Security Building Blocks Research Articles

Repossession Through Community Participation: A Study of Vrihi Community Seed Bank in Odisha

Seeds are the building blocks of food security, and their free exchange amongst the farming community has formed the bedrock for maintaining genetic diversity in addition to food security and sovereignty. The appropriation of production, exchange, and marketing of seeds by the corporate over the past decades has altered the agricultural scene in the Global South. Given the conflicting perspectives, mandates, and practices of multiple stakeholders, this article attempts to critically evaluate seed policies in India considering the cultural, economic, and social undertones that characterise them. From the perspective of the sociology of science, this article attempts to trace the shifts in the decline of the ‘rural,’ erosion of national agriculture, policy gaps, and why values matter in India’s development narratives vis-à-vis science and technology solutions. Further, this article investigates, through a case study of Vrihi Community Seed Bank (CSB),1 located in the eastern state of Odisha, how CSBs are progressively being seen as a possible long-term solution to combat the diverse challenges posed by changing agro-climatic conditions, increasing corporatisation, and industrialisation of agricultural and allied practices of food production.

‘Covering all the [welfare] basics’: a critical policy study of the Expert Panel on Basic Income report in British Columbia, Canada

In 2018, British Columbia (BC), Canada’s third most populous province, announced the creation of an Expert Panel to explore the feasibility of introducing a basic income in BC. The Expert Panel on Basic Income prepared the policy report, Covering All the Basics: Reforms for a More Just Society, that responded to this task. Our research applies a critical policy studies approach to explore the ideologies, discursive strategies, and discourses embedded in and emanating from the report. In so doing, we find that the report reproduces problematic discourses about self-sufficiency, welfare dependency, and (poor) choice(s). Rather than discarding a basic income for the working-age population based on flawed assumptions and problematic beliefs, we invite policymakers to consider a more transformative vision that recognises the systemic roots of financial hardship, and embraces a basic income as a key building block of income security for BC and all of Canada.

CryptoCliqIn: Graph-Theoretic Cryptography Using Clique Injection

Because encryption is a fundamental security building block, existing encryption techniques like AES, Twofish, Blowfish, and Triple DES are constantly under the threat of being compromised. We introduce a simple graph-theoretic encryption method named CryptoCliqIn using clique injection and prove that the decryption of this encryption without the appropriate key is #P-complete. We have shown that the proposed model does not introduce delays in encryption and decryption times and provides a more secure mechanism compared to some of the existing encryption mechanisms. Finally, an adaptation of CryptoCliqIn in an intelligent system is discussed under the setup of intelligent and smart building.

VERICA - Verification of Combined Attacks

Physical attacks, including passive Side-Channel Analysis and active Fault Injection Analysis, are considered among the most powerful threats against physical cryptographic implementations. These attacks are well known and research provides many specialized countermeasures to protect cryptographic implementations against them. Still, only a limited number of combined countermeasures, i.e., countermeasures that protect implementations against multiple attacks simultaneously, were proposed in the past. Due to increasing complexity and reciprocal effects, design of efficient and reliable combined countermeasures requires longstanding expertise in hardware design and security. With the help of formal security specifications and adversary models, automated verification can streamline development cycles, increase quality, and facilitate development of robust cryptographic implementations.In this work, we revise and refine formal security notions for combined protection mechanisms and specifically embed them in the context of hardware implementations. Based on this, we present the first automated verification framework that can verify physical security properties of hardware circuits with respect to combined physical attacks. To this end, we conduct several case studies to demonstrate the capabilities and advantages of our framework, analyzing secure building blocks (gadgets), S-boxes build from Toffoli gates, and the ParTI scheme. For the first time, we reveal security flaws in analyzed structures due to reciprocal effects, highlighting the importance of continuously integrating security verification into modern design and development cycles.

