Summary Cloud computing is an emerging paradigm that enables on‐demand data storage without considering the local infrastructure limitations of end‐users. The extensive growth in number of servers, resources, and networks intensifies security and privacy concerns in clouds. This necessitates secure mutual authentication and key agreement mechanism to verify the legitimacy of participating entities. In accordance, several authentication protocols have been designed to authenticate end‐users over insecure channels. This article presents security analysis of recent protocols that claim to render security and privacy features. We demonstrate that Kaur et al.'s protocol is vulnerable to replay attack, Dharminder et al.'s protocol is prone to user traceability and known session‐specific temporary information (KSSTI) attacks, and Bouchaala et al.'s protocol is prone to replay and KSSTI attacks. To withstand the aforementioned attacks, we propose an enhanced protocol based on fuzzy verifier and elliptic curve cryptography for clouds. Our protocol safeguards against security attacks while providing privacy functionalities. The security analysis is illustrated under real‐or‐random model, and correctness is verified under the Scyther security verification tool. Finally, comparative analysis with existing protocols shows that our protocol delivers robust security with reasonable computational and communication overheads than state‐of‐the‐art protocols.

Abstract Fingerprint authentication has gained attention in recent years due to its distinctiveness, low‐cost sensors, and user willingness to submit them. Its extensive deployment in our automated world raises major concerns regarding the secrecy of biometric templates and the privacy of rightful owners in biometric systems. Fuzzy Commitment (FC) focuses on securing the biometric templates by performing authentication based on the validity of secret keys from biometric features. However, the major challenge in designing Fingerprint‐based FC is the requirement of efficient binary representation for unordered and variable minutiae points in fingerprint images. Additionally, its leakage can compromise an intrinsic characteristic of the individual. The paper proposes Fingerprint‐based FC incorporating an encoding scheme dependent on the number and type of minutiae points present near the fingerprint's core point. The biometric templates are never identical thereby, this approach allows fuzziness in minutiae points by incorporating Bose–Chaudhuri–Hocquenghem (BCH) codes for error‐correction and secures random codeword of the error‐correcting scheme as secret key by SHA‐256 hash mapping. The proposed approach is evaluated on FVC2000‐DB2, FVC2002‐DB1, FVC2002‐DB2, and FVC2004‐DB1, and the results illustrate the efficiency of the proposed scheme. Furthermore, the security analysis of stored helper data and hash mapping demonstrates that the proposed approach is secure.

When specifying user requirements, not only is it critical to ensure correct and unambiguous specification of functional requirements, but also that of Non-Functional Requirements (NFRs). A critical success factor in Requirements Engineering (RE) involves recognizing conflicts among NFRs specified by multiple stakeholders having differing concerns, priorities, and responsibilities. There indeed are numerous attempts made in the literature to resolve the conflicts between two NFRs, with the traditional view of considering the two NFRs different from each other e.g. security conflicting with the availability. In this paper, however, we propose that to introduce fine-grained conflict resolution – by also focusing on those situations where one NFR conflicts with another NFR of the same type. For ease of understanding, we propose to differentiate such conflicts by coining the term intra-conflicts. Thus, we propose fine-grained conflict resolution – by focusing on the notion of resolving conflicts between two NFRs of the same type. Needless to say, non-detection of any conflict between two NFRs – whether the NFRs are of the same type or not – at an early stage of RE, leads to higher costs for changes. The process of conflict resolution is essentially intuitive and hence is iterative. Our proposal hence is motivated by a view that differentiating the inter-conflicts with intra-conflicts, helps one in better focusing on the conflict resolution. We also propose an approach that allows a requirements analyst to semi-automatically identify intra-conflicts among NFRs at an early stage of RE using natural language processing, machine learning, and ontology-based semantic analysis. The controlled experiments, conducted on five publicly available datasets, achieve an average recall, precision, and F-measure of 0.57, 0.77, and 0.65 respectively.

Social network platforms have become very popular due to their easy access and advanced features. Although social network dataset is very useful in research and market analysis, there are different risks and attacks that can breach user privacy. Online social network such as Facebook, Google Plus and LinkedIn provide a feature that allows finding out number of mutual friends (NMF) between two users. Adversary can use such information to identify individual user and related information. As the published dataset itself reveals the information of mutual friends for every connection, it becomes very easy for an adversary to re-identify users. Existing anonymization techniques for mutual friends attack are based on edge anonymization. Such methods perform anonymization operation without considering the NMF requirement of other edges that results into more edge insertion operations and low data utility of the anonymized dataset. In this paper, we propose a k-anonymization approach that works on mutual friend sequence to ensure existence of at least k elements holding the same value such that the data utility is preserved efficiently. The vertex selection process to increase the mutual friend value for one edge reduces the requirement for other edges too. The experimental results demonstrate that the proposed anonymization approach preserves the user privacy and data utility.