This paper proposes an architecture that supports security measures by evaluating the impact of cyber attacks on physical spaces, utilizing information gathered from the neighborhoods of devices. The architecture includes digital twin (DT) models that represent the conditions of physical spaces in cyberspace and utilizes various types of information in both cyber and physical spaces, such as device location, speed, and vulnerability, for cyber-physical security measures. We summarize the challenges in translating security information into DT models and in implementing the overall architecture for security measurements.

Hardware Trojans (HTs) have become a serious problem, and extermination of them is strongly required for enhancing the security and safety of integrated circuits. An effective solution is to identify HTs at the gate level via machine learning techniques. However, machine learning has specific vulnerabilities, such asadversarial examples. In reality, it has been reported that adversarial modified HTs greatly degrade the performance of a machine learning-based HT detection method. Therefore, we propose a robust HT detection method using adversarial training (R-HTDetector). We formally describe the robustness of R-HTDetector in modifying HTs. Our work gives the world-first adversarial training for HT detection with theoretical backgrounds. We show through experiments with Trust-HUB benchmarks that R-HTDetector overcomes adversarial examples while maintaining its original accuracy.

Puncturable encryption (PE), introduced by Green and Miers at IEEE S$&$P 2015, allows recipients to update their decryption keys to revoke decryption capability for selected messages without communicating with senders. In general, it allows users to control which ciphertexts their keys may decrypt. The notion of PE has been found very useful in many applications, such as asynchronous messaging systems, group messaging systems, public-key watermarking schemes, secure cloud emails, and many more. In this paper, we introduce a new primitive called hierarchical identity-based puncturable encryption (HIBPE) that enhances the concept of PE by allowing more general key delegation and flexible key puncture. It enhances the capability of the data owner for multi-level encrypted data sharing within a group of users by delegating the decryption keys of the users in higher-levels to generate decryption keys for the users in lower-levels. Moreover, it allows users to puncture (update) their decryption keys on tags so that a decryption key punctured on a tag can no longer decrypt ciphertexts under this tag. In addition, to control access to the users' data, the higher-level users can further puncture the delegated keys (for lower-level users) with some tags such that the part of the owner's data is labeled by the punctured tags will no longer be accessible by the lower-level users. These features offer an efficient and flexible solution for encrypted data sharing as well as data-access control mechanisms in a hierarchical setting. We propose the formal definition and security model for HIBPE schemes and provide a concrete HIBPE scheme based on the hardness of the learning with errors problem in the standard model. Further, we provide a generic construction of forward secure hierarchical identity-based encryption (fs-HIBE) from HIBPE, which enables the first quantum-safe construction of fs-HIBE in the standard model. Moreover, this is the first fs-HIBE construction by exploring the concept of PE. The proposed fs-HIBE provides quantum-safe protection for secret keys from exposure in multi-level encrypted data sharing by evolving the keys with time.

Residue number systems provide efficient techniques for speeding up calculations and/or protecting against side channel attacks when used in the context of cryptographic engineering. One of the interests of such systems is their scalability, as the existence of large bases for some specialized systems is often an open question. In this paper, we present highly optimized methods for generating large bases for residue number systems and, in some cases, the largest possible bases. We show their efficiency by demonstrating their improvement over the state-of-the-art bases reported in the literature. This work make it possible to address the problem of the scalability issue of finding new bases for a specific system that arises whenever a parameter changes, and possibly open new application avenues.

Adversarial images have been proposed to deceive deep neural networks (DNNs) by adding perturbations to the pixels. Unlike existing attacks, Su et al. [1] analyzed an attack in an extremely limited constraint where only one pixel was modified. However, their one-pixel attack is easy to recognize by humans. In this paper, we improve the attack to enable the deceit of both DNNs and humans. We conducted a human recognition analysis to prove our attack's effect. We then propose detection and defense methods against the attack by re-attacking the adversarial images. Our experimental results on the six most recent convolutional neural networks show that while our attack achieved approximately the same success rates and confidence scores as in the existing attack, our attack achieves a higher success rate for deceiving humans. Only 49.41 % of participants can recognize our attack even though 81.04 % participants have recognized the existing attack. OPA2D detects 99.33% of the existing attack and 100% of our attack and defends 92.00% of the existing attack and 95.33 % of our attack.