A Secure Clinical Diagnosis With Privacy-Preserving Multiclass Support Vector Machine in Clouds

With the rapid growth of machine learning and artificial intelligence in medical cloud systems, cloud-aided medical computing has materialized a concrete platform for rapid realization of the service-oriented computing paradigm. However, using machine learning approaches in medical clouds might cause serious privacy leakage risk, for example, it needs to take the patients’ sensitive data as the inputs of the machine learning algorithm. In this article, we propose an efficient and privacy-preserving clinical diagnosis scheme that was performed by an (untrusted and malicious) outsourced cloud platform, which can provide the diagnosis assistance for doctors without leaking any sensitive information of patients and service providers. Concretely, we give the security model of privacy-preserving multiclass support vector machine (SVM) in outsourced medical clouds and design a secure clinical diagnosis scheme with privacy-preserving multiclass predecision and diagnosis. We propose a novel encoding approach to implement the encryption of negative number, and design several security building blocks, such as privacy-preserving decision function computing, privacy-preserving classification, and search of max decision function on encrypted fields, to provide the construction of the secure clinical diagnosis with privacy-preserving multiclass SVM. We give the concrete scheme and provide the experiment on Dermatology datasheet. Security analysis and experimental results indicate that the proposed scheme is efficient and practical in privacy-preserving clinical diagnosis systems.

System on Chip (SoC) for Invisible Electrocardiography (ECG) Biometrics.

Biometric identification systems are a fundamental building block of modern security. However, conventional biometric methods cannot easily cope with their intrinsic security liabilities, as they can be affected by environmental factors, can be easily “fooled” by artificial replicas, among other caveats. This has lead researchers to explore other modalities, in particular based on physiological signals. Electrocardiography (ECG) has seen a growing interest, and many ECG-enabled security identification devices have been proposed in recent years, as electrocardiography signals are, in particular, a very appealing solution for today’s demanding security systems—mainly due to the intrinsic aliveness detection advantages. These Electrocardiography (ECG)-enabled devices often need to meet small size, low throughput, and power constraints (e.g., battery-powered), thus needing to be both resource and energy-efficient. However, to date little attention has been given to the computational performance, in particular targeting the deployment with edge processing in limited resource devices. As such, this work proposes an implementation of an Artificial Intelligence (AI)-enabled ECG-based identification embedded system, composed of a RISC-V based System-on-a-Chip (SoC). A Binary Convolutional Neural Network (BCNN) was implemented in our SoC’s hardware accelerator that, when compared to a software implementation of a conventional, non-binarized, Convolutional Neural Network (CNN) version of our network, achieves a 176,270× speedup, arguably outperforming all the current state-of-the-art CNN-based ECG identification methods.

Convergence of Blockchain, k-medoids and homomorphic encryption for privacy preserving biomedical data classification

Data privacy on the Internet of Medical Things (IoMT) remains a critical concern when handling biomedical data. While extant studies focus on cryptography and differential privacy, few of them capture the utility and authenticity of data. As a result, data privacy remains the primary concern when training a machine learning (ML) model with IoMT data from various data sources/owners such as k − medoids. To overcome the above-mentioned issues, this study proposes secure ​k − medoids ​that are implemented together with Blockchain and partial homomorphic cryptosystem (Paillier) to ensure authenticity and protect all entities (i.e., data owner and data analyst) data privacy. The homomorphic property of Paillier is utilized to develop secure building blocks (i.e., secure polynomial operations, secure comparison, and secure biasing operations) to ensure data privacy and eliminate dependency on any third parties. We utilized three different biomedical datasets, and these are (I) Heart Disease Data (HDD), (II) Diabetes Data (DD), and (III) Breast Cancer Wisconsin Data (BCWD). Rigorous security analysis demonstrates that secure ​k − medoids ​protect against sensitive data breaches. It also showed superior performance in both BCWD (Accuracy 97.80%, Precision 96.83%, and Recall 99.80%) and HDD (Accuracy 82.50%, Precision 81.28%, and Recall 80.50%) datasets, respectively. However, similar performance was not reflected in the case of the DD dataset. Furthermore, the study explains why such performance results are observed. In addition, the proposed system has been proven to take less execution time compared to the extant studies.

