Search

In many bandwidth-critical environments, including vehicle-to-vehicle and vehicle-to-infrastructure communications, implicit certificates such as elliptic curve Qu-Vanstone (ECQV) are frequently employed as a means to reduce the bandwidth requirement of digital signatures. In these environments, however, certain recipients such as roadside units need to verify signatures for multiple messages within considerably short time periods. In this paper, we propose two efficient methods of reducing the computational costs of signature verification when multiple digital signatures are provided together with the ECQV implicit certificates. The first method achieves this by sharing the intermediate results that are computed when public keys are extracted from ECQV certificates. The second guarantees a further speed improvement by merging the public key extraction processes into a batch signature verification process. We also present an algorithm that adaptively chooses the best verification method for the given signatures in real time. Our experimental results show that the proposed methods allow for a signature verification that is five times faster than existing methods.

Advanced smart grid technologies enable energy prosumers to trade surplus energy from their distributed renewable energy sources with other peer prosumers through peer-to-peer (P2P) energy trading. In many previous works, P2P energy trading was facilitated by blockchain technology through blockchain’s distributive nature and capacity to run smart contracts. However, the feature that all the data and transactions on a blockchain are visible to all blockchain nodes may significantly threaten the privacy of the parties participating in P2P energy trading. There are many previous works that have attempted to mitigate this problem. However, all these works focused on the anonymity of participants but did not protect the data and transactions. To address this issue, we propose a P2P energy trading system on a blockchain where all bids are encrypted and peer matching is performed on the encrypted bids by a functional encryption-based smart contract. The system guarantees that the information encoded in the encrypted bids is protected, but the peer matching transactions are performed by the nodes in a publicly verifiable manner through smart contracts. We verify the feasibility of the proposed system by implementing a prototype composed of smart meters, a distribution system operator (DSO) server, and private Ethereum blockchain.

The biggest cause of the epidemic is “unpredictable.” In Korea, the number of patients with hepatitis A has been increasing recently, and the government enacted a law in 1954 to effectively manage diseases such as hepatitis A. The purpose of this paper is to design a model for predicting trends in order to minimize the damage caused by the prevalence of infectious diseases. As a tool for it, various statistical techniques and Supervised Learning of Machine Learning and LSTM techniques were used. To this end, data were collected using Web Crawling and other data, correlation analysis using Regression analysis was conducted, and prediction models were designed using Machine Learning and LSTM.

We present a new Personal Identification Number (PIN) entry method for smartphones that can be used in security-critical applications, such as smartphone banking. The proposed “Two-Thumbs-Up” (TTU) scheme is resilient against observation attacks such as shoulder-surfing and camera recording, and guides users to protect their PIN information from eavesdropping by shielding the challenge area on the touch screen. To demonstrate the feasibility of TTU, we conducted a user study for TTU, and compared it with existing authentication methods (Normal PIN, Black and White PIN, and ColorPIN) in terms of usability and security. The study results demonstrate that TTU is more secure than other PIN entry methods in the presence of an observer recording multiple authentication sessions.

The development of smart meters that can frequently measure and report power consumption has enabledelectricity providers to offer various time-varying rates, including time-of-use and real-time pricing plans. High-resolution power consumption data, however, raise serious privacy concerns because sensitive information regarding an individual’s lifestyle can be revealed by analyzing these data. Although extensive research has been conducted to address these privacy concerns, previous approaches have reduced the quality of measured data. In this paper, we propose a new privacy-preserving electricity billing method that does not sacrifice data quality for privacy. The proposed method is based on the novel use of functional encryption. Experimental results on a prototype system using a real-world smart meter device and data prove the feasibility of the proposed method.