Due to the rapid growth in the information and telecommunications industries, an untrusted vendor might compromise the complicated supply chain by inserting hardware Trojans (HTs). Although hardware Trojan detection methods at gate-level netlists employing machine learning have been developed, the training dataset is insufficient. In this paper, we propose a data augmentation method for machine-learning-based hardware Trojan detection. Our proposed method replaces a gate in a hardware Trojan circuit with logically equivalent gates. The experimental results demonstrate that our proposed method successfully enhances the classification performance with all the classifiers in terms of the true positive rates (TPRs).

Hoang-Quoc Nguyen-Son, Tran Thao, Seira Hidano, Ishita Gupta, Shinsaku Kiyomoto. Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. 2021.

Threats and risks against supply chains are increasing and a framework to add the trustworthiness of supply chain has been considered. In this framework, organisations in the supply chain validate the conformance to the pre-defined requirements. The results of validations are linked each other to achieve the trustworthiness of the entire supply chain. In this paper, we further consider this framework for data supply chains. First, we implement the framework and evaluate the performance. The evaluation shows 500 digital evidences (logs) can be checked in 0.28 second. We also propose five methods to improve the performance as well as five new functionalities to improve usability. With these functionalities, the framework also supports maintaining the certificate chain.

Abstract The lattice‐based encryption scheme has high efficiency and reliability, and it can be run on small devices with limited memory capacity and computational resources such as sensor nodes or smart cards. The first implementation is presented of the original ring–learning‐with‐errors‐based encryption scheme on a standard Java Card platform by combining the number theoretic transform with improved Montgomery modular multiplication. Without any cryptographic coprocessor support, the decryption running time is around 7 s, corresponding to the AES‐128 security level. Two efficient discrete Gaussian sampling approaches, known at the discrete Ziggurat sampling algorithm and Knuth–Yao algorithm, were implemented on the Java Card and resulted in a reduction in running times. More important, polynomial modular multiplication is shown to perform efficiently on a standard Java Card platform even when the big integers and floating‐point number operations are not supported. The results show the feasibility of implementing more lattice‐based cryptosystems on existing memory‐constrained Java Cards. A preliminary version of this paper appeared with the title ‘Memory‐constrained implementation of lattice‐based encryption scheme on standard Java Card’ in Proceedings of the 2017 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) .

Secret sharing scheme has been applied commonly in distributed storage for Big Data. It is a method for protecting outsourced data against data leakage and for securing key management systems. The secret is distributed among a group of participants where each participant holds a share of the secret. The secret can be only reconstructed when a sufficient number of shares are reconstituted. Although many secret sharing schemes have been proposed, they are still inefficient in terms of share size, communication cost and storage cost; and also lack robustness in terms of exact-share repair. In this paper, for the first time, we propose a new secret sharing scheme based on Slepian-Wolf coding. Our scheme can achieve an optimal share size utilizing the simple binning idea of the coding. It also enhances the exact-share repair feature whereby the shares remain consistent even if they are corrupted. We show, through experiments, how our scheme can significantly reduce the communication and storage costs while still being able to support direct share repair leveraging lightweight exclusive-OR (XOR) operation for fast computation.

Supply chain management is critical in industrial efforts to reduce costs and time, stabilize product supply, and improve profitability. Surveillance cameras play a significant role in supply chain management, as they can record work activities to achieve appropriate monitoring of company operations. A solution for ensuring the reliability of the video taken by a surveillance camera is to achieve data integrity using a cryptographic algorithm. Another important solution is the identification of a surveillance camera to ensure the traceability of video. This paper proposes a novel approach for video-based fingerprint extraction and key generation, that can be used for camera PUF construction. Our experiment shows that a 256-bit key can be extracted from 50 frames of a normal video with a resolution of 800 X 600 pixels, and we theoretically prove that our methodology satisfies the randomness, uniqueness, steadiness, and unpredictability requirements. Our PUF construction can thus be used to identify a surveillance camera from a video.

