Information Security Commons^™

Editorial: Trust Management For Multimedia Big Data, Zheng Yan, Jun Liu, Deng, Robert H., Francisco Herrera

Research Collection School Of Computing and Information Systems

No abstract provided.

An Efficient Privacy-Preserving Outsourced Calculation Toolkit With Multiple Keys, Ximeng Liu, Robert H. Deng, Kim-Kwang Raymond Choo, Jian Weng

Research Collection School Of Computing and Information Systems

In this paper, we propose a toolkit for efficient and privacy-preserving outsourced calculation under multiple encrypted keys (EPOM). Using EPOM, a large scale of users can securely outsource their data to a cloud server for storage. Moreover, encrypted data belonging to multiple users can be processed without compromising on the security of the individual user's (original) data and the final computed results. To reduce the associated key management cost and private key exposure risk in EPOM, we present a distributed two-trapdoor public-key cryptosystem, the core cryptographic primitive. We also present the toolkit to ensure that the commonly used integer operations …

Ownership-Hidden Group-Oriented Proofs Of Storage From Pre-Homomorphic Signatures, Yujue Wang, Qianhong Wu, Bo Qin, Xiaofeng Chen, Xinyi Huang, Jungang Lou

Research Collection School Of Computing and Information Systems

In this paper, we study the problem of secure cloud storage in a multi-user setting such that the ownership of outsourced files can be hidden against the cloud server. There is a group manager for initiating the system, who is also responsible for issuing private keys for the involved group members. All authorized members are able to outsource files to the group’s storage account at some cloud server. Although the ownership of outsourced file is preserved against the cloud server, the group manager could trace the true identity of any suspicious file for liability investigation. To address this issue, we …

One-Round Attribute-Based Key Exchange In The Multi-Party Setting, Yangguang Tian, Guomin Yang, Yi Mu, Kaitai Liang, Yong Yu

Research Collection School Of Computing and Information Systems

Attribute-based authenticated key exchange (AB-AKE) is a useful primitive that allows a group of users to establish a shared secret key and at the same time enables fine-grained access control. A straightforward approach to design an AB-AKE protocol is to extend a key exchange protocol using attribute-based authentication technique. However, insider security is a challenge security issue for AB-AKE in the multi-party setting and cannot be solved using the straightforward approach. In addition, many existing key exchange protocols for the multi-party setting (e.g., the well-known Burmester-Desmedt protocol) require multiple broadcast rounds to complete the protocol. In this paper, we propose …

Achieving Ind-Cca Security For Functional Encryption For Inner Products, Shiwei Zhang, Yi Mu, Guomin Yang

Research Collection School Of Computing and Information Systems

Functional encryption allows the authorised parties to reveal partial information of the plaintext hidden in a ciphertext while in conventional encryption decryption is all-or-nothing. Focusing on the functionality of inner product evaluation (i.e. given vectors xxxx and yyyy, calculate ⟨xx,yy⟩⟨xx,yy⟩), Abdalla et al. (PKC 2015) proposed a functional encryption scheme for inner product functionality (FE-IP) with s-IND-CPA security. In some recent works by Abdalla et al. (eprint: Report 2016/11) and Agrawal et al. (CRYPTO 2016), IND-CPA secure FE-IP schemes have also been proposed. In order to achieve Indistinguishable under Chosen Ciphertext Attacks (IND-CCA security) for FE-IP, in this paper, we …

Virtual Values For Taint And Information Flow Analysis, Prakasam Kannan, Thomas Austin, Mark Stamp, Tim Disney, Cormac Flanagan

Faculty Publications, Computer Science

Security controls such as taint analysis and information flow analysis can be powerful tools to protect against many common attacks. However, incorporating these controls into a language such as JavaScript is challenging. Native implementations require the support of all JavaScript VMs. Code rewriting requires developers to reason about the entire abstract syntax of JavaScript. In this paper, we demonstrate how virtual values may be used to more easily integrate these security controls. Virtual values provide hooks to alter the behavior of primitive operations, allowing programmers to create the desired security controls in a more declarative fashion, facilitating more rapid prototyping. …

