Risk Of Information Leakage Research Articles

Encryption Techniques in Near Field Communication (NFC): Challenges, Applications, and Future Directions

With the growth of the need of information transmission and communication, Near Field Communication(NFC) technique is widely used in different areas for its convenience and simplicity,especially those areas that require both high efficiency and low cost of information transmission. However, the security of NFC itself is not ensured due to the risk of information leakage caused by technical features of short distance information transmission. Information encryption techniques are able to help NFC to be more reliable and safer from the danger of data leakage. There are several kinds of encryption techniques for NFC encryption.Due to the impact of multiple different techniques on the universality of NFC, placing different encryption techniques under the same standard can be an effective research method to improve collaboration efficiency of different encryption techniques. This paper mainly introduces common encryption techniques for NFC,including their features and applicable scenarios, and attempt to conduct technical analysis on existing encryption technologies for finding possible improving directions.

Blockchain-based fast handover authentication protocol for Internet of Vehicles in small industrial parks

Autonomous vehicles safeguard the security and efficiency of Internet of Vehicles systems in small industrial parks by authenticating and exchanging real-time information with transportation infrastructure. Deploying a multi-server framework reduces the risk of message blocking and privacy information leakage from centralized services. However, in traditional handover authentication protocols, there are still potential security risks such as high-overhead performance issues and single point of failure attacks. Therefore, it is considered challenging to realize efficient authentication while protecting the privacy of vehicles. In this paper, we propose a secure and efficient handover authentication protocol for autonomous vehicles in a small industrial park to address the challenges. The protocol is based on blockchain and Pedersen verifiable secret sharing scheme, which not only ensures lightweight real-time interactions between autonomous vehicles and edge servers in multi-server environments, but also strictly protects the security and privacy of both vehicles and edge servers. We prove the semantic security of the protocol under the Real-Or-Random model and perform a informal analysis of its security attributes to show that it can withstand a wide range of malicious attacks. Performance evaluation shows that the proposed protocol satisfies more security requirements and has better computational efficiency and communication cost than other related protocols.

Privacy Risks in the Storytelling of Open Government Data: A Study from the Perspective of User Cognitive Reasoning

ABSTRACTIn recent years, there has been an increase in the openness of government data. Data storytelling has emerged as a means to enhance communication by transforming mundane data into easily understandable narratives. However, it is crucial to pay attention to privacy risks. This paper delves into the concept of storytelling government data, integrating cognitive reasoning and the S‐O‐R model, and evaluates privacy risks. Through comparative experiments and interviews, this study examines how users may infer sensitive information. The research reveals that storytelling data has a positive impact on users' cognition. De‐storytelling, on the other hand, can mitigate privacy risks, reduce information relevance, simplify narratives, and strike a balance between user experience and privacy. Building on this research, the paper proposes a strategy to address privacy risks, recommends strengthening privacy protection awareness from the perspectives of both users and platforms, optimizing data presentation methods, reducing the risk of sensitive information leakage, and ensuring the convenience and security of government data disclosure.

Edge Computing Method for False Data Injection Attack Detection in Electromechanical Transient Simulation Grid

Because edge computing is close to the terminal, it has significant advantages of low latency and high-security realtime control and has huge application prospects in the current popular smart grid. Because its edge side is close to the terminal, it can also effectively avoid the risk of information leakage when control instructions or communication data are transmitted to remote cloud center servers over a long distance. However, edge devices have a greater probability of encountering false data injection attacks (FDIAs) from illegal terminals because of their proximity to terminals. The transient electromechanical situation of the smart grid due to FDIAs is analyzed under edge computing. Due to the characteristics that the status values of grid nodes have temporal correlation before and after and spatial correlation between nodes, the Long Short-Term Memory (LSTM) for training time series data is selected to predict the status values of grid nodes in advance. The FDIA detection method is also proposed based on the LSTM network. By calculating the predicted value at each historical moment and the root means square error (RMSE) of the system state estimation at that moment, the detection threshold of the scheme is calculated through the cumulative distribution function of RMSE. Simulation experiments are conducted on the Institute of Electrical and Electronics Engineers (IEEE)-14 node standard system. The detection rate is as high as 99.71%, which verifies the effectiveness of the proposed FDIA detection scheme. This paper studies the security threat of FDIA to the stable power system operation and provides theoretical analysis and practical reference for other power grid security protection strategies.

