Recognition accuracy of the new fingerprint construct based on a compact minutiae pattern

Biometric template protection is one of the important issues in deploying a practical biometric system. To tackle this problem, many algorithms have been reported in recent years, most of them being applicable to fingerprint biometric. Since the content and representation of fingerprint template is different from templates of other modalities such as face, the fingerprint template protection algorithms cannot be directly applied to face template. Moreover, we believe that no single template protection method is capable of satisfying the diversity, revocability, security and performance requirements. We propose a three-step cancelable framework which is a hybrid approach for face template protection. This hybrid algorithm is based on the random projection, class distribution preserving transform and hash function. Two publicly available face databases, namely FERET and CMU-PIE, are used for evaluating the template protection scheme. Experimental results show that the proposed method maintains good template discriminability, resulting in good recognition performance. A comparison with the recently developed random multispace quantization (RMQ) biohashing algorithm shows that our method outperforms the RMQ algorithm.

Theft of a template is theft of identity. Fingerprint identification is used by forensic department in identifying criminals because of its uniqueness. Biometrics is the science of verifying and establishing the identity of an individual through physiological features or behavioral traits. Fingerprint identification is commonly employed in Forensic science to support criminal investigations and in biometric systems such as civilian and commercial identification devices. The best way to identify criminals is using fingerprint verification which cannot be replaced. So such fingerprint acquired from the criminal should be safely stored and protected from hackers for future references. This paper mainly deals with protecting the criminal's record (fingerprint template). Templates represent intrinsic information about a criminal. The criminal record (Fingerprint template) should be protected from creation of physical spoof and replacement by imposter's template to gain unauthorized access. Due to these reasons, fool-proof techniques are required for securely storing the criminal fingerprint records. Fuzzy vault is a cryptographic construct that is designed to work with biometric features represented as an unordered set like minutiae points. Template protection is done by transformation based approaches and biometric cryptosystems. During transformation template is stored in a transformed form so that the original biometric template cannot be easily recovered. Fingerprint from the criminal is first preprocessed and minutiae points are extracted. Preprocessing is very essential because the creation of fuzzy vault highly depends on the quality of the input fingerprint image. Then image is binarized followed by thinning and then region of interest (ROI) is calculated finally followed by removal of false minutiae points. The remaining useful minutiae points are used in fuzzy vault generation. A polynomial is evaluated from the secret key which is combined with minutiae points to produce a secure vault. Some dummy points called chaff points are also added to increase the security. The security of the fuzzy vault depends on the infeasibility of the polynomial reconstruction and the number of chaff points. In the proposed system an even more secured fuzzy vault is generated with combined features of fingerprint and palm print to enhance the security of the template stored.

In identity management system, commonly used biometric recognition system needs attention towards issue of biometric template protection as far as more reliable solution is concerned.In view of this biometric template protection algorithm should satisfy security, discriminability and cancelability.As no single template protection method is capable of satisfying the basic requirements, a novel technique for face template generation and protection is proposed.The novel approach is proposed to provide security and accuracy in new user enrollment as well as authentication process.This novel technique takes advantage of both the hybrid approach and the binary discriminant analysis algorithm.This algorithm is designed on the basis of random projection, binary discriminant analysis and fuzzy commitment scheme.Three publicly available benchmark face databases are used for evaluation.The proposed novel technique enhances the discriminability and recognition accuracy by 80% in terms of matching score of the face images and provides high security.

A lot of attempts have been made to use biometrics in class attendance systems. Most of the implemented biometrie attendance systems are unimodal. Unimodal biometrie systems may be spoofed easily, leading to a reduction in recognition accuracy. This paper explores the use of bimodal biometrics to improve the recognition accuracy of automated student attendance systems. The system uses the face and fingerprint to take students' attendance. The students' faces were captured using webcam and preprocessed by converting the color images to grey scale images. The grey scale images were then normalized to reduce noise. Principal Component Analysis (PCA) algorithm was used for facial feature extraction while Support Vector Machine (SVM) was used for classification. Fingerprints were captured using a fingerprint reader. A thinning algorithm digitized and extracted the minutiae from the scanned fingerprints. The logical technique (OR) was used to fuse the two biometric data at the decision level. The fingerprint templates and facial images of each user were stored along with their particulars in a database. The implemented system had a minimum recognition accuracy of 87.83%.

