Leakage Of Sensitive Information Research Articles

A certificateless aggregate signature scheme for security and privacy protection in VANET

In the vehicular ad hoc network, moving vehicles can keep communicating with each other by entering or leaving the network at any time to establish a new connection. However, since many users transmit a substantial number of messages, it may cause reception delays and affect the entire system. A certificateless aggregate signature scheme can provide a signature compression that keeps the verification cost low. Therefore, it is beneficial for environments constrained by time, bandwidth, and storage, such as vehicular ad hoc network. In recent years, several certificateless aggregate signature schemes have been proposed. Unfortunately, some of them still have some security and privacy issues under specific existing attacks. This article offers an authentication scheme that can improve security, privacy, and efficiency. First, we apply the certificateless aggregate signature method to prevent the onboard unit devices from leaking sensitive information when sending messages. The scheme is proven to be secure against the Type-1 [Formula: see text] and Type-2 [Formula: see text] adversaries in the random oracle model under the computational Diffie–Hellman problem assumption. Then, the performance evaluation demonstrates that our proposed scheme is more suitable for deployment in vehicular ad hoc network environments.

Status of bring-your-own-device (BYOD) security practices in Australian hospitals – A national survey

ObjectiveThe use of personal devices for work purposes (BYOD) is in high demand among healthcare professionals as it improves productivity. However, it can also lead to an increased risk of leaking sensitive patient information, being a major challenge for hospital management. The authors identified a dearth of empirical studies concerning BYOD security practices in hospitals. Hence, the aim of the paper was to report BYOD security practices in Australian hospitals through a national survey, first of its kind. MethodsOnline survey was conducted among hospital IT personnel, enquiring about BYOD security practices. 28 responses were collected (21 hospital groups; 7 standalone hospitals), representing approximately 100 public hospitals. Descriptive statistical analysis and cross-tabulation were carried out on survey data. ResultsBYOD was generally allowed across most device types (smartphone:100%; tablet:70%; laptop:70%) and operating systems (apple:100%; android:96%; windows:74%), but generally for the use of basic services such as email (100%). Majority of hospitals use generic security technologies (firewall:87%; two-factor authentication:70%; VPN:65%), whereas BYOD specific technologies (MDM:43%; containerisation:39%; UEM:4%) haven't been widely adopted. Less than half of the surveyed hospitals have a BYOD policy (45%). Staff education though provided in majority of surveyed hospitals (60%), is not comprehensive and regular. Lack of engagement with clinical staff for BYOD strategy development was also found (23%). ConclusionThis research provided a comprehensive view of socio-technical BYOD security practices in Australian hospitals, highlighting its strengths, weaknesses, and the consequential implications, which can therefore provide useful insights for hospital IT executives and health departments.

Desire : Leveraging the Best of Centralized and Decentralized Contact Tracing Systems

Contact tracing in case of pandemic is becoming an essential mitigation tool for national health services to break infection chains and prevent the virus from spreading further. To support manual tracing, several countries have been developing contact tracing apps that detect nearby mobile phones using Bluetooth. Such data collection raised privacy concerns and several privacy-preserving protocols have been proposed to prevent the leakage of personal and sensitive information. These solutions are mainly divided into two categories using a centralized or a decentralized exposure score computation. However, both approaches depict limitations. This article presents Desire , a novel exposure notification system that leverages the best of centralized and decentralized systems. As opposed to existing contact tracing schemes, Desire leverages Private Encounter Tokens ( Pets ) generated locally on the device that uniquely identify an encounter between two nodes while being private and unlinkable by the server. The role of the server is merely to match PETs generated by diagnosed users with the pets provided by requesting users. Our privacy risk analysis shows that Desire drastically improves privacy against malicious users (i.e., limitation of decentralized systems) and authority (i.e., limitation of centralised systems). We implemented Desire , evaluated it in real condition, and show it feasibility.

