Encryption Research Articles

Blockchain-based semi-autonomous ransomware

Blockchain’s benefits and advantages have been extensively studied in literature, but far fewer works can be found on the dishonest uses of them. In this paper, we present the first blockchain-based ransomware schemes, which use smart contracts and simple cryptographic primitives to provide a limited degree of automation and fair exchange. Specifically, the use of smart contracts would enable new capabilities for ransomware, such as the possibility of paying for individual files or the refund of the ransom to the victim if the decryption keys are not received within a specified period of time. To demonstrate their feasibility, both technically and economically, these proposals have been implemented in the Ethereum Ropsten test network. The results show that running a full ransomware campaign similar to WannaCry, with more than 300,000 affected users, would have an additional cost of only 3 cents of a dollar per victim. Finally, we show that there are no feasible countermeasures if these schemes are implemented in public blockchains. Therefore, we firmly believe that it is increasingly urgent to recognize and study this matter, in order to create new policies and technical countermeasures.

A Traceable and Revocable Ciphertext-Policy Attribute-based Encryption Scheme Based on Privacy Protection

Considered as a promising fine-grained access control mechanism for data sharing without a centralized trusted third-party, the access policy in a plaintext form may reveal sensitive information in the traditional CP-ABE method. To address this issue, a hidden policy needs to be applied to the CP-ABE scheme, as the identity of a user cannot be accurately confirmed when the decryption key is leaked, so the malicious user is traced and revoked as demanded. In this article, a CP-ABE scheme that realizes revocation, white-box traceability, and the application of hidden policy is proposed, and such ciphertext is composed of two parts. One is related to the access policy encrypted by the attribute value, and only the attribute name is evident in the access policy. Another is related to the revocation information and updated when revoking, where the revocation information is generated by the binary tree related to users. The leaf node value of a binary tree in the decryption key is used to trace the malicious user. From experimental results, it is shown that the proposed scheme is proven to be IND-CPA secure under the chosen plaintext attacks and selective access policy based on the decisional q-BDHE assumption in the standard model, efficient, and promising.

Controllable synthesis of CsxPbyBrz-based perovskites by a polar solvent-triggered transformation method and its application as an invisible security ink

Recently, all-inorganic CsPbX3 (X = Cl, Br, I) perovskites have become one of the most promising candidates for photoelectronic and photovoltaic applications. Herein, we report the controllable synthesis of CsxPbyBrz-based perovskites by a simple polar solvent-triggered (H2O, CH3OH) chemical transformation method. The phase of CsxPbyBrz-based perovskites can be successfully converted from Cs4PbBr6 to CsPbBr3 by using H2O as a polar solvent and from CsPbBr3 to CsPb2Br5 by using CH3OH as a polar solvent, and this method can also be applied to synthesize Cs4PbBr6/CsPbBr3 and CsPbBr3/CsPb2Br5 composites by controlling parameters of transformation process. Moreover, a novel kind of encryption and decryption technology is developed based on the characteristics that the white Cs4PbBr6 reacts with H2O to rapidly produce yellow CsPbBr3, using the Cs4PbBr6 toluene solution as the invisible security ink and H2O as the decryption key. Our results present a controllable route to realize transformation from Cs4PbBr6 to CsPbBr3 and from CsPbBr3 to CsPb2Br5.

Hacia una teoría crítica de la razón algorítmica

El artículo parte de la revisión teórica de la literatura sobre los algoritmos para trazar los ejes clave de una teoría crítica. En la dicotomía entre la descripción del mundo, por medio de los macrodatos, y la prescripción de comportamientos preestablecidos una vez analizados los big data, la razón algorítmica puede dar lugar a sistemas cerrados de comunicación que simplifiquen y estandaricen nuestras prácticas. Conforme a una metodología ensayística y filosófica que vincula forma y contenido de la crítica, las dimensiones para una teoría reflexiva sobre los algoritmos se corresponden con tres vertientes fundamentales: a) la abstracción, el cifrado matemático y el cálculo, b) la pasividad inducida ante algoritmos performativos y c) el poder invisible e impersonal. En consecuencia, la principal aportación del artículo radica en la discusión de las constricciones que nacen al abrigo de las tecnologías algorítmicas. El énfasis en una teoría crítica de la tecnología se hace tanto más pertinente a medida que los dispositivos digitales se normalizan como intermediadores en diferentes campos de la actividad humana. Se trata, pues, de problematizar la tecnología como base de comportamientos cotidianos y decisiones, desde una perspectiva teórica. En este sentido, el artículo pretende continuar el enjuiciamiento de la tecnología de autores tales como los pertenecientes a la Escuela de Frankfurt o, en el campo específico de la tecnología, Lewis Mumford y Jacques Ellul, así como críticos actuales del digitalismo, tales como Cathy O’neil, Evgeny Morozov o Nicholas Carr.