[ACCESS RESTRICTED TO THE UNIVERSITY OF MISSOURI AT REQUEST OF AUTHOR.] In recent years, most scientific research in both academia and industry has become increasingly data-driven. According to market estimates, spending related to supporting scientific data-intensive research is expected to increase to $5.8 billion by 2018. Particularly for data-intensive scientific fields such as bioscience, or particle physics within academic environments, data storage/processing facilities, expert collaborators and specialized computing resources do not always reside within campus boundaries. With the growing trend of large collaborative partnerships involving researchers, expensive scientific instruments and high performance computing centers, experiments and simulations produce peta-bytes of data viz., Big Data, that is likely to be shared and analyzed by scientists in multi-disciplinary areas. Federated multi-cloud resource allocation for data-intensive application workflows is generally performed based on performance or quality of service (i.e., QSpecs) considerations. At the same time, end-to-end security requirements of these workflows across multiple domains are considered as an afterthought due to lack of standardized formalization methods. Consequently, diverse/heterogenous domain resource and security policies cause inter-conflicts between application's security and performance requirements that lead to sub-optimal resource allocations, especially when multiple such applications contend for limited resources. In this thesis, a joint performance and security-driven federated resource allocation scheme for data-intensive scientific applications is presented. In order to aid joint resource brokering among multi-cloud domains with diverse/heterogenous security postures, the definition and characterization of a data-intensive application's security specifications (i.e., SSpecs) is required. Next, an alignment technique inspired by Portunes Algebra to homogenize the various domain resource policies (i.e., RSpecs) along an application's workflow lifecycle stages is presented. Using such formalization and alignment, a near optimal cost-aware joint QSpecs-SSpecs-driven, RSpecs-compliant resource allocation algorithm for multi-cloud computing resource domain/location selection as well as network path selection, is proposed. We implement our security formalization, alignment, and allocation scheme as a framework, viz., "OnTimeURB" and validate it in a multi-cloud environment with exemplar data-intensive application workflows involving distributed computing and remote instrumentation use cases with different performance and security requirements.

There is a growing gap between the peak speed of parallel computing systems and the actual delivered performance for scientific applications. In general this gap is caused by inadequate architectural support for the requirements of modern scientific applications, as commercial applications and the much larger market they represent, have driven the evolution of computer architectures. This gap has raised the importance of developing better benchmarking methodologies to characterize and to understand the performance requirements of scientific applications, to communicate them efficiently to influence the design of future computer architectures. This improved understanding of the performance behavior of scientific applications will allow improved performance predictions, development of adequate benchmarks for identification of hardware and application features that work well or poorly together, and a more systematic performance evaluation in procurement situations. The Berkeley Institute for Performance Studies has developed a three-level approach to evaluating the design of high end machines and the software that runs on them: (1) A suite of representative applications; (2) A set of application kernels; and (3) Benchmarks to measure key system parameters. The three levels yield different type of information, all of which are useful in evaluating systems, and enable NSF and DOE centers to select computer architectures more suited for scientific applications. The analysis will further allow the centers to engage vendors in discussion of strategies to alleviate the present architectural bottlenecks using quantitative information. These may include small hardware changes or larger ones that may be out interest to non-scientific workloads. Providing quantitative models to the vendors allows them to assess the benefits of technology alternatives using their own internal cost-models in the broader marketplace, ideally facilitating the development of future computer architectures more suited for scientific computations. The three levels also come with vastly different investments: the benchmarking efforts require significant rewriting to effectively use a given architecture, which is much more difficult on full applications than on smaller benchmarks.

Biometric systems based solely on one-modal biometrics are often not able to meet the desired performance requirements for large user population applications, due to problems such as noisy data, intra-class variations, restricted degrees of freedom, nonuniversity, spoof attacks, and unacceptable error rates. Multimodal biometrics refers to the use of a combination of two or more biometric modalities in a single identification system. The most compelling reason to combine different modalities is to improve the recognition accuracy. This can be done when features of different biometrics are statistically independent. This paper overviews and discusses the various scenarios that are possible in multimodal biometric systems using fingerprint, face and iris recognition, the levels of fusion that are possible and the integration strategies that can be adopted to fuse information and improve overall system accuracy. This paper also discusses how the image quality of fingerprint, face and iris used in the multimodal biometric systems affects the overall identification accuracy and the need of staffing for the secondary human validation. For a large user population identification system, which often has more than tens or hundreds of millions of subject images already enrolled in the matcher databases and has to process more than hundreds of thousands of identification requests, the system's identification accuracy and the need of staffing levels to properly operate the system are two of the most important factors in determining whether a system is properly designed and integrated

