Leakage Of Private Information Research Articles

PBCert: Privacy-Preserving Blockchain-Based Certificate Status Validation Toward Mass Storage Management

In the recent years, the vulnerabilities of conventional public key infrastructure are exposed by the real-world attacks, such as the certificate authority’s single-point-of-failure or clients’ private information leakage. Aimed at the first issue, one type of approach is that multiple entities are introduced to assist the certificate operations, including registration, update, and revocation. However, it is inefficient in computation. Another type is to make the certificate information publicly visible by bringing in the log servers. Nevertheless, the data synchronization among log servers may lead to network latency. Based on the second approach, the blockchain-based public key infrastructure schemes are proposed. Through these type of schemes, all the certificate operations are stored in the blockchain for public audit. However, the issue of revoked certificates’ status storage is worth paying attention, especially in the setting with massive certificates. In addition, the target web server that a client wants to access is exposed in the process of certificate status validation. In this paper, we propose a privacy-preserving blockchain-based certificate status validation scheme called PBCert to solve these two issues. First, we separate the revoked certificates control and storage plane. Only the minimal control information (namely, certificate hashes and related operation block height) is stored in the blockchain and it uses external data stores for the detailed information about all revoked certificates. Second, we design an obscure response to the clients’ certificate status query for the purpose of privacy preserving. Through the security analysis and experiment evaluation, our scheme is significant in practice.

Reversible AMBTC-Based Data Hiding With Security Improvement by Chaotic Encryption

Social networking and cloud computing are being extensively used, and in this era, the frequency of sending information or images to each other is increasing. The prevention of private information leakage during communication over the Internet has become a concern in the past decades. Several data protection methods, such as cryptographic, watermarking, and steganography techniques, have been proposed to protect private data. In this paper, an embedding method is proposed based on an absolute moment block truncation coding (AMBTC)-compressed image. High and low mean tables are extracted from a compressed image and are divided into non-overlapping blocks. An adaptive variable N-bit bit plane truncation image embedding method is proposed to embed the secret data in each block. In this method, at the receiver end, the secret data are extracted, and the original AMBTC image could be recovered by recalling the stored peak and zero points. In addition, a chaotic encryption scheme is integrated into the proposed system to improve robustness against security vulnerability. The results show that the proposed method has superior performance and higher payload compared with the reference methods.

Analyzing Tools and Algorithms for Privacy Protection and Data Security in Social Networks

The purpose of this research, is to study factors influencing privacy concerns about data security and protection on social network sites and its’ influence on self-disclosure. 100 articles about privacy protection, data security, information disclosure and Information leakage on social networks were studied. Models and algorithms types and their repetition in articles have been distinguished and this study builds a research model to examine privacy concerns and the effect of it on self-disclosure. The need of having knowledge and skill about privacy protection seems to be necessary with social networks technology developments. Most of the researches have been studied about privacy protection scope related to users’ privacy on social networks including women, men, children and adults in smartphone and E-health. Most of researches on this scope have been done in USA. Most studies were focused on privacy protection and security on social networks.

Identifying the Fake Base Station: A Location Based Approach

Fake base station (FBS) attack is a great security challenge to wireless user equipment (UE). During the cell selection stage, the UE receives multiple synchronization signals (SSs) from multiple nearby base stations (BSs) and then synchronizes itself with the strongest SS. An FBS also can transmit an SS with sufficient power to confuse the UE, which makes the UE connect to the FBS, and may lead to the leakage of private information. In this letter, countermeasure to the FBS attack by utilizing the location information is investigated. Two location awareness based FBS-resistance schemes are proposed by checking the received signal strength according to the position of the UE and a legitimate BS map. The successful cheating rate (SCR) defined as the probability that the UE will connect to the FBS is investigated. Numeric results show that with the two proposed schemes, the SCR can be greatly reduced especially when the transmit power of the FBS is large. Beyond that, a cooperation-aided method is further proposed to improve the performance, and we show that the cooperation-aided method can further suppress the SCR when the signal strength from the FBS is similar to that from the legitimate BS.

