Privacy Properties Research Articles

Non-malleable encryption with proofs of plaintext knowledge and applications to voting

Non-malleable asymmetric encryption schemes which prove plaintext knowledge are sufficient for secrecy in some domains. For example, ballot secrecy in voting. In these domains, some applications derive encryption schemes by coupling malleable ciphertexts with proofs of plaintext knowledge, without evidence that the sufficient condition (for secrecy) is satisfied nor an independent security proof (of secrecy). Consequently, it is unknown whether these applications satisfy desirable secrecy properties. In this article, we propose a generic construction for such a coupling and show that our construction produces non-malleable encryption schemes which prove plaintext knowledge. Furthermore, we show how our results can be used to prove ballot secrecy of voting systems. Accordingly, we facilitate the development of applications satisfying their security objectives.

Energy-Aware RFID Authentication in Edge Computing

Internet of Things (IoT) devices are basic units in edge computing. Denial of service (DoS) attack is a great threat to low-cost IoT devices, even worse in privacy-preserving authentication protocols for radio frequency identification (RFID) tags. During DoS attacks, the attacker consumes the legal states in a target tag by continuous scanning and further observes its behavior in authentication to break privacy. Due to lack of adequate energy and computing power, it is hard for passive backscattering RFID tags to defend against DoS attacks. In this work, we cast a new insight on the DoS attacks to RFID tags and leverage the malicious scanning behavior as a new energy source. In this way, a passive tag gains more and more energy and can afford more and more complex cryptography computation under a DoS attack. Finally, the victim tag with adequate energy achieves to complete the complicated public key cryptographic computations and defend against the DoS attack. We further propose a protocol, namely the RUND protocol. We define the tracking privacy model and introduce in the notion of tracking interval to define the tracking privacy other than indistinguishable privacy. To guarantee the security and tracking privacy properties of our protocol, we propose 3 rules as designing guidelines. The analysis shows that our approach can achieve $O$ (1) efficiency while providing DoS-defending privacy-preserving authentication. Furthermore, with proper parameters our approach can save about 40% boosting time at least, compared to the directly charging for public key cryptographic computation method.

Conditional adjacency anonymity in social graphs under active attacks

Social network data is typically made available in a graph format, where users and their relations are represented by vertices and edges, respectively. In doing so, social graphs need to be anonymised to resist various privacy attacks. Among these, the so-called active attacks, where an adversary has the ability to enrol sybil accounts in the social network, have proven difficult to counteract. In this article, we provide an anonymisation technique that successfully thwarts active attacks while causing low structural perturbation. We achieve this goal by introducing (k, Gamma _{G,ell })-adjacency anonymity: a privacy property based on (k,ell )-anonymity that alleviates the computational burden suffered by anonymisation algorithms based on (k,ell )-anonymity and relaxes some of its assumptions on the adversary capabilities. We show that the proposed method is efficient and establish tight bounds on the number of modifications that it performs on the original graph. Experimental results on real-life and randomly generated graphs show that when compared to methods based on (k,ell )-anonymity, the new method continues to provide protection from equally capable active attackers while introducing a much smaller number of changes in the graph structure.

Formal analysis of a security protocol for e-passports based on rewrite theory specifications

We report on a case study in which Password Authentication Connection Establishment (PACE) protocol has been formally analyzed based on its rewrite theory specification with Maude, a rewriting logic-based computer language and system. Dominik Klein has formally verified with interactive theorem proving that PACE enjoys the key secrecy property under the condition that the password shared by a passport chip C and a terminal T would be never leaked to the third party. In contrast, our analysis supposes that the password is leaked to an intruder once it has been used in a session completed. Under the condition, the analysis unveils some security weakness that PACE does not enjoy the correspondence (or authentication or agreement) properties from both C and T points of view. Then, we propose that one-time password is used in PACE. We have formally analyzed that the revised version enjoys the correspondence properties under the latter condition. We have used the Maude search command that can be used to conduct reachability analysis because the correspondence properties can be formalized as invariant properties.

