Micropayment scheme implementation on the Android platform with performance evaluation

Enforcing security properties in a Cloud is a difficult task, which requires expertise. However, it is not the only security-related challenge met by a company migrating to a Cloud environment. Indeed, the tenant must also have assurance that the requested security properties have effectively been enforced. Therefore, the Cloud provider has to offer a way of monitoring the security. In this paper, we present a solution to express the assurance properties based on the security requirements of the tenant and to deploy these assurance properties. First, we introduce a language that expresses the assurance based on the tenant's security requirements. Secondly, we propose an infrastructure that deploys the assurance in a Cloud environment. This solution aims to be easy to use: the assurance directly results from the high-level expression of the tenant's security requirements, and no additional action is needed from the tenant. Consequently, we address one of the greatest drawback of security and assurance - the complexity of their configuration - while providing a complete assurance mechanism.

Engineering secure software remains a significant challenge for today's software organizations as they struggle to understand the implications of security o the system and develop systems that guarantee specified software security properties. Despite many software engineering advances, current methods for deriving a design from a set of requirements that guarantee the retention of the intended security properties remains difficult and often unachievable. If security requirements are formalized and transformed into design using formal methods, the result would reduce the potential for security vulnerabilities through better clarity, completeness, and consistency. To this end, we outline a requirements-driven security engineering approach for deriving design specifications from security requirements that guarantee security properties specified in requirements are retained. We build on the goal-oriented KAOS (Knowledge Acquisition in autOmated Specifications) framework to formally construct a complete, consistent, and clear security requirements model. The resulting model is then transformed to the B language to derive security design specifications. Using B enables us to further implement the design while preserving requirements relevant security properties. Using the B refinement mechanism, we generate design specifications and ultimately implementation. The approach treats security-specific elements in a systematic and constructive way while considering security early in the development lifecycle with assurance of completeness, consistency and clarity throughout the development. Moreover, our approach allows for requirement traceability at the various phases of development that helps security evaluators to have more confidence in the target of evaluation.

Previous work on electronic coupon (e-coupon) systems mainly focused on security properties such as unforgeability, double-redemption detection, and anonymity/unlinkability. However, achieving both traceability against dishonest users and anonymity for honest users without involving any third party is an open problem that has not been solved by the previous work. Another desirable feature of an e-coupon system that has not been studied in the literature is user privacy, which means the shop cannot identify the good (among all the choices specified in the coupon) that has been chosen by the customer during the redemption process. In this paper, we present a novel e-coupon system that can achieve all these desirable properties. We define the formal security models for these new security requirements, and show that our new e-coupon system is proven secure in the proposed models.

In this paper, we present a modular framework for constructing a secure and efficient program obfuscation scheme. Our approach, inspired by the obfuscation with respect to oracle machines model of [4], retains an interactive online protocol with an oracle, but relaxes the original computational and storage restrictions. We argue this is reasonable given the computational resources of modern personal devices. Furthermore, we relax the information-theoretic security requirement for computational security to utilize established cryptographic primitives. With this additional flexibility we are free to explore different cryptographic buildingblocks. Our approach combines authenticated encryption with private information retrieval to construct a secure program obfuscation framework. We give a formal specification of our framework, based on desired functionality and security properties, and provide an example instantiation. In particular, we implement AES in Galois/Counter Mode for authenticated encryption and the Gentry-Ramzan [13]constant communication-rate private information retrieval scheme. We present our implementation results and show that non-trivial sized programs can be realized, but scalability is quickly limited by computational overhead. Finally, we include a discussion on security considerations when instantiating specific modules.

ID-CEPPA: Identity-based Computationally Efficient Privacy-Preserving Authentication scheme for vehicle-to-vehicle communications

As the technology of mobile devices spreads fast, the price of mobile devices is getting cheaper. Most of the people have mobile devices, and these devices have the technology of near field communication (NFC). With the long time development and research, the mobile devices use NFC technology on the payment and authentication applications, and replace the smartcard, the access control card, and the credit card by using the card emulation mode. It helps the development of NFC applications. In recent years, more and more users begin using NFC technology on mobile payment and authentication. Many researches have proposed the related NFC authentication protocols, but their schemes are still lack of some security properties and functions, which are necessary for NFC authentication protocols. In this paper, we propose a secure and efficient NFC authentication scheme between two NFC devices by the help of the authentication server that provides mutual authentication.

