Local user access is important to machine-to-machine (M2M) communication because it possesses unique advantages over remote access in that it offers instant services, provides reliable connection, and offloads the traffic of M2M access networks. Local access control is also essential for authorized users to access M2M devices. In this paper, we propose a local authentication and access control scheme (LACS), which allows M2M devices to locally verify the access rights and access privileges of the users. In particular, the property of device heterogeneity is considered in our LACS. The resource-constrained M2M devices can securely outsource heavy computation to user equipment with or without the help of a gateway for energy saving. Our LACS satisfies the security criteria of: 1) user anonymity; 2) mutual authentication; 3) secure key agreement; and 4) securely outsourcing computation. All of these criteria are theoretically proved using a formal model. Experimental data also demonstrates the efficiency of the proposed LACS and the effectiveness of the design with regard to computation offloading.

Software-Defined Networking and Network Function Virtualisation (SDN/NFV) can provide flexible resource allocation to support innovative security solutions in a central manner. To mitigate HTTP DDoS attacks, shuffling-based moving target defense has been regarded as one of the most effective ways by redirecting user traffic among a group of virtualized service functions. However, previous work did not notice that frequent changes of user traffic will significantly intensify the control overhead of SDN. In this paper, therefore, we first model the effectiveness and cost for shuffling in SDN/NFV networking with Multi-Objective Markov Decision Processes to find the optimal tradeoff between the effectiveness and cost. We then propose a cost-effective approximation algorithm with a guarantee performance bound to solve the problem. Simulation and implementation on an experimental SDN/NFV network manifest that, given 100 attackers among 1000 users and 50 virtualized functions of a web service, our algorithm achieves the approximation ratio of 0.68 and imposes only 2.4s rule modification latency for each shuffle.

Deep packet filtering (DPF) has been demonstrated as an essential technique for effective fine-grained access controls, but it is commonly recognized that the technique may invade the individual privacy of the users. Secure computation can address the tradeoff between privacy and DPF functionality, but the current solutions limit the scalability of the network due to the intensive computation overheads and large connection setup delay, especially for the latest network paradigm, network function virtualisation (NFV) and software-defined network (SDN). In this paper, therefore, we propose a privacy-preserving deep packet filtering protocol, named DPF-ET, that can efficiently perform filtering function over encrypted traffic while diminishing the communication overhead and setup delay for the controller in SDN. DPF-ET guarantees the data privacy for users and remains rule privacy for the network owner. The implementation results on an experimental HP SDN/NFV platform demonstrate that the proposed DPF-ET outperforms the current approaches by reducing 250 times in the communications overhead and 32 times in the setup delay.

With the ubiquity of social networks and mobile devices, various new mobile applications for impromptu group formation and communications have emerged recently, such as Meetup, Plancast, Yahoo! Upcoming, Eventbrite and Epinions. Among those important applications, finding a dense subgraph in a social network plays a crucial role, but the current algorithms are only designed for online social networks. Different from online social networks, no central repository is available in mobile social networks (MSNs). Finding a dense subgraph in a distributed manner without compromising the individual privacy is very challenging, because a dense subgraph usually includes abundant friendship information. To address this important need for MSNs, we propose a privacy-preserving k-core discovery protocol, named PKcore. We show that the solution group returned by our protocol is optimal. In addition, we guarantee that the MSN users in our protocol do not reveal any social links to both the initiator and the other contacts. We also prove that the privacy properties based on Canetti's model always hold. Finally, we analyze the computation and communication overheads and show that our protocol is feasible for current mobile devices.

This paper proposes an energy-efficient private matching for secure two-party computation, called SafeMatch, in mobile social networks (MSNs). The proposed SafeMatch utilizes locality sensitive hashing (LSH) to sample the social data and protects social samples with cryptographic hash functions and one-time padding. Given acceptable tolerance rate and error rate, our proposed SafeMatch provides lightweight computation cost regardless the size of social data set. To guarantee the soundness of the proposed SafeMatch, we define its privacy and prove its security. Empirical experiment results on smart phones show that SafeMatch achieves orders of magnitude improvement in energy consumption compared to the homomorphic encryption based protocol.