M2M-REP: Reputation system for machines in the internet of things

In the age of IoT (Internet of Things), Machine-to-Machine (M2M) communication has gained significant popularity over the last few years. M2M communication systems may have a large number of autonomous connected devices that provide services without human involvement. Interacting with compromised, infected and malicious machines can bring damaging consequences in the form of network outage, machine failure, data integrity, and financial loss. Hence, users first need to evaluate the trustworthiness of machines prior to interacting with them. This can be realized by using a reputation system, which evaluates the trustworthiness of machines by utilizing the feedback collected from the users of the machines. The design of a reliable reputation system for the distributed M2M communication network should preserve user privacy and have low computation and communication overheads. To address these challenges, we propose an M2M-REP System (Machine to Machine REPutation), a privacy-preserving reputation system for evaluating the trustworthiness of autonomous machines in the M2M network. The system computes global reputation scores of machines while maintaining privacy of the individual participant score by using secure multi-party computation techniques. The M2M-REP system ensures correctness, security and privacy properties under the malicious adversarial model, and allows public verifiability without relying on a centralized trusted system. We implement a prototype of our system and evaluate the system performance in terms of the computation and bandwidth overhead.

A Formal Specification and Verification Framework for Timed Security Protocols

Nowadays, protocols often use time to provide better security. For instance, critical credentials are often associated with expiry dates in system designs. However, using time correctly in protocol design is challenging, due to the lack of time related formal specification and verification techniques. Thus, we propose a comprehensive analysis framework to formally specify as well as automatically verify timed security protocols. A parameterized method is introduced in our framework to handle timing parameters whose values cannot be decided in the protocol design stage. In this work, we first propose timed applied p-calculus as a formal language for specifying timed security protocols. It supports modeling of continuous time as well as application of cryptographic functions. Then, we define its formal semantics based on timed logic rules, which facilitates efficient verification against various authentication and secrecy properties. Given a parameterized security protocol, our method either produces a constraint on the timing parameters which guarantees the security property satisfied by the protocol, or reports an attack that works for any parameter value. The correctness of our verification algorithm has been formally proved. We evaluate our framework with multiple timed and untimed security protocols and successfully find a previously unknown timing attack in Kerberos V.

A demonstration of sterling

In this work, we demonstrate Sterling, a decentralized marketplace for private data. Sterling enables privacy-preserving distribution and use of data by using privacy-preserving smart contracts which run on a permissionless blockchain. The privacy-preserving smart contracts, written by data providers and consumers, immutably and irrevocably represent the interests of their creators. In particular, we provide a mechanism for data providers to control the use of their data through automatic verification of data consumer contracts, allowing providers to express constraints such as pricing and differential privacy. Through smart contracts and trusted execution environments, Sterling enables privacy-preserving analytics and machine learning over private data in an efficient manner. The resulting economy ensures that the interests of all parties are aligned. For the demonstration, we highlight the use of Sterling for training machine learning models on individuals' health data. In doing so, we showcase novel approaches to automatically appraising training data, verifying and enforcing model privacy properties, and efficiently training private models on the blockchain using trusted hardware.

Double verification protocol via secret sharing for low-cost RFID tags

RFID tags have become ubiquitous and cheaper to implement. It is often imperative to design ultralightweight authentication protocols for such tags. Many existing protocols still rely on triangular functions, which have been shown to have security and privacy vulnerabilities. This work proposes UMAPSS, an ultralightweight mutual-authentication protocol based on Shamir’s(2,n) secret sharing. It includes mechanisms for double verification, session control, mutual authentication, and dynamic update to enhance security and provide a robust privacy protection. The protocol relies only on two simple bitwise operations, namely addition modulo2mand a circular shiftRot(x,y), on the tag’s end. It avoids other, unbalanced, triangular operations.A security analysis shows that the protocol has excellent privacy properties while offering a robust defense against a broad range of typical attacks. It satisfies common security and the low-cost requirements for RFID tags. It is competitive against existing protocol, scoring favourably in terms of computational cost, storage requirement, and communication overhead.