Information Leakage Analysis Using a Co-Design-Based Fault Injection Technique on a RISC-V Microprocessor

The RISC-V instruction set architecture open licensing policy has spawned a hive of development activity, making a range of implementations publicly available. The environments in which RISC-V operates have expanded correspondingly, driving the need for a generalized approach to evaluating the reliability of RISC-V implementations under adverse operating conditions or after normal wear-out periods. Fault injection (FI) refers to the process of changing the state of registers or wires, either permanently or momentarily, and then observing execution behavior. The analysis provides insight into the development of countermeasures that protect against the leakage or corruption of sensitive information, which might occur because of unexpected execution behavior. In this article, we develop a hardware–software co-design architecture that enables fast, configurable fault emulation and utilize it for information leakage and data corruption analysis. Modern system-on-chip FPGAs enable building an evaluation platform, where control elements run on a processor(s) (PS) simultaneously with the target design running in the programmable logic (PL). Software components of the FI system introduce faults and report execution behavior. A pair of RISC-V FI-instrumented implementations are created and configured to execute the Advanced Encryption Standard and Twister algorithms. Key and plaintext information leakage and degraded pseudorandom sequences are both observed in the output for a subset of the emulated faults.

Multi-Factor Authentication with Randomly Selected Authentication Methods with DID on a Random Terminal

Background: Information and communication technology development provides services to various fields. In particular, the development of mobile technology has made ubiquitous services possible. However, as technology advances, security is being emphasized more and more. The existing method of user authentication by entering an ID and password is likely to leak sensitive information if the server is attacked or keylogged. Therefore, multi-level authentication is needed to prevent server attacks or keylogging. Methods: Biometric authentication technology has been utilized by smartphones, but it is challenging to apply in the case of a lost device because the central server does not manage biometric data. Encrypting transactions through blockchain technology makes data management more secure because blockchain technology is distributed, and there is no primary target for hackers. Results: The method proposed in this study can become a basis for an authentication method that guarantees both security and integrity due to the synergetic use of biometric and blockchain technologies. Conclusions: The information stored in the service provider does not include sensitive information such as the user’s biometric data but is only a means of verifying the user’s information in the blockchain transaction with guaranteed anonymity. Therefore, users can receive services with confidence and safety.

Cryptographic core design security verification and vulnerability detection based on information flow analysis

Cryptographic cores are the key components to enforce information security properties related to confidentiality and integrity. Since the security of a cryptographic core implementation and the security of the cryptographic algorithm itself from the mathematical perspective are two different problems, cryptographic cores may contain hidden security vulnerabilities such as design flaws and side channels. Security analysis methods based on functional verification rely heavily on the quality of test vectors and usually have low test coverage, which is difficult to meet the security verification requirements of security-critical components like cryptographic cores. This work proposes a cryptographic core security verification and vulnerability detection method from the perspective of information flow security. The proposed method can accurately measure all logical information flows in cryptographic core designs to formally verify security properties such as confidentiality and integrity. It can detect potential security vulnerabilities in cryptographic implementations by capturing harmful information flows. Experimental results show that our information flow security verification method is effective in detecting sensitive information leakage caused by the design vulnerabilities and side channels in cryptographic cores.

A practical privacy-preserving communication scheme for CAMs in C-ITS

In a Collaborative Intelligent Transportation System (C-ITS), vehicles send collaborative awareness messages (CAMs) carrying information such as speed, position, and identity, to interact with other vehicles and to obtain transportation services. Traditionally, CAMs are broadcasted in plaintext over unsafe networks, which may leak sensitive information of the vehicle. On one hand, many existing works attempting to solve this problem focused on anonymous authentication, but ignored the confidentiality of CAMs. Conversely, some other attempts trying to keep the privacy of CAMs have backward security problems in key management or vehicle revocation. Therefore, in this paper, we present a practical privacy-preserving communication scheme for CAMs in C-ITS. To ensure the privacy of a vehicle's identity, our scheme mainly uses the re-randomizable PS signature method to realize anonymous authentication; and to meet backward security, we use the complete subtree method to realize both key management and vehicle revocation. In more details, our proposal fulfills more security and privacy requirements, such as correctness, anonymity, traceability, revocability, backward security and anti-illegal message dissemination, while also hiding the content of CAMs.

