Revocation Procedure Research Articles

Enhanced Cauchy Matrix Reed-Solomon Codes and Role-Based Cryptographic Data Access for Data Recovery and Security in Cloud Environment

In computer systems ensuring proper authorization is a significant challenge, particularly with the rise of open systems and dispersed platforms like the cloud. Role-Based Access Control (RBAC) has been widely adopted in cloud server applications due to its popularity and versatility. When granting authorization access to data stored in the cloud for collecting evidence against offenders, computer forensic investigations play a crucial role. As cloud service providers may not always be reliable, data confidentiality should be ensured within the system. Additionally, a proper revocation procedure is essential for managing users whose credentials have expired. With the increasing scale and distribution of storage systems, component failures have become more common, making fault tolerance a critical concern. In response to this, a secure data-sharing system has been developed, enabling secure key distribution and data sharing for dynamic groups using role-based access control and AES encryption technology. Data recovery involves storing duplicate data to withstand a certain level of data loss. To secure data across distributed systems, the erasure code method is employed. Erasure coding techniques, such as Reed-Solomon codes, have the potential to significantly reduce data storage costs while maintaining resilience against disk failures. In light of this, there is a growing interest from academia and the corporate world in developing innovative coding techniques for cloud storage systems. The research goal is to create a new coding scheme that enhances the efficiency of Reed-Solomon coding using the sophisticated Cauchy matrix to achieve fault tolerance

귀화허가취소제도의 개선방안

The current revocation system of naturalization is not likely to initiate the revocation procedure because the basis clauses are incorrectly formed, the regulated acts cannot be clearly specified, and there is no reporting system in place. In addition, it is stipulated that the revocation procedure will be opened too late by allowing the Minister of Justice to initiate the cancellation procedure only after the conviction is finalized by forging or falsifying documents proving family relations. Overall, the current system of the revocation of naturalization permits is not sufficient to eliminate the illegal status obtained by foreign nationals abusing the naturalization system to pursue their own interests.
 In order to secure the effectiveness of the naturalization permission cancellation system, the types of acts stipulated in Article 21 of the Nationality Act and Article 27, Paragraph 1 of the Enforcement Decree of the Nationality Act must be integrated and reorganized. And “malignant abandonment of spouse” should be added as one reason for cancellation. Article 21, Paragraph 1 of the Nationality Act shall be amended as follows. The Minister of Justice may revoke the permission or judgment of a person who has been granted permission for naturalization, recovery of nationality, permission to renounce nationality, or judgment of holding nationality by making a false statement or forging or altering evidential documents for the purpose of obtaining permission for naturalization, etc. The same shall also apply to cases where a spouse is maliciously abandoned or a legal relationship that has resulted in the acquisition of nationality is falsely entered into.
 It is proposed to introduce a reporting system so that the naturalization permission revocation system can be operated effectively. The current revocation system does not have a notification system, so the possibility of the Minister of Justice initiating the revocation procedure is remarkably low. The fact that naturalization was granted illegally can only be known by those who have observed it over a long period of time. Therefore, Article 21-2 of the Nationality Act should be newly established as follows. ① Anyone who believes that a person has obtained permission for naturalization, etc. by making a false statement, oath, or forging or altering evidential documents may report the fact to the Ministry of Justice. ② When a public official believes that a person has obtained permission for naturalization by making a false statement or oath or forging or falsifying evidential documents in the course of performing his/her duties, he or she shall report the fact to the Ministry of Justice.

