Honest Users Research Articles

Fine-grained polynomial functional encryption

In this work, we present fine-grained secure polynomial functional encryption (PFE) for degree d≥1 over a field F: a ciphertext encrypts x∈Fn, a key is associated with a degree-d polynomial P and decryption recovers P(x)∈F. Fine-grained cryptographic primitives are secure against a resources bounded class of adversaries and computed by honest users with less resources than adversaries. In this paper, we construct the fine-grained PFE in these two fine-grained settings:(1) NC1 PFE: Based on the worst-case assumption NC1⊊⊕L/poly, we construct public-key polynomial functional encryption and achieve (i) selective simulation-based security and (ii) static function-hiding against adversary in NC1 where all honest algorithms are computable in AC0[2] and ciphertext sizes are O(n).(2) AC0 PFE: We construct a private-key polynomial functional encryption achieve unconditionally selective simulation-based security against adversary in AC0 where all honest algorithms are computable in AC0 and ciphertext sizes are O(n).

PACIFIC

To be useful and widely accepted, automated contact tracing schemes (also called exposure notification) need to solve two seemingly contradictory problems at the same time: they need to protect the anonymity of honest users while also preventing malicious users from creating false alarms. In this paper, we provide, for the first time, an exposure notification construction that guarantees the same levels of privacy and integrity as existing schemes but with a fully malicious database (notably similar to Auerbach et al. CT-RSA 2021) without special restrictions on the adversary. We construct a new definition so that we can formally prove our construction secure. Our definition ensures the following integrity guarantees: no malicious user can cause exposure warnings in two locations at the same time and that any uploaded exposure notifications must be recent and not previously uploaded. Our construction is efficient, requiring only a single message to be broadcast at contact time no matter how many recipients are nearby. To notify contacts of potential infection, an infected user uploads data with size linear in the number of notifications, similar to other schemes. Linear upload complexity is not trivial with our assumptions and guarantees (a naive scheme would be quadratic). This linear complexity is achieved with a new primitive: zero knowledge subset proofs over commitments which is used by our "no cloning" proof protocol. We also introduce another new primitive: set commitments on equivalence classes, which makes each step of our construction more efficient. Both of these new primitives are of independent interest.

MRFS: Mining Rating Fraud Subgraph in Bipartite Graph for Users and Products

Fraud in e-commerce fields (e.g., Amazon, Taobao, and so on) and social networks (e.g., Twitter and Weibo) has recently brought a very bad user experience. Rating fraud detection is an urgent issue for improving user experiences. However, existing methods have lots of limitations in some respects, because it is always very hard to acquire sufficient labeled data for fraud detection and detect new fraud patterns. Fortunately, the relationship for users rating (e.g., purchasing and following) products can be represented as a bipartite graph. So the problem of rating fraud detection can be transformed into the problem of abnormal subgraph detection in the bipartite graph. The major challenge of fraud detection is to distinguish fake rates from real user rates. In this article, we focus on mining rating fraud-connected subgraphs in a bipartite graph. The motivation for this work is fraud detection tasks, which can usually be formulated as mining a bipartite graph formed by source nodes (followers and users) and target nodes (followees and products) for malicious patterns. Now, smart fraudsters evade existing detection methods by buying a large pool of users and hijacking honest users, making them look “normal”-this behavior is called “ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">camouflage</i> .” Accordingly, we propose a fraud detection approach for mining rating fraud subgraph (MRFS), which addresses the problem from the intrinsic metric (e.g., fraudulence, badness and unreliability). The proposed MRFS mines the intrinsic characteristics of nodes and edges from node behavior information, which is an effective and scalable (linear on the input size) algorithm. A large number of comparative experimental results on real-world rating networks show that our proposed MRFS is efficient and universal.

A privacy-preserving publicly verifiable quantum random number generator

Verifying the quality of a random number generator involves performing computationally intensive statistical tests on large data sets commonly in the range of gigabytes. Limitations on computing power can restrict an end-user’s ability to perform such verification. There are also random number-based applications where an honest user needs to publicly demonstrate that the random bits they are using pass the statistical tests without the bits being revealed. Here, we report the implementation of an entanglement-based protocol that allows a third party to publicly perform statistical tests without compromising the privacy of the random bits.