Power of public‐key function‐private functional encryption

In the public-key setting, known constructions of function-private functional encryption (FPFE) were limited to very restricted classes of functionalities like inner-product. Moreover, its power has not been well investigated. The authors construct FPFE for general functions and explore its powerful applications, both for general and specific functionalities. One key observation entailed by their results is that attribute-based encryption with function privacy implies FE, a notable fact that sheds light on the importance of the function privacy property for FE.

The Darkest Hour: Private Information Control and the End of Democratic Science

The evaluation of scientific research is based on data protected by secrecy and intellectual property (e.g., Elsevier Scopus or Clarivate Web of Science). The peer review process is essentially anonymous. While science has progressed thanks to public dialogue, the current evaluation system is centered on private control of information. This represents a fundamental shift from democratic to authoritarian science. Open Science may confront this change only if it is accepted as the heir, in the digital age, of the values and principles that public and democratic science has traditionally fostered in the age of printing, thus becoming the guardian of a democratic society.

A privacy-aware decentralized and personalized reputation system

Reputation systems enable consumers to evaluate the trustworthiness of business entities (retailers, sellers) over the marketplace. In electronic marketplaces, the reputation of an business entity (retailer, seller) is computed by aggregating the “trust-scores” assigned to her by the parties who have had transactions with her. Most reputation systems designed for online marketplaces use all the available trust-scores to compute the reputation of business entity. However, in some scenarios, the consumer may wish to compute the reputation of a business entity by considering the trust-scores from a set of trustworthy participants, however, she does not want to disclose the identities of the users she trusts. There are two privacy protection challenges in the design of this kind of personalized reputation system: 1) protecting the set of trusted users of participants, and 2) protecting the trust-scores assigned by the participants in the trusted set. In this paper, we present a novel framework for computing the personalized global reputation of a business entity by considering the trust-scores from a set of trusted participants without disclosing identities of participants in the trusted set and their trust-scores. To this extent, the participants share cryptograms of their trust-scores for the business entity to the decentralized public bulletin board or tally center. These encrypted trust-scores are then used by the requester to compute the personalized reputation score of the business entity without leaking private information of participants in the system. We have analyzed the security and privacy properties of the scheme for the malicious adversarial model. The protocol has a linear message complexity, which proves that the system can be deployed in a real setup where such personalized recommendations may be required in practice. Furthermore, the system ensures correctness, privacy and security of trust-scores of participants in the trusted set under the malicious adversarial model.

On-line verification of current-state opacity by Petri nets and integer linear programming

Opacity is a security and privacy property that evaluates whether an external observer (intruder) can infer a secret of a system by observing its behavior. This paper proposes an on-line approach to address the problem of current-state opacity in discrete event systems (DESs) modeled in a labeled Petri Net (PN) framework and by observing its evolution. An observation of the system is said to be current-state opaque if the intruder is unable to determine whether the current state of the system is within a set of secret states, otherwise it is said to be not current-state opaque. The proposed approach to verify the current-state opacity works on-line: the verification algorithm waits for the occurrence of an observable event and uses Integer Linear Programming problem solutions to verify if the behavior of the system is current-state opaque to the intruder under the given observation. Moreover, the proposed method is applied in two different settings: (i) a centralized approach where the intruder has full knowledge of the system model but can partially observe the system behavior; (ii) a decentralized approach where a set of intruders can observe different event sets and collaborate with a coordinator to disclose the same secret. Finally, experimental results are presented to demonstrate the efficiency of the proposed method.