A Method For Revealing And Addressing Security Vulnerabilities In Cyber-Physical Systems By Modeling Malicious Agent Interactions With Formal Verification, Dean C. Wardell, Robert F. Mills, Gilbert L. Peterson, Mark E. Oxley

Faculty Publications

Several cyber-attacks on the cyber-physical systems (CPS) that monitor and control critical infrastructure were publically announced over the last few years. Almost without exception, the proposed security solutions focus on preventing unauthorized access to the industrial control systems (ICS) at various levels – the defense in depth approach. While useful, it does not address the problem of making the systems more capable of responding to the malicious actions of an attacker once they have gained access to the system. The first step in making an ICS more resilient to an attacker is identifying the cyber security vulnerabilities the attacker can …

Threats To Information Protection - Industry And Academic Perspectives: An Annotated Bibliography, Michael E. Whitman, Herbert J. Mattord

KSU Proceedings on Cybersecurity Education, Research and Practice

Threats to information assets have always been a concern to those responsible for making information useful and defending its value. The concepts of threat, threat agent, threat events and threat sources have evolved in recent years have very precise definitions. The article includes a summary of threat classification models used in academic research is provided along with a summary of recent industry threat assessment reports. Finally, the article shares results from a recent study, 2015 SEC/CISE Threats to Information Protection Report Including a Current Snapshot of the State of the Industry, are given.

The Implementation Of Information Systems In Network Administration: The Improvement Of Intranet Utilization In Higher Education Institutions, Besnik Skenderi, Murat Retkoceri, Rina Sadriu

UBT International Conference

Management Information systems or MIS broadly refers to a Computer system of Information that provides manager the tool to organize, Asses and manage efficiently departments within an organization.

Information System Management serves to assist in the more effective and efficient management of information. These systems make possible the production and preservation.

Nowadays the business, institutions and organization use MIS to certain functions or the entire organization. Some of the most important applicants are in dimensions or functions such as human resources, finance, marketing, manufacturing, asset management etc.

The primary definition shows that the primary task of management information system (MIS. …

The Importance Of Big Data Analytics, Eljona Proko

UBT International Conference

Identified as the tendency of IT, Big Data gained global attention. Advances in data analytics are changing the way businesses compete, enabling them to make faster and better decisions based on real-time analysis. Big Data introduces a new set of challenges. Three characteristics define Big Data: volume, variety, and velocity. Big Data requires tools and methods that can be applied to analyze and extract patterns from large-scale data. Companies generate enormous volumes of poly-structured data from Web, social network posts, sensors, mobile devices, emails, and many other sources. Companies need a cost-effective, massively scalable solution for capturing, storing, and analyzing …

Improving Business Networking Through The Effective Utilisation Of Information Systems, Ylber Limani

UBT International Conference

This Research addresses topics concerned with the enterprise models and information systems. The research is divided into two parts, in the first part is conducted the examination of business information systems in general, while in the second part the main factors of business networking are investigated.

The existing operational business practices and Information Technology infrastructure are not sufficiently used of efficiently sustain the effective business networking. A methodical analysis of the operational systems is performed in order to cover the main elements of the Information Systems and their utilisation for business needs. The implementation of a most important information business …

Traditional Mathematics And New Methods Of Teaching Through Programming Together With Students, Robert Kosova, Teuta Thanasi, Lindita Mukli, Loreta Nakuçi Pëllumbi

UBT International Conference

We are used to the traditional methods of teaching mathematics. The textbook, the blackboard and a chalk have been for centuries a wonderful part of teaching. And, they always will be. Traditional teaching methods of mathematics are a wonderful legacy of our educational system that have educated generations of teachers, engineers, administrators, managers, leaders, and economists. American universities websites, the video- lectures of the best professors of well-known disciplines such as statistics, operational research, number theory, algebra, game theory, show impressing large blackboards, all over the auditor's walls. We always will need and admire traditional mathematics. But, beyond the lessons, …

Cloud Computing And Enterprise Data Reliability, Luan Gashi

UBT International Conference

Cloud services offer many benefits from information and communication technology that to be credible must first be secured. To use the potential of cloud computing, data is transferred, processed and stored in the infrastructures of these service providers. This indicates that the owners of data, particularly enterprises, have puzzled when storing their data is done outside the scope of their control.

