A Lightweight Advertisement Ecosystem Simulation Platform for Security Analysis

Generative agents are a novel AI agent architecture developed in 2023 using LLMs that can generate believable human behaviors. They are of significant importance in social simulation and human-computer interaction. However, there is a lack of research on the privacy and security issues that may arise from its subsequent application in society. Based on the Generative Agent framework, this paper reintroduces a personal information system, and a shared database, reconstructing the memory and reflection systems to realize a Lightweight Generative Agent framework (LGA). To fill the research gap in the field of privacy for Generative Agents, this paper simulates three scenarios with five agents to explore potential privacy and security issues. Based on observed privacy leaks, three defensive strategies are proposed: behavior guideline regulation, Multi-Agents cooperation, and step-back prompts. These strategies have reduced privacy leaks by more than 50.00% on average. For some privacy leaks with special simulation scenarios, it has even reduced privacy leaks by more than 80.00%. Additionally, through supplementary experiments, we demonstrate that LGA achieves better cost-effectiveness compared to the original Generative Agent framework. The analysis of privacy and security issues provides a reference for subsequent research on the safety of generative agents.

Mobile sensing relies on data contributed by users through their mobile device (e.g., smart phone) to obtain useful information about people and their surroundings. However, users may not want to contribute due to lack of incentives and concerns on possible privacy leakage. To effectively promote user participation, both incentive and privacy issues should be addressed. Although incentive and privacy have been addressed separately in mobile sensing, it is still an open problem to address them simultaneously. In this paper, we propose two credit-based privacy-aware incentive schemes for mobile sensing systems, where the focus is on privacy protection instead of on the design of incentive mechanisms. Our schemes enable mobile users to earn credits by contributing data without leaking which data they have contributed, and ensure that malicious users cannot abuse the system to earn unlimited credits. Specifically, the first scheme considers scenarios where an online trusted third party (TTP) is available, and relies on the TTP to protect user privacy and prevent abuse attacks. The second scheme considers scenarios where no online TTP is available. It applies blind signature, partially blind signature, and a novel extended Merkle tree technique to protect user privacy and prevent abuse attacks. Security analysis and cost evaluations show that our schemes are secure and efficient.

In the era of machine learning, mobile users are able to submit their symptoms to doctors at any time, anywhere for personal diagnosis. It is prevalent to exploit edge computing for real-time diagnosis services in order to reduce transmission latency. Although data-driven machine learning is powerful, it inevitably compromises privacy by relying on vast amounts of medical data to build a diagnostic model. Therefore, it is necessary to protect data privacy without accessing local data. However, the blossom has also been accompanied by various problems, i.e., the limitation of training data, vulnerabilities, and privacy concern. As a solution to these above challenges, in this paper, we design a lightweight privacy-preserving medical diagnosis mechanism on edge. Our method redesigns the extreme gradient boosting (XGBoost) model based on the edge-cloud model, which adopts encrypted model parameters instead of local data to reduce amounts of ciphertext computation to plaintext computation, thus realizing lightweight privacy preservation on resource-limited edges. Additionally, the proposed scheme is able to provide a secure diagnosis on edge while maintaining privacy to ensure an accurate and timely diagnosis. The proposed system with secure computation could securely construct the XGBoost model with lightweight overhead, and efficiently provide a medical diagnosis without privacy leakage. Our security analysis and experimental evaluation indicate the security, effectiveness, and efficiency of the proposed system.

Wireless Sensor Networks (WSN) offer a significant potential for ubiquitous monitoring and control in future internet-connected pervasive systems architectures. This can be achieved through seamless integration along existing networking devices and systems, while taking account the data-driven nature and security constraints imposed upon such low power, efficient embedded networked platforms. We argue that only through a combined security and communication approach can the relevant goals be achieved, by considering security issues as an integral part of high level layers of the protocol stack. This paper presents an analysis of security and communication constraints of IPv6-based wireless sensor networks at the network and transport layer. Leveraging the Contiki operating system for resource constrained devices along with the ContikiSec security layer and RPL, IPv6 Protocol for Low Power and Lossy Networks, helpful insight is achieved for evaluation and deployment. The results of the analysis are discussed and functions of its modules are explained. This opens up the path towards robust implementation in real world applications following comparative experimental work on simulated and emulated mote platforms.

