Shamir's Secret Sharing Research Articles

Symmetric keyring encryption scheme for biometric cryptosystem

In this paper, we propose a novel biometric cryptosystem for vectorial biometrics called symmetric keyring encryption (SKE), inspired by Rivest's keyring model (2016). Unlike conventional biometric secret-binding primitives, such as fuzzy commitment and fuzzy vault approaches, the proposed scheme reframes the biometric secret-binding problem as a fuzzy symmetric encryption problem using a concept called a resilient vector pair. In this study, this pair resembles the encryption–decryption key pair in symmetric key cryptosystems. This scheme is realized using an index of maximum hashed vectors, a special instance of the ranking-based locality-sensitive hashing function. With a simple filtering mechanism and an [m, k] Shamir's secret-sharing scheme, we show that SKE, both in theory and in an empirical evaluation, can retrieve the exact secret with overwhelming probability for a genuine input yet negligible probability for an imposter input. Although SKE can be applied to any vectorial biometrics, we adopt fingerprint and face vectors in this work. Experiments were performed using the Fingerprint Verification Competition (FVC) and Labeled Face in the Wild (LFW) datasets. We formalize and analyze the threat model for SKE, which involves several major security attacks.

Secure logging scheme for forensic analysis in cloud

SummaryCloud computing has emerged as a prominent technology that provides reliable on‐demand cloud services to users. Among the various kind of attacks, Distributed Denial of Service (DDoS) attack is one of the major application layer attacks that target the resources and services running in the cloud. Due to the distributed nature of attacks or crimes in the cloud, the evidence are collected from various components such as the router, switches, hard disk, log traces, and virtual machines. An attacker may collude with the cloud provider or investigators to tamper the log files or by inserting false information or by deleting the malicious activity logs altogether by leaving no trace. Hence, security is the major concern in cloud wherein investigation of crimes and attacks are very difficult. Collecting logs from the cloud providers is very hard since many users share the same network resources and the investigators rely on the providers to access the information. Therefore, in order to preserve the confidentiality, integrity, and authentication of logs, secure logging scheme is proposed to preserve the logs for forensic investigation. This paper highlights the secure logging scheme by extracting the features from logs of all virtual machine instances by double encryption scheme and also deals the integrity of the logs using hashing and verifies the signatures using Bloom filter–based R tree (BR tree). Furthermore, the verification is performed using Shamir Secret Sharing (SSS) scheme, and it is responsible for sharing the secret (private) keys to all the three parties, ie, user, investigator, and cloud providers. It is inferred from the experimental results that the proposed scheme requires minimal log processing time, minimal verification time for inserting logs, stores logs in time, and space efficient manner and scalable than existing methods.

A Privacy-Preserving Protocol for Network-Neutral Caching in ISP Networks

By performing in-network caching, Internet Service Providers (ISPs) allow Content Providers (CPs) to serve contents from locations closer to users. In this way, the pressure of content delivery on ISPs' network is alleviated, and the users' Quality-of-Experience (QoE) improved. Due to its impact on QoE, caching has been recently considered as a form of traffic prioritization in the debate on Network Neutrality (NN). A possible approach to perform NN-compliant caching consists in assigning the same portion of cache storage to all the CPs. However, this static subdivision does not consider the different popularities of the CPs' contents and is therefore inefficient. Alternatively, the cache can be subdivided among the CPs proportionally to the popularity of their contents. However, CPs consider this information private and are reluctant to disclose it. In this work, we propose a protocol to perform a popularity-driven subdivision of the caches' storage in a privacy-preserving and network-neutral fashion. The protocol is based on the Shamir Secret Sharing (SSS) scheme and is designed to ensure a NN-compliant subdivision of the caches while preserving the privacy of both CPs and ISP (i.e., contents' popularity and caches' size are not disclosed). Through dynamic simulation, we show that the popularity-driven cache subdivision (enforced by using our protocol) outperforms several baseline approaches in terms of overall network Resource Occupation (RO) and caching Hit-Ratios. Thanks to our numerical results, we observe that the frequency of execution of the protocol has a significant impact on the RO, and that the ISP can tune this frequency to minimize its RO while introducing an acceptable data overhead. Because of this tuning, several CPs may experience a loss with respect to the hit-ratio that they would obtain by independently choosing the frequency of execution. This loss is very limited, and the employment of the protocol is therefore beneficial to all the involved parties, especially since, by using it, CPs are guaranteed that the ISP behaves in a network-neutral manner.