Secure outsourcing algorithms of modular exponentiations with optimal checkability based on a single untrusted cloud server

Modular exponentiation is an expensive discrete-logarithm operation, difficult for resource-constrained users to perform locally. Fortunately, thanks to burgeoning cloud computing, users are willing to securely outsourcing modular exponentiations to cloud servers to reduce computation overhead. In this paper, we contrive a fully verifiable secure outsourcing scheme for modular exponentiation with only a single server, named MExp. MExp not only prevents users’ private information leakage during outsourcing by our new logical division method, but also eliminates collusion attacks occurring in algorithms with two untrusted servers. Moreover, our MExp allows outsourcers to detect any misbehavior with a probability of 1, which shows significant improvement in checkability when compare to other single-server-based schemes. With a view to reducing computation overhead, MExp is extended to multiple modular exponentiations, named M2Exp. The algorithm significantly diminishes the local costs of multiple modular exponentiation calculations and the checkability is still 1. Compared with existing state-of-the-art schemes, MExp and M2Exp have outstanding performance in both efficiency and checkability. Finally, MExp and M2Exp are applied to Cramer–Shoup encryptions and Schnorr signatures.

Strategic leakage of private information

We present a model where an insider and multiple informed outsiders share some common information about a risky asset to analyze the insider’s incentive for voluntarily leaking information to the market maker. We find that the ex-ante uncertainty of the traded asset and the number of informed outsiders play a decisive role in the insider’s choice of information leakage. When trading an asset with low risk against very few informed outsiders, the insider never chooses to leak any information. However, if sufficient outsiders coexist in the market, strategically releasing a signal to the market maker helps the insider anticipate the price and consequently earn more profits. In this case, if the insider’s monopoly information advantage is large, the insider would choose to fully leak the shared information to the market maker. Our work shows that information leakage to the market maker is more efficient than the public disclosure of the shared private information as a way for the insider to profit from insider trading. The results also provide the theoretical explanation for the insider’s leaking information to the underwriter in seasoned equity offerings (SEOs).

Privacy Protection Scheme Based on Remote Anonymous Attestation for Trusted Smart Meters

The emergence of smart grids has considerably improved the quality of life. However, the real-time electric usage information transmitted by smart meters reveals consumers’ private information. Based on the remote anonymous attestation technology in trusted computing, the concept of a trusted smart meter is proposed in this paper in order to protect consumers’ private information from the terminal end. Attribute certificates are used to hide the platform configuration of smart meters and the ring signature technology is adopted to hide users’ personal information. The proposed protocol not only prevents the leakage of private information with competitive efficiency but also ensures trusted detection for upgrading the software of smart meters.

Image search scheme over encrypted database

In big data era, too much ordinary information leakage may lead to the leakage of private information. Image search is widely used in many fields. Though there are many studies on image search, most of them are search in plaintext databases. In this paper, we study the image retrieval techniques over encrypted databases. A content-based retrieval scheme for encrypted images is proposed. In the scheme, a blind technique based on discrete logarithm problem is introduced to keep the privacy of feature vectors, and a novel retrieval way is used. This is a flexible scheme, which support fuzzy search. The client can control the search range. And in the search process, the contents of the original image will not be revealed.

Multiple Antennas Secure Transmission Under Pilot Spoofing and Jamming Attack

Transmitter-side channel state information of the legitimate destination plays a critical role in physical layer secure transmissions. However, channel training procedure is vulnerable to the pilot spoofing attack (PSA) or pilot jamming attack (PJA) by an active eavesdropper (Eve), which inevitably results in severe private information leakage. In this paper, we propose a random channel training (RCT)-based secure downlink transmission framework for a time division duplex multiple antennas base station. In the proposed RCT scheme, multiple orthogonal pilot sequences (PSs) are simultaneously allocated to the legitimate user (LU), and the LU randomly selects one PS from the assigned PS set to transmit. Under either the PSA or PJA, we provide the detailed steps for the BS to identify the PS transmitted by the LU, and to simultaneously estimate channels of the LU and Eve. The probability that the BS makes an incorrect decision on the PS of the LU is analytically investigated. Finally, closed-form secure beamforming vectors are designed and optimized to enhance the secrecy rates during the downlink transmissions. Numerical results show that the secrecy performance is greatly improved compared to the conventional channel training scheme wherein only one PS is assigned to the LU.