A huge number of documents such as news articles, public reports, and personal essays has been released on websites and social media. Once documents including privacy-sensitive information are published, the risk of privacy breaches increases; thus, documents should be carefully checked before publication. In many cases, human experts redact or sanitize documents before publishing; however, this approach is sometimes inefficient with regard to its cost and accuracy. Furthermore, critical privacy risks may remain in the documents. In this paper, we present a generalized adversary model and apply it to document data. This paper devises an attack algorithm for documents, which uses a web search engine, and proposes a privacy-preserving algorithm against the attacks. We evaluate the privacy risks for real accident reports from schools and court documents. As experiments using the real reports, we show that human-sanitized documents still include privacy risks, and our proposal would contribute to risk reduction.

Abstract Privacy risks of collaborative filtering (CF) have been widely studied. The current state-of-theart inference attack on user behaviors (e.g., ratings/purchases on sensitive items) for CF is by Calandrino et al. (S&P, 2011). They showed that if an adversary obtained a moderate amount of user’s public behavior before some timeT, she can infer user’s private behavioraftertimeT. However, the existence of an attack that infers user’s private behaviorbefore Tremains open. In this paper, we propose the first inference attack that reveals past private user behaviors. Our attack departs from previous techniques and is based onmodel inversion(MI). In particular, we propose the first MI attack on factorization-based CF systems by leveraging data poisoning by Li et al. (NIPS, 2016) in a novel way. We inject malicious users into the CF system so that adversarialy chosen “decoy” items are linked with user’s private behaviors. We also show how to weaken the assumption made by Li et al. on the information available to the adversary from the whole rating matrix to only the item profile and how to create malicious ratings effectively. We validate the effectiveness of our inference algorithm using two real-world datasets.

The Internet of things (IoT) has come into widespread use, and data protection and integrity are critical for connected IoT devices in order to maintain security and privacy. Low-power wide-area (LPWA) technologies for IoT wireless communication achieve data protection and integrity by using encryption and message authentication. However, side-channel analysis techniques exist that have the capacity to recover secret information from a device. In this paper, we apply a side-channel analysis technique to the payload encryption process and message authentication code generation process on a real LoRaWAN end-device. The entire AES-128 key for the payload encryption can be recovered with 260 electromagnetic(EM)-leakage traces and 12 bytes of the key for message authentication code generation can be recovered with 140 EM-leakage traces.

Machine-translated text plays a crucial role in the communication of people using different languages. However, adversaries can use such text for malicious purposes such as plagiarism and fake review. The existing methods detected a machine-translated text only using the text’s intrinsic content, but they are unsuitable for classifying the machine-translated and human-written texts with the same meanings. We have proposed a method to extract features used to distinguish machine/human text based on the similarity between the intrinsic text and its back-translation. The evaluation of detecting translated sentences with French shows that our method achieves 75.0% of both accuracy and F-score. It outperforms the existing methods whose the best accuracy is 62.8% and the F-score is 62.7%. The proposed method even detects more efficiently the back-translated text with 83.4% of accuracy, which is higher than 66.7% of the best previous accuracy. We also achieve similar results not only with F-score but also with similar experiments related to Japanese. Moreover, we prove that our detector can recognize both machine-translated and machine-back-translated texts without the language information which is used to generate these machine texts. It demonstrates the persistence of our method in various applications in both low- and rich-resource languages.

Researching for malware detection using machine learning is becoming active. However, conventional detection techniques do not consider the impact of attacks on machine learning, which has become complicated in recent years. In this research, we focus on data poisoning attack, which is one of the typical attacks on machine learning, and aim to clarify the influence of attacks on malware detection technology. Data poisoning attack is an attack method that intentionally manipulates the predicted result of a learned model by injecting poisoning data into training data, and by applying this, it is possible to embed a backdoor that induces mis-prediction of only specific input data. In this paper, we first propose an attack framework for backdoor embedding that prevents detection of only specific types of malware by data poisoning attack. Next, we will describe a method to generate poisoning data efficiently while avoiding attack detection by solving the optimization problem. Furthermore, we take malware detection technology using logistic regression and show the effectiveness of the our method through evaluation experiments using two datasets.