집행유예 취소와 적법절차

Under the revision of the Penal Code in 1995, it became possible to attach probation as a condition to the suspension of execution of sentence. Before the revision, a suspension could be revoked only at the time of sentencing if it was discovered that due to legal restraints, the suspension would otherwise have been disqualified. If a person who was sentenced the suspension of execution of sentence with the condition of probation (hereinafter referred to as ‘the sentenced person’) is found to have seriously breeched the probation obligation, revocation procedure can be initiated. After reviewing whether or not the breech had actually occurred and assessing the gravity of the breech, the courts will render a decision as to revocation of the suspension. If the suspension is revoked, the sentenced person will be imprisoned for the original sentence.
 Because the revocation deprives the sentenced person of liberty, special care must be taken to adhere to the due process of law principle during the revocation procedure. Although securing the level of due process protection in revocation procedure would be difficult to attain to the level for the accused in criminal procedure, reasonable protections must be provided unless they conflict with the status of the sentenced person.
 The sentenced person must be given the opportunity to present evidence in his or her favor and to speak against any adverse evidence in open hearing. In special situations such as the sentenced person is in custody or is indigent, legal assistance must be provided according to the due process of law principle. These would provide the minimum level of protection. Especially in the revocation procedure of probation attached cases there must exist a more prudent and effectual hearing process in ascertaining the existence and gravity of the breaches. The Korean Criminal Procedure Act only requires that the court hear the sentenced person’s opinion regarding revocation with or without an open hearing thereby failing to offer minimum procedural protection.
 Strict evidence rules of typical criminal trials are not directly applied to the revocation hearing due to the basic differences of both procedures but could be used within a reasonable scope. In addition, through developing fair and objective revocation guidelines, unwarranted disparities in revocation decisions can be avoided or at the very least minimized.

Efficient and Secure Group based Collusion Resistant Public Auditing Scheme for Cloud Storage

Tremendous changes have been seen in the arena of cloud computing from previous years. Many organizations share their data or files on cloud servers to avoid infrastructure and maintenance costs. Employees from different departments create their specific groups and share sensitive information among group members. Revoked users from the group may try to access this information by colluding with an untrusted cloud server. Many researchers have specified revocation procedures using re-signature, proxy-re-signature concept to deflect the collusion between the cloud server and a revoked user. But these techniques are costly in terms of communication overhead and verification cost if combined with auditing techniques to prove the integrity of outsourced data on the cloud server. To reduce this cost, a collusion resistant public auditing scheme with group member revocation is proposed in this paper. In this scheme, the data owner regularly updates the recent valid members list which is used by a third-party auditor to validate the signature so that collusion can be avoided. To verify the integrity of outsourced data, proposed scheme uses one of the modern cryptographic technique indistinguishability obfuscation combined with a one-way function which can reduce the verification time significantly. Experimental results show that the proposed scheme decreases the communication overhead and verification cost compared to existing schemes.

Revocable identity-based encryption with bounded decryption key exposure resistance: Lattice-based construction and more

In general, identity-based encryption (IBE) does not support an efficient revocation procedure. In ACM CCS'08, Boldyreva et al. proposed revocable identity-based encryption (RIBE), which enables us to efficiently revoke (malicious) users in IBE. In PKC 2013, Seo and Emura introduced an additional security notion for RIBE, called decryption key exposure resistance (DKER). Roughly speaking, RIBE with DKER guarantees that the security is not compromised even if an adversary gets (a number of) short-term decryption keys. Therefore, DKER captures realistic scenarios and is an important notion.In this paper, we introduce bounded decryption key exposure resistance (B-DKER), where an adversary is allowed to get a-priori bounded number of short-term decryption keys in the security game. B-DKER is a weak version of DKER, but it seems to be sufficient for practical use. We obtain the following results:•We propose a lattice-based (anonymous) RIBE scheme with B-DKER, which is the first lattice-based construction resilient to decryption key exposure. Our lattice-based construction is secure under the learning with errors assumption. A previous lattice-based construction satisfies anonymity but is vulnerable even with a single decryption key exposure.•We propose the first pairing-based RIBE scheme that simultaneously realizes anonymity and B-DKER. Our pairing-based construction is adaptively secure under the symmetric external Diffie-Hellman assumption.Our two constructions rely on cover free families to satisfy B-DKER, whereas all the existing works rely on the key re-randomization property to achieve DKER.