Sensitive Information Protection Model Based on Bayesian Game

A game measurement model considering the attacker's knowledge background is proposed based on the Bayesian game theory aiming at striking a balance between the protection of sensitive information and the quality of service. We quantified the sensitive level of information according to the user's personalized sensitive information protection needs. Based on the probability distribution of sensitive level and attacker's knowledge background type, the strategy combination of service provider and attacker was analyzed, and a game-based sensitive information protection model was constructed. Through the combination of strategies under Bayesian equilibrium, the information entropy was used to measure the leakage of sensitive information. Furthermore, in the paper the influence of the sensitive level of information and the attacker's knowledge background on the strategy of both sides of the game was considered comprehensively. Further on, the leakage of the user's sensitive information was measured. Finally, the feasibility of the model was described by experiments.

Modern ethics as a practical philosophy of cyber security

The article examines the issue of morality and ethics within the framework of professional and corporate codes of conduct in the field of cyber security. It was noted that new means of production, digital technologies, digitalization of information and communication processes, construction of the economy created prerequisites for the emergence of new areas of production, new professions and specialties. In such new realities, the level of responsibility among employees who have access to automated management systems, databases of personal data and information arrays increases, when due to a low culture of production and a low level of cyber hygiene and the basics of cyber protection, it leads to the intervention of cyber attackers in the work of critical infrastructure, production processes, and this can cause the leakage of sensitive information, accidents at critical infrastructure facilities, the country's management system (in the sphere of security and defense), as well as the leakage of private data. In order to minimize the consequences of cyber incidents, it is necessary to raise the level of professional and corporate ethics of employees' behavior by adapting existing codes of conduct in the context of information security and cyber security. It is also proposed to add new ones to the list of basic and key competencies, namely: cyber hygiene and cyber security. At the same time, it is necessary to provide for inclusion in existing and development of new educational standards for new professions and specialties in the field of information security and cyber security, acquisition of new competencies related to cyber security and cyber protection.

Improved Henon Chaotic Map-based Progressive Block-based visual cryptography strategy for securing sensitive data in a cloud EHR system

The core objective of secret sharing concentrates on developing a novel technique that prevents the destruction and leakage of original data during the distribution and encoding processes. Progressive Visual Cryptography (VC) is considered for the potential over the traditional VC schemes since the former does not require and does not suffer from the limitations of requiring a minimum number of participants during the process of encryption and sharing. The chaotic map-based Progressive VC is superior in facilitating predominant secrecy under sharing and encryption. In this paper, an Improved Henon Chaotic Map-based Progressive Block-based VC (IHCMPBVC) scheme is proposed to prevent the leakage and destruction of sensitive information during an exchange and encryption. This proposed IHCMPBVC technique uses the merits of Henon and Lorentz maps for effective encryption since it introduces the option of deriving non-linear behavior that results in sequence generation that covers the complete range with proper distribution in order to minimize the degree of leaks in sharing. The simulation results of the proposed IHCMPBVC technique investigated using entropy, PSNR, and Mean Square Error were improved at an average rate of 27%, 23%, and 31%, predominant to the baseline VC approaches considered in the comparison.

AI Based Self – Learning Intelligent Information Leak Protection System for Insurance Companies

Preventing the leak of sensitive information, also popularly known as data leak or data loss to an unauthorized recipient, is the primary goal of an organization's information security system. Like all other financial institutions, Insurance companies collect sensitive personal information of their customers for business purposes. This information is often categorized into three primary types; Nonpublic Personal Information (NPI), Personally Identifiable Information (PII), and Personal Information (PI) are the designated types in the descending order of sensitivity. While it may not always be possible to prevent it entirely, measures can be taken to minimize the possibility of the occurrence. An intelligent and robust system is required where the content is analyzed by state-of-the-art data mining, statistical and machine learning techniques from various data dimensions. An Artificial Intelligence (AI) based self-learning Intelligent Information Leak Protection System (IILPS) using Long Short Term Memory (LSTM) is proposed in the project that mines and extracts information and categorizes the document images, to Secured Documents (SD) or Non-secured documents(NSD), based on the presence of NPI and PII semantic signatures without any explicit rule configuration. The system is designed to be used proactively as an early warning system to tag the SD images while resting in the data store. It can also act as a real-time checkpoint for the information loss by the documents in transit or use. The proposed model prescribes an information loss protection mechanism using a binary classifier based on the state-of-the-art LSTM technique within the paradigm of Artificial Intelligence.

