The global interest in taking preventative measures has intensified in response to the coronavirus epidemic. The vaccination certificate is one approach used to control the spread of disease while enabling people to carry out their regular lives and interact with each other as they normally would. Most services require their users to provide proof of immunization; however, the information they require seems to be either overly personal or unrelated to the service's intended use. Immunization Information System (IIS), the data owner, is indeed accountable for safeguarding client data and privacy in accordance with ethical considerations. In order to ensure that requests for data access are acknowledged by data subjects and that only the fields required to fulfill the usage purpose are given, some mechanisms must be presented. In this study, consent management blockchain with add-on modules that enable loose-coupling integration with existing vaccination applications is presented in an attempt to provide such functionality without adding extra burden to IIS. To limit the quantity and sensitivity of the data retrieved, a data filtering scheme is proposed. Additionally, a source authentication technique is introduced to guarantee that data is delivered to the authorized requesters. To make sure all transaction requests are processed regardless of limitations in the execution capability of the blockchain, job queues are presented to reduce transactions' conflicts. This allows multiple transactions to be executed in parallel and resolves scalability and performance concerns which are the major issues found when integrating blockchain with large-scaled production systems.

The growing number of e-voting applications indicates the need in resolving issues that exist in the traditional election model. By integrating with blockchain technology, we could extend the model’s capabilities by presenting transparency in logic execution and integrity in data storage. Despite these advantages, blockchain brings in new challenges regarding system performance and data privacy. Due to distributed nature of blockchain, any new updating request needs to be reflected in all network’s peers before proceeding to the subsequence requests. This process produces delay and possibility in request rejection due to update conflict. In addition, data removal is no longer feasible since each record is protected by immutable hashed link. To overcome these limitations, the integration model of blockchain and message queue is proposed in this paper. The design addresses security concerns in data exchanging patterns, voter anonymization, and proof of system actor’s legitimacy. Performance tests are conducted on system prototypes which were deployed on two different settings. The result shows that the system can perform well in production environment, and introduction of message queue handling scheme can cope with blockchain’s errors in unexpected scenarios.

International audience

Service Function Chaining (SFC) has recently received considerable attentions from both industry and academia, due to its potential for improving the flexibility of provisioning and composition of Virtualized Network Functions (VNFs) to suit application-specific needs. From a security perspective, there is a gap between high-level SFC policy specification and its enforcement in the data plane. It cannot guarantee that the deployed VNFs are always chained in an expected manner, or the packet flows of a particular service chain are sequentially forwarded to the intended and legitimate VNFs strictly compliant with the specified SFC policy. This lack of assurance leaves the door open for attackers to maliciously manipulate the service chain by evading from security functions such as firewall, Deep Packet Inspection (DPI), etc., or deviating the packet flows from their original service function path, ultimately leading to the violation of SFC policy. It is therefore important to have an efficient self-checking mechanism in place, ensuring the SFC to be implemented in a secure and dependable way. This paper presents a new security primitive - Lite Identity-based Ordered Multisignature scheme (ChainSign in short), which enforces all intended VNFs in a particular service chain to sequentially sign the packet received. Then the last hop of the chain will verify the signature, so as to validate whether all of them work as expected and have not been compromised, while satisfying the security properties of concern (i.e., the consistency in VNF chaining, their authenticities and sequences in a service chain). In addition to the implementation, we leverage the IETF Network Service Header (NSH) to carry the signature generated from our proposed scheme. The experiments show that ChainSign can preserve all identified security properties with minimal overhead.

Biometric authentication is increasingly recognized as an effective technique for secure authentication, but using such authentication with Internet of Things (IoT) devices is difficult. In the present paper, we propose an IoT biometric authentication solution that adopts a cloud-based IoT service platform. We present the proposed system architecture, which uses an IoT service platform and security alerting mechanisms to deal with physical and administrative constraints, including a limited Internet connection, a limited budget, a need for easy development, and a required high level of security. We also demonstrate the feasibility of the proposed solution.

Many countries have founded national high performance computing center aiming to provide computational resources to their scientists upon requests. The resources provided are not efficient because the job requests are not relative to the real use leading to unnecessary resource consumption. In this paper, we present a method to monitor and manage High Performance Computing (HPC) resources more efficiently. Usually, the HPC resources are managed by a Portable Batch System (PBS) as the Job Management System (JMS) for effective job scheduling and resource allocation. However, the HPC resources often engage in inefficient job requests. For instance, a job request may have for four processors running per node for two hours, but the actual usage engages four processors per node for one hour. Hence, the HPC resources lose an hour of productivity. As a consequence, the queues for job execution are longer. The automated job monitoring system proposed in this paper would scan all the jobs on every HPC Node and compare the job requests conditions with preset criteria. If the conditions meet the criteria, then the inefficient jobs are forced to cancel from the HPC queue. The results show that more HPC resources are available for executing other jobs in the queue, leading to saved resources in the HPC environment and Stabilization of HPC hardware, promoting an HPC infrastructure ecosystem.

This paper presents a gain invariant speech watermarking technique based on quantization of the Lp-norm. In this scheme, first, the original speech signal is divided into different frames. Second, each frame is divided into two vectors based on odd and even indices. Third, quantization index modulation (QIM) is used to embed the watermark bits into the ratio of the Lp-norm between the odd and even indices. Finally, the Lagrange optimization technique is applied to minimize the embedding distortion. By applying a statistical analytical approach, the embedding distortion and error probability are estimated. Experimental results not only confirm the accuracy of the driven statistical analytical approach but also prove the robustness of the proposed technique against common signal processing attacks.

Today, many organizations allow their employees to bring their own smartphones or tablets to work and to access the corporate network, which is known as a bring your own device (BYOD). However, many such companies overlook potential security risks concerning privacy and confidentiality. This paper provides a review of existing literature concerning the preservation of privacy and confidentiality, with a focus on recent trends in the use of BYOD. This review spans a large spectrum of information security research, ranging from management (risk and policy) to technical aspects of privacy and confidentiality in BYOD. Furthermore, this study proposes a policy-based framework for preserving data confidentiality in BYOD. This framework considers a number of aspects of information security and corresponding techniques, such as policy, location privacy, centralized control, cryptography, and operating system level security, which have been omitted in previous studies. The main contribution is to investigate recent trends concerning the preservation of confidentiality in BYOD from the perspective of information security and to analyze the critical and comprehensive factors needed to strengthen data privacy in BYOD. Finally, this paper provides a foundation for developing the concept of preserving confidentiality in BYOD and describes the key technical and organizational challenges faced by BYOD-friendly organizations.

Information security in critical infrastructure sectors has become a crucial issue in recent years. A drastic increase of mobile device usage for accessing to corporate networks could expose the critical systems to major security risks. The paper provides an overview of research and practice trends in mobile device security focusing on critical infrastructure. This includes access control, next-generation firewall, BYOD control mechanism, and BYOD management and policy. Confidentiality, integrity, and availability issues related on the research and practice trends are discussed, followed by the conclusion.

Recently, location based services (LBS) have become more important in today technology advancements. Privacy issue in LBS is one of the most important concerns. In this paper, we have proposed an anonymity preserving framework which can provide a user with more privacy in both authenticating and querying processes. In our framework, an authentication protocol has been proposed, in order to strengthen a privacy, a technique called "Timed Fuzzy Logic" is used. In querying processes of location based services, the use of the Anonymizer, a trusted third party, to provide users anonymous querying and requesting processes is presented. Moreover, when concerning on privacy in user's context, k-anonymity cloaking has been employed for the purpose of preventing user's current location from tracking.