In developing secure applications and systems, designers must often incorporate secure user identification in the design specification. In this paper, we study secure off-line authenticated user identification schemes based on a biometric system that can measure a user's biometrics accurately (up to some Hamming distance). The presented schemes enhance identification and authorization in secure applications by binding a biometric template with authorization information on a token such as a magnetic strip. Also developed are schemes specifically designed to minimize the compromising of a user's private biometrics data, encapsulated in the authorization information, without requiring secure hardware tokens. We also study the feasibility of biometrics performing as an enabling technology for secure systems and applications design. We investigate a new technology which allows a user's biometrics to facilitate cryptographic mechanisms.

An almost uniform $NC^1 $ circuit family for integer division is presented. The circuit size is $O(n^6 / \log (n))$. The circuit design is based on modular representation for integers below $2^n $. In particular, a very efficient technique is introduced for computing “$a < b$?” when a and b in modular representation. This leads to a uniform $NC^1 $ circuit of $O(n^2 )$ size for comparison of integers in modular representation.

The author describes the use of cryptographic authentication for controlling computer viruses. The objective is to protect against viruses infecting software distributions, updates, and programs stored or executed on a system. The authentication determines the source and integrity of an executable, relying on the source to produce virus-free software. The scheme relies on a trusted (and verifiable, where possible) device, the authenticator, used to authenticate and update programs and convert programs between the various formats. In addition, each user's machine uses a similar device to perform run-time checking.>

Data protection in computer systems is a rather complex problem. Data has to be protected while it is in memory, during communication and while it is stored on mass storage devices. During computation the central processor executes instructions and operates on data that are in readable form. The problem of operating on encrypted data was first considered by Rivest et al [4]. However, notrivial privacy homomorphisms do not exist. Thus it seems that isolation of users is the only alternative if security and privacy is to be achieved. However, in practice isolation is difficult to enforce. Worse, when user to user communication is allowed, more serious loopholes develop. Even though the problems of protection in Operating Systems in general are difficult, one does not have to settle for no security. Encryption allows the protection of data even when good security measures are lacking in an Operating System. In fact it is possible to design operating systems with improved protection using encryption [3]. In this paper we shall consider the problems of encrypted relational datsbases and show that it is possible under some circumstances to perform relational operations without decrypting an entire record.

Operating systems security is relatively new area. Most Operating Systems were designed without adequate attention to security since the primary concerns were economic. In this paper we present a new architecture that facilitates the design of secure time-shared Operating Systems. This approach differs from others that rely on verification to achieve security. In the proposed architecture, encryption is used to enforce the security policies.

A new cryptosystem that is suitable for database encryption is presented. The system has the important property of having subkeys that allow the encryption and decryption of fields within a record. The system is based on the Chinese Remainder Theorem.

In this paper, we present a scheme for distributing a key to n users in such a way as to require at least k of them (k < n) to be present to construct the original key. The scheme has the property that up to k - 1 defections can be tolerated. It can be implemented simply and efficiently.

Technology that allows significant sharing of computer resources carries with it an increased responsibility to protect these resources from un-authorized, malicioua, irresponsible, or unintended use or disclosure. The years have seen a progression of increasingly sensitive information made available in increasingly less supervised modes to a variety of users. Commercial users routinely store valuable financial information and conduct cashless transactions electronically. University professors maintain class grading forms and examinations on departmental computers. Government agencies keep extensive databases of sensitive information regarding employees, foreign nationals, U.S. citizens. The military and intelligence communities continue to press for more powerful techniques to enhance their information gathering and processing capabilities. In spite of the clear need for guarantees of security, all practical schemes to protect information stored or manipulated by such systems are either seriously flawed or reduce ultimately to a collection of physical security protocols (ace [1] for an overview of the state of the art).

In attempting to solve the problems of data security, researchers, and practititioners are placing increasing emphasis on encryption. An important class of encryption schemes is that of substitution-permutation (SP) encryption networks. A variant of the SP network has been chosen by the National Bureau of Standards as the data encryption standard. In this paper, we introduce the concept of completeness, which captures the intuitive notion of complexity of SP networks. The completeness property is examined and a technique for designigning complete SP networks is demonstrated.

The related fields of privacy and security are examined. Privacy issues are discussed and topics in the security fields of cryptography, database inference and operating systems are re viewed.

Databases may be compromised by asking a set of queries which return only statistical information and making inferences about a specific entry from the results of the set of queries. We present methods of constructing the set of queries to compromise a database where all the queries in the set return the maximum of a set of k elements, or all queries return the mean of a set of k elements. In the case of the mean query, all elements involved will be compromised. We also consider bounds on the number of queries required to compromise the database.

We develop a new error-locating polynomial for BCH codes. This polynomial has a simple form and suggests a decoding procedure similar to Massey's step-by-step decoding.

An algorithm is presented to test the graph isomorphism for undirected linear graphs. The graph isomorphism between two or more graphs can be tested by obtaining their optimum codes. The algorithm relabels the nodes of graphs to obtain optimum codes. The optimum code is the code of maximum weight obtained from the upper triangle of the Adjacency matrix of the given graph. The method of ordering the nodes of a graph to produce a code invariant to isomorphism is related to invariant features in feature extraction [7], [15].