An Identity-Based Elliptic Curve Cryptography for Mobile Payment Security

Security breaches have been observed in different dimensions in mobile payment system. The violation of user’s privacy is a common phenomenon in mobile payment transactions. This study presents an improved security scheme for a mobile payment system using elliptic curve cryptography over a binary field with International Mobile Equipment Identity to ensure higher security. The scheme uses a payment gateway for registration and maps all input text to elliptic curve points using ASCII values. Payment details are stored on the gateway, which is encrypted but decrypted only with merchant’s decryption key. The proposed scheme was evaluated in terms of key size, security strength, computational power, memory capacity, encryption and decryption time and mobile phone battery. The result shows that the scheme provides integrity, confidentiality and privacy. The result also shows that the proposed scheme is time-efficient and computationally inexpensive for resource-constrained environment like mobile payment system.

Attacking Key Management in Ransomware

Ransomware have observed a steady growth over the years with several concerning trends that indicate efficient, targeted attacks against organizations and individuals alike. These opportunistic attackers indiscriminately target both public and private sector entities to maximize gain. In this article, we highlight the criticality of key management in ransomware's cryptosystem in order to facilitate building effective solutions against this threat. We introduce the ransomware kill chain to elucidate the path our adversaries must take to attain their malicious objective. We examine current solutions presented against ransomware in light of this kill chain and specify which constraints on ransomware are being violated by the existing solutions. Finally, we present the notion of memory attacks against ransomware's key management and present our initial experiments with dynamically extracting decryption keys from real-world ransomware. Results of our preliminary research are promising and the extracted keys were successfully deployed in subsequent data decryption.

A cryptographic algorithm using wavelet transforms over max-plus algebra

Cryptography has a role to secure an important information. Until now, many varieties of cryptographic algorithms are available in the literature. In this paper, we propose a cryptographic algorithm based on Type IVa max-plus wavelet transforms (MP-Wavelets). Encryption and decryption algorithms are constructed based on the analysis and synthesis process of Type IVa MP-Wavelets, respectively. The encryption key contains the number of channels in all levels. The encryption key is chosen such that multiplication of the number of channels in all levels is greater than or equal to the number of characters in the Plaintext. The decryption key consists of the encryption key and a sequence generated by the binary encoding of detail components. This guarantees that the decryption key is very difficult to obtain using the brute-force method. The cryptographic process involves only maximization and addition operations as main operations. The experiments and analysis show that the algorithm is a good cryptographic algorithm based on the correlation between Plaintext and Ciphertext, encryption quality, the decryption key space, cryptanalysis (Ciphertext-only attack) and security analysis (entropy analysis, key sensitivity, Plaintext sensitivity). This algorithm is also efficient in the running time, because the complexity is linear w.r.t.the number of characters in the Plaintext.

Optical encryption and authentication scheme based on phase-shifting interferometry in a joint transform correlator

In this paper, the effectiveness of the cryptosystem based on phase-shifting technique (PST) in a joint transform correlator (JTC) is evaluated. It is shown that the cryptosystem has some inherent drawbacks, for example, since the plaintexts are required to obtain the phase-shifting intensity patterns in the first phase extraction step, which means that the information of the plaintexts should be known by the authorized users before decryption processing. It seems impossible and paradoxical in the practical case. Moreover, the cryptosystem can only achieve binary plaintexts encryption while the inputs of this scheme cannot be the gray-scale or color images. To address these issues, we propose an encryption and authentication scheme based on PST in a JTC. By introducing a pre-processing operation including an intensity modulator based on histogram equalization and photon-counting (PC) operator, a photon-limited binary distribution of the plaintexts is obtained and used as the input of the cryptosystem. Due to this design, our proposed scheme can achieve encryption for different kinds of images such as binary, gray-scale and color images using same optical setup without any changes, which can simplify the optical implementation. Furthermore, a post-processing operator to extract phase information of encoded images and authenticate the decoded images is introduced. Since no useful information will be released from the photon-limited binary decoded images obtained using correct decryption keys and the interface of the database storing the plaintexts is only given to the authorized users, an additional security layer is established. This is the first time to report the use of binary intensity pattern in a scheme based on PSI in a JTC for secured verification of different images.