When a user consumes an encrypted digital content (for example video and music files), the player application accesses the secret key to decrypt the content. If the user is malicious, he can analyse the access pattern of the player application to extract the secret key efficiently. Oblivious RAMs (ORAMs) are effective solution for such threats. However, ORAMs are only effective for `passive' attackers who can observe the RAM access done by the application, but cannot alter data stored on RAM. The attacker with ability to alter data on RAM can be called `active' attackers. In this paper, we evaluate the security of ORAM schemes against active adversaries where they alter data on RAM and try to efficiently extract the secret information. We also propose countermeasures against active adversaries.

In order to ensure faster audits, higher transparency and security, many applications are being designed using blockchains. We propose BlockStore, a secure decentralized storage framework using blockchain technology. The primary motivation is efficient utilization of storage resources of users. Users often have un-utilized or underutilized storage in their devices. They can choose to host their storage resources when they are not in use. Users rent storage from the host for a fee for a fixed period of time and release back after the time expires. BlockStore keeps track of un-utilized storage of hosts in Space Wallet, a structure that helps in assigning storage to renters on request. The ownership of storage can be proved by logging all storage transactions in a public ledger (the blockchain), which can be verified by any user. A host cannot host the same storage to two users at the same time, nor can it tamper with the data of the renter. Renters cannot frame a host of cheating. BlockStore uses proofs of storage and data possession to verify that the hosts do not tamper with data and penalizes parties for misbehavior. Users can encrypt data for privacy. Payment and penalty are handled using smart contracts. BlockStore differs from existing solutions, by providing stronger audit that detects and penalizes misbehaving parties earlier than existing schemes.

Time-sequence data is high dimensional and con- tains a lot of information, which can be utilized in various fields, such as insurance, finance, and advertising. Personal data including time-sequence data is often converted to anonymized datasets, which need to strike a balance between both privacy and utility. In this paper, we consider low-rank matrix decomposition as one of the anonymization methods and evaluate its efficiency. We convert time-sequence datasets to matrices and evaluate both privacy and utility. The record IDs in time-sequence data are changed at regular intervals to reduce re-identification risk. However, since individuals tend to behave in a similar fashion over periods of time, there remains a risk of record linkage even if record IDs are different. Hence, we evaluate the re- identification and linkage risks as privacy risks of time-sequence data. Our experimental results show that matrix decomposition is a viable anonymization method and it can achieve better utility than existing anonymization methods.

Quantum computers have the potential to solve some difficult mathematical problems efficiently and thus will inevitably exert a more significant impact on the traditional asymmetric cryptography. The National Institute of Standards and Technology (NIST) has opened a formal call for the submission of proposals of quantum-resistant public-key cryptographic algorithms to set the next-generation cryptography standards. Compared to powerful machines with ample amount of hardware resources such as racks of servers and IoT devices, including the massive number of microcontrollers, smart terminals, and sensor nodes with limited computing capacity, should also have some postquantum cryptography features for security and privacy. To ensure the correct execution of encryption algorithms on any platforms, the portability of implementation becomes more important. As distinguished from C/C++, JavaScript is a popular cross-platform language that can be used for the web applications and some hardware platforms directly, and it could be one of the solutions of portability. Therefore, we investigate and implement several recent lattice-based encryption schemes and public-key exchange protocols including Lizard, ring-Lizard, Kyber, Frodo, and NewHope in JavaScript, which are the active candidates of postquantum cryptography due to their applicabilities and efficiencies. We show and compare the performance of our JavaScript implementation on web browsers, embedded device Tessel2, Android phone, and several JavaScript-enabled platforms on PC and Mac. Our work shows that implementing lattice-based cryptography on JavaScript-enabled platforms is achievable and results in desirable portability.

This article proposes a privacy-preserving quantum-secure protocol for the DBSCAN clustering algorithm. It allows multiple parties to jointly compute clusters without revealing their individual datasets to each other. We show how to outsource the DBSCAN computation on encrypted data to a cloud service provider securely such that the parties do not need to perform the expensive clustering computation locally. We also discuss some future research directions at the end of the paper.

