The widespread adoption of embedded systems has led to their deployment in critical real-world applications, making them attractive targets for malicious actors. This paper presents RunPBA , a hardware-based runtime attestation system designed to defend against control flow attacks while maintaining minimal performance overhead and adhering to strict power consumption constraints. RunPBA leverages Pointer Authentication and Branch Target Identification (PACBTI), a new processor extension tailored for the ARM Cortex M processor family, allowing robust protection without requiring hardware modifications, a limitation present in similar solutions. We implemented a proof-of-concept and evaluated it using two benchmark suites, Coremark PRO and BEEBS. Experimental results indicate that RunPBA imposes a geometric mean performance overhead of only 1.3% and 6.8% across the benchmarks, underscoring its efficiency and suitability for real-world deployment.

Abstract Protecting user data privacy can be achieved via many methods, from statistical transformations to generative models. However, they all have critical drawbacks. For example, creating a transformed data set using traditional techniques is highly time-consuming. Also, recent deep learning-based solutions require significant computational resources in addition to long training phases, and differentially private-based solutions may undermine data utility. In this paper, we propose $$\epsilon$$ ϵ -PrivateSMOTE, a technique designed to protect against re-identification and linkage attacks, particularly addressing cases with a high re-identification risk. Our proposal combines synthetic data generation via noise-induced interpolation with differential privacy principles to obfuscate high-risk cases. We demonstrate how $$\epsilon$$ ϵ -PrivateSMOTE is capable of achieving competitive results in privacy risk and better predictive performance when compared to multiple traditional and state-of-the-art privacy-preservation methods, including generative adversarial networks, variational autoencoders, and differential privacy baselines. We also show how our method improves time requirements by at least a factor of 9 and is a resource-efficient solution that ensures high performance without specialised hardware.

While the importance of consent request in today's society is increasing, specially online as a lawful basis for the processing of personal data, no detailed analysis of current technological solutions is available. In this work, we describe the existing technological solutions to express online consent in a positive fashion, including all the properties that an online solution should hold. We conclude by offering a risk proposal based on the linear combination of the rating of each one of these properties. We observe a low agreement between observers, highlighting that it is not easy to fulfill the requirements of the GDPR and showing that these studies are important when performing a Data Protection Impact Assessment. To overcome the low agreement, we propose the median of the observers' rate.

Cloud storage allows users to remotely store their data, giving access anywhere and to anyone with an Internet connection. The accessibility, lack of local data maintenance and absence of local storage hardware are the main advantages of this type of storage. The adoption of this type of storage is being driven by its accessibility. However, one of the main barriers to its widespread adoption is the sovereignty issues originated by lack of trust in storing private and sensitive information in such a medium. Recent attacks to cloud-based storage show that current solutions do not provide adequate levels of security and subsequently fail to protect users' privacy. Usually, users rely solely on the security supplied by the storage providers, which in the presence of a security breach will ultimate lead to data leakage. In this paper, we propose and implement a broker (ARGUS) that acts as a proxy to the existing public cloud infrastructures by performing all the necessary authentication, cryptography and erasure coding. ARGUS uses erasure code as a way to provide efficient redundancy (opposite to standard replication) while adding an extra layer to data protection in which data is broken into fragments, expanded and encoded with redundant data pieces that are stored across a set of different storage providers (public or private). The key characteristics of ARGUS are confidentiality, integrity and availability of data stored in public cloud systems.

New governmental legislation introduced e-prescription as mandatory in the Portuguese health system. This changes consequences were not properly considered, which caused security problems related to patient and prescriber's data, such as digital identity fraud or access to prescriptions history to build clinical profiles. In order to evaluate the e-prescribing software users awareness to those risks, a survey took place, and the results revealed ignorance of certain obligations and procedures of the e-prescribing process. A significant part of doctors are not conscious about where the patient's data is stored neither about the risks related with prescription's information.

Antunes, Fortnow, van Melkebeek and Vinodchandran captured the notion of non-random information by computational depth, the difference between the polynomial-time- bounded Kolmogorov complexity and traditional Kolmogorov complexity. We show unconditionally how to probabilistically find satisfying assignments for formulas that have at least one assignment of logarithmic depth. The converse holds under a standard hardness assumption though fails if BPP = FewP = EXP. We also show that assuming good pseudorandom generators one cannot increase the depth of a string efficiently.

There is no generally accepted definition of conditional Rényi entropy. The (unconditional) Rényi entropy depends on a parameter α, which for the case of min-entropy takes the value ∞. Even for this particular case, there are several proposals for the definition of conditional entropy. This paper describes three general definitions of conditional Rényi entropy that were found or suggested in the literature. Their properties are studied and their values, as a function of α, are compared. The particular case of min-entropy is widely used in cryptography as a security parameter; this case is studied in some detail.

Access control defines what users can perform within a system. It is usually defined by software engineers and end users are seldom asked for cooperation. The main objective of this paper is to gather the necessary knowledge from the end users of an Electronic Medical Record (EMR) regarding access control and, with their collaboration, define a list of usable access control rules and access control model, which are closer to user needs and workflows. Access control standards in healthcare were also analyzed. Afterwards, focus groups were applied to health professionals and several access control rules were extracted from the analysis of all the information that was gathered. The Break The Glass — Role Based Access Control model (BTG-RBAC) was created and includes the generated access control rules, which are closer to users' workflows and needs and can, therefore, improve EMR's usability while reducing some barriers for its effective integration.