A superposition based multiple-image encryption using Fresnel-Domain high dimension chaotic phase encoding

A new superposition based multiple-image encryption using Fresnel-domain high dimension chaotic phase encoding is proposed. In this method, each color image of an authenticated user is decomposed into R, G, and B channels. The amplitude of each channel is independently normalized, phase encoded and then modulated by corresponding high-dimension chaotic random phase mask (HDCPM). The modulated R, G, and B channels of multiple color images are individually added and Fresnel transformed to produce corresponding encrypted channels. All the parameters (initial values and control parameters) of HDCPM are exploited as remarkably sensitive decryption keys of the proposed system. Moreover, the update, management, and transmission of the decryption keys are convenient. The individual decryption keys of R, G, and B channels significantly increase the resistance to various types of attacks. The proposed cryptosystem can be executed by using a hybrid optoelectronic system. Numerical simulation results demonstrate the viability and effectiveness of the proposed scheme.

CCA-Secure and Revocable Certificateless Encryption with Ciphertext Evolution

Certificateless cryptosystems have attracted great interests in cryptographic research since its invention. Because compared with traditional public key cryptosystems or identity-based cryptosystems, they could not only simplify the certificate management, but also alleviate the key escrow problem. In certificateless cryptosystems, user revocation is a challenging issue. To address this issue, one popular method is to update the key via public channels. However, most of the existing schemes in this approach are impractical because of the following two shortcomings. Firstly, the user needs to maintain a list of decryption keys, but the size of the list will keep increasing. Secondly, the revoked user can still recover the plaintexts of the encrypted data prior to revocation, and this is a particular threat in some applications. To solve these problems, this paper presents revocable certificateless encryption with ciphertext evolution. We give a generic construction and then describe how it can be initialized concretely. In our proposed scheme, the user only needs to keep one decryption key, and once a user is revoked, it can no longer decrypt any ciphertext in the server. Moreover, the IND-CCA security model is defined against three types of attacks. And our schemes are formally proved to satisfy these security requirements.

Energy Efficient Virtual Fixed Number System on Mobile Devices

Kullanıcı alışkanlıklarının mobil cihazlara doğru değişmesi, mobil cihaz yaygınlığının artması ve giderek daha da yaygınlaşması, sabit telefon hizmetlerinin (telefon ve faks) yanı sıra, SMS hizmetinin mobil kullanımı ile farklı bir boyut kazanarak mevcut sabit telefon operatörleri için yeni bir yaklaşım sergilemiştir. Skype ve Whatsapp gibi birçok firmanın benzer özellikte ürün olmasına rağmen, uluslararası geçerli bir numara ile telekom sistemlerine bağlanarak kullanım sunmak internet üzeri yazılı ve sesli iletişim sağlayan önceki saydığımız firmalarda olmayan bir özellik olup, kullanım açısından özellikle kurumsal kullanımlarda fark yaratmaktadır. Kurumsal sabit numara kurumun kimliğinin bir parçasıdır. Bu numara üzerinden çağrı yapmak ve gelen çağrıları almak müşterilerle iletişimde güven sağlar. Bu nedenle özellikle küçük ve orta ölçekli firmalarda, firma çalışanı seyahatte iken kurumsal numara çağrısının o kişiye yönlendirilmesi zor ve ciddi bir maliyet oluşturmaktadır. Bu problemi çözmek için sanal sabit hat uygulamaları geliştirilmektedir. Bu yayın kapsamında mobil cihazlarda sabit telefon özelliklerinin kullanılması, bellek, batarya ve ses kalitesi yönetimi, şifreleme entegrasyonu açısından uluslararası kapsamda özgün çıktıları olan yaklaşımlarla oluşturulmuş mobil cihazlar üzerinde sanal sabit numara sistemi sunulmuştur.