Oblivious RAM (ORAM) is a primitive for hiding storage access patterns in the context of software protection. With the trend of cloud computing, ORAM also has important applications in privacy-preserving cloud storage applications. Many ORAMs for cloud storage have been proposed to improve efficiency and security. However, data availability, data confidentiality, and data integrity have not been simultaneously addressed. In this paper, we formalize a new concept of ORAM called RORAM (Robust ORAM by enhancing availability, confidentiality and integrity), which can deal with these three challenges. Furthermore, RORAM not only can achieve a higher security level but also is more efficient compared with previous ORAMs by using linear network coding to reduce the client's computational cost of block encryption/decryption in every read/write operation in previous ORAMs. The security and complexity analyses show that RORAM is provably secure and highly lightweight.

Secure two-party comparison plays a crucial role in many privacy-preserving applications, such as privacy-preserving data mining and machine learning. In particular, the available comparison protocols with the appropriate input/output configuration have a significant impact on the performance of these applications. In this paper, we firstly describe a taxonomy of secure two-party comparison protocols which allows us to describe the different configurations used for these protocols in a systematic manner. This taxonomy leads to a total of 216 types of comparison protocols.We then describe conversions among these types. While these conversions are based on known techniques and have explicitly or implicitly been considered previously, we show that a combination of these conversion techniques can be used to convert a perhaps less-known two-party comparison protocol by Nergiz et al. (IEEE SocialCom 2010) into a very efficient protocol in a configuration where the two parties hold shares of the values being compared, and obtain a share of the comparison result. This setting is often used in multi-party computation protocols, and hence in many privacy-preserving applications as well. We furthermore implement the protocol and measure its performance. Our measurement suggests that the protocol outperforms the previously proposed protocols for this input/output configuration, when off-line pre-computation is not permitted.

While online services based on machine learning (ML) have been attracting considerable attention in both academic and business, privacy issues are becoming a threat that cannot be ignored. Recently, Fredrikson et al. [USENIX 2014] proposed a new paradigm of model inversion attacks, which allows an adversary to expose the sensitive information of users by using an ML system for an unintended purpose. In particular, the attack reveals the sensitive attribute values of the target user by using their non-sensitive attributes and the output of the ML model. Here, for the attack to succeed, the adversary needs to possess the non-sensitive attribute values of the target user prior to the attack. However, in reality, even if this information (i.e., non-sensitive attributes) is not necessarily information the user regards as sensitive, it may be difficult for the adversary to actually acquire it. In this paper, we propose a general model inversion (GMI) framework to capture the above scenario where knowledge of the non-sensitive attributes is not necessarily provided. Here, our framework also captures the scenario of Fredrikson et al. Notably, we generalize the paradigm of Fredrikson et al. by additionally modeling the amount of auxiliary information the adversary possesses at the time of the attack. Our proposed GMI framework enables a new type of model inversion attack for prediction systems, which can be carried out without knowledge of the non-sensitive attributes. At a high level, we use the paradigm of data poisoning in a novel way and inject malicious data into the set of training data to modify the ML model into a target ML model, which we can attack without having to have knowledge of the non-sensitive attributes. Our new attack enables the inference of sensitive attributes in the user input from only the output of the ML model, even when the non-sensitive attributes of the user are not available to the adversary. Finally, we provide a concrete algorithm of our model inversion attack on prediction systems based on linear regression models, and give a detailed description of how the data poisoning algorithm is constructed.We evaluate the performance of our new model inversion attack without the knowledge of non-sensitive attributes through experiments with actual data sets.

In this paper, we design a distributed platform for anonymized dataset trading without any centralized trusted third party. The platform consists of peers and consensus-based blockchain mechanism, and each peer acts as a data broker, data receiver, or verifier for blockchain in a data transfer transaction. A data broker collects data from data owners under their consent for data trading. The Privacy Policy Manager (PPM) manages the consent information and confirms them on behalf of data owners, when data distribution is requested from data broker. We implement a prototype system of the platform using an open-source blockchain mechanism, Hyperledger Fabric, and provide evaluation results of the prototype system.