Accurate and Privacy-Preserving Person Localization Using Federated-Learning and the Camera Surveillance Systems of Public Places

In this paper we propose an accurate and privacy-preserving scheme that enables a law enforcement agency to locate persons of interest using the camera surveillance systems of public places. Comparing to the existing schemes that measure the Euclidean distance to locate persons using their embedding vectors storing facial features, we use a more accurate approach by training a machine learning model. Moreover, to avoid leaking sensitive information by sharing the images of the public places’ visitors to train the model, we use a federated learning technique to compute the model in a privacy-preserving way. The model is designed in such a way that makes executing it over encrypted data efficient. Specifically, the model is executed by three parties as follows. Each public place computes an embedding vector for each visitor’s image and inputs it to a neural network and encrypts the output using a modified inner product encryption scheme and sends the ciphertext to a cloud server. The law enforcement agency does the same steps on the images of persons of interest. Finally, the server uses these ciphertexts to evaluate the last layer of the model by computing the inner product of the two vectors over encrypted data. The cryptosystem enables the server to compute the inner product of two vectors using their ciphertexts without being able to learn the vectors. We have modified an encryption cryptosystem that is designed for a single public place and a single law enforcement agency to make it more efficient in our application that has multiple public places. To evaluate our scheme, we have conducted extensive experiments and the results confirm that our model is accurate in locating persons of interest with low communication and computation overhead. A formal proof and analysis are used to demonstrate the ability of our scheme to preserve privacy.

A Quantitative Analysis of Compromising Emanation From TMDS Interface and Possibility of Sensitive Information Leakage

This paper investigates the electromagnetic interference characteristics of the transition-minimized differential signaling (TMDS) scheme, a well-known technology for rapid serial data transmission, from a radio communication perspective. Such scrutiny regarding the leaking phenomenon inspires a pseudo model of the compromising signal model, which can simultaneously consider behavioral features of the software-defined radio with a simple RF front-end measuring the leakage. In this work, a conceptual explanation with mathematical formulations in implementing the pseudo model has been presented. Subsequently, by merging the model with various extra noises being in nature, the model can be utilized to facilitate and quantify the possibility of information extraction from the defected electromagnetic signatures. Furthermore, it is interesting to note that there are asynchronous problems due to inevitable timing errors in video display devices, even with a sophisticated acquisition system, turning out to be fatal for the frame-averaging scheme conducted before the signal demodulation. In view of these challenges, we have formulated a synchronizing scheme and verified validity by utilizing the pseudo model with the extra noise to take into account the asynchronous problem. Moreover, the structural similarity (SSIM), a function of the signal-to-noise ratio, can provide the number of frames for the frame-averaging process and eventually give the minimum acquisition time to earn meaningful information from the compromising emanation. Finally, after the appropriate post-processing, the extracted information from the actual measurements is compared with the reconstruction from the pseudo-model results revealing excellent agreements.

Security Analysis of Machine Learning-Based PUF Enrollment Protocols: A Review.

The demand for Internet of Things services is increasing exponentially, and consequently a large number of devices are being deployed. To efficiently authenticate these objects, the use of physical unclonable functions (PUFs) has been introduced as a promising solution for the resource-constrained nature of these devices. The use of machine learning PUF models has been recently proposed to authenticate the IoT objects while reducing the storage space requirement for each device. Nonetheless, the use of a mathematically clonable PUFs requires careful design of the enrollment process. Furthermore, the secrecy of the machine learning models used for PUFs and the scenario of leakage of sensitive information to an adversary due to an insider threat within the organization have not been discussed. In this paper, we review the state-of-the-art model-based PUF enrollment protocols. We identity two architectures of enrollment protocols based on the participating entities and the building blocks that are relevant to the security of the authentication procedure. In addition, we discuss their respective weaknesses with respect to insider and outsider threats. Our work serves as a comprehensive overview of the ML PUF-based methods and provides design guidelines for future enrollment protocol designers.