Privacy-Preserving Secret Shared Computations using MapReduce

Data outsourcing allows data owners to keep their data at \emph{untrusted} clouds that do not ensure the privacy of data and/or computations. One useful framework for fault-tolerant data processing in a distributed fashion is MapReduce, which was developed for \emph{trusted} private clouds. This paper presents algorithms for data outsourcing based on Shamir's secret-sharing scheme and for executing privacy-preserving SQL queries such as count, selection including range selection, projection, and join while using MapReduce as an underlying programming model. Our proposed algorithms prevent an adversary from knowing the database or the query while also preventing output-size and access-pattern attacks. Interestingly, our algorithms do not involve the database owner, which only creates and distributes secret-shares once, in answering any query, and hence, the database owner also cannot learn the query. Logically and experimentally, we evaluate the efficiency of the algorithms on the following parameters: (\textit{i}) the number of communication rounds (between a user and a server), (\textit{ii}) the total amount of bit flow (between a user and a server), and (\textit{iii}) the computational load at the user and the server.\B

An Image Secret Sharing Method Based on Shamir Secret Sharing

An Image Secret Sharing Method Based on Shamir Secret Sharing

Proposal of a Secure Modbus RTU Communication with Adi Shamir's Secret Sharing Method

Drinking fresh water, turning the lights on, travelling by tram, calling our family or getting a medical treatment are usual activities, but the underlying SCADA (Supervisory Control and Data Acquisition) systems like CIS (Critical Infrastructure Systems), ICS (Industrial Control Systems) or DCS (Distributed Control Systems) were always the target of many types of attacks, endangered the above mentioned simple activities. During the last decades because of the fast spread of the internet based services and the continuous technical development these systems become more vulnerable than ever. Full reconstruction and innovative changes in older SCADA systems has high cost, and it is not always rewarding. Communication protocols as Modbus (1979) serve as a main basis for SCADA systems, so security of Modbus has a major impact of the security of SCADA systems. Our paper raises and answers questions about the security of the Modbus RTU protocol. We focus on the serial Modbus protocol, because in that method we found many unsolved problems, like lack of authentication of the participants, lack of secure channel and so on. The aim of this paper to propose a secure communication alternative for Modbus RTU @ RS485 wire. The main advantage of the proposed method is the coexistence with traditional slaves and bus systems and only software update is necessary.

Public Auditing for Shared Data Utilizing Backups with User Revocation in the Cloud

With the advent of cloud storage, users can share their own data in the remote cloud as a group. To ensure the security of stored data and the normal operation of public auditing, once a user is revoked from the user group, the data files he signed should be resigned by other legal users in the group. In this paper, we propose a new re-signature scheme utilizing backup files to rebuild data which can resist the collusion between the cloud and revoked users, and we use Shamir Secret Sharing Scheme to encrypt data in the multi-managers system which can separate the authority of the group managers. Moreover, our scheme is more practical because we do not need managers to be online all the time. Performance evaluation shows that our mechanism can improve the efficiency of the process of data re-signature.

Energy-efficient and reliable data collection in wireless sensor networks

Ensuring energy efficiency, data reliability, and security is important in wireless sensor networks (WSNs). A combination of variants from the cryptographic secret sharing technique and the disjoint multipath routing scheme is an effective strategy to address these requirements. Although Shamir's secret sharing (SSS) provides the desired reliability and information-theoretic security, it is not energy efficient. Alternatively, Shamir's ramp secret sharing (SRSS) provides energy efficiency and data reliability, but is only computationally secure. We argue that both these approaches may suffer from a compromised node (CN) attack when a minimum number of nodes is compromised. Hence, we propose a new scheme that is energy efficient, provides data reliability, and is secure against CN attacks. The core idea of our scheme is to combine SRSS and a round-reduced AES cipher, which we call split hop AES (SHAES). Both the simulation results and the theoretical analysis are employed to validate the near-sink CN attack, and a secure reliable scheme using SHAES is proposed.