Enhanced certificate revocation scheme with justification facility in mobile ad-hoc networks

MANETs cover immersed interests owing to their effortlessness in deployment and mobility. Dynamic environments make them defenceless to a variety of protection attacks while compared to static networks. The foremost confront is to assure safe transmission services in which certificate revocation is significant to protect unwanted activities in the network. This paper proposes an Enhanced Certificate Revocation Scheme with Justification Facility (ECRSJF) for certificate revocation to separate attackers from additional participation in network performance. In addition, to enhance the dependability of the methodology, we recuperate cautioned nodes to include in the certificate revocation procedure. To improve the correctness, we suggest a threshold-related method to evaluate and justify cautioned nodes as legal nodes. The overall performance of the ECRSJF scheme is evaluated by simulation. The performance results reveal that the certificate revocation scheme is successful and competent to protected communication in MANETs. The simulation results prove that our projected scheme provides the packet delivery ratio and revocation rate as 91% and 95% respectively. These results are better compared to those of the other existing schemes even in the presence of large number of attacker nodes.

A Review of a Decade of Limitation and Revocation Procedures at the EPO

The limitation and revocation procedures were introduced, by Article 105a-c EPC, at the European Patent Office (EPO) with the revision of the European Patent Convention (EPC), which entered into force on 13 December 2007. In the history of the European Patent Office, the limitation and revocation procedures are the only new procedures introduced since the founding. They offer an additional possibility to patent proprietors to centrally limit or revoke their patents, without having to enter the corresponding national procedures. After more than a decade from their entry into force, this article will address the main procedural aspects of both procedures, providing practitioners better chances of success. This article will also shed light on statistical data relating to both procedures. For more details, refer to the EPC and to the Guidelines for Examination in the European Patent Office, Part D-X.

Revocable identity-based proxy re-signature against signing key exposure.

Identity-based proxy re-signature (IDPRS) is a novel cryptographic primitive that allows a semi-trusted proxy to convert a signature under one identity into another signature under another identity on the same message by using a re-signature key. Due to this transformation function, IDPRS is very useful in constructing privacy-preserving schemes for various information systems. Key revocation functionality is important in practical IDPRS for managing users dynamically; however, the existing IDPRS schemes do not provide revocation mechanisms that allow the removal of misbehaving or compromised users from the system. In this paper, we first introduce a notion called revocable identity-based proxy re-signature (RIDPRS) to achieve the revocation functionality. We provide a formal definition of RIDPRS as well as its security model. Then, we present a concrete RIDPRS scheme that can resist signing key exposure and prove that the proposed scheme is existentially unforgeable against adaptive chosen identity and message attacks in the standard model. To further improve the performance of signature verification in RIDPRS, we introduce a notion called server-aided revocable identity-based proxy re-signature (SA-RIDPRS). Moreover, we extend the proposed RIDPRS scheme to the SA-RIDPRS scheme and prove that this extended scheme is secure against adaptive chosen message and collusion attacks. The analysis results show that our two schemes remain efficient in terms of computational complexity when implementing user revocation procedures. In particular, in the SA-RIDPRS scheme, the verifier needs to perform only a bilinear pairing and four exponentiation operations to verify the validity of the signature. Compared with other IDPRS schemes in the standard model, our SA-RIDPRS scheme greatly reduces the computation overhead of verification.

