Search

Graph-based databases are concerned with performance and flexibility. Most of the existing approaches used to design secure NoSQL databases are limited to the final implementation stage, and do not involve the design of security and access control issues at higher abstraction levels. Ensuring security and access control for Graph-based databases is difficult, as each approach differs significantly depending on the technology employed. In this paper, we propose the first technology-ascetic framework with which to design secure Graph-based databases. Our proposal raises the abstraction level by using ontologies to simultaneously model database and security requirements together. This is supported by the TITAN framework, which facilitates the way in which both aspects are dealt with. The great advantages of our approach are, therefore, that it: allows database designers to focus on the simultaneous protection of security and data while ignoring the implementation details; facilitates the secure design and rapid migration of security rules by deriving specific security measures for each underlying technology, and enables database designers to employ ontology reasoning in order to verify whether the security rules are consistent. We show the applicability of our proposal by applying it to a case study based on a hospital data access control. • Database designers can focus on data to be protected, ignoring the implementation. • Facilitates quick migration of security rules to each underlying database technology. • Enable checking whether the security rules are consistent through ontology reasoning. [ABSTRACT FROM AUTHOR]

The fingerprint is the readily available and most widely used biometrics for the security of a system. In order to impart the security of the template database, it is important to make the fingerprint template robust to fingerprint reconstruction, i.e., invertibility. In this paper, a fingerprint template is proposed using a novel minutiae triangulation technique. In this triangulation technique, the set of minutiae of a template is taken to generate a set of minutiae triplets each forming a triangle. After this, a minutiae transformation is applied to obtain a set of triplets of internal angles of the triangle which also removes the minutiae location and orientation information. In the absence of this information, the orientation map of the fingerprint cannot be estimated. This set of triplets together with some other information is used as a proposed fingerprint template. The proposed system is experimented using standard FVC2000, FVC2004 and FVC2006 databases and yields better results in terms of EER (Equal Error Rate) as compared with the state-of-art techniques. • A novel minutiae triangulation technique for generating a robust fingerprint template is proposed. • The proposed threshold for minutiae triplet validation is adaptive. • The proposed fingerprint template is robust against fingerprint deformation. [ABSTRACT FROM AUTHOR]

Access control in a hierarchy refers to a selective access to a database. A large number of users work with the same database. These users are organized in a hierarchical structure and therefore have different access rights to the data. This paper offers a solution to the problem of access control in a hierarchy based on quantum cryptography. Each user has two keys: a classical key and a quantum key. Our scheme offers several security advantages over the classical schemes to date. It protects users from identity theft and prevents collusion attacks. Most importantly though, our scheme adapts to dynamic changes of the user hierarchy: users may join, leave, or change position in the hierarchy, without affecting the rest of the user structure. [ABSTRACT FROM AUTHOR]

We construct a formal model of a security control system for an automated system and analyze errors in making decisions concerning the system’s security level under conditions of partial information availability. [ABSTRACT FROM AUTHOR]

Secure chips, e.g., present in smart cards, USB dongles, i-buttons, are now ubiquitous in applications with strong security requirements. Moreover, they require embedded data management techniques. However, secure chips have severe hardware constraints, which make traditional database techniques irrelevant. The main problem faced by secure chip DBMS designers is to be able to assess various design choices and trade-offs for different applications. Our solution is to use a benchmark for secure chip DBMS in order to 1) compare different database techniques, 2) predict the limits of on-chip applications, and 3) provide codesign hints. In this paper, we propose Data management in Secure Chip (DISC), a benchmark that reaches these three objectives. This work benefits from our long experience in developing and tuning data management techniques for the smart card. To validate DiSC, we compare the behavior of candidate data management techniques using a cycle-accurate smart-card simulator. Furthermore, we show the applicability of DiSC to future designs involving new hardware platforms and new database techniques. [ABSTRACT FROM AUTHOR]

We face a growing need to be able to perform linkage among data set records to connect data about the same individual, organization or event so that further analysis becomes possible. At the same time, we also need to do a better job of protecting the privacy of the individuals identified by data set records. Therefore, it would be ideal if linkage could be effectively performed based not on the actual data but on some anonymous form of the data without diminishing the ability to link records whose identifiers are only “close” to each other, not equal, because of typical recording errors. This paper reviews existing proposals for how such anonymized string comparisons might be accomplished, but demonstrates that existing methods have various operational deficiencies. It therefore argues that new, more capable methods are needed. [ABSTRACT FROM AUTHOR]

Contemporary businesses face many new and unprecedented challenges including the threat of terrorism. The impact of a terrorist attack can undermine an organization's success and survival. A significant area of organizational vulnerability to acts of terrorism involves the information systems infrastructure of the organization. This article discusses the mission-critical expectations that corporate executives have for their information technology departments with respect to securing and protecting these essential resources. [ABSTRACT FROM AUTHOR]