Driver behavioral analysis can be described as the process of analyzing sensor data collected from a vehicle to identify unique facets of the manner the vehicle handles while under the control of a driver. This analysis can be used to either uniquely identify a driver or differentiate him/her from other drivers. Driver behavioral analysis has practical applications in insurance, safety and security. Autonomous vehicle controllers are software systems that are static by nature. This implies that while driver behavior analysis can be carried out on autonomous vehicles, the unique driving patterns that can be used to differentiate human drivers will not be possible with autonomous vehicles controlled by the same agent. This scenario is undesirable from a security viewpoint. It is widely accepted that the predictability of software systems makes them vulnerable, this is more so if a large of number of users utilize the software system. Based on the above, in this paper, we argue for the necessity of creating diversity in the driving behavior of autonomous vehicles. We present a conceptual framework that lays out how this can be accomplished at low cost, with high flexibility and without compromising one of the major advantages of autonomous vehicles - safety. Using the example of a remote vehicle hijack, an attack scenario that has shown to be practical in recent times, we highlight an application of our proposed model. We show how having diverse behavior is advantageous in creating a fail-safe remote vehicle hijack detection system.

In human history, the dependency on secret phrases - passwords - known to only a selected few in a group has mostly ensured that only those are authorised to access certain resources or information. However, such passwords have also spelled disasters when compromised. Beyond passwords, multi-factor authentication requires the knowledge of or the possession of things other than a password to complete an authentication procedure. The process of uniquely identifying a user has also been achieved through biometric authentication. Any user and her actions are, however, not devoid of context; and may reflect a specific persona of the user. In this short position paper, we describe the blueprint of a generalised context-aware identification - user-in-a-context - that is based on various parameters obtained by sensing the environment and the user; and is, therefore, able to recognise as an entity a particular individual with situational awareness. While such identification can be used in authentication, identifying persona can also help devise better tailored services.

The Physically Unclonable Function (PUF) is a technique that generates unique device identifiers based on variations in the manufacturing process. The Internet of Things (IoT) has become widespread, and various kinds of devices are now available. Device authentication and key management are essential to provide a secure service to these devices. We can use the unforgeable identifier generated by the PUF as a key for encryption and authentication. However, the existing PUFs require a dedicated hardware or low-level software, i.e., driver. Thus, they are impractical to use on smartphones or IoT devices due to the severe limitations of production cost and power consumption. In this paper, we propose a sensor-based PUF that utilizes the accelerometer and gyroscope, which are widely available on smartphones and IoT devices. We implement the proposed PUF on a smartwatch and show that accelerometer-based PUF achieves good usability, extreme robustness, and a high entropy of 91.66 bits.

The privacy of individuals included in the datasets must be preserved when sensitive datasets are published. Anonymization algorithms such as k-anonymization have been proposed in order to reduce the risk of individuals in the dataset being identified. k-anonymization is the most common technique of modifying attribute values in a dataset until at least k identical records are generated. There are many algorithms that can be used to achieve k-anonymity. However, existing algorithms have the problem of information loss due to a tradeoff between data quality and anonymity. In this paper, we propose a novel method of constructing a generalization hierarchy for k anonymization algorithms. Our method analyses the correlation between attributes and generates an optimal hierarchy according to the correlation. The effect of the proposed scheme has been verified using the actual data: the average of k of the datasets is 83:14, and it is around 1=3 of the value obtained by conventional methods.

In this paper, we introduce the concept of a privacy enhancing personal agent that manages a user's privacy policy settings and provides access control functions to ITS services. The personal agent acts as a proxy between a vehicle and service providers, and it automatically decides whether personal data can be sent to a service provider based on the privacy policy settings. The functions of the personal agent are also described. The personal agent provides a common web-based interface, and the quality of data can be controlled through anonymization levels. Our research provides a conceptual model of the personal agent and considers the design of the personal agent based on privacy requirements. Drivers can delegate their user consent role to the personal agent by configuring privacy policy settings on the personal agent. The personal agent is a key component for achieving a secure and reliable data transfer platform between vehicles and service providers.