Fast growth of smartphone technology and advent of Fintech enabled smartphones to deal with more sensitive information. Although many devices applying biometric technology are released as a step for protecting sensitive information securely, there can be potential vulnerabilities if security is not considered at the design stage of a biometric system. By analyzing the potential vulnerabilities, we classify threats in biometric system design process on smartphones and we propose the design requirements for solving these problems. In addition, we propose a framework for secure biometric system design on smartphone by synthesizing the design requirements.Keywords:Biometrics, Smartphone Security, System Design Requirement, Framework 스마트폰 상의 안전한 바이오인식 시스템 설계를 위한 프레임워크 임 종 혁 † ⋅권 희 용 †† ⋅이 문 규 ††† 요 약 최근 스마트폰 기술의 빠른 발전과 핀테크의 등장으로 스마트폰은 더욱 많은 민감한 정보를 다루게 되었다. 이 같은 민감한 정보를 안전하게 보호하는 수단으로 바이오인식 기술이 적용된 다양한 기기들이 출시되고 있으나, 바이오인식 시스템 설계 시 보안을 고려하지 않을 경우 잠재적인 취약점이 존재할 수 있다. 이에 본 논문에서는 잠재적인 취약점의 분석을 통해 스마트폰 상의 바이오인식 시스템 설계 과정에서 주의할 점을 분류하고, 이를 해결하기 위한 설계 요구사항을 제시한다. 또한, 설계 요구사항을 종합하여 안전한 스마트폰 바이오인식 시스템 설계를 위한 프레임워크를 제시한다.키워드:바이오인식, 스마트폰 보안, 시스템 설계 요구사항, 프레임워크

A Personal Identification Number (PIN) is a multiple-digit sequence widely used for user authentication. It is desirable for a PIN-entry method to be secure against two main security threats, random guessing attacks and recording attacks. Although there have been many proposals for challenge-response-based PIN-entry methods, it is well known that the only way to prevent both attacks is to physically prevent attackers from observing the challenge-response pairs, which motivates the development of PIN-entry methods that use secure secondary channels such as audio signals. To provide a guideline for designing an audio-based PIN-entry method, we propose a simple framework to transform a non-audio-based method into an audio-based one. We also present a new PIN-entry method that improves the performance of this simple transformation. Most audio-based methods in the literature are unimodal methods, that is, they transmit almost all required information through an audio channel because it was believed that this approach maximized the user's performance. In this paper, however, we show that a carefully designed bimodal system may be more usable than a unimodal one. We present a new PIN-entry method whose audio channel only transmits the minimal required data while most of the challenge information is transmitted through the efficient visual channel. Our user study shows that the PIN-entry time of the proposed method is shorter than those of the previous audio-based methods, while its error rate is kept as low as that of the previous methods.

Currently, an increasing number of smartphones are adopting fingerprint verification as a method to authenticate their users. Fingerprint verification is not only used to unlock these smartphones, but also used in financial applications such as online payment. Therefore, it is very crucial to secure the fingerprint verification mechanism for reliable services. In this paper, however, we identify a few vulnerabilities in one of the currently deployed smartphones equipped with fingerprint verification service by analyzing the service application. We demonstrate actual attacks via two proof-of-concept codes that exploit these vulnerabilities. By the first attack, a malicious application can obtain the fingerprint image of the owner of the victimized smartphone through message-based interprocess communication with the service application. In the second attack, an attacker can extract fingerprint features by decoding a file containing them in encrypted form. We also suggest a few possible countermeasures to prevent these attacks.

In this paper, we introduce a transaction authentication solution that provides compatibility with any banking transactions. Our solution is based on a novel visual cryptographic scheme that supports multiple uses of a single static share, unlike existing techniques in the literature of visual cryptography. To support multiple uses, we utilize complementary colors in the subtractive color mixing model. In our solution, a user is asked to overlap an issued visual cryptography card on an encrypted image that is rendered on a screen to check transaction information and transaction authentication number. We analyze the security of our scheme against various attacks and show its effectiveness using a usability study.

The personal identification number (PIN) is a well-known authentication method used in various devices, such as ATMs, mobile devices, and electronic door locks. Unfortunately, the conventional PIN-entry method is vulnerable to shoulder-surfing attacks. Consequently, various shoulder-surfing resistant methods have been proposed. However, the security analyses used to justify these proposed methods are not based on rigorous quantitative analysis, but instead on the results of experiments involving a limited number of human attackers. In this paper, we propose new theoretical and experimental techniques for quantitative security analysis of PIN-entry methods. We first present new security notions and guidelines for secure PIN-entry methods by analyzing the existing methods under the new framework. On the basis of these guidelines, we develop a new PIN-entry method that effectively obviates human shoulder-surfing attacks by significantly increasing the amount of short-term memory required in an attack.