With advancements in fields of science and technology, communication has become quite faster and more efficient. As the popularity of several social media apps continues to grow among the population of both young and old, telephonic communication is being gradually replaced by these powerful social apps. Apart from standard communication, these apps are also utilized for sharing news, academic scriptures, images, files, music, movies, etc. In conclusion, we might state that our lives have got linked with these apps in massive amounts. Social media platforms contain numerous information about us, in certain cases, even more than we can figure. These apps have emerged to access a certain amount of power and control upon us. So, this massive amount of information needs to be protected, for the breach of the same could harm the basic privacy and security rights of any human being. In this paper, we will try to make a thorough study on different threats and issues regarding our privacy and security and analyze certain precautionary measures.

Emerging device-to-device (D2D) communication in 5th generation (5G) mobile communication networks and internet of things (loTs) provides many benefits in improving network capabilities such as energy consumption, communication delay and spectrum efficiency. D2D group communication has the potential for improving group-based services including group games and group discussions. Providing security in D2D group communication is the main challenge to make their wide usage possible. Nevertheless, the issue of security and privacy of D2D group communication has been less addressed in recent research work. In this paper, we propose an authentication and key agreement tree group-based (AKATGB) protocol to realize a secure and anonymous D2D group communication. In our protocol, a group of D2D users are first organized in a tree structure, authenticating each other without disclosing their identities and without any privacy violation. Then, D2D users negotiate to set a common group key for establishing a secure communication among themselves. Security analysis and performance evaluation of the proposed protocol show that it is effective and secure.

Android users install various apps, such as banking apps, on their smart devices dealing with user‐sensitive information. The Android framework, via Inter‐Component Communication (ICC) mechanism, ensures that app components (inside the same app or on different apps) can communicate. The literature works have shown that this mechanism can cause security issues, such as app security policy violations, especially in the case of Inter‐App Communication (IAC). Despite the plethora of research on detecting security issues in IAC, detection techniques face fundamental ICC challenges for improving the precision of static analysis. Challenges include providing comprehensive and scalable modeling of app specification, capturing all potential ICC paths, and enabling more effective IAC analysis. To overcome such challenges, in this paper, we propose a framework called VAnDroid2, as an extension of our previous work, to address the security issues in multiple components at both intra‐ and inter‐app analysis levels. VAnDroid2, based on Model‐Driven Reverse Engineering, has extended our previous work as per following: (1) providing a comprehensive Intermediate Representation (IR) of the app which supports extracting all the ICC information from the app, (2) extracting high‐level representations of the apps and their interactions by omitting the details that are not relevant to inter‐app security analysis, and (3) enabling more effective IAC security analysis. This framework is implemented as an Eclipse‐based tool. The results of evaluating VAnDroid2 w.r.t. correctness, scalability, and run‐time performance, and comparing with state‐of‐the‐art analysis tools well indicate that VAnDroid2 is a promising framework in the field of Android inter‐app security analysis.

With the popular use of IoT devices, edge computing has been widely applied in the Internet of things (IoT) and regarded as a promising solution for its wide distribution, decentralization, low latency. At the same time, in response to the massive computing data and intelligent requirements of various applications in the IoT, artificial intelligence (AI) technology has also achieved rapid development. As a result, edge intelligence (EI) for the Internet of Things has attracted widespread attention. Driven by the requirement that making full use of data, machine learning (ML) models trained in EI are usually shared. However, there may be some security and privacy issues due to the openness and heterogeneity of edge intelligence. How to ensure flexible data access and data security as well as the accountability for edge nodes and users in EI model sharing have become important issues. In this article, we propose a Ciphertext Policy Attribute Based Proxy Re-encryption (CP-ABPRE) scheme with accountability to address the security and privacy issues in EI model sharing. In our scheme, a user can delegate the access right to others to make model access more flexible. Furthermore, each entity that may need to be held accountable is embedded a unique ID to achieve traceability. Finally, security analysis and performance evaluation are given to prove that our scheme is CPA secure and does not lose much efficiency with more features.

Smart environments are becoming ubiquitous despite many potential security and privacy issues. But, do people understand what consequences could arise from using smart environments? To answer this research question, we conducted a survey with 575 participants from three different countries (Germany, Spain, Romania) considering smart home and health environments. Less than half of all participants mentioned at least one security and privacy issue, with significantly more German participants mentioning issues than the Spanish ones and the Spanish participants in turn mentioning significantly more security and privacy issues than the Romanian participants. Using open coding, we find that among the 275 participants mentioning security and privacy issues, 111 only expressed abstract concerns such as “security issues” and only 34 mentioned concrete harms such as “Burglaries (physical and privacy)”, caused by security and privacy violations. The remaining 130 participants who mentioned security and privacy issues named only threats (i.e. their responses were more concrete than just abstract concerns but they did not mention concrete harming scenarios).