Defending dominant cooperative probabilistic attack in CRNs by JS-divergence-based improved reputation algorithm

Rapid advances in wireless communication services has made limited spectrum resources increasingly scarce. One promising solution for enhancing spectrum utilization is cooperative spectrum sensing (CSS) in cognitive radio networks (CRNs). However CSS is vulnerable to Byzantine attack. Current researches show that Byzantine attack is easily defended for their fixed attack probability. In this context, we propose an improved attack model called the dominated cooperative probabilistic attack (DCPA) model in the actual situation, building upon the generalized collaborative probabilistic Byzantine attack model. This DCPA model contains auxiliary cooperative attackers (ACAs) who launch attacks and a dominant attacker (DA) who determines ACAs’ attack probability intervals based on their respective credibility. The DCPA model allows ACAs to flexibly launch attacks, without being identified by the traditional reputation defense algorithm, significantly compromising the sensing performance of CSS. To successfully resist the threat posed by the DCPA model to CSS, we propose a JS-divergence-based improved reputation algorithm that can distinguish honest users (HUs) from attackers. This algorithm analyzes two consecutive sensing reports to identify differences in sensing behavior between HUs and attackers. Through Python simulation analysis, we demonstrate that, compared to the generalized cooperative probabilistic attack (CPA) model and the attack-free CSS (AFC) model, the proposed DCPA model is more concealed and significantly more disruptive to the performance of traditional reputation defense algorithms. Furthermore, our approach greatly enhances the performance of CSS by promoting the participation of HUs and suppressing attackers during the final data fusion. And also compared with the PAM2 algorithm, the conventional voting rule (CVR) algorithm and the traditional reputation defense algorithm, our proposed algorithm improves the detection performance by at least 7%, 15% and 50%.

Secrecy Enhancement of relay cooperative NOMA network based on user behavior

From the perspective of information security, relays exhibit varying levels of trustworthiness when forwarding information. For screening and eliminating the malicious users of cooperative NOMA relay networks, a reputation-based algorithm is proposed, in which the user relays (URs) are categorized into three types based on their behaviors—malicious users, speculative users, and honest users. Meanwhile, in order to minimize information leakage at the relay, cooperative interference signals are transmitted by far user (FU) and near user (NU) via the uplink while the base station (BS) is also transmitting signals to the relay. This approach increases inter-user interference (IUI) to confuse the eavesdropping capability of the relay. To verify the superiority of the proposed scheme, an asymptotic lower bound expression for the ergodic secrecy rate (ESR) of the downlink is derived to characterize the secrecy performance of the proposed scheme. Furthermore, in the case of limited system power, a joint power allocation algorithm based on the golden section method is also proposed to further enhance the security performances of the system. The simulation results validate the accuracy of the derived analysis results and demonstrate that the proposed scheme has a significant improvement in the ESR compared with the traditional scheme.

Improved reputation evaluation for reliable federated learning on blockchain

AbstractWorker selection is critical to the success of federated learning, but issues such as inadequate incentives and poor‐quality data can negatively impact the process. The existing studies have used the multi‐weight subjective logic model, but it is vulnerable to malicious evaluation and unfair to newly added nodes. In this paper, the authors propose an improved reputation evaluation algorithm that allows evaluations from different sources to influence each other and reduce the impact of malicious comments. The authors’ approach effectively distinguishes between malicious and honest users and improves worker selection and collaboration in federated learning.

Verification of continuous-variable quantum memories

A proper quantum memory is argued to consist in a quantum channel which cannot be simulated with a measurement followed by classical information storage and a final state preparation, i.e. with an entanglement breaking (EB) channel. The verification of quantum memories (non-EB channels) is a task in which an honest user wants to test the quantum memory of an untrusted, remote provider. This task is inherently suited for the class of protocols with trusted quantum inputs, sometimes called measurement-device-independent (MDI) protocols. Here, we study the MDI certification of non-EB channels in continuous variable (CV) systems. We provide a simple witness based on adversarial metrology, and describe an experimentally friendly protocol that can be used to verify all non Gaussian incompatibility breaking quantum memories. Our results can be tested with current technology and can be applied to test other devices resulting in non-EB channels, such as CV quantum transducers and transmission lines.

Commitment Against Front-Running Attacks

We provide a game-theoretic analysis of the problem of front-running attacks. We use it to distinguish attacks from legitimate competition among honest users for having their transactions included earlier in the block. We also use it to introduce an intuitive notion of the severity of front-running attacks. We then study a simple commit-reveal protocol and discuss its properties. This protocol has costs because it requires two messages and imposes a delay. However, we show that it prevents the most severe front-running attacks while preserving legitimate competition between users, guaranteeing that the earliest transaction in a block belongs to the honest user who values it the most. When the protocol does not fully eliminate attacks, it nonetheless benefits honest users because it reduces competition among attackers (and overall expenditure by attackers). This paper was accepted by Joshua Gans, business strategy. Funding: The authors gratefully acknowledge the financial support of the Ethereum Foundation [Grant FY22-0840].