Security and Privacy Requirements for RFID Schemes in Healthcare: Case Studies, Solutions, and Challenges

The use of formal methods has long been advocated in the development of secure systems. Yet, methods for deriving design from requirements that guarantee retention of the intended security properties remain largely unrealized on a repeatable and consistent basis. We present the FADES (Formal Analysis and Design approach for Engineering Security) that integrates KAOS (Knowledge Acquisition in autOmated Specifications) with the B specification language to derive security design specifications and further implementation from security requirements. We demonstrate the capability of the approach to handle changes to security requirements by introducing corrective changes to the security requirements of a case study, the spy network system. The objective is to bridge the gap between formal requirements and design for security requirements. Our initial results show promise with FADES in preserving security properties and detecting security vulnerabilities early during requirements. Encouraged by these, we are more quantitatively assessing the FADES capabilities.

Solar-based smart grids have emerged as a transformative force, encapsulating a paradigm shift towards decentralized and sustainable power generation. However, this evolution is accompanied by growing concern-authentication challenges that pose a substantial threat to solar-based smart grids' security. Existing work done by researchers reveals a gap in addressing these authentication issues, resulting in vulnerabilities that compromise the overall security and performance of solar enabled smart grid infrastructures. In response to these concerns, this paper suggests a novel certificate-less authentication scheme designed explicitly for solar-based smart grids. Our technique, which uses elliptic curve (EC) encryption, mitigates authentication problems and navigates the resource limits inherent in a smart grid environment. The security evaluation also shows that our mechanism security is higher in terms of the security attributes it delivers. Supported by a Scyther-based protocol specification, our solution undergoes a rigorous security analysis, demonstrating its robustness and effectiveness in critical security attributes. Furthermore, a performance evaluation underscores the efficiency of our scheme, positioning it as a robust, and effective solution for fortifying solar-based smart grid environments against evolving cyber threats.

Smartphone platforms are fast becoming the de-facto method of online communication. Android is one of the most promising smartphone platforms with backing of both the finances of industry leaders and the technical skills and expertise of the open source community. These two factors combined with the usability of application design on the Android platform has propelled the platform in the fore-front of technological innovations. However, along with this wide acceptance by the community come large risks associated with privacy, security and trust. Users share very sensitive data of a very personal nature on their smartphones. Protection of this data is of immense importance if the adoption of smartphones is to be continued. Similar threats on the pc have been countered using the concepts of Trusted Computing -- a highly flexible trust mechanism with strong security properties. The Android platform has yet to see any Trusted Computing applications primarily because of the difficulty in adopting the relatively new paradigm of security. In this paper, we present the design of a high-level api that allows existing Android developers to adopt Trusted Computing and use it in their applications without having to learn the intricate details of how Trusted Computing works. The api will help the developers to increase the security of their applications and the data that they consume.

Android is the OS for mobile phones created by Google. Android has changed the situations of mobile developing community, and currently many of mobile programs based on the android platform are designed. In this paper, android platform based traffic information system by using LBS is proposed and developed. The main contributions and features of the proposed system are as follows. First, no space constraints as mobile based traffic information system. Second, basic information services as well as telephone service. direct homepage service. Third, user oriented suitable program that can be made by users themselves. The performance evaluation of the developed system is performed by using AVD (Android Virture Device) for Android SDK 1.5.

Vehicular Ad hoc networks (VANETs) as spontaneous wireless communication technology of vehicles has a wide range of applications like road safety, navigation and other electric car technologies, however its practicability is greatly hampered by cyber-attacks. Due to message broadcasting in an open environment during communication, VANETs are inherently vulnerable to security and privacy attacks. However to address the cyber-security issues with optimal computation overhead is a matter of current security research challenge. So this paper designs a secure and efficient certificate-less aggregate scheme (ECLAS) for VANETs applicable in a smart grid scenario. The proposed scheme is based on elliptic curve cryptography to provide conditional privacy-preservation by incorporating usage of time validated pseudo-identification for communicating vehicles besides sorting out the KGC (Key Generation Center) escrow problem. The proposed scheme is comparatively more efficient to relevant related research work because it precludes expensive computation operations likes bilinear pairings as shown by the performance evaluation. Similarly, communication cost is within the ideal range to most related works while considering the security requirements of VANETs system applicable in a smart grid environment.