Opinions from people can either be biased or reflect low participation due to legitimate concerns about privacy and anonymity. To alleviate those concerns, the identity of a message sender should be disassociated from the message while the contents of the actual message should be hidden from any relaying nodes. We propose a novel message routing scheme based on probabilistic forwarding that guarantees message privacy and sender anonymity through additively homomorphic public-key encryption. Our scheme is applicable to anonymous surveys and microblogging.

Network coding is a way of transmitting information where nodes in a network combine incoming packets into a single one to increase throughput in some scenarios, nodes wishing to get the original information can perform decoding when enough packets have been received. Given its efficiency, the exclusive or (XOR) operation is very popular for network coding. One security concern for networks using network coding is the so called “pollution attack”, where an adversary introduces packets that are not combinations of the original ones. In this paper, we present a construction to prevent pollution attacks in XOR network coding that is suitable for networks where nodes must perform fast verifications. Unlike existing constructions in the literature which are based on XOR-homomorphic authentication functions, our construction can be instantiated with existing cryptographic primitives that are not related to the XOR operation. The core insight of our proposal is a carefully selected set of authenticated packets that are used to authenticate the network coding stream. We show that our proposal is computationally efficient at the intermediate nodes and that can be computed efficiently at the nodes which are generating the content.

Mobility data gathered from location sensors such as Global Positioning System (GPS) enabled phones and vehicles is valuable for spatio-temporal data mining for various location-based services (LBS). Such data is often considered sensitive and there exist many a mechanism for privacy preserving analyses of the data. Through various anonymisation mechanisms, it can be ensured with a high probability that a particular individual cannot be identified when mobility data is outsourced to third parties for analysis. However, challenges remain with the privacy of the queries on outsourced analysis results, especially when the queries are sent directly to third parties by end-users. Drawing inspiration from our earlier work in privacy preserving collaborative filtering (CF) and next location prediction, in this exploratory work, we propose a novel representation of trajectory data in the CF domain and experiment with a privacy preserving Slope One CF predictor. We present evaluations for the accuracy and the computational performance of our proposal using anonymised data gathered from real traffic data in the Italian cities of Pisa and Milan. One use-case is a third-party location-prediction-as-a-service deployed on a public cloud, which can respond to privacy-preserving queries while enabling data owners to build a rich predictor on the cloud.

Cloud services provide advantages in terms of service scalability and availability of users' data, but increase concerns about the control that a user has over her own data. These concerns include not just issues related to access to the information itself, but issues about the effective deletion of the information by the cloud in compliance with the user's right to deletion. In this on-going work, we present a mechanism that allows users to control access to and deletion of their information stored on the cloud. Our construction separates the user's content into several encoded pieces most of which are stored by a cloud provider. The remaining encoded pieces are stored by the user and are served directly from the user's infrastructure to the persons interested in viewing the content. The encoding must satisfy the property that without the pieces stored in the user's infrastructure none of the data is revealed. This property is found in several constructions related to secret sharing. We evaluate the practical feasibility of our proposal by developing an image sharing mechanism and simulating the user infrastructure using a single-board computer connected to the home Internet connection of one of the authors.

Proofs of Data Possession (PDPs) are protocols that allow a file owner to verify that a file stored at an outsourced server is stored entirely. From a security perspective, it must be difficult for the server to pass the verification protocol if the file is not available. Even though several efficient PDPs exist in the literature, to the best of our knowledge no special algorithms, besides the existing combinatorial approaches have been designed to find what exact blocks of the file are defective. In this article we present an efficient method to find what blocks are defective in a server, even when the server might lie; we show that by taking advantage of the homomorphic properties of existing PDPs, we can improve existing combinatorial methods to find the defective blocks. Our method involves a single invocation of the PDP's verification protocol and an additional communication overhead, which is never larger than the number of blocks of the file regardless of the number of missing blocks. For cases where few blocks have been corrupted, the transmission overhead is proportional to the the number of missing block times the logarithm of the length of the file. This is a significant improvement from existing combinatorial methods which exhibit worse performance than the naive approach (where the result of the PDP for each block is sent independently) as the number of corrupted blocks increases.