Availability evaluation of IoT systems with Byzantine fault-tolerance for mission-critical applications

Byzantine fault-tolerant (BFT) systems are able to maintain the availability and integrity of IoT systems, in the presence of failure of individual components, random data corruption or malicious attacks. Fault-tolerant systems in general are essential in assuring continuity of service for mission-critical applications. However, their implementation may be challenging and expensive. In this study, IoT Systems with BFT are considered. Analytical models and solutions are presented as well as a detailed analysis for the evaluation of the availability. BFT is particularly important for blockchain mechanisms, and in turn for IoT, since it can provide a secure, reliable and decentralized infrastructure for IoT devices to communicate and transact with each other. A continuous-time Markov chain is used to model the IoT systems with BFT where the breakdown and repair times follow exponential distributions, and the number of the Byzantine nodes in the network follows various distributions. The presented numerical findings demonstrate the relationship between the number of nodes in the system, the proportion of honest users, and the overall availability. Based on the model, it can be inferred that the correlation between the scale of the system (nodes) and network availability is non-linear. Additionally, results show that even for relatively small-size systems with 40 nodes, an average availability greater than 0.999 and an estimated downtime per year that is less than 9 h is possible.

Detecting malicious reviews and users affecting social reviewing systems: A survey

The proliferation of attacks on On-line Social Networks (OSNs) has imposed particular attention by providers and users. This has an even higher importance for Social Reviewing Systems (SRSs), where users can be strongly conditioned by means of malevolent reviews and behavior of fake or camouflage accounts. There is a rich literature on the use of strong authentication means, encryption or privacy-preserving schemes for OSNs and SRSs, but these mechanisms only represent a first defense line. Advanced attacks may be able to bypass such a defense and to successfully threaten the system and harm its users. Therefore, it is needed to embed a second defence line to peculiar attack scenarios of SRSs that take advantage of user dynamics occurring within social networks. This survey focuses on the issue and solutions to detect malicious reviews and users so as to exclude them from social networks, protect legitimate and honest users and keep the credibility of the protected SRS as high as possible. Therefore, we provide an evaluation of the main detection solutions for the mentioned specific attacks against SRSs in according to different metrics on several standard datasets.

Enhancing Sybil Detection via Social-Activity Networks: A Random Walk Approach

Detecting fake accounts (sybils) in online social networks (OSNs) is vital to protect OSN operators and their users from various malicious activities. Typical graph-based sybil detection (a mainstream methodology) assumes that sybils can make friends with only a limited (or small) number of honest users. However, recent evidences showed that this assumption does not hold in real-world OSNs, leading to low detection accuracy. To address this challenge, we explore users activities to assist sybil detection. We first develop the social and activity network (SAN), a two-layer hyper-graph that unifies users friendships and their activities, to fully utilize users activities. We also propose a more practical sybil attack model, where sybils can launch both friendship attacks and activity attacks. We then design Sybil SAN to detect sybils via coupling three random walk-based algorithms on the SAN, and prove the convergence of Sybil_SAN. We develop an efficient iterative algorithm to compute the detection metric for Sybil_SAN, and derive the number of rounds needed to guarantee the convergence. Extensive experiments on both synthetic and real-world datasets show that Sybil SAN is highly robust against sybil attacks, and can detect sybils accurately under practical scenarios, where current state-of-art sybil defenses have low accuracy.

The principle of operation of a decentralized money transfer information system

The article is devoted to reviewing the concept of blockchain in the implementation of a decentralized money transfer system. The concept of fault tolerance of cryptocurrency technology is considered and some aspects of the fault tolerance solution are given. The analysis of information security of enterprises was carried out. The questions of anonymity of banking systems are touched upon. The dependence of the anonymity of the banking system on the quality of the software and on the security policy is shown. Recommendations are given for solving the problem of anonymity, in particular, generating a private key or embedding an algorithm for connecting transactions. Approaches to creating transactions are considered. Examples of algorithms that allow protecting user transactions are given. The description of the blockchain structure and the consensus algorithm has been carried out. The issues of generating a chain of blocks of an honest user and a chain of blocks of an attacker are considered. Formalization of the estimate of the probability of transaction break-even has been carried out. Binomial random walk was used for estimation. The end of the transaction process is just as justified as waiting for new blocks to be added to the chain of an honest user. A digital signature is used to identify whether a transaction belongs to a public key. The processes of signing a transaction and verifying a signature are considered. Separately, the approaches used in the design of cryptocurrencies are highlighted. The network stores the entire history of transactions, it is possible to calculate the balance of the total amount of incoming funds and spending money. These approaches are software solutions based on game theory and cryptography. The main attention is drawn to the business values of cryptocurrencies and ways to achieve them. As a result, the necessary functionality of the software client is formulated. The article provides a thorough analysis of a new financial and settlement instrument - electronic money. The task of developing a virtual payment system has recently received much attention.