Key Synchronization Method Based on Negative Databases and Physical Channel State Characteristics of Wireless Sensor Network.

Due to their inherent openness, wireless sensor networks (WSNs) are vulnerable to eavesdropping attacks. Addressing the issue of secure Internet Key Exchange (IKE) in the absence of reliable third parties like CA/PKI (Certificate Authority/Public Key Infrastructure) in WSNs, a novel key synchronization method named NDPCS-KS is proposed in the paper. Firstly, through an initial negotiation process, both ends of the main channels generate the same initial key seeds using the Channel State Information (CSI). Subsequently, negotiation keys and a negative database (NDB) are synchronously generated at the two ends based on the initial key seeds. Then, in a second-negotiation process, the NDB is employed to filter the negotiation keys to obtain the keys for encryption. NDPCS-KS reduced the risk of information leakage, since the keys are not directly transmitted over the network, and the eavesdroppers cannot acquire the initial key seeds because of the physical isolation of their eavesdropping channels and the main channels. Furthermore, due to the NP-hard problem of reversing the NDB, even if an attacker obtains the NDB, deducing the initial key seeds is computationally infeasible. Therefore, it becomes exceedingly difficult for attackers to generate legitimate encryption keys without the NDB or initial key seeds. Moreover, a lightweight anti-replay and identity verification mechanism is designed to deal with replay attacks or forgery attacks. Experimental results show that NDPCS-KS has less time overhead and stronger randomness in key generation compared with other methods, and it can effectively counter replay, forgery, and tampering attacks.

Research on Personal Information Protection in the Context of Generative Artificial Intelligence

Personal information is the foundation of generative AI, and ChatGPT-like generative AI needs to process a large amount of personal information at various stages such as model training, model generation, and model optimization, which also has a certain impact on traditional personal information protection rules. During the information collection phase, generative AI may fugitive the informed consent rules and infringe on the privacy rights of information subjects. In the information utilization stage, generative AI may impact basic personal information processing rules such as the principle of purpose limitation and the principle of openness and transparency, increasing the risk of personal information leakage. At the information generation stage, generative AI can generate false and discriminatory information. Therefore, in the context of generative AI, personal information protection is faced with the problems of the notification and consent rules being hollowed out, the principle of minimum necessity being voided, and the frequent leakage of personal information. Based on this, it is necessary to promote the transformation of the "personal control center to the risk control center" of the notification and consent rules, promote the risk-based interpretation of the principle of least necessary, and improve the risk-based personal information protection compliance system to solve the problem of personal information protection in the context of generative AI.

Information leakage risk and countermeasures in the age of artificial intelligence - Taking Chatgpt as an example

Information leakage risk and countermeasures in the age of artificial intelligence - Taking Chatgpt as an example

Customers’ blockchain adoption and suppliers’ provision of trade credit: A pre-registered report

China gravitates strongly towards a digitized economy. Given that many Chinese firms heavily rely on informal financing access, such as trade credit, we seek to investigate whether and how this increasing digitization, particularly blockchain technology, impacts suppliers' trade credit provision. We argue that if blockchains facilitate information transparency and corporate profitability, suppliers should be incentivized to grant more trade credit to customers using blockchain technology. Otherwise, suppliers should have reservations about providing trade credits to firms that have adopted blockchain technology if it increases the likelihood of illegal activities and poses information leakage risk from cyberattacks. As a further analysis, to the extent that blockchain technology may impact customers' credit quality, we explore the effects of customers' blockchain usage on suppliers' receivable financing through securitization. Overall, this study aims to investigate the potential association between blockchain technology and supply chain financing in China.