Identity-based re-encryption scheme with lightweight re-encryption key generation

Cryptographic proxy re-encryption is a very useful primitive which is capable of transforming a ciphertext under one public key PK1 into a new ciphertext under another public key PK2 without private information leakage, while the two ciphertexts are encryptions of the same message. Re-encryption schemes at first are constructed under the public-key encryption (PKE) scenario. While it is a powerful primitive naturally required in not only PKE but also other scenarios, various extensions from PKE to other advanced encryption schemes like identity-based encryption (IBE), attribute-based encryption (ABE) as well as functional encryption (FE) are needed as well. In this work we have concentrated on how to reduce the workloads in the user/client side at large. To this end, we have put forth a novel identity-based proxy re-encryption (IBPRE) scheme with the feature that the re-encryption key gen­eration for the users is highly lightweight - actually almost free. Although this will lead to possibly extra decryption workload due to the utilization of homomorphic encryption, it is the first scheme realizing such almost free RK generation. In addition, it can also avoid some other shortcomings like re-encryption key management.

Generating security questions for better protection of user privacy

ABSTRACTCyber threats to identity prevail. One of the most common forms of authentication, which most of the online service providers require users to provide a username and preset password. But password reset rates have been estimated as one recovery per every four users per month. Since the number of active registered users in Google is over 425 million, it indicates the importance of reliability of second authentication method for account recovery. On the other hand, increasingly more attackers are abusing the option of forget password or account recovery, which demonstrates the urgent needs of the security of the account recovery methods. This paper proposes an inexpensive approach of generating memorizable stories which are of readily use for setting security questions and their answers. We conduct experiments to prove the effectiveness of this approach by investigating how well different groups of people could accurately answer the challenges based on randomly generated contents. According to our findings, around 73% of the 135 participants correctly answered the security questions, and nearly half of them acknowledged that randomly generated information is difficult to recall despite its usefulness on privacy protection. We proved that this method is effective as long as the generated story is more related to the user and the time frame is relatively short. The results of this research may help to create the feasible solutions to reduce the leakage of private information from security questions.

Performance evaluation of implicit smartphones authentication via sensor-behavior analysis

The pervasiveness of mobile devices not only facilitates people’s daily life with a wide variety of services, but also brings users risks of private information leakage (e.g., photos, contact lists, bank accounts), which emphasizes the demand for reliable, feasible and user-friendly authentication mechanisms on mobile devices. In this paper, we develop an authentication mechanism using motion sensors (accelerometer and gyroscope) embedded in smartphones. Our proposed mechanism performs authentication continuously and implicitly by monitoring the user daily activities. We extract time-, frequency- and wavelet-domain features from motion-sensor data, and conduct empirical feature analysis to investigate the optimal combination of features, to acquire a fine-grained characterization of users’ movement patterns. To make a systematic performance evaluation, we have established a dataset containing 27,681 samples, including five kinds of actions and five different smartphone placements. In the evaluation procedure, four kinds of contexts are considered (nothing-aware context, action-aware context, placement-aware context and full-information-aware context), and ten one-class detectors are implemented. The best accuracy (represented as EER) for the four conditions achieves 28.22%, 2.21%, 5.50% and 3.28%, respectively, indicating our proposed approach is feasible and applicable in some real scenarios. Moreover, the performance analyses for sensor combinations and feature combinations are also conducted.

Security-Aware Waveforms for Enhancing Wireless Communications Privacy in Cyber-Physical Systems via Multipath Receptions

Cyber-physical system (CPS), regarded as the next generation of engineered system, has the capability to interact with the real physical world. Applications of CPS span various fields such as medical monitoring, traffic control, and smart grid. With such widespread applications, privacy assurance is becoming more and more important since what the CPS connects are people and the real world. Any leakage of private information will cause serious consequences. In this paper, we focus on enhancing the secrecy of wireless communications in CPS by use of physical layer security techniques. Specifically, we study an amplify and forward (AF) relay network where all devices are equipped with a single antenna. We propose a privacy-enhanced waveform design approach aided by artificial noise (AN) to enhance the communication secrecy in a wireless environment with multipath receptions. First, we consider the case with perfect eavesdropper's channel state information (CSI). We optimize the AF coefficient for forwarding the informationbearing signal and the AN covariance to maximize the achievable secrecy rate. The optimal solution is obtained by solving a series of semidefinite programs. Then, a more practical scenario with imperfect eavesdropper's CSI is studied. We develop a robust waveform design method and obtain the lower bound of the achievable secrecy rate. Numerical results are presented to show the effectiveness of our proposed algorithms.