Radio frequency identification (RFID) tags are cheap and simple devices that can store unique identification information and perform simple computation to keep better inventory of packages. Security protocol for RFID tags is needed to ensure privacy and authentication between each tag and their reader. In order to accomplish this, in this paper, we analyzed a lightweight privacy and authentication protocol for passive RFID tags.

Cloud-based RFID mutual authentication scheme for efficient privacy preserving in IoV

Smart health has attracted a huge amount of attention nowadays with the advancement of information and communications technology. Meanwhile, the medical data is imperative to support smart health techniques. However, the storage of medical data faces serious security and privacy issues from the hacktivists, cloud service providers and even medical institutions. Therefore, we propose a novel data repository named Derepo to address these issues by securing the storage with the decentralized access control mechanism and preserving privacy via the homomorphic encryption scheme. We adopt the distributed ledger technology to endow the access control mechanism with trustworthy properties such as Byzantine fault tolerance. Besides, we utilize the fully homomorphic encryption scheme to protect data privacy and preserve the computability in the meanwhile. The design of Derepo is user-centric. Only the data owner can make the access control policy and decrypt their data while the authorized third parties can enforce the data processing processes on their encrypted data without knowing the original values. Furthermore, the prototype of Derepo is evaluated by security analysis and demonstrates the feasibility.

Cloud computing is a technology that holds great promise and has potential to revolutionize the healthcare sector. Many security and privacy issues are brought up by the cloud’s centralization of data for both patients and healthcare professionals. There is a need for maintaining secrecy in communication in exchanging medical data between the sender and the receiver, which can be done by cryptography. This article presents a cryptographic algorithm (encryption and decryption) to have a secure communication of digital health care confidential data using DNA cryptography and Huffman coding. The interesting property is the cipher size obtained from our algorithm is equal to the size of the cipher obtained from the character set of given data. Security analysis is provided to show the security of data when stored and transmitted to the cloud. The cryptographic requirements, key space analysis, key and plain text sensitivity, sensitive score analysis, sensitivity and specificity, optimal threshold, randomness analysis, uniqueness of implementation, entropies of binary bits, DNA bases, DNA bases with Huffman code, Huffman encoded binary bits and cloud service provider’s risk are analyzed. The method proposed is compared with other cryptographic methods and results that it is more secure and stronger than other methods.

Vehicular ad hoc networks (VANETs) are an increasing important paradigm for greatly enhancing roadway system efficiency and traffic safety. To widely deploy VANETs in real life, it is critical to deal with the security and privacy issues in VANETs. In this paper, we propose a certificateless conditional privacy preserving authentication (CCPPA) scheme based on certificateless cryptography and elliptic curve cryptography for secure vehicle-to-infrastructure communication in VANETs. In the proposed scheme, a roadside unit (RSU) can simultaneously verify plenty of received messages such that the total verification time may be sharply decreased. Furthermore, the security analysis indicates that the proposed scheme is provably secure in the random oracle model and fulfills all the requirements on security and privacy. To further improve efficiency, both map-to-point hash operation and bilinear pairing operation are not employed. Compared with previous CCPPA schemes, the proposed scheme prominently cuts down computation delay of message signing and verification by 66.9%–85.5% and 91.8%–93.4%, respectively, and reduces communication cost by 44.4%. Extensive simulations show that the proposed scheme is practicable and achieves prominent performances of very little average message delay and average message loss ratio and thus is appropriate for realistic applications.

The development of manufacturing, communication, and computing technologies has promoted convergence of different network architectures, aiming to make full use of all resources to create valuable information. While heterogeneous integrated networks play a key role in providing highly effective and efficient solutions for medical users, they also raise various security and privacy issues. Strengthen the security and privacy protection and efficiency before transmitting sensitive data is a primary challenge to be addressed. Traditional authentication methods fail to differentiate the privacy sensitivity difference between data collected by distinct devices. We propose a secure and efficient key management scheme based on a key-exposure resistant chameleon hash function. Through adopting the devices' privacy sensitivity and users' attribute credential as two factors to establish trust between different entities, we proposed a secure and anonymous authentication protocol. The security analyses indicate that the proposed protocol can satisfy security requirements.