Reconciling privacy and accuracy in AI for medical imaging

Artificial intelligence (AI) models are vulnerable to information leakage of their training data, which can be highly sensitive, for example, in medical imaging. Privacy-enhancing technologies, such as differential privacy (DP), aim to circumvent these susceptibilities. DP is the strongest possible protection for training models while bounding the risks of inferring the inclusion of training samples or reconstructing the original data. DP achieves this by setting a quantifiable privacy budget. Although a lower budget decreases the risk of information leakage, it typically also reduces the performance of such models. This imposes a trade-off between robust performance and stringent privacy. Additionally, the interpretation of a privacy budget remains abstract and challenging to contextualize. Here we contrast the performance of artificial intelligence models at various privacy budgets against both theoretical risk bounds and empirical success of reconstruction attacks. We show that using very large privacy budgets can render reconstruction attacks impossible, while drops in performance are negligible. We thus conclude that not using DP at all is negligent when applying artificial intelligence models to sensitive data. We deem our results to lay a foundation for further debates on striking a balance between privacy risks and model performance.

Information security outsourcing strategies in the supply chain considering security externality

Information assets that complement each other capture the information security characteristics of supply chain firms. Supply chain firms usually outsource security services to Managed Security Service Providers (MSSPs) to protect their information. Considering the security externality and information leakage risk in security outsourcing, this article investigates four security management scenarios faced by two supply chain firms. We try to answer whether both firms should outsource security to the same or different MSSPs. We find that no matter under which scenario, as the complementation degree increases, both firms and MSSPs decrease the security quality, and MSSPs offer a contract with lower compensation. We show that information leakage risk and security externality have different effects on the MSSP’s optimal strategy selections. Besides, the MSSP tends to serve both firms when the security externality is positive but prefers serving only one firm when the security externality is negative. Moreover, we find that the strategy that one firm outsources to an MSSP and its partner manages it in-house can be the optimal selection for the social planner but not the MSSP’s optimal strategy. We also extend the model and find that the results are robust to the situations of uncertain loss and asymmetric loss.

SIHNet: A safe image hiding method with less information leaking

AbstractImage hiding is a task that hides secret images into cover images. The purposes of image hiding are to ensure the secret images are invisible to the human and the secret images can be recovered. The current state‐of‐the‐art steganography methods run the risk of secret information leakage. A safe image hiding network (SIHNet) is presented to reduce the leakage of secret information. Based on some phenomena of image hiding methods which use invertible neural network, a reversible secret image processing (SIP) module is proposed to make the secret images suitable for hiding and make the stego images leak less secret information. Besides, a reversible lost information hiding (LIH) module is used to hide the lost information into the cover images, thus the method can recover the secret images better than the method that uses random noise to replace the lost information. Experimental results show that SIHNet outperforms other state‐of‐the‐art methods on the PSNR and SSIM values of the recovered secret images and the stego images. Besides, residual images of other state‐of‐the‐art methods all contain information about secret images while residual images of SIHNet leak almost no secret information. Thus the method can prevent the listener of transmission channel from obtaining the information of the secret image through the residual image, which means SIHNet performs better in security than other state‐of‐the‐art methods.

Screen‐shooting resistant robust document watermarking in the Discrete Fourier Transform domain

AbstractMetaverse's augmented reality (AR) function allows virtual information to be seamlessly superimposed onto real scenes through the camera of a head‐mounted device. However, this raises concerns about privacy protection and copyright authentication when transmitting cross‐media information. Additionally, there is a risk of secret information leakage due to screen candid shooting in the real world. Ensuring information security and copyright authentication in case of unauthorized screen capturing is crucial. To prevent information loss and interference from cross‐media transfer between screens and cameras, we implement digital watermarking for copyright protection. We have proposed an innovative framework for automatic document watermarking that can resist screen‐shooting. Our approach involves embedding a ring watermark in the document underlay. On the extraction side, the watermark extraction process is divided into three key steps: automatic location, automatic correction, and automatic extraction. First, the document image is located in the covert photography. Then, perspective correction is performed based on the text line features of the document. Finally, the watermark information is extracted by combining the ring watermark features. Our method is capable of automatically extracting watermarks from covert photography while considering aspects such as concealment, robustness, and visual quality. The watermark is embedded in the document underlay, which ensures good visual quality and does not affect the normal reading and editing. We also propose various embedding strength schemes that can adapt to different usage scenarios, providing resistance to screen‐shooting or screenshot attacks, as well as various noise attacks. Through extensive experiments, we have demonstrated the feasibility of the proposed automated framework and the robustness of the watermarking algorithm, as well as the superiority and broad application prospects of our method.