Practical traceable multi-authority CP-ABE with outsourcing decryption and access policy updation

Multi-authority ciphertext policy attribute-based encryption (CP-ABE) is one of the promising approaches where multiple authorities issue and manage various attributes to achieve fine-grained access control on stored data in cloud platforms. However, the practical use of multi-authority CP-ABE (MCP-ABE) requires satisfaction of different features. Firstly, in MCP-ABE, users having the same set of attributes must share the same decryption privileges. This may potentially lead to exposure of decryption keys by some malicious users. Thus, there is a need of designing MCP-ABE with traceability to overcome this problem. Secondly, as the cost of decryption increases with the complexity of access policy, it is preferred to provide the functionality of outsourcing decryption to reduce the computational burden on the user. Finally, the data owners must have flexibility to change the access policy. Hence, policy updation must be an integral part of MCP-ABE scheme. In this paper, we construct a new multi-authority CP-ABE scheme over large attribute universe with decentralization of authorities that supports white-box traceability along with policy updation and outsourcing decryption. Our proposed cryptosystem is built on prime order groups and supports monotonic access structures. These features improve efficiency and expressiveness of our system. We implemented our proposed cryptosystem in Charm cryptographic framework and analyzed its performance with a diverse set of test cases.

Key regeneration-free ciphertext-policy attribute-based encryption and its application

Attribute-based encryption (ABE) provides a promising solution for enabling scalable access control over encrypted data stored in the untrusted servers (e.g., cloud) due to its ability to perform data encryption and decryption defined over descriptive attributes. In order to bind different components which correspond to different attributes in a user’s attribute-based decryption key together, key randomization technique has been applied in most existing ABE schemes. This randomization method, however, also empowers a user the capability of regenerating a newly randomized decryption key over a subset of the attributes associated with the original decryption key. Because key randomization breaks the linkage between this newly generated key and the original key, a malicious user could leak the new decryption key to others without taking any responsibility for the key abuse. To solve this problem, we think of key regeneration-free ABE to disallow a user from randomizing his/her decryption key in any manner, i.e., a user can only delegate his/her decryption key in exactly the same form without any modification so that any abused or pirated key can be traced back to its original owner. Motivated by strongly unforgeable signature, we first define a security notion called strong key unforgeability, and show that ABE schemes equipped with the strong key unforgeability are immune to key regeneration. We then provide a generic transformation to convert ciphertext-policy ABE (CP-ABE) schemes of certain type to key regeneration-free CP-ABE schemes, and show how the transformation works by presenting two concrete constructions.

Parallel Key Insulated ID-Based Public Key Cryptographic Primitive with Outsourced Equality Test

Parallel key-insulation allows the use of multiple helper keys to protect private decryption keys during secret decryption key updates. This approach prevents decryption key leakage or exposure in insecure environment. We combined parallel key-insulated encryption (PKIE) with multiple helper keys and identity-based encryption with the equality test (IBE-ET) to obtain parallel key insulated ID-based public key encryption with outsourced equivalent test (PKI-IBPKE-ET). The scheme inherits the advantages of identity-based encryption (IBE), which simplifies certificate management for public key encryption. Furthermore, the parallel key-insulation with multiple helper mechanism was introduced in our scheme, which perfectly reduced the possibility of helper key exposure. Our scheme will enable the protection and periodic update of decryption keys in insecure environment. Our scheme achieves a weak indistinguishable identity chosen ciphertext (W-IND-ID-CCA) security in the random oracle model. Ultimately, it is observed that our scheme is feasible and practical through the experimental simulation and theoretical analysis.

A malicious activity monitoring mechanism to detect and prevent ransomware

In this digital world, security is the primary concern for users concerned about unauthorised access to their computer systems. At the same time, ransomware – a tool used by cyber criminals to encrypt the contents of a computer's file system without the permission or knowledge of the victim – is becoming increasingly common. Once the system is compromised – that is, the files are encrypted – the attacker forces users to pay a ransom, typically through online payment methods, to get a decryption key. Even if victims pay the ransom, there is no guarantee that the decryption key will be supplied, or access to their computer system restored.

