Cryptographically-Secure and Efficient Remote Cancelable Biometrics Based on Public-Key Homomorphic Encryption

This chapter discusses two popular homomorphic public key encryption (PKE) techniques, i.e., Paillier PKE and Boneh-Goh-Nissim (BGN) PKE, which serve as the preliminary for building most privacy-enhancing aggregation techniques in the rest chapters of this monograph. In addition, the Java source codes of the two homomorphic PKEs are also provided for the interested readers to better understand and implement them. In order to attain privacy-preserving data aggregation in smart grid communications, we need to first understand the homomorphic public key encryption (HPKE) techniques [1, 2, 3, 4, 5, 6, 7]. Different from the general public key encryption algorithms [8, 9], HPKE further holds an additional “homomorphic” property, which makes the privacy-preserving data aggregation possible. As shown in Fig. 2.1, when we directly operate over two encrypted data E(x) and E(y) with some operation “•”, we can gain E(x ∘ y) = E(x)•E(y). In most HPKE cases, the operations “•” and “∘” are respectively referred to the common multiplication “×” and addition “+” operations. Because most of privacy-enhancing aggregation techniques illustrated in this monograph are based on Paillier public key encryption [2] and Boneh-Goh-Nissim (BGN) public key encryption [6], in this chapter, we first take a close look at these two popular homomorphic encryption techniques. Note that, both of them are randomized encryption algorithms [1], i.e., in addition to the plaintext as the input of encryption, a random number is also input for achieving semantic security.

Chapter 1 - Introducing Network Analysis

A formal treatment to the security of Concealed Data Aggregation (CDA) and the more general Private Data Aggregation (PDA) is given. While there exist a handful of constructions, rigorous security models and analyses for CDA or PDA are still lacking. Standard security notions for public key encryption, including semantic security and indistinguishability against chosen ciphertext attacks, are refined to cover the multisender nature and aggregation functionality of CDA and PDA in the security model. The proposed security model is sufficiently general to cover most application scenarios and constructions of privacy-preserving data aggregation. An impossibility result on achieving security against adaptive chosen ciphertext attacks in CDA/PDA is shown. A generic CDA construction based on public key homomorphic encryption is given, along with a proof of its security in the proposed model. The security of a number of existing schemes is analyzed in the proposed model.

Aimed at the security authentication problem between Near Field Communication (NFC) devices, this paper uses the technology of asymmetric encryption algorithm, symmetric encryption algorithm, hash function, timestamp and survival period to improve the confidentiality, performance and security of the protocol. The symmetric encryption algorithm encrypts the transmission content, while the asymmetric encryption algorithm encrypts the shared key. The whole authentication process is secure, and the key distribution is secure. The improved NFC device authentication protocol can effectively resist the brute force attack, man-in-the-middle attack and replay attack in the authentication process, it can reduce the number of message transmission in the authentication process, improve the transmission efficiency, enhance the confidentiality, integrity, non-repudiation and improve the security of NFC device authentication.

The fast-emerging of cloud computing technology today has sufficiently benefited its wide range of users from individuals to large organizations. It carries an attractive characteristic by renting myriad virtual storages, computing resources and platform for users to manipulate their data or utilize the processing resources conveniently over Internet without the need to know the exact underlying infrastructure which is resided remotely at cloud servers. However due to the loss of direct control over the systems/applications, users are concerned about the risks of cloud services if it is truly secured. In the literature, there are cases where attackers masquerade as cloud users, illegally access to their accounts, by stealing the static login password or breaking the poor authentication gate. In this paper, we propose a two-factor authentication framework to enforce cloud services' authentication process, which are Public Key Infrastructure (PKI) authentication and mobile out-of-band (OOB) authentication. We discuss the framework's security analysis in later session and conclude that it is robust to phishing and replay attacks, prohibiting fraud users from accessing to the cloud services.

By a generic transformation by Canetti, Halevi, and Katz (CHK) every Identity-based encryption (IBE) scheme implies a chosen-ciphertext secure public-key encryption (PKE) scheme. In the same work it is claimed that this transformation maps the two existing IBE schemes to two new and different chosen-ciphertext secure encryption schemes, each with individual advantages over the other.In this work we reconsider one of the two specific instantiations of the CHK transformation (when applied to the “second Boneh/Boyen IBE scheme”). We demonstrate that by applying further simplifications the resulting scheme can be proven secure under a weaker assumption than the underlying IBE scheme.Surprisingly, our simplified scheme nearly converges to a recent encryption scheme due to Boyen, Mei, and Waters which itself was obtained from the other specific instantiation of the CHK transformation (when applied to the “first Boneh/Boyen IBE scheme”). We find this particularly interesting since the two underlying IBE schemes are completely different.The bottom line of this paper is that the claim made by Canetti, Halevi, and Katz needs to be reformulated to: the CHK transformation maps the two known IBE schemes to nearly one single encryption scheme.KeywordsEncryption SchemeMessage Authentication CodeChallenge CiphertextChoose Ciphertext AttackBilinear GroupThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