Software applications are essential for managing daily life activities, including social interactions and business transactions, that significantly increase the need for security in sharing sensitive information. Misuse case modeling is used for identifying and analyzing security requirements in software applications. However, security threats and their corresponding mitigations are inherently cross-cutting concerns. These concerns are scattered and tangled within multiple functional requirements and cannot be modularized using traditional object-oriented techniques. The realization of misuse cases causes crosscutting threats and corresponding mitigations to be scattered and tangled across use cases, resulting in ambiguity, incomplete understanding, and insufficient analysis of security requirements. This study proposes a misuse case modelling method called Aspect-oriented Formalized Misuse Case (AFMUC). It specifies crosscutting security threats separately as an aspect misuse case and integrates them with use cases using an aspect-oriented approach. AFMUC provides structured guidelines and restriction rules for modeling crosscutting security threats and corresponding mitigations using aspect-oriented constructs such as Pointcut, Joinpoint Advice, and Introduction. The aspect threat model is then woven into the base use case model. Similarly, an aspect mitigation model is proposed to specify crosscutting mitigations following the AFMUC restriction rules. The aspect mitigation model is then woven into the base misuse case model. The proposed approach is applied to a case study and evaluated through a controlled experiment involving twenty-four students with a background in information security. The findings indicate that the AFMUC approach is practical and unambiguous for specifying and analyzing crosscutting security requirements. However, some aspect-oriented modeling constructs and restriction rules have been misapplied by students. This shows that while students favored the AFMUC approach, they may have found it challenging to apply the aspect-oriented constructs and restriction rules due to a limited exposure to aspect-oriented modelling.

As the power system undergoes continuous digitization and networking, the associated network security challenges have become increasingly prominent. Addressing these issues, the zero trust framework emerges as a cutting-edge security concept that underscores sustained vigilance toward users, devices, and applications within the network environment. Its core principle involves minimizing the scope of trust granted to the smallest possible extent. This study delves into the application of the zero trust framework in crafting the architecture of power system networks, with the primary objective of enhancing network security and thwarting potential threats. The article commences by scrutinizing the network security requirements of internet applications and subsequently proposes a zero trust architecture as a security solution. The construction of a zero trust-based smart grid security protection architecture follows, encompassing elements such as terminal trusted perception agents, multi-source data aggregation platforms, intelligent trust evaluation platforms, dynamic access control platforms, and trusted access agents. Finally, the efficacy of the zero trust framework in power system network architecture is validated through case studies and simulation experiments. The research findings highlight a significant enhancement in the network security of the power system with the incorporation of the zero trust framework. This, in turn, establishes an effective security mechanism conducive to the digital transformation of future power systems. In summary, the study contributes a novel security approach and technical solution for the design of power system network architecture, offering valuable insights and reference for the development of the power system network security field.

Two-factor authentication is one of the widely used approaches to allow a user to keep a weak password and establish a key shared with a server. Recently, a large number of chaotic maps-based authentication mechanisms have been proposed. However, since the Diffie–Hellman problem of the Chebyshev polynomials defined on the interval [−1,+1] can be solved by Bergamo et al.’s method, most of the secure chaotic maps-based key agreement protocols utilize the enhanced Chebyshev polynomials defined on the interval (−∞,+∞). Thus far, few authenticated key agreement protocols based on chaotic maps have been able to achieve user unlinkability. In this paper, we take the first step in addressing this problem. More specifically, we propose the notions of privacy in authenticated key agreement protocols: anonymity-alone, weak unlinkability, medium unlinkability, and strong unlinkability. Then, we construct two two-factor authentication schemes with medium unlinkability based on Chebyshev polynomials defined on the interval [−1,1] and (−∞,+∞), respectively. We do the formal security analysis of the proposed schemes under the random oracle model. In addition, the proposed protocols satisfy all known security requirements in practical applications. By using Burrows-Abadi-Needham logic (BAN-logic) nonce verification, we demonstrate that the proposed schemes achieve secure authentication. In addition, the detailed comparative security and performance analysis shows that the proposed schemes enable the same functionality but improve the security level.