Efficient Secure Building Blocks With Application to Privacy Preserving Machine Learning Algorithms

Nowadays different entities (such as hospitals, cyber security companies, banks, etc.) collect data of the same nature but often with different statistical properties. It has been shown that if these entities combine their privately collected datasets to train a machine learning model, they would end up with a trained model that often outperforms the human experts of the corresponding field(s) in terms of classification accuracy. However, due to judicial, privacy and cost reasons, no entity is willing to share their data with others. We have the same problem during the classification (inference) stage. Namely, the user doesn't want to reveal any information about his query or its' final classification, while the owner of the trained model wants to keep this model private. In this article we overcome these drawbacks by firstly introducing novel efficient secure building blocks for general purpose, which can also be used to build privacy preserving machine learning algorithms for both training and classification (inference) purposes under strict privacy and security requirements. Our theoretical analysis and experimentation results show that our building blocks (hence also our privacy preserving algorithms which are built on top of them) are more efficient than most (if not all) of the state-of-the-art schemes in terms of computation and communication cost, as well as security characteristics in the semi-honest model. Furthermore, and to the best of our knowledge, for the Naïve Bayes model we extend this efficiency for the first time to also deal with active malicious users, which arbitrarily deviate from the protocol.

Efficient and Secure Outsourcing of Differentially Private Data Publishing With Multiple Evaluators

Since big data becomes a main impetus to the next generation of IT industry, data privacy has received considerable attention in recent years. To deal with the privacy challenges, differential privacy has been widely discussed and related private mechanisms are proposed as privacy-enhancing techniques. However, with today’s differential privacy techniques, it is difficult to generate a sanitized dataset that can suit every machine learning task. In order to adapt to various tasks and budgets, different kinds of privacy mechanisms have to be implemented, which inevitably incur enormous costs for computation and interaction. To this end, in this article, we propose two novel schemes for outsourcing differential privacy. The first scheme efficiently achieves outsourcing differential privacy by using our preprocessing method and secure building blocks. To support the queries from multiple evaluators, we give the second scheme that employs a trusted execution environment to aggregately implement privacy mechanisms on multiple queries. During data publishing, our proposed schemes allow providers to go off-line after uploading their datasets, so that they achieve a low communication cost which is one of the critical requirements for a practical system. Finally, we report an experimental evaluation on UCI datasets, which confirms the effectiveness of our schemes.

Distributed Security Framework for Reliable Threat Intelligence Sharing

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

Privacy-Preserving Support Vector Machine Training Over Blockchain-Based Encrypted IoT Data in Smart Cities

Machine learning (ML) techniques have been widely used in many smart city sectors, where a huge amount of data is gathered from various (IoT) devices. As a typical ML model, support vector machine (SVM) enables efficient data classification and thereby finds its applications in real-world scenarios, such as disease diagnosis and anomaly detection. Training an SVM classifier usually requires a collection of labeled IoT data from multiple entities, raising great concerns about data privacy. Most of the existing solutions rely on an implicit assumption that the training data can be reliably collected from multiple data providers, which is often not the case in reality. To bridge the gap between ideal assumptions and realistic constraints, in this paper, we propose secureSVM , which is a privacy-preserving SVM training scheme over blockchain-based encrypted IoT data. We utilize the blockchain techniques to build a secure and reliable data sharing platform among multiple data providers, where IoT data is encrypted and then recorded on a distributed ledger. We design secure building blocks, such as secure polynomial multiplication and secure comparison, by employing a homomorphic cryptosystem, Paillier, and construct a secure SVM training algorithm, which requires only two interactions in a single iteration, with no need for a trusted third-party. Rigorous security analysis prove that the proposed scheme ensures the confidentiality of the sensitive data for each data provider as well as the SVM model parameters for data analysts. Extensive experiments demonstrates the efficiency of the proposed scheme.