The privacy issue of online social networks (OSNs) has been getting attention from the public, especially when data privacy has caused the disagreement between users and OSN providers. While the providers utilize users' data as a commercial usage to make profit; on the other hand, users feel their privacy has been violated by such behavior. In this paper, we propose a privacy preserving protocol for users' data sharing in OSNs, where the OSN provider cannot retrieve the users' social content while the users can efficiently add or remove a social contact and flexibly perform the data access control. Moreover, we prove that the users would allow the OSN provider to perform keyword search over the encrypted content for advertising profit, so that the OSN provider can commercialize its products without the knowledge of content.

It is necessary to authenticate users who attempt to access resources in Wireless Local Area Networks (WLANs). Extensible Authentication Protocol (EAP) is an authentication framework widely used in WLANs. Authentication mechanisms built on EAP are called EAP methods. The requirements for EAP methods in WLAN authentication have been defined in RFC 4017. To achieve user efficiency and robust security, lightweight computation and forward secrecy, excluded in RFC 4017, are desired in WLAN authentication. However, all EAP methods and authentication protocols designed for WLANs so far do not satisfy all of the above properties. This manuscript will present a complete EAP method that utilizes stored secrets and passwords to verify users so that it can 1) fully meet the requirements of RFC 4017, 2) provide for lightweight computation, and 3) allow for forward secrecy. In addition, we also demonstrate the security of our proposed EAP method with formal proofs.

A three-factor authentication scheme combines biometrics with passwords and smart cards to provide high-security remote authentication. Most existing schemes, however, rely on smart cards to verify biometric characteristics. The advantage of this approach is that the user's biometric data is not shared with remote server. But the disadvantage is that the remote server must trust the smart card to perform proper authentication which leads to various vulnerabilities. To achieve truly secure three-factor authentication, a method must keep the user's biometrics secret while still allowing the server to perform its own authentication. Our method achieves this. The proposed scheme fully preserves the privacy of the biometric data of every user, that is, the scheme does not reveal the biometric data to anyone else, including the remote servers. We demonstrate the completeness of the proposed scheme through the GNY (Gong, Needham, and Yahalom) logic. Furthermore, the security of our proposed scheme is proven through Bellare and Rogaway's model. As a further benefit, we point out that our method reduces the computation cost for the smart card.

Articulation problems seriously reduce speech intelligent and speech communication and affect person's interpersonal communication, personality, social adaptive capacity, and learning ability. In the clinical protocol, language therapist utilizes clinical experience to individualized assessment, treatment, and training. However, the manpower of language therapists and the assistant instruments are insufficient. In this paper, an articulation assessment and training system is proposed to assist language therapists and articulation disorders. The articulation errors in phonetic are analyzed and modeled by clinical linguist. Using clinical experience of language therapists, articulation training strategies for each type of articulation errors are designed. The articulation characteristics of user can be effectively detected. Speechreading information is responded to improve the performance of training program. The articulation training strategy is automatically selected to suggest articulation disorder in language training activities. Experimental results reveal the practicability of proposed method and system.

More and more researchers combine biometrics with passwords and smart cards to design remote authentication schemes for the purpose of high-degree security. However, in most of these authentication schemes proposed in the literature so far, biometric characteristics are verified in the smart cards only, not in the remote servers, during the authentication processes. Although this kind of design can prevent the biometric data of the users from being known to the servers, it will result in that they are not real three-factor authentication schemes and therefore some security flaws may occur since the remote servers do not indeed verify the security factor of biometrics. In this paper we propose a truly three-factor remote authentication scheme where all of the three security factors, passwords, smart cards, and biometric data, are examined in the remote servers. Especially, the proposed scheme fully preserves the privacy of the biometric data of every user, that is, the scheme does not reveal the biometric data to anyone else, including the remote servers. Furthermore, we also demonstrate that the proposed scheme is immune to both the replay attacks and the offline-dictionary attacks and it satisfies the requirement of low-computation cost for smart-card users.