A public key encryption scheme based on a new variant of LWE with small cipher size

Cancelable biometric techniques play a vital role in the privacy and security of remote surveillance systems to keep the genuine users’ confidential data safe and away from intruders. This research presents an efficient cancelable biometric framework by exploiting an irreversible hybrid encryption technique that incorporates Deoxyribonucleic, Ribonucleic acid sequences (DNA and RNA), and the evolutionary optimization technique of the Genetic Algorithm (GA). So, these techniques are employed to create completely deformed templates from their original ones. Thus, our main contribution is offering a novel biometric security framework that achieves unique randomness characteristics using RNA and DNA sequences and the evolutionary GA-based encryption scheme. The proposed framework produces an entirely unrecognized biometric template by ciphering the main discriminative features of the biometric traits of the authorized clients. The proposed algorithm is first initialized by creating several encrypted biometric images of the original users by employing the logistic map function. Secondly, the initialized encrypted images are transformed into one vector of a binary array. Then, they are converted to their corresponding introns, exons, and consequently, their relevant codons are stored in the cloud database. Thirdly, these relevant codons are replaced by new ones after generating encrypted RNA lists. The utilized encryption key is extracted from the original biometric image after utilizing excessive permutations between its pixels. Then, the GA-based optimization technique is applied to select the most convenient biometric features. Finally, after employing the GA-based cross-over and mutation operations, the chosen features are used to generate the cancelable biometric traits. To validate the security efficacy of the proposed framework, different six biometric databases are used, which are Olivetti Research Laboratory (ORL) Faces (gray), CASIA v.5 Faces (color), UPOL Iris (gray), Indian Institute of Technology Delhi (IIT Delhi) Ear (color and gray), Fingerprint, and CASIA Palmprint (color and gray). The security performance of the proposed framework is compared to those of recent studies in this field, such as OSH (Optical Scanning Holography) and DRPE (Double Random Phase Encoding). The simulation results prove the superior performance of the proposed framework in terms of all tested evaluation metrics. The proposed framework provides high AROC (Area under the Receiver Operating Characteristic) that reaches 0.9990, low FAR (False Acceptance Rate) of 0.0015, more uniform histograms, high correlation values for genuine users, and complete hidden of biometric features. In addition, from a security perspective, the proposed framework accomplishes good entropy, UACI (unified average changing intensity), and NPCR (number of pixels change rate) values that reach 7.9960, 33.55%, and 99.65%, respectively.

The Fujisaki-Okamoto (FO) conversion is a generic conversion to enhance a public key encryption scheme with security of one-way against chosen plaintext attacks (OW-CPA) to security of indistinguishable against adaptive chosen ciphertext attacks (IND-CCA) in the random oracle model. Existing works have shown that the FO conversion also can generically upgrade the security of the identity-based encryption (IBE) schemes or certificateless public key encryption (CL-PKE) schemes. However, it is still unknown if the same holds for certificate-based encryption (CBE) schemes. In this paper, we investigate the generic security of the CBE scheme obtained by applying the FO conversion to an arbitrary underlying OW-CBE-CPA secure CBE scheme and confirm that the FO conversion can generically convert any OW-CBE-CPA secure CBE into an IND-CBE-CCA secure CBE. We also note that the straightforward application of the FO conversion only leads to a CBE scheme with a loose reduction. To solve this problem, we propose an enhanced FO conversion which just introduces minor extra computation overhead, but results in considerably more efficient security reduction.

A hidden vector encryption scheme (HVE) is a derivation of identity-based encryption, where the public key is actually a vector over a certain alphabet. The decryption key is also derived from such a vector, but this one is also allowed to have * (or wildcard) entries. Decryption is possible as long as these tuples agree on every position except where a * occurs. These schemes are useful for a variety of applications: they can be used as a building block to construct attribute-based encryption schemes and sophisticated predicate encryption schemes (for e.g. range or subset queries). Another interesting application - and our main motivation - is to create searchable encryption schemes that support queries for keywords containing wildcards. Here we construct a new HVE scheme, based on bilinear groups of prime order, which supports vectors over any alphabet. The resulting ciphertext length is equally shorter than existing schemes, depending on a trade-off. The length of the decryption key and the computational complexity of decryption are both constant, unlike existing schemes where these are both dependent on the amount of non-wildcard symbols associated to the decryption key. Our construction hides both the plaintext and public key used for encryption. We prove security in a selective model, under the decision linear assumption.