We propose an authentication methodology that combines multimodal biometrics and cryptographic mechanisms for border control applications. We accommodate faces and fingerprints without a mandatory requirement of (tamper-resistant) smart-card-level devices on e-passports for easier deployment, It is even allowable to imprint (publicly readable) bar codes on the passports. Additionally, we present a solution based on the certification and key management method to control the validity of passports within the current Public-Key Infrastructure (PKI) technology paradigm. [ABSTRACT FROM AUTHOR]

Biometric sensor interoperability refers to the ability of a system to compensate for the variability introduced in the biometric data of an individual due to the deployment of different sensors. Poor intersensor performance has been reported in different biometric domains including fingerprint, face, iris, and speech. In the context of fingerprint technology, variations are observed in the acquired images of a fingerprint due to differences in sensor resolution, scanning area, sensing technology, etc., which subsequently impact the feature set extracted from these images. The inability of a fingerprint matcher to compensate for these variations introduced by different sensors results in inferior intersensor matching performance. In this work, a nonlinear calibration scheme based on the Thin- Plate Spline (TPS) model is used to register a pair of fingerprint sensors. The proposed calibration technique relies on the evidence of a few image pairs acquired using the two sensors to generate an average deformation model that defines the spatial relationship between the two sensors. This assists in the systematic perturbation of images/features pertaining to one sensor in order to make them compatible with images/features originating from the other sensor. Experimental results using multiple fingerprint data sets confirm the efficacy of the proposed method in addressing intersensor geometric variations. [ABSTRACT FROM AUTHOR]

Policy-based management for federated healthcare systems has recently gained increasing attention due to strict privacy and disclosure rules. Although the work on privacy languages and enforcement mechanisms, such as Hippocratic databases, has advanced our understanding of designing privacy-preserving policies for healthcare databases, the need to integrate these policies in a practical healthcare framework is becoming acute. Additionally, although most work in this area has been organization oriented, dealing with the exchange of information between healthcare organizations (such as referrals), the requirements for the emerging area of personal healthcare information management have so far not been adequately addressed. These shortcomings arise from the lack of a sophisticated policy specification language and enforcement architecture that can capture the requirement for 1) the integration of privacy and disclosure policies with well-known healthcare standards used in the industry in order to specify the precise requirements of a practical healthcare system and 2) the provision of ubiquitous healthcare services to patients using the same infrastructure that enables federated healthcare management for organizations. In this paper, we have designed a policy-based system to mitigate these concerns. First, we have designed our disclosure and privacy policies by using a requiremEnts specification based on a set of use cases for the Clinical Document Architecture (CDA) standard proposed by the community. Second, we present a context-aware policy specification language, which allows encoding of CDA-based requirements use cases into privacy and disclosure policy rules. We have shown that our policy specification language is effective in terms of handling a variety of expressive constraints on CDA-encoded document contents. Our language enables specification of privacy-aware access control for federated healthcare information across organizational boundaries, whereas the use of contextual constraints allows the incorporation of user and environment context in the access control mechanism for personal healthcare information management. Moreover, the declarative syntax of the policy rules makes the policy adaptable to changes in privacy regulations or patient preferences. We also present an enforcement architecture for the federated healthcare framework proposed in this paper. [ABSTRACT FROM AUTHOR]

Software code regulates behaviour and maybe even more so than legal code. For instance, digital rights management systems can prevent users from breaching copyrights more effectively than copyright law itself can. The relationship between ‘code’ and privacy is more complex than is the case with copyright. Where technology in general seems to have a negative impact on privacy, technology could equally be used for enhancing privacy. This article discusses the nature of ‘software code’ in relation to privacy. It argues that, often, privacy threats are not implemented in code on purpose, but that privacy erosion is nevertheless an inexorable side effect of technology. The paradigmatic reflex of data maximization, due to a lack of awareness on the part of developers – and users, is a major factor that leads to the erosion of privacy by technology. [ABSTRACT FROM AUTHOR]

The literature on physical database design in general, and on rile segmentation in particular, typically ignores any consideration of data security and the cost to enforce it. If records can be physically designed so that all data elements in a given record type have identical security restrictions for a given user, then data element level security enforcement can he transformed into the less costly rile level security enforcement for that user and file. Similarly, If all record types have identical security restrictions, file based security might be sufficient. This paper extends an earlier model for file segmentation to include security considerations. The extended model embeds the security measures into the logical file structure and exploits a four category taxonomy of security restriction types. The model is used to generalize the interaction between element level selective security and physical data- base design. [ABSTRACT FROM AUTHOR]

• Post-quantum security solution based on security measurement. • Systolic architecture of inversion for building post-quantum crypto-system. • Employing post-quantum crypto-system to IoT security measurement. Internet of Things (IoTs) have become one of the most popular techniques and widely used in advanced manufacturing and other engineering areas. As the applications of IoT-based advanced manufacturing rapidly increase, security measurement of data management has become one of the most crucial challenges in IoT-based advanced manufacturing. It is claimed that such systems are vulnerable to quantum computer attacks. Thus, it is very urgent to improve data management based on security measurement. In this paper, we improve multivariate cryptographic systems for IoT-based advanced manufacturing based on employing new inversion algorithms. Compared with related designs, the proposed design has better performance and meets the resource requirement of IoTs and the secure requirement of data management in advanced manufacturing, which is very suitable to build multivariate cryptographic systems for securing data management based on security measurement in IoT-based advanced manufacturing. [ABSTRACT FROM AUTHOR]