ShiftRoute: Achieving Location Privacy for Map Services on Smartphones

Map services, e.g., Google Maps, are gaining popularity for vehicle navigation. However, map service users have to provide sensitive information like precise geographic locations or detailed addresses, which are susceptible to accidental leakage or even data mining in the future. We find existing general-purposed location privacy protection mechanisms (LPPMs) not effective, when applied to map service on smartphones. This paper presents ShiftRoute, a new LPPM specially designed for map services on smartphones. ShiftRoute enables smartphone users to query a route between two endpoints on the map, without revealing any meaningful location information. The basic idea is to strategically shift the endpoints to nearby ones, such that: 1) the semantic meanings encoded in these endpoints (e.g., their addresses) change much , i.e., location privacy is largely protected; 2) the routes returned by map services change little , i.e., service usability is preserved. Specifically, we design a protocol to allow a mobile client to retrieve point of interests (POIs) close to the original endpoints, and an algorithm that selects shifted endpoints from these POIs, that achieves the privacy property of geo-indistinguishability . We implement an application of ShiftRoute on Android, and conduct experiments with real traces from a production map service. Experimental results show that ShiftRoute strikes a good tradeoff between location privacy and service usability.

Privacy Property, Information Costs, and the Anticommons

The current law of privacy is a hodgepodge of rights and remedies. Some rights arise out of a specific statute, others arise out of the general common law of torts and contract. Each system for protecting privacy has its own distinctive remedial scheme. Some rights are backed by public enforcement alone, some by private rights of action, some by both. Some come with compensatory damages, others with attorneys' fees, punitive damages, or statutory damages. Even where a private right of action exists, however, that right is often enforced by civil liability, rather than property-based entitlements. While this essay argues for property-based protection of personal data, its principle goal is to take seriously (and propose techniques for minimizing) the costs associated with the coordination problems created by a regime of information property.

Formal analysis of HMAC authorisation in the TPM2.0 specification

The Trusted Platform Module (TPM) is a system component that provides a hardware-based approach to establish trust in a platform. The latest TPM2.0 specification was accepted as the ISO standard in 2015. It offers functionality for key management by storing keys into the TPM's protected storage. The access to the TPM-resident key object is protected by the session-based authorisation mechanism. This mechanism is keyed to the object's authorisation value known as authValue and the session-bound secret value known as sessionKey. The new authValue introduced into the TPM is protected by the sessionbased encryption mechanism, which is also keyed on the sessionKey. In the authors' study, they conduct a formal analysis of the TPM2.0 HMAC (hash message authentication code) authorisation mechanism used in the key management. They first use the stateful applied π calculus to formalise the session-based HMAC authorisation and encryption mechanisms in a model of TPM2.0 API commands. They propose a threat model to formalise the secrecy and authentication properties. Then they discuss several attacking scenarios in practice where the sessionKey could be disclosed. They also instantiate their threat model according to specific attacking scenarios. By using the SAPIC tool and the tamarin prover, they automatically give out the analysis results of their models.

On-line Algorithm for Current State Opacity Enforcement in a Petri Net Framework

Opacity notion is a security and privacy property that verifies whether an external observer (intruder) can deduce a secret of a system by observing its behaviour. This paper addresses the current state opacity verification and enforcement in the framework of Petri Net (PN): an observation of the system is said to be current-state opaque if an intruder is unable to determine whether the current-state of the system belongs to a set of secret states, otherwise it is said to be not current-state opaque. The run time verifier waits for an observable event and performs an algorithm based on the solution of Integer Linear Programming problem to verify the current state opacity and preserve the secret. Indeed, if the secret may be discovered, then the last event is hidden. An example shows the efficiency of the proposed approach.