Road-to-Vehicle Communications With Time-Dependent Anonymity: A Lightweight Construction and Its Experimental Results

This paper describes techniques that enable vehicles to collect local information (such as road conditions and traffic information) and report it via road-to-vehicle communications. To exclude malicious data, the collected information is signed by each vehicle. In this communication system, the location privacy of vehicles must be maintained. However, simultaneously linkable information (such as travel routes) is also important. That is, no such linkable information can be collected when full anonymity is guaranteed using cryptographic tools such as group signatures. Similarly, continuous linkability (via pseudonyms, for example) may also cause problem from the viewpoint of privacy. In this paper, we propose a road-to-vehicle communication system with relaxed anonymity via group signatures with time-token dependent linking (GS-TDL). Briefly, a vehicle is unlinkable unless it generates multiple signatures in the same time period. We provide our experimental results (using the RELIC library on a cheap and constrained computational power device, Raspberry Pi) and simulate our system by using a traffic simulator (PTV), a radio wave propagation analysis tool (RapLab), and a network simulator (QualNet). Though a similar functionality of time-token-dependent linking was proposed by Wu et al. (“Balanced trustworthiness, safety, and privacy in vehicle-to-vehicle communications,” IEEE Trans. Veh. Technol., vol. 59, 2010), we can show an attack against the scheme where anyone can forge a valid group signature without using a secret key. In contrast, our GS-TDL scheme is provably secure. In addition to the time-dependent linking property, our GS-TDL scheme supports verifier-local revocation, where a signer (vehicle) is not involved in the revocation procedure. It is particularly worth noting that no secret key or certificate of a signer (vehicle) must be updated, whereas the security credential management system must update certificates frequently for vehicle privacy. Moreover, our technique maintains constant signing and verification costs by using the linkable part of signatures. This might be of independent interest.

Secure and reliable communication scheme for MANET using ECMS cluster head-based certificate revocation

Mobile ad hoc networks (MANETs) have received increasing attention due to their ease of deployment and mobility. However, MANETs are more suspicious to various malicious activates and unauthorized access. In order to overcome this issue, we have proposed a cluster based certificate revocation method to isolate the malicious node and prevent the unauthorized access. The proposed algorithm effectively used to solve security issues in MANET. The proposed framework is demonstrated as following blocks, namely, cluster construction, cluster head selection, certificate authority, node classification, certificate revocation and evaluation of false accusations. Especially, we have proposed ECMS algorithm for identifying the best cluster head in each cluster. The ECMS algorithm is stands for energy (E), connectivity (C), mobility (M) and signal to noise ratio (S). The sensor nodes present in the network are classified into three types, namely, normal node, warned node, and revoked node. In certificate revocation procedure, every node present in the network is monitored with the help of one-hop neighbours. These neighbours are also used to collect the malicious information about the sensor nodes. If any node is wrongly identified as a malicious node then its legitimate nodes send the vindication packets (VPs) to the appropriate gateways to correct the mistake. The performance of the proposed cluster based certificate revocation method is evaluated on the basis of various parameters it includes successful certification ratio (SSR), settling time (ST), average certification delay (ACD), packet delivery ratio, normalized overhead (NRO), end-to-end delay and throughput. The simulation results of the proposed algorithm are compared with the trust based algorithm, non-voting based algorithm and voting based algorithm. The experimental results proved the good performance of the proposed cluster based certificate revocation method.

Communication-efficient revocable identity-based signature from multilinear maps

An efficient revocation mechanism is absolutely necessary for a cryptosystem with a large number of users to strengthen the system security. Besides the integrity and authentication of messages, a revocable identity-based signature scheme also provides a public way to remove those users whose credentials are expired or whose private keys are compromised from the system. In the existing revocable identity-based signature schemes, the workload of the authority performing the revocation procedure is linear or logarithmic in the number of non-revoked users, which decrease its usability in many practical scenarios (e.g., ad hoc networks) that are sensitive of bandwidth. In this study, we propose the first revocable identity-based signature scheme with constant sizes of private key, update key and signature by using multilinear maps. The security of the proposed scheme is proven in the selective-revocation list and adaptive-message setting, without random oracles. Performance discussions show that our scheme owns advantages in terms of functionality and efficiency.

Cryptanalysis and Improvement of "A Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks".