Since Ratha et al. introduced the functional transform for cancelable fingerprint templates, a few simulation attacks to this method have been proposed. The attacks are based on the fact that the transform depends only on the predefined parameters. That is, the attacker may fully simulate the transform and partially invert it if the parameters are available. Although an original template is transformed using different parameters for different systems, even the compromise of only one of these systems may reveal the original template, which may be a serious potential threat from a practical viewpoint. In this paper, we propose an improved functional transform, whose parameters are decided by the original template, as well as predefined user-specific keys. Because the information on the original template will not be available to the attacker even when a system is compromised, the proposed method significantly improves the security of the original template by preventing the attacker from reconstructing the transform. Copyright © 2013 John Wiley & Sons, Ltd.

User authentication is a process for a system to verify the identity of a claimed user and to give access permission. Although there are many other authentication methods such as biometrics and physical tokens, passwords are still being used in many applications due to easy deployment. To enhance the security against possible attacks such as an off-line dictionary attack, passwords are usually stored in a hashed form using a random nonce called a salt. However, this does not completely solve the security issue. In this paper, we propose a new password-based authentication method using homomorphic encryption where a password is stored in a remote server in an encrypted form and an input password is compared with the stored one on the encrypted domain. For this purpose, we also propose a new cryptographic primitive called one-time private key-based digital signature.

Biometric verification systems have security issues regarding the storage of biometric data in that a user's biometric features cannot be changed into other ones even when a system is compromised. To address this issue, it may be safe to store the biometrics data on a reliable remote server instead of storing them in a local device. However, this approach may raise a privacy issue. In this paper, we propose a biometric verification system where the biometric data are stored in a remote server in an encrypted form and the similarity of the user input to the registered biometric data is computed in an encrypted domain using a homomorphic encryption. We evaluated the performance of the proposed system through an implementation on an Android-based smartphone and an i7-based server.

The NTRU cryptosystem is a public key system based on lattice problems. While its theoretical security has been well studied, little effort has been made to analyze its security against implementation attacks including power analysis attacks. In this paper, we show that a typical software implementation of NTRU is vulnerable to the simple power analysis and the correlation power analysis including a second-order power attack. We also present novel countermeasures to prevent these attacks, and perform experiments to estimate the performance overheads of our countermeasures. According to our experimental results, the overheads in required memory and execution time are only 8.17% and 9.56%, respectively, over a Tmote Sky equipped with an MSP430 processor.

In an RFID search protocol, a reader uses designated query to determine whether a specific tag is in the vicinity of the reader. This fundamental difference makes search protocol more vulnerable to replay attacks than authentication protocols. Due to this, techniques used in existing RFID authentication protocols may not be suitable for RFID search protocols. In this paper, we propose two RFID search protocols, one based on static ID and the other based on dynamic ID, which use counter to prevent replay attacks. Moreover, we propose a security model for RFID search protocols that includes forward/backward traceability, de-synchronization and forgery attack. Based on this model, we analyze security of our protocols and related works.

Currently, many smartphones are adopting fingerprint verification as a method to authenticate their users. Because fingerprint verification is not only used to unlock these smartphones but also used in financial applications such as online payment, it is crucial to secure the fingerprint verification mechanism for reliable services. In this paper, we identify a few vulnerabilities in one of the currently deployed smartphones equipped with fingerprint verification service by analyzing the service application. We demonstrate actual attacks via a proof-of-concept code that exploits these vulnerabilities. By these attacks, an attacker can extract fingerprint features by decoding a file containing them in encrypted form. We also suggest a few possible countermeasures against these attacks.

Passwords and PINs are convenient and ubiquitous, yet they are quite vulnerable to attackers who stand near the user. This problem may be partially resolved by changing the user interface, but previous solutions of this kind still give shoulder-surfing attackers a significant advantage over brute-force search. We propose a novel solution based on 3D, especially suitable for glasses-free 3D displays found in many smartphones and handheld game consoles. A user at the “3D spot” may log in easily, while nearby shoulder-surfers gain no advantage. We perform a detailed experimental analysis of the usability of our scheme.

We propose a user authentication method that uses a smart phone as a hardware token. Our method enables a smart phone to prove its owner's identity by receiving audio challenges from a target system.

Personal identification number (PIN) is a common user authentication method widely used for ATMs and mobile phones. However, an attacker can obtain the PIN easily by looking over a user's shoulder. We present a new PIN entry method which makes this kind of attack significantly harder.