Efficiently approaching vertical federated learning by combining data reduction and conditional computation techniques

In this paper, a framework based on a sparse Mixture of Experts (MoE) architecture is proposed for the federated learning and application of a distributed classification model in domains (like cybersecurity and healthcare) where different parties of the federation store different subsets of features for a number of data instances. The framework is designed to limit the risk of information leakage and computation/communication costs in both model training (through data sampling) and application (leveraging the conditional-computation abilities of sparse MoEs). Experiments on real data have shown the proposed approach to ensure a better balance between efficiency and model accuracy, compared to other VFL-based solutions. Notably, in a real-life cybersecurity case study focused on malware classification (the KronoDroid dataset), the proposed method surpasses competitors even though it utilizes only 50% and 75% of the training set, which is fully utilized by the other approaches in the competition. This method achieves reductions in the rate of false positives by 16.9% and 18.2%, respectively, and also delivers satisfactory results on the other evaluation metrics. These results showcase our framework’s potential to significantly enhance cybersecurity threat detection and prevention in a collaborative yet secure manner.

A Single-Sized Metasurface for Image Steganography and Multi-Key Information Encryption

With the escalating flow of information and digital communication, information security has become an increasingly important issue. Traditional cryptographic methods are being threatened by advancing progress in computing, while physical encryption methods are favored as a viable and compelling avenue. Metasurfaces, which are known for their extraordinary ability to manipulate optical parameters at the nanoscale, exhibit significant potential for the revolution of optical devices, making them a highly promising candidate for optical encryption applications. Here, a single-sized metasurface with four independent channels is proposed for conducting steganography and multi-key information encryption. More specifically, plaintext is transformed into a ciphertext image, which is encoded into a metasurface, while the decryption key is discretely integrated into another channel within the same metasurface. Two different keys for steganographic image unveiling are also encoded into the metasurface and can be retrieved with different channels and spatial positions. This distributed multi-key encryption approach can enhance security, while strategically distributing images across distinct spatial zones serves as an additional measure to reduce the risk of information leakage. This minimalist designed metasurface, with its advantages of high information density and robust security, holds promise across applications including portable encryption, high-camouflaged image display, and high-density optical storage.

Decency or devilment: the impact of blockchain technology on product line design

ABSTRACT Blockchain is a secure database shared across a network of all participants, characterised by immutability, openness, transparency, and traceability. Therefore, blockchain technology is widely used in supply chain management, which can increase consumers' understanding of product information when goods arrive at the consumer end and increase the risk of consumer privacy information leakage. Considering a supply chain system that consists of a manufacturer and a platform, this paper studies the strategic interactions between the platform's adoption of blockchain technology and the manufacturer's product line design based on blockchain's positive and negative impacts on consumers. We examine the driving factors of the platform's use of blockchain technology, which are related to the effect of information transparency and privacy concerns caused by blockchain and the marginal production cost coefficient. In particular, a higher marginal production cost coefficient could make the platform more likely to use blockchain technology. We also find that the practice of blockchain technology may incentivize a manufacturer to extend its product line.

Lightweight federated learning for STIs/HIV prediction

This paper presents a solution that prioritises high privacy protection and improves communication throughput for predicting the risk of sexually transmissible infections/human immunodeficiency virus (STIs/HIV). The approach utilised Federated Learning (FL) to construct a model from multiple clinics and key stakeholders. FL ensured that only models were shared between clinics, minimising the risk of personal information leakage. Additionally, an algorithm was explored on the FL manager side to construct a global model that aligns with the communication status of the system. Our proposed method introduced Random Forest Federated Learning for assessing the risk of STIs/HIV, incorporating a flexible aggregation process that can be adjusted to accommodate the capacious communication system. Experimental results demonstrated the significant potential of a solution for estimating STIs/HIV risk. In comparison with recent studies, our approach yielded superior results in terms of AUC (0.97) and accuracy (93%\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$93\\%$$\\end{document}). Despite these promising findings, a limitation of the study lies in the experiment for man’s data, due to the self-reported nature of the data and sensitive content. which may be subject to participant bias. Future research could check the performance of the proposed framework in partnership with high-risk populations (e.g., men who have sex with men) to provide a more comprehensive understanding of the proposed framework’s impact and ultimately aim to improve health outcomes/health service optimisation.