Lemonade from Lemons

Most architectures are designed to mitigate the usually undesirable phenomenon of device wearout. We take a contrarian view and harness this phenomenon to create hardware security mechanisms that resist attacks by statistically enforcing an upper bound on hardware uses, and consequently attacks. For example, let us assume that a user may log into a smartphone a maximum of 50 times a day for 5 years, resulting in approximately 91,250 legitimate uses. If we assume at least 8-character passwords and we require login (and retrieval of the storage decryption key) to traverse hardware that wears out in 91,250 uses, then an adversary has a negligible chance of successful brute-force attack before the hardware wears out, even assuming real-world password cracking by professionals. M-way replication of our hardware and periodic re-encryption of storage can increase the daily usage bound by a factor of M. The key challenge is to achieve practical statistical bounds on both minimum and maximum uses for an architecture, given that individual devices can vary widely in wearout characteristics. We introduce techniques for architecturally controlling these bounds and perform a design space exploration for three use cases: a limited-use connection, a limited-use targeting system and one-time pads. These techniques include decision trees, parallel structures, Shamir's secret-sharing mechanism, Reed-Solomon codes, and module replication. We explore the cost in area, energy and latency of using these techniques to achieve system-level usage targets given device-level wearout distributions. With redundant encoding, for example, we can improve exponential sensitivity to device lifetime variation to linear sensitivity, reducing the total number of NEMS devices by 4 orders of magnitude to about 0.8 million for limited-use connections (compared with 4 billion if without redundant encoding).

ANALISIS ATRIBUT KEAMANAN TERHADAP PERBAIKAN PROTOKOL GROUP KEY TRANSFER : PROTOKOL HSU

Protocol Hsu et.al first introduced in 2012 and is the protocol type Group Key Transfer based Linear Shamir's Secret Sharing Scheme (LSSS). The main idea of this protocol is to use m-secret sharing perspective. This protocol assumes that the difficulty of discrete logarithm problem (DLP) (ie given is computationally very difficult/not feasible to count ) and Cryptographyc Diffie Hellman (CDH) (ie given and it is computationally very difficult/not feasible to count ) in . Thus, it needs to analyze the security attributes to this mechanism Protocol Hsu. Good cryptographic protocols should meet the security attributes Known Security Key, Key-Compromise Impersonation Resillience, Unknown Key-Share Resillience, Key Control and Key Confirmation.

Secure File Sharing in Multi-clouds using Shamir’s Secret Sharing Scheme

Cloud computing is a significant model for permitting on-demand network access to shared data, software’s, infrastructure, and platform resources. However, cloud storage needs a certain level of availability, confidentiality, and integrity. Information sensitivity and value encourage users to select a highly secure protocol. This work proposes a new mechanism to increase the user trust in cloud computing using the secret sharing technique. The proposed algorithm is using Base64 encoding to convert any file type to ASCII strings. Base64 strings do not need any extra process to be compressed and this can speed up the share building process. Each string is used to produce N shares (using Shamir Secret Sharing Scheme) where each share is stored in a separate location in the cloud.

Steganography on multiple MP3 files using spread spectrum and Shamir's secret sharing

The purpose of steganography is how to hide data into another media. In order to increase security of data, steganography technique is often combined with cryptography. The weakness of this combination technique is the data was centralized. Therefore, a steganography technique is develop by using combination of spread spectrum and secret sharing technique. In steganography with secret sharing, shares of data is created and hidden in several medium. Medium used to concealed shares were MP3 files. Hiding technique used was Spread Spectrum. Secret sharing scheme used was Shamir's Secret Sharing. The result showed that steganography with spread spectrum combined with Shamir's Secret Share using MP3 files as medium produce a technique that could hid data into several cover. To extract and reconstruct the data hidden in stego object, it is needed the amount of stego object which more or equal to its threshold. Furthermore, stego objects were imperceptible and robust.