<inline-formula> <tex-math notation="LaTeX">$PROST$ </tex-math> </inline-formula>: Privacy-Preserving and Truthful Online Double Auction for Spectrum Allocation

Spectrum auction is an effective way to redistribute scarce spectrum resources. However, most spectrum auction designs only target at economic robustness, while neglecting the inherent privacy leakage problem. Existing secure spectrum auction mechanisms fail to provide adequate security, and they all neglect the online fashion of spectrum request arrival. In this paper, for the first time, we propose a Privacy-pReserving and truthful Online double auction mechanism for Spectrum allocaTion in wireless networks, PROST . Compared with the state-of-the-art solutions, PROST provides a comprehensive and strong protection for users’ sensitive information, especially for location privacy and time dynamics. PROST is constructed based on our carefully designed security building blocks, which support various arithmetics over encrypted real numbers, and they are also well applicable in other spectrum auctions. Besides, we improve on the existing online spectrum auction mechanisms by designing a novel privacy-preserving buyer grouping protocol for spectrum reuse. We not only theoretically prove that PROST can realize an all-round security against semi-honest adversaries but also extensively evaluate its performance. Experimental results validate that PROST achieves nice spectrum allocation efficiency with light computation and communication costs.

Fighting Novel Diseases amidst Humanitarian Crises.

The Democratic Republic of the Congo is facing two crises: a potentially explosive Ebola epidemic and a major insurgency. But they are not wholly distinct from each other: the first is intertwined with the second, and public mistrust and political violence add a dangerous dimension to the Ebola epidemic. The World Health Organization and other health emergency responders will increasingly find themselves fighting outbreaks in insecure, misgoverned or ungoverned zones, possibly experiencing active conflict. Yet the WHO has neither the mission nor the capabilities to navigate these security threats. We cannot expect that the usual public health strategy will succeed when health workers' lives are directly imperiled and community resistance runs deep. Tackling health emergencies amidst complex humanitarian crises requires fresh thinking. Here, we offer a blueprint for fighting diseases in complex humanitarian emergencies. The building blocks of security and trust include high-level political support, street-level diplomacy, community engagement, enhanced funding, and protection of health professionals working in conflict or disaster zones.

Information Security Using the Ensemble Approach of Steganography and Cryptography

Information security is a buzz world that has made the working philosophy of businesses, administration and society more complex. Cryptography and steganography are the twin technologies that form the building block of data security in various operating environments including the networked systems. We find that most of the security endeavors use these technologies in isolation. We propose that data can be made more secure by applying the multifold fold techniques wherein we convert the plain text into cipher text and then embed it to other media by applying steganography technique. We establish that this ensemble approach can make the security feature more robust.

Enhanced Mutual Authenticated Key Agreement Protocol for Anonymous Roaming Service in Global Mobility Networks

With the rapid development of mobile intelligent terminals, users can enjoy ubiquitous life in global mobility networks (GLOMONET). It is essential to secure user information for providing secure roaming service in GLOMONET. Recently, Xu et al. proposed a mutual authentication and key agreement (MAKA) protocol as the basic security building block. The purpose of this paper is not only to show some security problems in Xu et al.’s MAKA protocol and but also proposes an enhanced MAKA protocol as a remedy protocol for Xu et al.’s MAKA protocol. The proposed protocol ensures higher security compared to the well-known authentication and key agreement protocols but has a bit computational overhead than them due to the security enhancements.

NOSArmor: Building a Secure Network Operating System

Software-Defined Networking (SDN), controlling underlying network devices (i.e., data plane) in a logically centralized manner, is now actively adopted in many real world networking environments. It is clear that a network administrator can easily understand and manage his networking environments with the help of SDN. In SDN, a network operating system (NOS), also known as an SDN controller, is the most critical component because it should be involved in all transactions for controlling network devices, and thus the security of NOS cannot be highly exaggerated. However, in spite of its importance, no previous works have thoroughly investigated the security of NOS. In this work, to address this problem, we present the NOSArmor, which integrates several security mechanisms, named as security building block (SBB), into a consolidated SDN controller. NOSArmor consists of eight SBBs and each of them addresses different security principles of network assets. For example, while role-based authorization focuses on securing confidentiality of internal storage from malicious applications, OpenFlow protocol verifier protects availability of core service in the controller from malformed control messages received from switches. In addition, NOSArmor shows competitive performance compared to existing other controllers (i.e., ONOS, Floodlight) with secureness of network assets.