DESIGNING A SECURE NETWORK SOLUTION AGAINST DHCP ATTACKS

DHCP is an important aspect in small and large networks, since it facilitates the IP configuration of computers. However, DHCP is vulnerable to different attacks; therefore, the essential objective of this paper is to propose solutions against DHCP attacks. The paper gives an explanation about how DHCP works and understand the handshake mechanism and give a brief summary about DHCP attack, how they occur and how they affect the security of the enterprise since a leakage of sensitive Information could happen, which threatens the enterprise's security or a denial of service that immobilizes the network. Three effective countermeasures are looked up and tested against DHCP attacks, and each one successfully prevented the attack.

A tokenization technique for improving the security of EMV contactless cards

ABSTRACT This paper focuses on the EMV contactless payment cards and their vulnerability of leaking sensitive information such as the cardholder name, Primary Account Number (PAN), and the expiry date of the EMV card. Such data can be sniffed using off-the-shelf hardware or software without the knowledge of the genuine cardholder. The paper proposes a tokenization technique to replace the PAN of the actual EMV contactless card’s with a token to protect the genuine data from being sniffed by an attacker and used in the Card-No-Present (CNP) attack or any other attacks. The proposal was inspired by the implementation of the tokenization in the EMV Mobile payment such as Apple, Google, and Samsung mobile payments. We argue that the proposed tokenization technique is easy to adopt and cost-effective to implement by EMV protocol as it does not require any changes to the infrastructure of existing payment systems. A vital feature of the proposal is that all the changes in the EMV protocol are at the personalization phase of the EMV card. The paper presents a successful implementation of the tokenization approach using a Java contactless card framework to represent EMV contactless cards to demonstrate its effectiveness in improving the security and protecting the privacy of the card’s information.

Privacy‐preserving and efficient user matching based on attribute encryption in mobile social networks

SummaryWith the rapid popularity of social networking platforms, users can be matched when sharing their profiles. However, there is a risk of leakage of sensitive user information during the user matching process, which leads to the lack of user privacy protection. In this paper, we propose a privacy protection scheme based on the encryption of hidden attributes during user matching in mobile social networks, which uses linear secret sharing scheme (LSSS) as the access structure based on ciphertext policy attribute‐based encryption (CP‐ABE), and the match server can perform friend recommendation by completing bi‐directional attribute matching determination without disclosing user attribute information. In addition, the use of selective keywords protects the privacy of requesters and publishers in selecting keywords and selecting plaintext attacks. The scheme reduces the encryption and decryption overhead for users by dividing encryption into a preparation phase and an online phase and shifting most of the decryption overhead from the requester to the match server. The experimental results show that the scheme ensures user privacy while effectively reducing communication overhead.

Enhancement of an Optimized Key for Database Sanitization to Ensure the Security and Privacy of an Autism Dataset

Interrupting, altering, or stealing autism-related sensitive data by cyber attackers is a lucrative business which is increasing in prevalence on a daily basis. Enhancing the security and privacy of autism data while adhering to the symmetric encryption concept is a critical challenge in the field of information security. To identify autism perfectly and for its data protection, the security and privacy of these data are pivotal concerns when transmitting information over the Internet. Consequently, researchers utilize software or hardware disk encryption, data backup, Data Encryption Standard (DES), TripleDES, Advanced Encryption Standard (AES), Rivest Cipher 4 (RC4), and others. Moreover, several studies employ k-anonymity and query to address security concerns, but these necessitate a significant amount of time and computational resources. Here, we proposed the sanitization approach for autism data security and privacy. During this sanitization process, sensitive data are concealed, which avoids the leakage of sensitive information. An optimal key was generated based on our improved meta-heuristic algorithmic framework called Enhanced Combined PSO-GWO (Particle Swarm Optimization-Grey Wolf Optimization) framework. Finally, we compared our simulation results with traditional algorithms, and it achieved increased output effectively. Therefore, this finding shows that data security and privacy in autism can be improved by enhancing an optimal key used in the data sanitization process to prevent unauthorized access to and misuse of data.