Plaintext checkable encryption with check delegation revisited

Plaintext checkable encryption with check delegation revisited

Efficient Hybrid Cryptography Algorithm

Cryptography is the operation of transferring a specific message to prevent an attacker from accessing the contents of a message. To increase the level of security in any communication, both parties must have a copy of the encryption key. The Data Encryption Standard algorithm is insufficient due to its weak key generation, so that the key must be reconfigured to make this algorithm more secure, effective, and stronger. The key for encryption enhances securities of the Data Encryption Standard algorithm. This research assumed a combination of two efficient encryption algorithms to achieve the goal of information security by adding a new level of security to the Data Encryption Standard algorithm using the elliptic curve cryptography algorithm. This aim was met by adding two new key functions; the first one is EncK(), and the second one is DecK() for an encryption and decryption key of the Data Encryption Standard algorithm to make this algorithm more secure against attackers. The results obtained from this research also demonstrate good resistance against a brute-force attack, which makes the system more effective by applying the elliptic curve cryptography algorithm to encrypt and decrypt keys using the Data Encryption Standard. In addition, these modifications enhance the degree of complexity, increase key search space, and make the ciphered message more difficult for an attacker to crack.

A novel encryption algorithm for unstructured big data in wireless communication network

In order to improve the confidentiality and security of transmission through data encryption, a novel encryption algorithm for unstructured big data in wireless communication network is proposed. In this algorithm, an encryption scheme of homomorphic public key is adopted to establish encryption key of unstructured big data, and an elliptic curve homomorphic encryption scheme is also adopted to design public key random number; the integral multiple bit length is adaptively adjusted to fixed-numbered public keys at different block lengths, and the random sampling method is adopted to extract features of encryption bit sequence, on which cyclic shift encryption is performed; encryption key and decryption key are established, and information entropy is adopted as a key sensitivity parameter concerning big data encryption to perform source coding to realise code element frequency detection of encryption output of unstructured big data, on which key padding is performed to optimise data encryption. Simulation results show that in unstructured big data encryption in wireless communication network, the proposed method can provide good confidentiality and steganography and relatively strong anti-attack capability.

Secure encryption algorithms for wireless sensor networks based on node trust value

The data transmission in the wireless sensor network is affected by the forwarding randomness of the relay node, resulting in poor security encryption performance. In order to improve the security encryption capability of wireless sensor network, a wireless sensor network security encryption algorithm based on node trust value is proposed. The linear coding design of sensor network transmission data is carried out according to the trust degree and the composite chaotic model is used for recursive analysis of vector quantisation in wireless sensor network encryption process and then the linear block code design of encryption key and decryption key is realised. The regression analysis results of node trust value are used to realise wireless sensor network security encryption. Simulation results show that the security of wireless sensor network encryption used proposed method is better, the distortion of encrypted transmission is lower and the performance is better.

Ciphertext-Policy Hierarchical Attribute-Based Encryption Against Key-Delegation Abuse for IoT-Connected Healthcare System

With the maturity of technologies such as Internet of Things (IoT) and Cloud Computing, more and more medical institutions share patient’s medical data in the IoT-connected healthcare system, whereas it also brings hidden dangers to data security and privacy protection. The application of Hierarchical Attribute-Based Encryption (HABE) in IoT-connected healthcare system helps to solve the problem of data sharing with a large number of users. Delegation is a function of HABE, which can realize the transfer of hierarchical user access rights, effectively reducing the workload of the trusted authority. However, when “delegation” is used to generate decryption keys for users who do not comply with the access structure, the “key-delegation abuse” problem arises, which can seriously damage the privacy of patient’s data. Nevertheless, it has not attracted much attention in previous research. This paper proposes the problem of key-delegation abuse in Ciphertext-Policy Hierarchical Attribute-Based Encryption (CP-HABE). After the cryptanalysis of typical schemes, we conclude two reasons for key-delegation abuse in CP-HABE, which are randomizing the original key elements or keeping parts of them in a new decryption key. This paper proposes a new mechanism specifically by using directed graph and construct a CP-HABE scheme against key-delegation abuse (CP-HABE-AKDA). Aiming at the scenario of key leaking, we further present the traceable CP-HABE-AKDA solution for the IoT-connected healthcare system, which has the additional function of tracking and verifying the identity of key leaker.