Design of Reliable and Secure Devices Realizing Shamir's Secret Sharing

Shamir's secret sharing scheme is an effective way to distribute secret to a group of shareholders. The security of the unprotected sharing scheme, however, can be easily broken by cheaters or attackers who maliciously feed incorrect shares during the secret recovery stage or inject faults into hardware computing the secret. In this paper, we propose cheater detection and identification schemes based on robust and algebraic manipulation detection (AMD) codes and m-disjunct matrices (superimposed codes). We present the constructions of codes for cheater detection and identification and describe how the cheater identification problem can be related to the classic group testing algorithms based on m-disjunct matrices. Simulation and synthesis results show that the proposed architecture can improve the security level significantly even under strong cheating attack models with reasonable area and timing overheads.

An Integratable Verifiable Secret Sharing Mechanism

Threshold secret sharing (SS), also denoted as (t, n) SS, has been used extensively in the area of information security, such as for group authentication, cloud storage schemes, secure parallel communication and wireless multipath routing protocols. However, a (t, n) SS cannot detect any deceptions among the dealer and shareholders. Verifiable secret sharing (VSS) overcomes the weakness of (t, n) SS in such a way that it is able to detect cheaters by verifying the validity of shares or the correctness of the recovered secret under the condition that both shares and the secret are not compromised. Recently, two non- interactive VSSs based on Asmuth-Bloom's SS were pro-posed by Harn et al. and Liu et al., respectively. Both VSSs require shareholders to examine the range of values of some integers related to the secret before recovering the secret, which is a time-consuming operation. In this paper, we propose a novel integratable VSS mechanism that integrates the concepts of the generalized Chinese remainder theorem (GCRT), Shamir's SS and Asmuth Bloom's SS. Our proposed VSS can verify that the secret reconstructed by any t or more shareholders is the same as the one that the dealer has generated. Analysis shows that our proposed VSS can provide perfect secrecy and better efficiency.

Cascade Forward Back-propagation Neural Network Based Group Authentication Using (n, n) Secret Sharing Scheme

Authentication is the important issue over the internet. It results in need of robust security services and schemes. This paper proposes the Shamir Secret Sharing Scheme along with Cascade forward back propagation neural network. The proposed (n, n) Shamir secret sharing scheme is implemented successfully for share encryption and decryption process. It reveals the secret only and only when all the n number of participants are available at the reconstruction process. The generated shares have a best quality so that human brain can’t predict the original secret by any combination. The neural network is already trained for RGB image database and images are stored in particular group having a group category number which is to be predicted as output of neural network. For testing purpose, we take an image, store it in a group, create its shares and now identifies to which group it belongs. The neural network here provides the correct group of that image which we have trained earlier.

Multi-Cloud Data Management using Shamir's Secret Sharing and Quantum Byzantine Agreement Schemes

Cloud computing is a phenomenal distributed computing paradigm that provides flexible, low-cost on-demand data management to businesses. However, this so-called outsourcing of computing resources causes business data security and privacy concerns. Although various methods have been proposed to deal with these concerns, none of these relates to multi-clouds. This paper presents a practical data management model in a public and private multi-cloud environment. The proposed model BFT-MCDB incorporates Shamir's Secret Sharing approach and Quantum Byzantine Agreement protocol to improve trustworthiness and security of business data storage, without compromising performance. The performance evaluation is carried out using a cloud computing simulator called CloudSim. The experimental results show significantly better performance in terms of data storage and data retrieval compared to other common cloud cryptographic based models. The performance evaluation based on CloudSim experiments demonstrates the feasibility of the proposed multi-cloud data management model.