Algorithmic entropy and Shannon entropy are two conceptually different information measures, as the former is based on size of programs and the later in probability distributions. However, it is known that, for any recursive probability distribution, the expected value of algorithmic entropy equals its Shannon entropy, up to a constant that depends only on the distribution. We study if a similar relationship holds for Rényi and Tsallis entropies of order α, showing that it only holds for Rényi and Tsallis entropies of order 1 (i.e., for Shannon entropy). Regarding a time bounded analogue relationship, we show that, for distributions such that the cumulative probability distribution is computable in time t(n), the expected value of time-bounded algorithmic entropy (where the alloted time is nt(n) log(nt(n))) is in the same range as the unbounded version. So, for these distributions, Shannon entropy captures the notion of computationally accessible information. We prove that, for universal time-bounded distribution mt(x), Tsallis and Rényi entropies converge if and only if a is greater than 1.

Access control models describe frameworks that dictate how subjects (e.g. users) access resources. In the role-based access control (RBAC) model access to resources is based on the role the user holds within the organization. RBAC is a rigid model where access control decisions have only two output options: grant or deny. break the glass (BTG) policies on the other hand are flexible and allow users to break or override the access controls in a controlled and justifiable manner. The main objective of this paper is to integrate BTG within the NIST/ANSI RBAC model in a transparent and secure way so that it can be adopted generically in any domain where unanticipated or emergency situations may occur. The new proposed model, called BTG-RBAC, provides a third decision option BTG, which grants authorized users permission to break the glass rather than be denied access. This can easily be implemented in any application without major changes to either the application code or the RBAC authorization infrastructure, apart from the decision engine. Finally, in order to validate the model, we discuss how the BTG-RBAC model is being introduced within a Portuguese healthcare institution where the legislation requires that genetic information must be accessed by a restricted group of healthcare professionals. These professionals, advised by the ethical committee, have required and asked for the implementation of the BTG concept in order to comply with the said legislation.

Under a standard hardness assumption we exactly characterize the worst-case running time of languages that are in average polynomial-time over all polynomial-time samplable distributions. More precisely we show that if exponential time is not infinitely often in subexponential space, then the following are equivalent for any algorithm A: (1) For all P-samplable distributions mu, A runs in time polynomial on mu-average. (2) For all polynomial p, the running time for A is bounded by 2O(Kp(x)-K(x)+log(|x|))for all inputs x. where K(x) is the Kolmogorov complexity (size of smallest program generating x) and Kp(x) is the size of the smallest program generating x within time p(|x|). To prove this result we show that, under the hardness assumption, the polynomial-time Kolmogorov distribution, mp(x) = 2-Kp(x), is universal among the P-samplable distributions.

The Electronic Medical Record (EMR) integrates heterogeneous information within a Healthcare Institution stressing the need for security and access control. The Biostatistics and Medical Informatics Department from Porto Faculty of Medicine has recently implemented a Virtual EMR (VEMR) in order to integrate patient information and clinical reports within a university hospital. With more than 500 medical doctors using the system on a daily basis, an access control policy and model were implemented. However, the healthcare environment has unanticipated situations (i.e. emergency situations) where access to information is essential. Most traditional policies do not allow for overriding. A policy that allows for "Break-The-Glass (BTG)" was implemented in order to override access control whilst providing for non-repudiation mechanisms for its usage. The policy was easily integrated within the model confirming its modularity and the fact that user intervention in defining security procedures is crucial to its successful implementation and use.

Fetal heart rate (FHR) monitoring is widely used regarding the detection of fetuses in danger of death or damage. Thirty one FHR tracings acquired in the antepartum period were clustered by compression in order to identify abnormal ones. A recently introduced approach based on algorithmic information theory was used. The new method can mine patterns in completely different areas, without domain-specific parameters to set, and does not require specific background knowledge. At the highest level the FHR tracings were clustered according to an unanticipated feature, namely the technology used in signal acquisition. At the lower levels all tracings with abnormal or suspicious patterns were clustered together, independently of the technology used

The use of an EPR within a hospital is essential in order to integrate and centralize patient healthcare information. With the introduction of this technology information security becomes an important issue, moreover when the EPR integrates several exam results and reports that need to be properly stored and managed. The Biostatistics and Medical Informatics Department in Porto's Faculty of Medicine is implementing a centralized electronic patient record, the HSJ.ICU, to integrate several departments' information that comprises mainly electronic reports. The provision for the integrity of these documents is essential. Usually, the users of the system have blind trust in the information they access. The HSJ.ICU is implementing a process that digitally signs reports automatically, and therefore does not interfere with system's usability. It also provides for simple key management with the use of only one public key pair focusing protection in one single point. The digital signature provides real trust in the way it prevents and detects inconsistencies or errors that may affect information integrity. The approach presented in this paper will guarantee that when there is the need to access patient reports, whether now or in 20 years' time, those are still trustable and valid to be integrated within the EPR.

Introduces computational depth, a measure for the amount of "non-random" or "useful" information in a string, by considering the difference of various Kolmogorov complexity measures. We investigate three instantiations of computational depth: (1) basic computational depth, a clean notion capturing the spirit of C.H. Bennett's (1988) logical depth; (2) time-t computational depth and the resulting concept of shallow sets, a generalization of sparse and random sets based on low depth properties of their characteristic sequences (we show that every computable set that is reducible to a shallow set has polynomial-size circuits); and (3) distinguishing computational depth, measuring when strings are easier to recognize than to produce (we show that if a Boolean formula has a non-negligible fraction of its satisfying assignments with low depth, then we can find a satisfying assignment efficiently).