Purpose The purpose of this paper is to highlight the key technical challenges that derive from the recently proposed European Artificial Intelligence Act and specifically, to investigate the applicability of the requirements that the AI Act mandates to high-risk AI systems from the perspective of AI security. Design/methodology/approach This paper presents the main points of the proposed AI Act, with emphasis on the compliance requirements of high-risk systems. It matches known AI security threats with the relevant technical requirements, it demonstrates the impact that these security threats can have to the AI Act technical requirements and evaluates the applicability of these requirements based on the effectiveness of the existing security protection measures. Finally, the paper highlights the necessity for an integrated framework for AI system evaluation. Findings The findings of the EU AI Act technical assessment highlight the gap between the proposed requirements and the available AI security countermeasures as well as the necessity for an AI security evaluation framework. Originality/value AI Act, high-risk AI systems, security threats, security countermeasures.

Oblivious inference is the task of outsourcing a ML model, like neural-networks, without disclosing critical and sensitive information, like the model's parameters. One of the most prominent solutions for secure oblivious inference is based on a powerful cryptographic tools, like Homomorphic Encryption (HE) and/or multi-party computation (MPC). Even though the implementation of oblivious inference systems schemes has impressively improved the last decade, there are still significant limitations on the ML models that they can practically implement. Especially when both the ML model and the input data's confidentiality must be protected. In this paper, we introduce the notion of partially oblivious inference. We empirically show that for neural network models, like CNNs, some information leakage can be acceptable. We therefore propose a novel trade-off between security and efficiency. In our research, we investigate the impact on security and inference runtime performance from the CNN model's weights partial leakage. We experimentally demonstrate that in a CIFAR-10 network we can leak up to $80\%$ of the model's weights with practically no security impact, while the necessary HE-mutliplications are performed four times faster.

Abstract Cloud computing (CC) is the new trend in computing and resource management. This architectural shift toward thin clients and the centralized on‐demand provision of computing resources aspires to offer significant economical benefits to its users. However, the adaption of the CC model has forced many times the IT industry and the academia to revisit most of the traditional tools and technologies. The last few years, it has been identified that one of the computer branches that has been most affected by the CC model is Digital Forensics, one of the main law enforcement tools in the cyberspace. In this context, a new security area was born, the so‐called cloud forensics (CF). In this paper, we investigate the impact that the CC model has on the trustworthiness of one of the main CF sources of information, the log‐files. More precisely, we bring forth a crucial but rather underestimated problem, the problem of accurate log‐records timestamping. The synchronization of time (stamps) is of major importance for the investigation logs to be used as source of evidence. We show that this requirement is not easy in the cloud context. We demonstrate that the main features of CC render existing time synchronization techniques inadequate, and we provide a list of guidelines toward a CF aware timekeeping system. Copyright © 2014 John Wiley & Sons, Ltd.

ABSTRACT Radio‐frequency identification (RFID) technology constitutes an important part of what has become known as the Internet of Things (IoT) that is accessible and interconnected machines and everyday objects that form a dynamic and complex environment. To secure the IoT in a cost‐efficient manner, we need to build security and privacy into the design of its components. Moreover, mechanisms should be constructed that will allow both individuals and organizations to actively manage their “things” and information in a highly flux environment. The contributions of this paper are twofold: We first discuss the use of security and privacy policies that can offer fine granularity and context‐aware information control in RFID systems. Second, we propose a novel secure and privacy‐preserving tag management protocol that can support such policies. Our protocol has a modular design that allows it to support a set of desirable management operations (viz. tag authentication, delegation, and ownership transfer) while imposing minimal hardware and computational requirements on the tag side. Furthermore, inspired by the European Network and Information Security Agency's Flying 2.0 study, we describe a near‐future air travel scenario to further explain and demonstrate the inner workings of our proposal. Copyright © 2011 John Wiley & Sons, Ltd.

At the 2011 Eurocrypt, Kiltz et al., in their best paper price awarded paper, proposed an ultra-lightweight authentication protocol, called AUTH. This new protocol is supported by a delegated security proof, against passive and active attacks, based on the conjectured hardness of the Learning Parity with Noise (LPN) problem. However, AUTH has two shortcomings. The security proof does not include man-in-the-middle (MIM) attacks and the communication complexity is high. The weakness against MIM attacks was recently verified as a very efficient key recovery MIM attack was introduced with only linear complexity with respect to the length of the secret key. Regarding the communication overhead, Kiltz et al. proposed a modified version of AUTH where the communication complexity is reduced at the expense of higher storage complexity. This modified protocol was shown to be at least as secure as AUTH.

In this study, a method is presented for constructing convolutional codes of variable rate and decoding complexity. Starting with an (n,1,m) mother code, the techniques of puncturing and path pruning are utilized in order to construct large families of convolutional codes of various code rates and complexity. Decoding is performed using the trellis of the mother code.

