The existing methods of ransomware detection have limitations. To be specific, static analysis is not effective to obfuscated binaries, while dynamic analysis is usually restricted to a certain platform and often takes tens of minutes. In this paper, we propose a block-level monitoring system to detect potentially malicious cryptographic operations. We carry out statistical analysis to find heuristic rules to distinguish between normal and encrypted blocks. In order to apply the heuristic rule to the filesystem without kernel modification, we adopt Filesystem in Userspace (FUSE) and define our filesystem Rcryptect for real-time detection of cryptographic function. We demonstrate the protection of well-known ransomware and show that various cryptographic functions can be detected with about 13% overhead.

5G-assisted device-to-device (D2D) communication plays an instrumental role in minimizing latency, maximizing resource utilization, improving speed, and boosting system capacity. However, the technology confronts several challenges to realize its enormous potential fully. Security and privacy concerns are at the top of the list that can jeopardize the regular operation of D2D communication by executing various assaults such as free-riding and impersonation. Although several researchers suggested different solutions to these concerns, most are too heavy for resource-constrained devices or are vulnerable to security risks. Consequently, we proposed a lightweight and provably secure D2D communication protocol comprising initialization, device discovery, and link setup phases. The protocol is light in terms of computational overhead and communication latency while verifiably secure through formal security analysis. The protocol relies on a new network function, called D2D Security Management Function (DSMF), located near the devices to facilitate secure communication and improve performance. Moreover, we used deep learning-based UE trust score forecasting to better handle and prioritize communication requests when the network is overloaded. The comparative analysis against state-of-the-art security schemes concerning computational and communication overheads shows that our protocol is a superior alternative for resource-constrained IoT devices wishing to perform D2D communication in a 5G network.

Traditional public key exchange protocols are based on algebraic number theory. In another perspective, neural cryptography, which is based on neural networks, has been emerging. It has been reported that two parties can exchange secret key pairs with the synchronization phenomenon in neural networks. Although there are various models of neural cryptography, called Tree Parity Machine (TPM), many of them are not suitable for practical use, considering efficiency and security. In this paper, we propose a Vector-Valued Tree Parity Machine (VVTPM), which is a generalized architecture of TPM models and can be more efficient and secure for real-life systems. In terms of efficiency and security, we show that the synchronization time of the VVTPM has the same order as the basic TPM model, and it can be more secure than previous results with the same synaptic depth.

Since deduplication inevitably implies data sharing, control over access permissions in an encrypted deduplication storage is more important than a traditional encrypted storage. Therefore, in terms of flexibility, data deduplication should be combined with data access control techniques. In this paper, we propose an authorized deduplication scheme using CP-ABE to solve this problem. The proposed scheme provides client-side deduplication while providing confidentiality through client-side encryption to prevent exposure of users’ sensitive data on untrusted cloud servers. Also, unlike existing convergent encryption schemes, it provides authorized convergent encryption by using CP-ABE to allow only authorized users to access critical data. The proposed authorized deduplication scheme provides an adequate trade-off between storage space efficiency and security in cloud environment and is very suitable for the hybrid cloud model considering both the data security and the storage efficiency in a business environment.

We develop a couple of new methods to reduce transmission overheads in broadcast encryption. The methods are based on the idea of assigning one key per each partition using one-way key chains after partitioning the users. One method adoptsskippingchainson partitions containing up toprevoked users and the other adoptscascadechainson partitions with layer structure. The scheme using the former has the transmission overhead [(r)/(p+1)]+ [(N-r)/(c)], which is less thanr/pifr>p2N/c. The scheme using the latter keeps the same transmission overhead with the subset difference (SD) scheme whenrapproaches 0, whereris the number of revoked users. Combining the two schemes, we propose a new broadcast encryption scheme whose transmission overhead is the same with that of the SD scheme for smallrand becomes smaller than that of the SD asrgrows. The scheme using skipping chains possesses an advantage that any number of new users can join any time at no cost for current users. Finally, we show that the proposed key assignment scheme satisfieskey-indistinguishabilityassuming pseudorandom generators.

Since broadcast encryption was first introduced in 1993 by Fiat and Naor, many broadcast encryption schemes have been developed. Among these, schemes based on tree structure and linear structure are notable. The subset difference (SD) scheme and layered subset difference (LSD) scheme based on tree structure have small user-key size and small transmission overhead when the number r of revoked users is very small. The punctured interval (PI) scheme based on linear (or circular) structure has better transmission overhead when r is not too small.In this paper, we propose a new broadcast encryption scheme, called the tree-based circle (TC) scheme, combining tree structure and circular structure. In this scheme, the transmission overhead is proportional to r like in the SD scheme for small r and becomes asymptotically same as that of the PI scheme when r grows, keeping the computation cost and the storage size small. The TC scheme also inherits the flexibility of the PI scheme. We further improve the transmission overhead of the TC scheme, when r is very small, by adopting the notion of cascade arc.