Private attribute inference from Facebook’s public text metadata: a case study of Korean users

PurposeAs the number of users on social network services (SNSs) continues to increase at a remarkable rate, privacy and security issues are consistently arising. Although users may not want to disclose their private attributes, these can be inferred from their public behavior on social media. In order to investigate the severity of the leakage of private information in this manner, the purpose of this paper is to present a method to infer undisclosed personal attributes of users based only on the data available on their public profiles on Facebook.Design/methodology/approachFacebook profile data consisting of 32 attributes were collected for 111,123 Korean users. Inferences were made for four private attributes (gender, age, marital status, and relationship status) based on five machine learning-based classification algorithms and three regression algorithms.FindingsExperimental results showed that users’ gender can be inferred very accurately, whereas marital status and relationship status can be predicted more accurately with the authors’ algorithms than with a random model. Moreover, the average difference between the actual and predicted ages of users was only 0.5 years. The results show that some private attributes can be easily inferred from only a few pieces of user profile information, which can jeopardize personal information and may increase the risk to dignity.Research limitations/implicationsIn this paper, the authors’ only utilized each user’s own profile data, especially text information. Since users in SNSs are directly or indirectly connected, inference performance can be improved if the profile data of the friends of a given user are additionally considered. Moreover, utilizing non-text profile information, such as profile images, can help increase inference accuracy. The authors’ can also provide a more generalized inference performance if a larger data set of Facebook users is available.Practical implicationsA private attribute leakage alarm system based on the inference model would be helpful for users not desirous of the disclosure of their private attributes on SNSs. SNS service providers can measure and monitor the risk of privacy leakage in their system to protect their users and optimize the target marketing based on the inferred information if users agree to use it.Originality/valueThis paper investigates whether private attributes of SNS users can be inferred with a few pieces of publicly available information although users are not willing to disclose them. The experimental results showed that gender, age, marital status, and relationship status, can be inferred by machine-learning algorithms. Based on these results, an early warning system was designed to help both service providers and users to protect the users’ privacy.

Privacy Preserving in Cloud Environment for Obstructed Shortest Path Query

With the prosperity of location-based services, shortest path query became one of the most common services, and provided convenience for finding the best way to arrive at the destination of users. However, in order to obtain the service, users had to submit the current locations to a data owner, and this process may pose privacy threats to users. More seriously, if the data owner outsourcing the query data to a cloud server for calculating the shortest distance, users’ privacy may be leaked even further. To cope with the problem of outsourcing computation, based the homomorphic encryption and secure multiparty computation, this manuscript presents a framework to reduce the likelihood of private information leakage, and privacy preservation of both the user, and the data owner. In this framework, two different conditions were considered, and the shortest path was computed with or without obstruction on the road. Thereafter, two protocols called “query with obstruction” and “query without obstruction” are presented.

Towards win-win: weighted-Voronoi-diagram based channel quantization for security enhancement in downlink cloud-RAN with limited CSI feedback

Physical layer (PHY) security is recently proved to enable improving the security of wireless communication networks. In downlink frequency division duplex (FDD) cloud radio access network (C-RAN), the performance of PHY security highly relies on the channel state information (CSI) which is usually acquired through the codebook-quantization-based technique at the transceiver. However, the conventional quantization method aggravates the leakage of privacy information in C-RAN under the eavesdropping environment. In this paper, a novel channel quantization method is investigated to improve the secrecy-rate performance of C-RAN by exploiting the high-dimension space geometry. Based on this method, it is proved that when the statistical distribution of the channel matrices of {both} the legitimate user {and} the eavesdropper is exploited, a win-win situation can be created where secrecy-rate gains are improved without sacrificing beamforming gains from the point of view of ergodic rate. Particularly, a secrecy-oriented criterion is devised to implement the proposed method for generating codebooks. Then a weighted Voronoi diagram (WVD) is formulated on the complex Grassmann manifold and finally, a vector quantization based algorithm is proposed to build up novel quantization codebooks iteratively. Simulation results further validate the superiority of our proposed codebooks over conventional codebooks in C-RAN systems.