We investigate privacy-preserving Public-Key Infrastructures (PKIs) with additional security, privacy, and performance requirements meant to support vehicular networks. While conventional PKIs are a cornerstone for identity management in certain security applications, they do not offer the privacy properties that vehicular networks demand. Over the last few years, there have been efforts to generalize conventional PKIs to meet these new privacy and security demands. One particular example is the class of multiple certificate PKIs where each vehicle is given multiple short-lived and anonymous certificates that can function as credentials until the vehicle is due for, say, the next inspection or dealership visit. While such PKIs offer attractive security and privacy properties, achieving acceptable performance has remained an open problem thus questioning their practicality.In this paper, we formally define and investigate the efficient certificate revocation list (CRL) search problem for multiple certificate PKIs, which asks whether it is possible to efficiently test CRL membership of a given certificate in the same order of computational complexity as in conventional PKIs (that is, by a simple and fast binary search over the set of revoked PKI members). Any solution to this problem is of particular interest when it does not introduce unacceptable compromises on other important properties such as security and privacy. We start by formally defining vehicular networks and a number of security, privacy and performance requirements for them. Then we demonstrate that for PKIs based on general classes of efficient algorithms, containing binary search over totally ordered sets and approximate nearest neighbor search over metric spaces, a solution to the efficient CRL search problem can be used to violate privacy. Finally, we present and analyze new solutions that simultaneously solve the efficient cRL search problem and satisfy privacy requirements by allowing all vehicles to locally (i.e., with minimal help from the CA) and consistently (i.e., with the same results across all vehicles) manage their CRLs. Using these ideas, we can maintain security and privacy properties while reducing the CRL membership testing time to logarithmic in the number of revoked vehicles, which is essentially the same performance that one obtains with conventional PKIs where privacy is not required.

In this paper, we propose a multi-client secure and efficient keyword search scheme for cloud storage, which is built upon distributed point function (DPF). Specifically, outsourced keyword indexes are encoded by using garbled bloom filter and cuckoo filter, instead of bloom filter adopted by most of the state-of-the-art DPF-based schemes. In this way, clients can apply cuckoo hashing into DPF and utilize a segmentation method to interact with cloud servers for keyword search, and servers can obliviously aggregate DPF evaluation results to perform the search. Accordingly, the computational complexity at server side can be significantly reduced. Furthermore, the proposed scheme preserves constant downlink overheads, which is more communication-efficient for multi-keyword conjunctive search. To achieve privacy preservation and access control for multiple clients, we propose a double encryption method to encrypt outsourced indexes and correspondingly put forward an authorization algorithm from set-constrained pseudorandom functions by which fine-grained search-authorized keys can be generated, and collusion attacks among clients are addressed by integrating Wegman-Carter message authentication codes and cover-free systems. Since our scheme is designed under both semi-honest and malicious models (i.e., malicious servers may return incorrect query results), we use a simulation-based proof to formally demonstrate its security properties. Finally, we develop a proof-of-concept prototype and perform extensive experiments to show our scheme's practicality and efficiency in terms of computation, communication, and storage overheads.

The main topic of this thesis is related to the state of the art in designing cryptographic primitives from a hardware point of view. A special emphasis is dedicated to low-power/low-energy CMOS design. A set of solutions is proposed including an LFSR based stream cipher with self-synchronizing capabilities, a new memory-less Rijndael block cipher architecture and a public key scheme in the class of discrete logarithm. The former is based on arithmetic in large finite field, mainly Galois extension field GF(2‴). These solutions are droved using low-energy techniques, in order to decrease both the switching activity and the total delay. The fundamental motivation supporting this work, is to demonstrate that practical solutions can be obtained for implementing such complex primitives in large scaled circuits, that arc at once, high performance architectures (low-power, high-speed) and cryptographicaly strong, using the well known trade-off between area-speed or area-power. Security constraint has been duly considered, mainly by increasing the key-size. In this work, we explore the general aspects of designing the above mentioned cryptographic functions. We give an extensive survey of some cryptographic primitives from the hardware point of view and expose their security properties. The thesis favours stream cipher and public-key schemes, as currently the most promising advance to capture the notion of key generation and establishment and data bulk encryption. One contribution is the convenient notation for expressing cryptographic self-synchronizing stream ciphers SSSC schemes and our SSMG proposal, a scheme based on packet fingerprint identification, that relies on keyed cryptographic hash function to achieve the security requirements. We maintain an important distinction between hardware implementation and algorithm's security, because the security of cryptographic primitives cannot be based on mathematically strong functions only but requires an extensive cryptanalysis at different levels including the application. This causes a concern for a formalization of the security of an implemented cryptographic primitive. Nevertheless, while some schemes arc well known to be secure such as DL based public key schemes and enough cryptanalyzed such as the new standard Rijndael, some security aspects of the SSMG are discussed. A part of this work studies the specific aspects related to hardware implementation of Rijndael block cipher, the new standard designed to be a substitute for DES. An efficient architecture is developed targeting FPGA implementation, by simply avoiding memory blocks dedicated to the implementation of S-boxes and replacing them by on-chip forward computation using composite Galois field. This technique helps to reduce considerably the amount of hardware required at the cost of little increase of the switching activity. The main conclusion is that, while security constraint of cryptographic primitives increases the hardware complexity and reduces the performances, practical solutions exist for reducing such complexities while keeping or increasing the level of security. Nevertheless, major open questions remain both for a firm theoretical foundation and the proper cryptanalysis of certain solutions.