Steganalysis of the methods of concealing information in graphic containers

Aim. Today, there is a pressing matter of protection against steganography-based attacks against information systems. These attacks present a danger as they use the most common data files – especially graphics files – as containers that deliver malicious code to a system or cause a leak of sensitive information. Developing methods of detecting such hidden information is the responsibility of a special subsection of steganography, the steganalysis. Such methods should be extensively used in computer forensics as part of security incident investigation, as well as in automated security systems with integrated modules for analyzing data files for malicious or dangerous information. An important feature of such activities is the need to examine a wide variety of elements and containing files. In particular, it is required to verify not only the colour values of the pixels in images, but their frequency characteristics as well. This raises a number of important questions associated with the best practices of applying steganalysis algorithms and making correct conclusions based on the outputs. The paper aims to briefly analyse the most important and relevant methods of steganalysis, both spatial and frequency, as well as to make conclusions regarding their performance and ways to analyse the outputs based on the test results of the software that implements such methods. Methods. The steganalysis of concealment within the least significant bits of an image’s pixels uses Pearson’s Chi-square statistical analysis, as well as the Regular-Singular method that involves signature analysis of pixel groups and analytical geometry tools for estimating the relative volume of the hidden message. The Koch-Zhao method of steganalysis is used for the purpose of detecting information embedded in the frequency-domain image representation. It also allows identifying the parameters required for extracting the hidden message. Results. A software suite was created that includes the software implementations of the analysed methods. The suite was submitted to a number of tests in order to evaluate the outputs of the examined methods. For the purpose of testing, a sample of images of various formats was compiled, in which information was embedded using a number of methods. Based on the results of the sample file analysis, conclusions were made regarding the efficiency of the analysed methods and interpretation of the outputs. Conclusion. Based on the test results, conclusions were made on the accuracy of the steganalysis methods in cases of varied size of the embedded message and methods of its concealment. The patterns identified with the help of the analysis outputs allowed defining a number of rules for translating the outputs into conclusions on the identification of the fact of detection of hidden information and estimation of its size.

Relationship Between Perceived Risks of Using mHealth Applications and the Intention to Use Them Among Older Adults in the Netherlands: Cross-sectional Study.

BackgroundConsidering the increasing demand for health services by older people and the ongoing COVID-19 pandemic, digital health is commonly viewed to offer a pathway to provide safe and affordable health services for older adults, thus enabling self-management of their health while health care systems are struggling. However, several factors cause older people to be particularly reluctant to adopt digital health technologies such as mobile health (mHealth) tools. In addition to previously studied technology acceptance factors, those related to perceived risks of mHealth use (eg, leakage of sensitive information or receiving incorrect health recommendations) may further diminish mHealth adoption by older adults.ObjectiveThe aim of this study was to explore the relationship between perceived risks of using mHealth applications and the intention to use these applications among older adults.MethodsWe designed a cross-sectional study wherein a questionnaire was used to collect data from participants aged 65 years and older in the Netherlands. Perceived risk was divided into four constructs: privacy risk, performance risk, legal concern, and trust. Linear regression analyses were performed to determine the associations between these perceived risk constructs and the intention to use mHealth applications.ResultsLinear regression per perceived risk factor showed that each of the four constructs is significantly associated with the intention to use mobile medical applications among older adults (adjusted for age, sex, education, and health status). Performance risk (β=–.266; P=<.001), legal concern (β=–.125; P=.007), and privacy risk (β=–.100; P=.03) were found to be negatively correlated to intention to use mHealth applications, whereas trust (β=.352; P=<.001) was found to be positively correlated to the intention to use mHealth applications.ConclusionsPerformance risk, legal concern, and privacy risk as perceived by older adults may substantially and significantly decrease their intention to use mHealth applications. Trust may significantly and positively affect this intention. Health care professionals, designers of mHealth applications, and policy makers can use these findings to diminish performance risks, and tailor campaigns and applications to address legal and privacy concerns and promote mHealth uptake and health care access for older adults, especially during the COVID-19 pandemic.