HOPE: improved order preserving encryption with the power to homomorphic operations of ciphertexts

Database applications that manage and utilize massive data must address the issues of {element comparisons}, the core operations in index accessing, {metric computations} and {metric comparisons}, and the core operations in result ranking. In the cloud era, to avoid private information leakage, encrypted data are subcontracted, and resolutions for the problems that arise in three operations over ciphertexts are urgently required. Indeed, it is possible to handle element comparison through {order preserving encryption/encoding} (OPE) or metric computation through {homomorphic encryption} (HE) directly over ciphertexts. Unfortunately, the simultaneous achievement of both goals (i.e., metric computation and comparison) by directly combining OPE and HE remains intractable. In this work, an improved OPE, named hOPE, is proposed to support homomorphic operations over ciphertexts in addition to comparisons. Based on hOPE, AhOPE and PhOPE are designed to support homomorphic addition and product, respectively. Both schemes are proved to be indistinguishable under operated and ordered chosen-plaintext attack (IND-O\textsuperscript{2}CPA) secure when the adopted HE algorithm provides indistinguishable under ordered chosen-plaintext attack (IND-OCPA secure). hOPE is a general construction that supports arbitrary HE algorithms and achieves consistent security. We deploy AhOPE and PhOPE in practice with a trusted/untrusted third party and compare the result with the state-of-the-art methods. The results show that our presented algorithms need few interactions and fill the gap between OPE and HE.

Robustly Optimal Auctions with Unknown Resale Opportunities

We study robust revenue maximization by the designer of a single-object auction who has Bayesian beliefs about bidders' independent private values but is ignorant about post-auction resale opportunities (including possible leakage of private information). We show the optimality of a Vickrey auction with bidder-specific reserve prices proposed by Ausubel and Cramton (2004), which allocates the object efficiently provided that at least one of the bidders has bid above his reserve price. In this auction, truthful bidding and no resale is an ex post equilibrium for any individually rational resale procedure. We show optimality of this auction for a worst-case resale procedure in which the highest-value bidder learns all other bidders' values and has full bargaining power. The proof involves construction of Lagrange multipliers on the incentive constraints representing non-local deviations in which a bidder underbids to lose and then purchases from the auction's winner.

Unintentional and Involuntary Personal Information Leakage on Facebook from User Interactions

Online social networks (OSNs) have changed the way people communicate with each other. An OSN usually encourages the participants to provide personal information such as real names, birthdays and educational background to look for and establish friendships among them. Some users are unwilling to reveal personal information on their personal pages due to potential privacy concerns, but their friends may inadvertently reveal that. In this work, we investigate the possibility of leaking personal information on Facebook in an unintentional and involuntary manner. The revealed information may be useful to malicious users for social engineering and spear phishing. We design the inference methods to find birthdays and educational background of Facebook users based on the interactions among friends on Facebook pages and groups, and also leverage J-measure to find the inference rules. The inference improves the finding rate of birthdays from 71.2% to 87.0% with the accuracy of 92.0%, and that of educational background from 75.2% to 91.7% with the accuracy of 86.3%. We also suggest the sanitization strategies to avoid the private information leakage.

Changes in information environment and merger announcements

Purpose The purpose of this paper is to examine the impact of regulatory changes by the US Securities and Exchange Commission in 2000 on private information leakage prior to merger announcements. Design/methodology/approach Using a sample of 5,045 merger announcements between 1990 and 2008, the authors examine differences in information leakage between the pre- and post-regulation period merger announcements for acquirers using regression analysis. Findings The results suggest that regulatory changes have been effective in preventing private information leakage in merger announcements for large- and medium-sized firms, for high-tech firms, and for stock deals. The authors find that abnormal trading volume due to differences in information quality is reduced post-regulation for stock deals, high-tech firms, large- and medium-sized bidders, indicating less leakage of information after the new regulations. The authors find higher announcement returns post-regulation for the entire sample and for all subsamples except stock deals, small firms, and public targets. Higher announcement returns indicate that merger announcements are a greater surprise to the market due to a reduction in leaked private information after the regulatory changes. Practical implications The results have implications on future rule changes, on refinements of insider trading rules, regulation fair disclosure, and regulation M-A. The authors leave for future research why certain types of firms or deals are not impacted by regulatory changes. Originality/value Examine the effect of changes in information environment on merger announcements for acquirers because the impact likely has greater significance on acquirers than that on targets. Past studies have examined only targets.