Proxy Mobile IPv6 is a network-based localized mobility management protocol that supports mobility without mobile nodes’ participation in mobility signaling. The details of user authentication procedure are not specified in this standard, hence, many authentication schemes have been proposed for this standard. In 2013, Chuang et al., proposed an authentication method for PMIPv6, called SPAM. However, Chuang et al.’s Scheme protects the network against some security attacks, but it is still vulnerable to impersonation and password guessing attacks. In addition, we discuss other security drawbacks such as lack of revocation procedure in case of loss or stolen device, and anonymity issues of the Chuang et al.’s scheme. We further propose an enhanced authentication method to mitigate the security issues of SPAM method and evaluate our scheme using BAN logic.

Orthus v2 Authentication Protocol Enhancement, and Supporting Enterprise Architecture

Abstract The message negotiations involved in the Orthus authentication protocol for self-contained realms are a matter of prior publication. Orthus provides Authentication of a compliant entity to a realm, and a clear demarcation between realm membership verification and service access. Version II of the protocol introduces some security enhancements. Furthermore, functional descriptions of the supplementary application and functioning of supporting services and architecture in the Enterprise Environment are provided. Namely, those protocol exchanges necessary for the establishment of realm-to-realm trusts, and hierarchies, including a remote realm location protocol, and security hardening functions such as key revocation and re-issue procedures are described.

Keeping it simple!!! Supreme Court of India streamlines patent revocation procedures

Keeping it simple!!! Supreme Court of India streamlines patent revocation procedures

Anr-Hiding Revocable Group Signature Scheme: Group Signatures with the Property of Hiding the Number of Revoked Users

If there are many displaced workers in a company, then a person who goes for job hunting might not select this company. That is, the number of members who quit is quite negative information. Similarly, in revocable group signature schemes, if one knows (or guesses) the number of revoked users (sayr), then one may guess the reason behind such circumstances, and it may lead to harmful rumors. However, no previous revocation procedure can achieve hidingr. In this paper, we propose the first revocable group signature scheme, whereris kept hidden, which we callr-hiding revocable group signature. To handle this property, we newly define the security notion called anonymity with respect to the revocation which guarantees the unlinkability of revoked users.

Efficient revocation in ciphertext-policy attribute-based encryption based cryptographic cloud storage

It is secure for customers to store and share their sensitive data in the cryptographic cloud storage. However, the revocation operation is a sure performance killer in the cryptographic access control system. To optimize the revocation procedure, we present a new efficient revocation scheme which is efficient, secure, and unassisted. In this scheme, the original data are first divided into a number of slices, and then published to the cloud storage. When a revocation occurs, the data owner needs only to retrieve one slice, and re-encrypt and re-publish it. Thus, the revocation process is accelerated by affecting only one slice instead of the whole data. We have applied the efficient revocation scheme to the ciphertext-policy attribute-based encryption (CP-ABE) based cryptographic cloud storage. The security analysis shows that our scheme is computationally secure. The theoretically evaluated and experimentally measured performance results show that the efficient revocation scheme can reduce the data owner’s workload if the revocation occurs frequently.

An IBC and certificate based hybrid approach to WiMAX security

Worldwide inter-operability for microwave access (WiMAX) is a promising technology that provides high data throughput with low delays for various user types and modes of operation. While much research had been conducted on physical and MAC layers, little attention has been paid to a comprehensive and efficient security solution for WiMAX. We propose a hybrid security solution combining identity-based cryptography (IBC) and certificate based approaches. We provide detailed message exchange steps in order to achieve a complete security that addresses the various kind of threats identified in previous research. While attaining this goal, efficient fusion of both techniques resulted in a 53% bandwidth improvement compared to the standard's approach, PKMv2. Also, in this hybrid approach, we have clarified the key revocation procedures and key lifetimes. Consequently, to the best of knowledge our approach is the first work that unites the advantages of both techniques for improved security while maintaining the low overhead for WiMAX.

