND-CPA secure encryption and an IND-PCA secure KEM. Based on DDH assumption, the total communication of PAKE consists of 6 group elements …

Genomic Security (Lest We Forget), Tatiana Bradley, Xuhua Ding, Gene Tsudik

Research Collection School Of Computing and Information Systems

Genomic privacy has attracted much attention from the research community, because its risks are unique and breaches can lead to terrifying leakage of sensitive information. The less-explored topic of genomic security must address threats of digitized genomes being altered, which can have dire consequences in medical or legal settings.

Ua8 It Security Bulletin, Wku Information Technology

WKU Administration Documents

WKU Information Technology security bulletin issued to faculty & staff via email.

• Ciampa, Mark. Ransomware
• Securing the Human
• New to WKU?
• Phone Scams
• Phishing
• SMiShing
• Handling Sensitive Data
• University Policy

Forensic State Acquisition From Internet Of Things (Fsaiot): A General Framework And Practical Approach For Iot Forensics Through Iot Device State Acquisition, Christopher S. Meffert, Devon R. Clark, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

IoT device forensics is a difficult problem given that manufactured IoT devices are not standardized, many store little to no historical data, and are always connected; making them extremely volatile. The goal of this paper was to address these challenges by presenting a primary account for a general framework and practical approach we term Forensic State Acquisition from Internet of Things (FSAIoT). We argue that by leveraging the acquisition of the state of IoT devices (e.g. if an IoT lock is open or locked), it becomes possible to paint a clear picture of events that have occurred. To this end, …