A proof of Data Possession (PDP) allows a client to verify that a remote server is still in possession of a file entrusted to it. One way to design a PDP, is to compute a function depending on a secret and the file. Then, during the verification stage, the client reveals the secret input to the server who recomputes the function and sends the output back to the client. The client can then compare both values to determine if the server is still in possession of the file. The problem with this approach is that once the server knows the secret, it is not useful anymore. In this article, we present two PDP schemes inspired in Multiple-Server Private Information Retrieval (MSPIR) protocols. In a traditional MSPIR protocol, the goal is to retrieve a given block of the file from a group of servers storing identical copies of it, without telling the servers what block was retrieved. In contrast, our goal is to let servers evaluate a function using an input that is not revealed to them. We show that our constructions are secure, practical and that they can complement existing approaches in storage architectures using multiple cloud providers. The amount of transmitted information during the verification stage of the protocols is proportional to the square root of the length of the file.

A key issue for an organization that is responsible for disaster and emergency management becomes how to gather reliable and useful information during a major disaster. We consider an information-gathering platform for large-scale disasters and emergencies based on mobile terminals. A simple solution to realize an information-gathering system is to construct a server where information is uploaded and published. However, such a centralized approach is not flexible nor is it robust. For example, it is very hard to find an appropriate system to which the user can upload information during a disaster, and the centralized server may be down because of overload or has been physically destroyed. We must consider a distributed and dynamic architecture for the system. Security and privacy issues are another concern that should be addressed for providing information from user's mobile terminals. We focus on a design of a privacy preserving data upload mechanism for the information-gathering system. We design the mechanism that accommodates privacy requirements and present a feasibility analysis of the mechanism.

A challenging task in privacy protection for public data is to realize an algorithm that generalizes a table according to requirements of a data user. In this paper, we propose an anonymization scheme for generating a k-anonymous and l-diverse table, and show evaluation results using three different tables. Our scheme is based on both top-down and bottom-up approaches for full-domain and partial-domain generalization, and the requirements are automatically incorporated into the generated table. The generated table meets user's requirements and can be employed in the services provided by users without any modification or evaluation.

It is preferable for authentication and key exchange protocols to be verified automatically and rapidly in accordance with security requirements. In order to meet these requirements, we proposed a security verification method for 2-party authentication and key exchange protocols based on Bellare et al.'s model and showed the verification points of the security properties to verify their security efficiently. However, 3-party authentication and key exchange protocols have more security properties than 2-party protocols: key privacy and security against a malicious insider. In this paper, we describe the novel security properties for 3-party protocols and show the verification point of key privacy. We also show the validity of the proposed method by explaining how it verifies the 3-party protocols as two verification examples. Our method is the first automatic security verification method that can verify the aforementioned security properties.

In this paper, we propose a perfectly anonymous attribute authentication scheme that is both unidentifiable and untraceable. The proposed scheme employs a self-blindable certificate that a user is able to change randomly; thus the certificate is modified for each authentication, and the authentication scheme is unidentifiable and untraceable. Furthermore, our scheme can revoke issued self-blindable certificates without leaks of confidential private information and check the revocation status without online access.

Copyright protection is a major issue in online content distribution services and many key-management schemes have been proposed for protecting content. Tree-based schemes aim at reducing the load on the server, and do not give consideration to that on clients. This scheme is not fully suitable for devices with low computational capacity. On the other hand, the load on clients is low in a star-based scheme. However, the load on the server becomes large in proportion to the number of clients. This structure is far from scalable. We propose a key-management scheme that is the intermediate scheme of a star-based scheme and a tree-based scheme. Then, we evaluate both the load on the server and clients in key-management scheme using the three structures. We find that the load on server and that on clients in our scheme have a relation of trade-off. We can construct optimal key-management structure satisfying system requirements using our scheme. Furthermore, the loads on both the server and clients in our scheme are lower than tree-based structure scheme under a certain condition.