SECMACE: Scalable and Robust Identity and Credential Management Infrastructure in Vehicular Communication Systems

Several years of academic and industrial research efforts have converged to a common understanding on fundamental security building blocks for the upcoming vehicular communication (VC) systems. There is a growing consensus toward deploying a special-purpose identity and credential management infrastructure, i.e., a vehicular public-key infrastructure (VPKI), enabling pseudonymous authentication, with standardization efforts toward that direction. In spite of the progress made by standardization bodies (IEEE 1609.2 and ETSI) and harmonization efforts [Car2Car Communication Consortium (C2C-CC)], significant questions remain unanswered toward deploying a VPKI. Deep understanding of the VPKI, a central building block of secure and privacy-preserving VC systems, is still lacking. This paper contributes to the closing of this gap. We present SECMACE, a VPKI system, which is compatible with the IEEE 1609.2 and ETSI standards specifications. We provide a detailed description of our state-of-the-art VPKI that improves upon existing proposals in terms of security and privacy protection, and efficiency. SECMACE facilitates multi-domain operations in the VC systems and enhances user privacy, notably preventing linking pseudonyms based on timing information and offering increased protection even against honest-but-curious VPKI entities. We propose multiple policies for the vehicle–VPKI interactions and two large-scale mobility trace data sets, based on which we evaluate the full-blown implementation of SECMACE. With very little attention on the VPKI performance thus far, our results reveal that modest computing resources can support a large area of vehicles with very few delays and the most promising policy in terms of privacy protection can be supported with moderate overhead.

Hash Chain based Key Management for Mobile Heterogeneous Sensor Network

Key management is an important issue for wireless sensor networks because sensors have limited resources as memory, processing speed and battery power. Key management is one of the basic building blocks of sensor network security. Many protocol presented before didn’t take much attention on mobility of node. In this paper, we proposed Hass Chain based key management scheme for Heterogeneous networks where Base Station and cluster head are fixed and other node moving around these heads. Compare to other basic key management scheme, proposed scheme increase resilience against node capture as well as consider memory limitations.

인지무선네트워크를 위한 회전자 기반 적응형 보안프레임워크 설계

최근 들어 IT 분야에 하나나 그 이상의 기술들이 하나의 장치에 결합되는 융합이 활발히 진행되고 있다. 특히, 기학급수적으로 증가하는 방송 및 통신 시스템으로 인해 무선 주파수 자원의 고갈 문제가 심각하게 대두되고 있다. 이와 같은 주파수 고갈과 비효율적인 주파수 사용 문제를 해결하기 위해 유휴 주파수를 합리적으로 이용하기 위한 융합기술인 인지무선 기술이 많은 관심을 받고 있다. 하지만 융합을 통해 개별적으로 제공되던 기존 서비스에 새로 개발된 기술들이 결합됨으로서 기존에는 존재하지 않았던 새로운 보안 문제들을 야기할 수 있다. 본 논문의 목적은 통신 융합응용 기술로서 인지무선네트워크를 위한 회전자 기반 적응형 보안프레임워크를 제안한다. 제안한 적응형 보안프레임워크는 위치정보에 기반한 회전자를 프라이버시 및 다양한 보안을 제공하기 위한 보안 기법들에 필요한 공유키 설정을 위한 기초로 이용한다. 본 논문에서 제안한 적응형 보안프레임워크는 인지무선네트워크 표준들을 포함한 다양한 융합응용의 보안 기반 구조로 활용될 수 있을 것이다.

ESF: an efficient security framework for wireless sensor network

A wireless sensor network WSN consists of a large number of resource constrained sensor nodes, usually deployed in hostile environments, where they face a variety of malicious attacks. To address the security vulnerabilities in WSN, this paper proposes an efficient security framework ESF, which comprises of two security building blocks. The first one security building block is to establish key between the sending and receiving nodes while other component provides confidentiality and integrity of data. Owing to the limited resources available with the sensor nodes, ESF avoids intensive computations like public key cryptography and encryption mechanisms. Analysis of ESF shows that the framework provides a secure environment and resistant against the wireless threats using simple bit-wise operations and cryptographic hash functions.