It is widely accepted that cloud computing technologies will soon have substantial impact on a broad range of industrial and institutional sectors such as governance, health care, education, agriculture, logistics, manufacturing, media etc. Cloud infrastructures are typically based on virtualized environments to allow physical infrastructure to be shared by multiple and diverse end users. However, the efficient sharing of a cloud infrastructure can be performed only through user-centered service admission control procedure, which should also be flexible enough to adapt to the various real market cloud deployment scenarios. Several conflicting parameters such as the type of the hybrid cloud infrastructure being deployed, multiple user priority groups, security, energy efficiency and financial costs should also be taken into account. Thus, aiming to deal with all these emerging resource management trade-off problems, we propose in this paper a user-oriented, highly customizable infrastructure sharing approach, namely IaaS Request Admission Control (IRAC), designed for Hybrid Cloud Computing Environments.

In the last few years, a plethora of RFID authentication protocols have been proposed and several security analyses have been published creating the impression that designing such a protocol must be, more or less, a straightforward task. In this paper, we investigate the security of two recently proposed schemes, showing that designing a secure RFID authentication protocol is still a demanding process. One is a mature work; in the sense that it has predecessors that have been extensively analyzed, while the other is a fresh proposal. Our security analysis demonstrates that both are weak, as they suffer from a similar desychronization attack. In addition we prove the existence of a fatal tag impersonation attack against the second one.

In this paper, new constructions of low trellis complexity convolutional codes are presented. New codes are found by searching into a specific class of time varying convolutional codes, which is shaped by some basic properties and search restrictions. An efficient technique for obtaining minimal trellis modules for the proposed codes is provided. Finally, new low complexity convolutional codes of various code rates and memory sizes are tabulated.

In the past few years, algebraic attacks against stream ciphers with linear feedback function have been significantly improved. As a response to the new attacks, the notion of algebraic immunity of a Boolean functionfwas introduced, defined as the minimum degree of the annihilators of f and f + 1. An annihilator of f is a nonzero Boolean function g , such that f · g = 0. While several constructions of Boolean functions with optimal algebraic immunity have been proposed, there is no significant progress concerning the resistance against the so-called fast algebraic attacks. In this paper, we provide a framework to assess the resistance of Boolean functions against the new algebraic attacks, including fast algebraic attacks. The analysis is based on the univariate polynomial representation of Boolean functions and necessary and sufficient conditions are presented for a Boolean function to have optimal behavior against all the new algebraic attacks. Finally, we introduce a new infinite family of balanced Boolean functions described by their univariate polynomial representation. By applying the new framework, we prove that all the members of the family have optimal algebraic immunity and we efficiently evaluate their behavior against fast algebraic attacks.

In this paper new constructions of low trellis complexity convolutional codes are presented. New codes are found by searching into a specific class of time varying convolutional codes, which is shaped by some basic properties and search restrictions. An efficient technique for obtaining minimal trellis modules for the proposed codes is provided. Finally, new low complexity convolutional codes of various code rates and memory sizes are tabulated.

The construction of quantum computers forms the major threat against the security of modern communication systems, as anyone who can build a large quantum computer can break today's most popular cryptosystems. Given the central role of information security in the deployment of modern systems, the preparation of the cryptographic world for a future of quantum computers is imperative. In this context, several alternatives have been proposed, mainly basing their security on the laws of physics. One of the most promising technologies is the optically generated chaos-based cryptography. One of its main advantages is that it can be combined with the technology of optical communication networks in a natural way. In this paper, we propose a message authentication and integrity protection scheme based on optically generated chaos. The new scheme is coming to complete a recently introduced solution, for data confidentiality based on optical chaos.

The nonlinear span of a sequence x is defined as the length of the shortest feedback shift register that generates x. In this correspondence, we solve the problem of designing periodic binary sequences with given linear complexity and maximal possible nonlinear span. We concentrate on the case of sequences with period N=2n-1 and we introduce two construction methods

A new approach on the computation of the nonlinear span of periodic binary sequences, i.e. the length of shortest feedback shift register that generates the given sequence, is presented. The problem of designing binary sequences with the maximum possible span is considered and solved

The problem of finding the length of a shortest feedback shift register that generates a given finite-length sequence is considered. An efficient algorithm for the determination of the span is proposed, that takes advantage of the special block structure of the associated system of linear equations. The span distribution of finite-length binary sequences is also studied.

The problem of finding the shortest feedback shift register, with quadratic feedback function that generates a given finite-length sequence is considered. An algorithm for the determination of the quadratic span and the feedback function, which takes advantage of the special block structure of the associated system of linear equations, is proposed.

The problem of finding the length of shortest feedback shift register that generates a given finite-length sequence is considered. An algorithm for the determination of the span is proposed, that takes advantage of the special block structure of the associated system of linear equations. The span distribution of finite-length binary sequences is also studied.

The determination of the minimum linear span sequence that differs from a given binary sequence, of period N=2/sup n/-1, by at most one digit is discussed and three methods are presented: the sequential divisions method, the congruential equations method, and the phase synchronization method. High-level algorithm organizations are provided. Finally, guidelines on sequence characterization and design via the notion of robustness are given.