A Secure EMR Sharing System With Tamper Resistance and Expressive Access Control

To reduce the cost of human and material resources and improve the collaborations among medical systems, research laboratories and insurance companies for healthcare researches and commercial activities, electronic medical records (EMRs) have been proposed to shift from paperwork to friendly shareable electronic records. To take advantage of EMRs efficiently and reduce the cost of local storage, EMRs are usually outsourced to the remote cloud for sharing medical data with authorized users. However, cloud service providers are untrustworthy. In this paper, we propose an efficient, secure, and flexible EMR sharing system by introducing a novel cryptosystem called dual-policy revocable attribute-based encryption and tamper resistance blockchain technology. Our proposed system enables EMRs to be shared at a fine-grained level and allows data users to detect any unauthorized manipulation. Moreover, the key generation center can revoke malicious users without affecting the honest users. We provide the formal security model as well as the concrete scheme with security analysis. The experimental simulation and experimental analysis of our proposed scheme demonstrate that our proposed system has superior performances to the most relevant solutions.

DALock: Password Distribution-Aware Throttling

Large-scale online password guessing attacks are widespread and pose a persistant privacy and security threat to users. The common method for mitigating the risk of online cracking is to lock out the user after a fixed number (K) of consecutive incorrect login attempts. Selecting the value of K induces a classic security-usability trade-off. When K is too large, a hacker can (quickly) break into a significant fraction of user accounts, but when K is too low, we will start to annoy honest users by locking them out after a few mistakes. Motivated by the observation that honest user mistakes typically look quite different from an online attacker’s password guesses, we introduce DALock, a distribution-aware password lockout mechanism to reduce user annoyance while minimizing user risk. As the name suggests, DALock is designed to be aware of the frequency and popularity of the password used for login attacks. At the same time, standard throttling mechanisms (e.g., K-strikes) are oblivious to the password distribution. In particular, DALock maintains an extra “hit count" in addition to “strike count" for each user, which is based on (estimates of) the cumulative probability of all login attempts for that particular account. We empirically evaluate DALock with an extensive battery of simulations using real-world password datasets. In comparison with the traditional K-strikes mechanism, our simulations indicate that DALock offers a superior simulated security/usability trade-off. For example, in one of our simulations, we are able to reduce the success rate of an attacker to 0.05% (compared to 1% for the 3strikes mechanism) whilst simultaneously reducing the unwanted lockout rate for accounts that are not under attack to just 0.08% (compared to 4% for the 3-strikes mechanism).

Mitigation of spectrum sensing data falsification attack using multilayer perception in cognitive radio networks

&lt;p&gt;Cognitive radio network (CRN) is used to solve spectrum scarcity and low spectrum utilization problems in wireless communication systems. Spectrum sensing is a vital process in CRNs, which needs continuous measurement of energy. It enables the sensors to sense the primary signal. Cooperative Spectrum Sensing (CSS) has recommended to sense spectrum accurately and to enhance detection performance. However, Spectrum Sensing Data Falsification (SSDF) attack being launched by malicious users can lead to wrong global decision on the availability of spectrum. It is an extremely challenging task to alleviate impact of SSDF attack. Over the years, numerous strategies have been proposed to mitigate SSDF attack ranging from statistical to machine learning models. Energy measurement through statistical models is based on some predefined criteria. On the other hand, machine learning models have low sensing performance. Therefore, it is necessary to develop an efficient method to mitigate the negative impact of SSDF attack. This paper intends to propose a Multilayer Perceptron (MLP) classifier to identify falsified data in CSS to prevent SSDF attack. The statistical features of the received signals are measured and taken as feature vectors to be trained by MLP. In this manner, measurement of these statistical features using MLP becomes a key task in cognitive radio networks. Trained network is employed to differentiate malicious users signal from honest users’ signal. The network is trained with the Levenberg-Marquart algorithm and then employed for eliminating the effect of attacks due to the SSDF process. Once the simulated results are observed, it can be revealed that the proposed model could efficiently reduce the impact of malicious users in CRN.&lt;/p&gt;