In this paper, we propose a notion of threshold tag-based encryption schemes that simplifies the notion of threshold identity-based encryption schemes, and we show a conversion from any stag-CCA-secure threshold tag-based encryption schemes to CCA-secure threshold public-key encryption schemes. Moreover, we give two concrete constructions of stag-CCA-secure threshold tag-based encryption schemes, under the decisional bilinear Diffie-Hellman assumption and the decisional linear assumption, respectively. Thus, we obtain two concrete constructions of threshold public-key encryption schemes, both of which are non-interactive, robust and can be proved secure without random oracle model. Our threshold public-key encryption schemes are conceptually more simple and shown to be more efficient than those of Boneh, Boyen and Halevi.Keywordsthreshold public-key encryption schemestag-based encryption schemesthe decisional bilinear Diffie-Hellman assumptionthe decisional linear assumption

In Mobile ad hoc network (MANET) security is the prime concern. In MANET there is no authentication process, any node can join the network, and can read and modify the data, drop the message generated by other node. There are many possible attacks on MANET, like replay attack, flooding attack, link withholding attack, node isolation attack, are some examples. Lot of researches is going on in order to make routing protocol secure. In this paper standard OLSR is modified by modifying the MPR selection process known as DFOLSR so that Node Isolation attack against OLSR (a routing protocol used in MANET) can be protected. Simulations are carried out on both standard and modified OLSR on throughput and packet delivery ratio and compare the results and found encouraging results.

The development of information technology has driven the need for stronger security systems and guaranteed privacy on web-based platforms. Traditional verification methods such as passwords and two-factor authentication are increasingly seen as insufficient in facing the growing complexity of cyber threats. Zero-Knowledge Proof (ZKP) emerges as an alternative solution that enables identity verification without revealing sensitive information. This research aims to implement ZKP technology in web-based systems to enhance user security and privacy. The method involves the implementation of a simple XOR-based ZKP algorithm to prove identity without disclosing personal data, as well as a three-step verification mechanism between the verifier and the prover. Implementation results show that the system can prevent attacks such as man-in-the-middle and replay attacks, while maintaining data confidentiality during the authentication process. This study also identifies challenges in system efficiency and verification process integrity and offers technical solutions to support broader ZKP integration in digital platforms. Thus, the use of ZKP in web-based systems holds great potential to improve user trust and security in the digital era.

Most blockchain-based identity authentication systems focus on using blockchain to establish the public key infrastructure (PKI). It can solve the problem of single point of failure and certificate transparency faced by traditional PKI systems, but there are still some problems such as complex certificate management and complex certificate usage process. In this paper, we propose an identity authentication scheme based on blockchain and identity-based cryptography (IBC). The scheme implements a decentralized private key generator (PKG) by deploying the smart contract in Ethereum blockchain, and uses the IBC signature algorithm and challenge-response protocol during the authentication process. Compared with other blockchain-based identity authentication systems, the scheme not only prevents the single point of failure, but also avoids the complex certificate management, has lower system complexity, and resists impersonation attack, man-in-the-middle attack and replay attack.

As an emerging wireless communication technology, narrowband Internet of Things is widely used in various scenarios, but it also brings new security problems, especially the group authentication between terminal devices and servers. In narrowband Internet of Things, terminal devices are often deployed in unattended environments, which are vulnerable to various attacks and controlled by adversaries, resulting in identity information leakage. Secondly, a large number of terminal devices send authentication request information to the server at the same time, which is easy to cause network signaling congestion, and the centralized calculation mode of the server will cause a large delay in the authentication process. To solve these problems, we propose an edge-assisted group authentication scheme for narrowband Internet of Things. Firstly, a lightweight encryption algorithm LCHAOSAES was used to encrypt the terminal device identity to prevent the terminal device identity information leakage. Then, the edge computing method was used to add an edge network layer to the NB-IoT system architecture to assist in completing the group authentication of massive terminal devices, and the edge assistance could realize decentralization and reduce the load of centralized processing of the server. The Burrows Abadi Needham logic verification, informal security analysis and performance analysis show that the proposed scheme is robust under malicious attacks such as replay attack, man-in-the-middle attack and insider attack, and has less signaling overhead and delay.