Outsourcing medical data and their search services to a third party cloud have been a popular trend for many medical practices, because using healthcare cloud services can help cut down the cost of Electronic Health Records (EHR) systems in terms of front-end ownership cost and IT maintenance burdens. Healthcare cloud applications need searchable encryption with the following two capabilities for protecting data privacy and access privacy: (1) the healthcare providers need to share the encrypted data with authorized users and enable querying over encrypted data, and (2) they also need to keep the query keywords and associated search operations private such that healthcare data hosting service providers cannot gain access to unauthorized content or trace and infer sensitive data stored in the healthcare cloud. This survey paper describes the notion of searchable encryption (SE) in the context of healthcare applications and characterize the SE use cases into four scenarios in healthcare. Then we provide a comprehensive overview of the four representative SE techniques: searchable symmetric encryption (SSE), public key encryption with keyword search (PEKS), attribute-based encryption with keyword search (ABKS), and proxy re-encryption with keyword search (PRES) according to different EHR retrieving scenarios and requirements. We categorize and compare the different SE schemes in terms of their security, efficiency, and functionality. The survey is designed to benefit both experienced researchers in the computer science (CS) field and non-specialists who are domain scientists or healthcare professionals with limited CS and information security background. Thus, we are in favor of technological overview of the state of art searchable encryption models and the underlying key techniques, instead of detailed proofs and constructions of the respective SE algorithms. We describe how the existing SE schemes relate to and differ from one another, and point out the connections between the SE techniques and the security and privacy requirements of healthcare applications and the open research problems.

Recently, massive research works have been accomplished for augmenting privacy and security requirements for cybersecurity applications in wireless communication networks. This is attributed to the fact that conventional security processes are not appropriate for robust, efficient, and reliable multimedia streaming over unsecure media. Therefore, this paper presents an efficient color image cryptosystem based on RC6 with different modes of operation. The proposed cryptosystem is composed of two phases: encryption and decryption. The encryption phase starts by decomposing the color plainimage with few details into its RGB components, which in turn, are segmented into 128-bit blocks. These blocks are then enciphered using RC6 with an appropriate mode of operation. After that, the corresponding enciphered blocks of RGB components are multiplexed for constructing the final cipherimage. This scenario is reversed in the decryption phase. The performance of the proposed cryptosystem is gauged via simulation using a set of encryption quality metrics. The simulation results reveal that the proposed cryptosystem with cipher block chaining (CBC), cipher feedback (CFB), and output feedback (OFB) modes can efficiently and effectively hide all information of the color images with few details even in the presence of some input blocks with similar data. On the other hand, the results show that the electronic codebook (ECB) mode is not effective at all in hiding all details of images. Finally, the obtained results ensure the applicability of the proposed cryptosystem and its efficiency in encrypting images in terms of security, encryption quality, and noise immunity.

The establishment of an efficient access control system in healthcare intranets is a critical security issue directly related to the protection of patients' privacy. Our C-TMAC (Context and Team-based Access Control) model is an active security access control model that layers dynamic access control concepts on top of RBAC (Role-based) and TMAC (Team-based) access control models. It also extends them in the sense that contextual information concerning collaborative activities is associated with teams of users and user permissions are dynamically filtered during runtime. These features of C-TMAC meet the specific security requirements of healthcare applications. In this paper, an experimental implementation of the C-TMAC model is described. More specifically, we present the operational architecture of the system that is used to implement C-TMAC security components in a healthcare intranet. Based on the technological platform of an Oracle Data Base Management System and Application Server, the application logic is coded with stored PL/SQL procedures that include Dynamic SQL routines for runtime value binding purposes. The resulting active security system adapts to current need-to-know requirements of users during runtime and provides fine-grained permission granularity. Apart from identity certificates for authentication, it uses attribute certificates for communicating critical security metadata, such as role membership and team participation of users.

Smartphones are now ubiquitous. However, the security requirements of these relatively new systems and the applications they support are still being understood. As a result, the security infrastructure available in current smartphone operating systems is largely underdeveloped. In this paper, we consider the security requirements of smartphone applications and augment the existing Android operating system with a framework to meet them. We present Secure Application INTeraction (Saint), a modified infrastructure that governs install-time permission assignment and their run-time use as dictated by application provider policy. An in-depth description of the semantics of application policy is presented. The architecture and technical detail of Saint is given, and areas for extension, optimization, and improvement explored. As we show through concrete example, Saint provides necessary utility for applications to assert and control the security decisions on the platform.

Multi-tenancy in cloud-based applications helps cloud providers improve their Quality of Service (QoS) and reduce service customization and maintenance time. This result is achieved by sharing resources among many tenants, which can be in the form of applications composed of multiple web services. However, distinct tenants may impose different security requirements on their perspective of the application. Thus, the application must comply with the individual tenant requirements while assuring compatibility across all tenants using the application. This assurance during runtime remains a challenge, especially if tenants are allowed to alter their security posture dynamically. Such self-adaptation within cloud tenants can help to shift security compliance tasks from the static design time to runtime. Security requirements have relied on human intervention or complex models to change or integrate the requirements at runtime. Our approach permits tenants to modify security requirements during runtime without changing the internal code of their offered services. The proposed approach externalizes the process of mapping and guaranteeing the modified security requirements outside the service while preserving the application functionality.