Efficient k-Nearest Neighbor Classification Over Semantically Secure Hybrid Encrypted Cloud Database

Nowadays, individuals and companies increasingly tend to outsource their databases and further data operations to cloud service provides. However, utilizing the cost-saving advantages of cloud computing brings about the risk of violating database security and user’s privacy. In this paper, we focus on the problem of privacy-preserving k-nearest neighbor (kNN) classification, in which a query user (QU) submits an encrypted query point to a cloud server (CS) and asks for the kNN classification labels based on the encrypted cloud database outsourced by a data owner (DO), without disclosing any privacy of DO or QU to CS. Previous secure kNN query schemes either cannot fully achieve required security properties or introduce heavy computation costs, making them not practical in real-world applications. To better solve this problem, we propose a novel efficient privacy-preserving kNN classification protocol over semantically secure hybrid encrypted cloud database using Paillier and ElGamal cryptosystems. The proposed protocol protects both database security and query privacy and also hides data access patterns from CS. We formally analyze the security of our protocol and evaluate the performance through extensive experiments. The experiment results show that the computation cost of our protocol is about two orders of magnitude lower than that of the state-of-the-art protocol while achieving the same security and privacy properties.

Cryptanalysis and Security Enhancement of Three Authentication Schemes in Wireless Sensor Networks

Nowadays wireless sensor networks (WSNs) have drawn great attention from both industrial world and academic community. To facilitate real‐time data access for external users from the sensor nodes directly, password‐based authentication has become the prevalent authentication mechanism in the past decades. In this work, we investigate three foremost protocols in the area of password‐based user authentication scheme for WSNs. Firstly, we analyze an efficient and anonymous protocol and demonstrate that though this protocol is equipped with a formal proof, it actually has several security loopholes been overlooked, such that it cannot resist against smart card loss attack and violate forward secrecy. Secondly, we scrutinize a lightweight protocol and point out that it cannot achieve the claimed security goal of forward secrecy, as well as suffering from user anonymity violation attack and offline password guessing attack. Thirdly, we find that an anonymous scheme fails to preserve two critical properties of forward secrecy and user friendliness. In addition, by adopting the “perfect forward secrecy (PFS)” principle, we provide several effective countermeasures to remedy the identified weaknesses. To test the necessity and effectiveness of our suggestions, we conduct a comparison of 10 representative schemes in terms of the underlying cryptographic primitives used for realizing forward secrecy.

Trajectory Planning under Current-State Opacity Constraints

Privacy and security guarantee against curious observers or malicious actors has recently emerged as a critical aspect for maintaining, protecting, and securing complex automated systems that are implemented over shared (thus, non-secure) cyber-infrastructures, such as the Internet. In this paper, we discuss how current-state opacity formulations can be used to capture privacy properties of interest in automated systems that are modeled as controlled finite automata that need to be steered from one state (initial location) to another state (target location), while maintaining certain privacy guarantees. More specifically, given a deterministic finite automaton that is externally observed via some output mapping, along with a subset of states S that are considered critical/secret, we aim to drive it from a given initial state (starting location) to a given target state (final location) while ensuring that, in the process, the state (location) of the finite automaton at any given time is not exposed (i.e., the external observer cannot be certain that the state of the system belongs to the set of critical/secret states S). We develop two algorithms that can be used to solve this constrained trajectory planning problem and obtain an appropriate sequence of inputs (if one exists) or conclude that no such sequence exists (otherwise). The first algorithm has complexity O(N2N) and the second algorithm has complexity O(NK+2), where N (K) is the number of states (secret states).

Insertion Functions with Memory for Opacity Enforcement

We investigate the enforcement of opacity, an information-flow privacy property, using insertion sequences that modify the output of the system by event insertions. Previous work considered the problem of enforcing opacity under the assumption that the insertion functions were based on the observed system strings. Now, we investigate an extension of the previous method introducing a k-memory insertion mechanism. In this case, we store k consecutive events and we compute an insertion function for a k length event sequence. The k-memory insertion mechanism can be applied to a broader class of systems than the previously proposed insertion mechanism. The first contribution of this paper is the introduction of ik-enforceability. A system is ik-enforceable if we can apply k-memory insertion mechanism to enforce privacy. The second contribution of this paper is the development of a verification algorithm for ik-enforceability.