Shamir Secret Sharing Scheme with Dynamic Access Structure (SSSDAS): case study on nuclear power plant

Abstract In recent years, due to the sophistication offered by the Internet, strategic organizations like nuclear power plants are linked to the outside world communication through the Internet. The entry of outside world communication into strategic organization (nuclear power plant) increases the hacker's attempts to crack its security and to trace any information which is being sent among the top level officials. Information security system in nuclear power plant is very crucial as even small loophole in the security system will lead to a major disaster. Recent cyber attacks in nuclear power plant provoked information security professionals to look deeply into the information security aspects of strategic organizations (nuclear power plant). In these lines, Shamir secret sharing scheme with dynamic access structure (SSSDAS) is proposed in the paper which provides enhanced security by providing dynamic access structure for each node in different hierarchies. The SSSDAS algorithm can be applied to any strategic organizations with hierarchical structures. In this paper the possible scenarios where SSSDAS algorithm can be applied to nuclear power plant is explained as a case study. The proposed SSSDAS scheme identifies the wrong shares, if any, used for reconstruction of the secret. The SSSDAS scheme also address the three major security parameters namely confidentiality, authentication and integrity.

Secure image sharing method over unsecured channels

Image sharing has become a prominent field in large and small networks. However, in order to deliver the shares to their respective shareholders, we need a secure channel to protect the shares from potential attacks by other users on the network. These users can locate the shares and retrieve the image using the Lagrange interpolation method if they are able to locate the minimum required number of shares. This paper proposes a method to protect the privacy and security of the shares when sending them through unsecured channels. The proposed method is divided into three phases. In the first phase, image pixels are changed using the column and row indices, then the shares are created using Shamir's secret sharing (SSS) method. Then a relationship is created between the shares using a linear independence function. In the second phase, the first part of the image is encrypted to hide the solver data. Finally, in the third phase, the data is shared using the SSS method. Participants can retrieve the whole image by applying the reverse order of the proposed method using only the information from the sender through the same channel. The simulation results show that the proposed method is efficient and robust against different types of attacks and can be used to send the shares over unsecured channels.

Privacy-friendly load scheduling of deferrable and interruptible domestic appliances in Smart Grids

The massive integration of renewable energy sources in the power grid ecosystem with the aim of reducing carbon emissions must cope with their intrinsically intermittent and unpredictable nature. Therefore, the grid must improve its capability of controlling the energy demand by adapting the power consumption curve to match the trend of green energy generation. This could be done by scheduling the activities of deferrable and/or interruptible electrical appliances. However, communicating the users’ needs about the usage of their appliances also leaks sensitive information about their habits and lifestyles, thus arising privacy concerns.This paper proposes a framework to allow the coordination of energy consumption without compromising the privacy of the users: the service requests generated by the domestic appliances are divided into crypto-shares using Shamir Secret Sharing scheme and collected through an anonymous routing protocol by a set of schedulers, which schedule the requests by directly operating on the shares. We discuss the security guarantees provided by our proposed infrastructure and evaluate its performance, comparing it with the optimal scheduling obtained by means of an Integer Linear Programming formulation.

Enabling Privacy in Vehicle-to-Grid Interactions for Battery Recharging

The diffusion of Electric Vehicles (EV) fostered by the evolution of the power system towards the new concept of Smart Grid introduces several technological challenges related to the synergy among electricity-propelled vehicle fleets and the energy grid ecosystem. EVs promise to reduce carbon emissions by exploiting Renewable Energy Sources (RESes) for battery recharge, and could potentially serve as storage bank to flatten the fluctuations of power generation caused by the intermittent nature of RESes by relying on a load aggregator, which intelligently schedules the battery charge/discharge of a fleet of vehicles according to the users’ requests and grid’s needs. However, the introduction of such vehicle-to-grid (V2G) infrastructure rises also privacy concerns: plugging the vehicles in the recharging infrastructures may expose private information regarding the user’s locations and travelling habits. Therefore, this paper proposes a privacy-preserving V2G infrastructure which does not disclose to the aggregator the current battery charge level, the amount of refilled energy, nor the time periods in which the vehicles are actually plugged in. The communication protocol relies on the Shamir Secret Sharing threshold cryptosystem. We evaluate the security properties of our solution and compare its performance to the optimal scheduling achievable by means of an Integer Linear Program (ILP) aimed at maximizing the ratio of the amount of charged/discharged energy to/from the EV’s batteries to the grid power availability/request. This way, we quantify the reduction in the effectiveness of the scheduling strategy due to the preservation of data privacy.