Research conducted on this topic show how this should be addressed unequivocally. The provided information on the organization of cloud computing models, services and standards, with a focus on security aspects in protecting enterprise data where emphasis shows how …

The Role Of Knowledge Management In The Information System, Sejdi Xhemaili

UBT International Conference

We are living in a world in which the knowledge is a precious commodity. The fast pace of the development of the companies both for trade and service require management of the acquired knowledge in the best possible way.

This paper would show the influence of the knowledge management in the information system that is what is achieved when knowledge management itself is applied to the information system. The accumulated knowledge in terms of innovation, management of the staff and its training, competitiveness on the wide market and improvement of the level of the business processes and performance tend to …

Some Propositions About Inverse Semigroups, Osman Hysa, Arben Reka

UBT International Conference

The inverse semigroups are semigroups studied by many algebraists. In this paper we will formulate and prove some other propositions on these semigroups. So we will prove two propositions concerning the closure of a subsemigroup of a given inverse semigroup S, within the meaning introduced by Schein in 1962, two propositions on the group congruence on a normal subsemigroup of the inverse semigroup S, and a proposition about closed subsemigroup assertion of an inverse semigroup S.

Some Issues In The Testing Of Computer Simulation Models, David J. Murray-Smith

UBT International Conference

The testing of simulation models has much in common with testing processes in other types of application involving software development. However, there are also important differences associated with the fact that simulation model testing involves two distinct aspects, which are known as verification and validation. Model validation is concerned with investigation of modelling errors and model limitations while verification involves checking that the simulation program is an accurate representation of the mathematical and logical structure of the underlying model. Success in model validation depends upon the availability of detailed information about all aspects of the system being modelled. It also …

Securing Mobile Applications Based On Ntru, Hanqing Zhao, Vikram Hegde, Kefeng Shi, Yi Yang

ASA Multidisciplinary Research Symposium

Modern mobile devices have an urgent need for a new-generation public-key cryptographic system, which should provide sufficient security for mobile devices without degrading their performance due to limited resources. NTRU is an ideal model for this. We validate it through experimental studies. We apply NTRU to protect an Android mobile app.

Designing Laboratories For Small Scale Digital Device Forensics, Richard P. Mislan, Tim Wedge

Annual ADFSL Conference on Digital Forensics, Security and Law

The ubiquity of small scale digital devices (SSDD), the public’s ever increasing societal dependence on SSDD, and the continual presence of SSDD at all types of crime scenes, including non-technical and violent crimes, demand a formalized curriculum for the education and training of future cyber forensic examiners. This paper presents the various SSDD forensics labs currently in use and under development for future use at the Purdue University Cyber Forensics Laboratory. The primary objective of each module is to provide specific real-world cases for the learning, comprehension, and understanding of hands-on investigative techniques and methodologies. The purpose of this paper …

Network Forensic Investigation Of Internal Misuse/Crime In Saudi Arabia: A Hacking Case, Abdulrazaq Al-Murjan, Konstantinos Xynos

Annual ADFSL Conference on Digital Forensics, Security and Law

There are ad-hoc guidelines and a limited policy on computer incident response that does not include computer forensic preparation procedures (e.g. logging incidents). In addition, these guidelines do not consider the requirement of Islamic law for admissible evidence at an organisational level in Saudi Arabia. Network forensic investigation might breach the Saudi law if they follow ad-hoc or international digital forensic standards such as Association of Chief Police Officers (ACPO) guidelines. This might put the organisation in a costly situation when a malicious employee sues an Islamic court. This is because the law of Saudi Arabia is complying with Islamic …

A Framework For Hybrid Intrusion Detection Systems, Robert N. Bronte

Master of Science in Information Technology Theses

Web application security is a definite threat to the world’s information technology infrastructure. The Open Web Application Security Project (OWASP), generally defines web application security violations as unauthorized or unintentional exposure, disclosure, or loss of personal information. These breaches occur without the company’s knowledge and it often takes a while before the web application attack is revealed to the public, specifically because the security violations are fixed. Due to the need to protect their reputation, organizations have begun researching solutions to these problems. The most widely accepted solution is the use of an Intrusion Detection System (IDS). Such systems currently …