유비쿼터스 전자거래를 위한 쓰레시홀드 링 그룹 서명

유비쿼터스 전자거래를 통하여 사용자는 언제 어디서나 네트워크에 접근하여 편리한 정보를 개인과 그룹, 그룹과 그룹 사이에서 교환할 수 있다. 사용자가 이러한 유비쿼터스 전자거래를 안전하게 사용하기 위해서는, 전자 정보의 무결성과 인증의 특성을 가지는 디지털 서명이 필수 조건이다. 유비쿼터스 네트워크에서의 디지털 서명은 언제 어디서나 필요에 따라 그룹을 만들기도 하고 해체하기도 하므로, 유비쿼터스 전자거래는 신뢰된 그룹 관리자와 셋업 프로시져 철회 프로시져 등이 필요 없는 디지털 서명이 요구된다. 따라서 본 논문에서는 안전한 유비쿼터스 전자거래를 위한 디지털 서명으로서 쓰레시홀드 링 서명을 제안한다. 제안된 디지털 서명은 위조의 위험이 없는(무결성) 링 서명과 메시지가 다른 서명자에 의해 서명되는 것을 증명할 수 없는 문제를 해결하는(인증) (n,t)링 서명을 사용한다. 그러므로 제안된 쓰레시홀드 링 서명은 무결성과 인증을 만족하는 차세대 유비쿼터스 그룹 서명이다. Ubiquitous electronic commerce can offer anytime, anywhere access to network and exchange convenient informations between individual and group, or between group and group. To use secure ubiquitous electronic commerce, it is essential for users to have digital signature with the properties of integrity and authentication. The digital signature for ubiquitous networks is required neither a trusted group manager, nor a setup procedure, nor a revocation procedure etc. because ubiquitous networks can construct or deconstruct groups anytime, anwhere as occasion demands. Therefore, this paper proposes a threshold ring signature as digital signature for secure ubiquitous electronic commerce using the ring signature without forgery (integrity) and the (n,t) ring signature solving the problem cannot prove the fact which a message is signed by other signer. Thus the proposed threshold ring signature is ubiquitous group signature for the next generation.

Revocation by consent: The United States Parole Commission's expedited revocation procedure

This article examines the United States Parole Commission's development and use of an expedited revocation procedure for parole violations not involving serious new felony offenses. The majority of parole revocation proceedings involve charges of administrative violations (such as alcohol abuse, drug use, or failure to report) or misdemeanor offenses, and most parolees charged with such violations admit them. When there is no dispute as to the charged violation, the sole issue is the determination of the appropriate sanction. In 1996, the commission began a pilot project designed to expedite the processing of parole violations involving administrative, misdemeanor, and lesser felony charges. Certain alleged parole violators were given the option of waiving the right to a revocation hearing, acknowledging responsibility for the charged violation, and accepting a specified revocation penalty determined by the commission on the basis of the case record. The goal was to conserve commission resources without negatively affecting the due process rights of the alleged parole violator or the integrity of the guideline system used to sanction parole violations. In 1998, the commission incorporated the expedited revocation procedure developed in the pilot project into its permanent regulations. By FY 2003, expedited revocation determinations accounted for 40 percent of all commission revocation actions. The savings generated by the expedited revocation procedure allowed the commission to devote more resources to conducting revocation hearings involving more serious and/or contested charges.

PKI design based on the use of on-line certification authorities

Public-key infrastructures (PKIs) are considered the basis of the protocols and tools needed to guarantee the security of new Internet applications like electronic commerce, government-citizen relationships and digital distribution. This paper introduces a new infrastructure design, Cert’eM, a key management and certification system that is based on the structure of the electronic mail service and on the principle of near-certification. Cert’eM provides a secure means to identify users and distribute their public-key certificates, enhances the efficiency of revocation procedures, and avoids scalability and synchronization problems. Because we have considered the revocation problem as priority in the design process and a big influence in the rest of the PKI components, we have developed an alternative solution to the use of certificate revocation lists (CRLs). This has become one of the strongest points of this new scheme.