The growth in demand for biometrics as a factor of authentication stems from two main areas – hardened security for compliance and greater end-user convenience. As security threats grow and security regulations become more rigid, organisations are increasingly choosing to implement biometric authentication to protect data and comply with regulatory demands. [Copyright &y& Elsevier]

Abstract: Database privacy can be conceptually described in terms of three dimensions, each of which refers to the privacy of a different subject and is pursued by a different discipline: respondent privacy, addressed by statistical disclosure control (SDC), owner privacy, addressed by privacy-preserving data mining (PPDM), and user privacy, pursued by private information retrieval (PIR). This special issue contains papers reporting recent advances in each of those three dimensions. [Copyright &y& Elsevier]

Energy security is important for the economic and social development of a country, especially for China, because it has become one of the biggest energy consumers in the world and the energy security varies greatly in different regions. However, most existing studies evaluate China's energy security from the perspective of the whole country, while few studies from the perspective of different regions within the country. So this paper aims to evaluate China's provincial energy security from 2010 to 2016, not only identify the problems but also provide policy strategies. Firstly, a comprehensive evaluation system of energy security is established including availability and stability of energy supply dimension, sustainability and acceptability of energy use dimension, and external influences of policies and market dimension. Secondly, the combination method of the order relation and the entropy method is utilized to evaluate the provincial energy security in 30 provinces, which considers both subjective and objective information. Thirdly, according to the changes in the ranking of provincial energy security between the 30 provinces over the 7 years, this paper analyzes the reasons and put up corresponding suggestions. The results show that there is still a huge gap among different regions and some provinces changes greatly in the ranking. The most energy-secure provinces are mainly in the northwest and northeast provinces with abundant natural resources such as Shanxi, Shaanxi and Sichuan, the least energy-secure provinces are mainly in the resource-deficient regions such as Zhejiang, Guangxi and Jiangxi. And in order to beef up the provincial energy security, suggesting that some provinces should develop clean energy, optimize the structure of terminal energy consumption and improve energy efficiency according to the changes in the ranking. • We developed a provincial energy security evaluation system from 3 dimensions. • Analysis and policy recommendations in different provinces of China is conducted. • The most energy-secure provinces are mainly in the northwest and northeast provinces. • The least energy-secure provinces are mainly in the resource-deficient regions. • Some provinces changed greatly in energy security performance from 2010 to 2016. [ABSTRACT FROM AUTHOR]

The aim of this paper was to enhance the process of diagnosing and detecting possible vulnerabilities within an Internet of Things (IoT) system by using a named entity recognition (NER)-based solution. In both research and practice, security system management experts rely on a large variety of heterogeneous security data sources, which are usually available in the form of natural language. This is challenging as the process is very time consuming and it is difficult to stay up to date with the constant findings in the areas of security threats, vulnerabilities, attacks, countermeasures, and risks. The proposed system is conceived as a semantic indexing solution of existing vulnerabilities and serves as an information tool for security management experts. By integrating the proposed system, the users can easily discover the potential vulnerabilities of their IoT devices. The proposed solution integrates ontologies and NER techniques in order to obtain a high rate of automation with the scope of reaching a self-maintained and up-to-date system in terms of vulnerabilities and common exposures knowledge. To achieve this, a total of 312 CVEs (common vulnerabilities and exposures) specific to the IoT field were identified. CVEs are arguably one of the most important cybersecurity resources nowadays, containing information about the latest discovered vulnerabilities. This set is further used as data corpus for an NER model designed to identify the main entities and relations that are relevant to IoT security. The goal is to automatically monitor cybersecurity information relevant to IoT, and filter and present it in an organized and structured framework based on users' needs. The taxonomies specific to IoT security are implemented via a domain ontology, which is later used to process natural language. Relevant tokens are marked as entities and the relations between them identified. The text analysis solution is connected to a gateway which scans the environment and identifies the main IoT devices and communication technologies. The strength of the approach proposed within this research is that the designed semantic gateway is using context-aware searches in the modeled IoT security database and can identify possible vulnerabilities before they can be exploited. [ABSTRACT FROM AUTHOR]

Databases may be compromised by asking a set of queries which return only statistical information and making inferences about a specific entry from the results of the set of queries. We present methods of constructing the set of queries to compromise a database where all the queries in the set return the maximum of a set of k elements, or all queries return the mean of a set of k elements. In the case of the mean query, all elements involved will be compromised. We also consider bounds on the number of queries required to compromise the database. [ABSTRACT FROM AUTHOR]