Garou: An Efficient and Secure Off-Blockchain Multi-Party Payment Hub

To mitigate the scalability problem of decentralized cryptocurrencies such as Bitcoin and Ethereum, the payment channel, which allows two parties to perform secure coin transfers without involving the blockchain, has been proposed. The payment channel increases the transaction throughput of two parties to a level that is only limited by their network bandwidth. Recent proposals focus on extending the two-party payment channel to the N-party payment hub. Unfortunately, none of them can achieve efficiency, flexibility in the absence of a trusted third-party. In this paper, we propose Garou, a secure N-party payment hub that allows multiple parties to perform secure off-chain coin transfers. Except in the case of disputes, participants within the payment hub can make concurrent and direct coin transfers with each other without the involvement of the blockchain or any third-party intermediaries. This allows Garou to achieve both high-performance and flexibility. If all participants keep online, Garou guarantees all honest users’ balance security against strong adversarial capabilities. To demonstrate the feasibility of the Garou protocol, we develop a proof of concept prototype for the Ethereum network. Experimental evaluations show that, with 300 participants and without disputes, that the maximum transaction throughput of Garou is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$20{ \times }$ </tex-math></inline-formula> higher than that of state-of-the-art payment hubs.

An Authentication Based Approach for Prevention of Spectrum Sensing Data Falsification Attacks in Cognitive Radio Network

This is the era of Intelligent Cognitive Radio Network (CRN) technology that provides the available spectrum with efficient utilization. Cognitive Radio (CR) technology must promise to allow interference-free spectrum access by users. The paper discusses the several attacks and motives of attacks. The authentication mechanism role to prevent the attacks for hassle-free spectrum utilization is demonstrated. In this paper, resolving the cognitive network security issues by the authentication mechanism and the methods and need of authentication is discussed. This paper addresses the research challenges in the way of securing the CRN and countermeasures in CRN security strategies. Spectrum sensing data falsification (SSDF) attack is most disruptive in which the malicious users degrade the decision-making process by sending the false sensing reports to data fusion center’s thus preventing honest users from utilizing the spectrum. In this paper, to counter the SSDF attack, the trust-based security mechanism is demonstrated to authenticate the honest users and it is observed that the proposed framework in the MATLAB environment is efficient and able to detect malicious users. CR technology is the strategy applied to the spectrum to make it efficient for wireless communication. The strategy is an intelligent way to access the spectrum as it can learn its environment and make decisions by easy adaptation of operating parameters. The initial step is to sense the spectrum available further steps are spectrum decision making, spectrum management, and spectrum mobility. The network is vulnerable to various attacks on spectrum sensing and policy protocols which lead to disturbing functionality of CR technology. The defence mechanism based on public-key cryptography is proposed in which the Primary User (PU) is authenticated by appending signature provided to PU signal. Authentication with a tag to the primary users is another perspective proposed. CRN technology should provide integrity, confidentiality and authenticity to the users.

Data fusion and transfer learning empowered granular trust evaluation for Internet of Things

In the Internet of Things (IoT), a huge amount of valuable data is generated by various IoT applications. As the IoT technologies become more complex, the attack methods are more diversified and can cause serious damages. Thus, establishing a secure IoT network based on user trust evaluation to defend against security threats and ensure the reliability of data source of collected data have become urgent issues, in this paper, a Data Fusion and transfer learning empowered granular Trust Evaluation mechanism (DFTE) is proposed to address the above challenges. Specifically, to meet the granularity demands of trust evaluation, time–space empowered fine/coarse grained trust evaluation models are built utilizing deep transfer learning algorithms based on data fusion. Moreover, to prevent privacy leakage and task sabotage, a dynamic reward and punishment mechanism is developed to encourage honest users by dynamically adjusting the scale of reward or punishment and accurately evaluating users’ trusts. The extensive experiments show that: (i) the proposed DFTE achieves high accuracy of trust evaluation under different granular demands through efficient data fusion; (ii) DFTE performs excellently in participation rate and data reliability.

Group authentication for cloud-to-things computing: Review and improvement

Group authentication enables a set of users to mutually authenticate each other without the help of a coordinating manager, which has proven effective for the new framework of cloud-to-things computing. Recently many group authentication schemes have been proposed using threshold secret sharing technique. In this article we review these schemes and show that some of group authentication schemes based on secret sharing are insecure. Specifically we develop an impersonation attack against such schemes. This attack allows an outsider with no credential to successfully authenticate herself to a group of users. The idea behind our attack is quite simple: in the threshold setting, when the size of the group is larger than the threshold an outsider can compute a linear combination of honest users’ tokens which validates her identity though she is actually not a registered member in the group. Finally we propose three types of security enhancement to fix the vulnerability. Our improved group authentication schemes avoid the above attack by breaking the linearity of threshold secret sharing, using the technique of signature, splitting communication and commitment scheme.