Value co-creation in group enterprises: an evolutionary game theory-based analysis

Information barriers exist between subsidiaries in a group enterprise, where each subsidiary acts independently, and hinder rational allocation and utilisation of resources. This study proposed a value co-creation model consisting of heterogeneous subsidiaries in a group enterprise and consumers. By constructing a three-party evolutionary game model, we discussed the impact of information leakage risk, punishment intensity, consumer experience, and reputation on the strategy evolution process, which means the proportion of strategy choices for the three entities over time. We analysed and verified the evolutionary process of the value co-creation system in different scenarios. This study revealed the ‘butterfly effect’ of value co-creation within the group enterprise, highlighting how different combinations of decision-making probabilities among the three entities in the initial stage can result in diverse outcomes, even when starting from identical conditions. The study also found that under certain conditions, group subsidiaries may sacrifice their own interests for the overall interests of cooperation. This study yielded the counterintuitive conclusion that in a stable state, the choice of cooperation strategies between subsidiaries is not directly related to their willingness to share knowledge.

On the security of JPEG image encryption with RS pairs permutation

Recently, a JPEG encryption scheme with RS (run/size) pairs multi-permutation and block permutation has been proposed, which mainly improves security by extracting the expected number of RS pairs for global permutations that need overflow processing. However, it still has the risk of information leakage under the chosen plaintext attack. This is because the limited embedding capacity in overflow processing makes the overflow blocks (OBs) less. On the one hand, a few OBs make the sketch generated by non-zero coefficients count after RS pair multi-permutation visually indistinguishable from the original sketch. On the other hand, a few OBs limit the number of extracted RS pairs that can participate in global permutation, so there are many partially extracted blocks (PEBs) containing unextracted RS pairs. More PEBs make the accuracy of the estimated block permutation sequence high, because the unique plaintext block can be constructed as long as there is an unextracted RS pair in an encrypted block. Simulation results show that the correct ratio of block permutation sequence is not less than 60 %. The highest and average PSNRs between the attacked sketch and the original one reach up to 47.07 dB and 27.42 dB, respectively.

Federated Unlearning and Its Privacy Threats

Federated unlearning has emerged very recently as an attempt to realize "the right to be forgotten" in the context of federated learning. While the current literature is making efforts on designing efficient retraining or approximate unlearning approaches, they ignore the information leakage risks brought by the discrepancy between the models before and after unlearning. In this paper, we perform a comprehensive review of prior studies on federated unlearning and privacy leakage from model updating. We propose new taxonomies to categorize and summarize the state-of-the-art federated unlearning algorithms. We present our findings on the inherent vulnerability to inference attacks of the federated unlearning paradigm and summarize defense techniques with the potential of preventing information leakage. Finally, we suggest a privacy preserving federated unlearning framework with promising research directions to facilitate further studies as future work.

Pairing-Free Certificate-Based Proxy Re-Encryption Plus Scheme for Secure Cloud Data Sharing

The popularity of secure cloud data sharing is on the rise, but it also comes with significant concerns about privacy violations and data tampering. While existing Proxy Re-Encryption (PRE) schemes effectively protect data in the cloud, challenges persist with certificate administration and key escrow. Moreover, the increasing number of users and prevalence of lightweight devices demand functional and cost-effective solutions. To address these issues, this paper presents a novel Pairing-free Certificate-Based Proxy Re-Encryption Plus scheme that leverages elliptic curve groups for improved effectiveness and performance. This scheme successfully resolves challenges related to certificate management and key escrow in traditional PRE schemes, while also introducing non-transferable and message-level fine-grained control characteristics. These enhancements bolster data security during sharing and minimize the risk of malicious information leakage. Our proposed scheme’s correctness, security, and effectiveness are rigorously verified and analyzed. The results demonstrate that the scheme achieves the chosen ciphertext security in the random oracle model. Compared to current PRE schemes, our approach offers greater advantages, lower computational overhead, and enhanced suitability for practical cloud computing applications.