Search

Elliptical curves are dedicated for several security applications including Radio Frequency Identification (RFID) devices, smart cards, bankcards, etc. To guarantee effective security of such applications, these cryptographic systems require effective resistance to various types of physical attack. Differential Power-Analysis (DPA) attacks were considered the most efficient attacks against scalar multiplication calculation algorithms. In this paper, we propose a countermeasure method against the DPA attacks, for a scalar multiplication algorithm that is basically secure against Simple Power Analysis (SPA) and safe-error attacks. Our proposal is intended for Elliptic Curves Cryptosystems (ECC) algorithms dedicated to low cost applications. We first introduce the different types of side-channel attacks that ECC-based cryptographic algorithms can suffer, as well as their countermeasure methods existing in the literature. We then present an optimized hardware implementation of the most effective scalar multiplication algorithm against SPA and safe-error attacks. Finally, we present our proposed DPA countermeasure method and its effectiveness against other extensions of DPA attacks. Our proposed method is similar to the Basic Random Initial Point (BRIP) method except that the latter is only applicable for the left-to-right algorithm. The proposed method is based on the randomization of processed data during the computation of the scalar multiplication algorithm and prevents vulnerability to Zero-value Point Attack (ZPA), Refined Power analysis (RPA) attack and double attack. In the last part of our paper, we present comparative analysis in terms of computational cost between our proposed method and other countermeasure algorithms presented in the literature, such as Montgomery-ladder, the BRIP algorithm, the left-to-right algorithm and the Co-Z Mont-Ladder algorithm. [ABSTRACT FROM AUTHOR]

The integrity of electronic voting systems is critical in safeguarding the democratic process worldwide. This study addresses the twin challenges of bribery and coercion that undermine most existing electronic voting systems. Recognizing the limitations of current security measures, which fail to protect voter autonomy even after the disclosure of voting secrets, we propose an innovative level-five secure e-voting system. By integrating an additional setup phase, our system maintains voter volition, ensuring security even when key secrets are compromised. Utilizing cryptographic techniques, blind signatures, and subliminal channels in conjunction with smart card PIN mechanisms, our approach not only bolsters system security but also enhances its potential for widespread adoption. This work underscores the importance of advanced cryptographic methods in developing coercion-resistant electronic voting systems that prioritize voter privacy and choice. [ABSTRACT FROM AUTHOR]

Alighting bus stops inferring is of great significance for origin–destination estimation. Cellular signaling data (CSD), a kind of individual trajectory generated by mobile phones, provides a new idea for alighting stop identification. To explore the capacity of CSD in this field, this study proposes a method of inferring alighting bus stops by integrating smart card data, bus GPS data, and CSD. Firstly, a correspondence table is generated by individual matching, which correspondingly links mobile phone users in CSD and bus passengers in smart card data. Secondly, the inferred alighting bus stops are determined by the radii of the circumscribed circles of triangles consisting of directly projective points, piecewise projective points, and CSD points. The proposed method is verified by an experimental dataset from a behavioral simulation experiment of 10 volunteers in Foshan, China. The results show that the recognition rate is 92.94% and the inference accuracy is 65.82%, or 93.67% under a one-stop error. In the case of a real dataset in Foshan, the proposed method with a recognition rate of 53.02% highly outperforms the trip-chain-based method. The difference in the recognition rate between the two datasets is due to that the real dataset is more likely to be incomplete than the experimental data, which indicates that the performance and effectiveness of the proposed method are sensitive to the data quality and completeness of CSD and bus GPS data. Having said that, the proposed method can infer both alighting stops of linked bus trips and single unlinked bus trips. [ABSTRACT FROM AUTHOR]

As public transportation faces increasing ridership demand, metrics such as the number of passengers denied boarding become important for measuring the service quality of transit systems. Many studies in the past have used automated fare collection (AFC) (also known as smart card data) and automated vehicle location data to infer the probability distributions for commuters that experience unable-to-board (UTB) events in metro systems, but few have studied UTB events for buses. In this paper, we demonstrate that the probability distribution of UTB commuters inferred from AFC data can be modelled by a truncated binomial distribution under certain assumptions. This model is then validated against synthetic UTB events generated using simulations and against actual UTB events recorded from ground surveys. Finally, we apply our model on real AFC data of commuters in the Singapore bus network to serve as a case study. Our method enables transport planners and operators to identify bus stops and time intervals where overcrowding and UTB events is prevalent, so that appropriate measures can be taken to mitigate such occurrences. [ABSTRACT FROM AUTHOR]

A patient-centered personal health records system has been actively promoted in recent years. Its purpose is to maintain long-term personal records and health improvement plans. It combines a cloud computing environment to build a personal health records system to quickly collect personal information and transfer it to the back end for storage for future access. However, in a cloud environment, the message transmission process is more open. Therefore, a lack of an authority security mechanism for the users of such an architecture will result in distrust and doubt by the users. This adversely affects the implementation and quality of long-term health plans. To protect the crucial privacy of the users from malicious attacks or theft, it is necessary to ensure that the users have different authority to access their personal health records under the cloud computing environment and manage the openness of their authority to other users. A secured identify authentication mechanism can ensure that only legitimate users can log in to the system and obtain system service resources through verification. For a personal health records system in the cloud computing environment, this study proposes a secure and reliable user authentication mechanism allowing relevant users access to the user's PHR in the cloud based on their authority. The proposed authentication method uses a password combined with a smart card, allowing the owner and authorized users to log in to the system and access the relevant personal records. In this study, an authentication method based on bilinear pairing was used to verify the identity of users and to effectively prevent malicious intrusion and theft. [ABSTRACT FROM AUTHOR]

Split-gate embedded Flash memory technology has been around for decades and has become the standard application for a wide range of devices such as microcontrollers and smart cards. Among them, due to a number of advantages, SuperFlash (SF) produced by Silicon Storage Technology is the most widely used nonvolatile memory technology. In this paper, the results of a study of the structure of memory cells (MCs) are presented and the principle of their operation, as well as the main technological stages of the production process of forming transistor structures, is discussed. [ABSTRACT FROM AUTHOR]

Despite recent efforts by the Artificial Intelligence (AI) community to move towards standardised procedures for documenting models, methods, systems or datasets, there is currently no methodology focused on use cases aligned with the risk-based approach of the European AI Act (AI Act). In this paper, we propose a new framework for the documentation of use cases that we call use case cards, based on the use case modelling included in the Unified Markup Language (UML) standard. Unlike other documentation methodologies, we focus on the intended purpose and operational use of an AI system. It consists of two main parts: firstly, a UML-based template, tailored to allow implicitly assessing the risk level of the AI system and defining relevant requirements, and secondly, a supporting UML diagram designed to provide information about the system-user interactions and relationships. The proposed framework is the result of a co-design process involving a relevant team of EU policy experts and scientists. We have validated our proposal with 11 experts with different backgrounds and a reasonable knowledge of the AI Act as a prerequisite. We provide the 5 use case cards used in the co-design and validation process. Use case cards allows framing and contextualising use cases in an effective way, and we hope this methodology can be a useful tool for policy makers and providers for documenting use cases, assessing the risk level, adapting the different requirements and building a catalogue of existing usages of AI. [ABSTRACT FROM AUTHOR]

Nowadays, smart card and password-based user authentication and key agreement schemes have become an integral mechanism to ensure only legitimate users get access to the data of wireless sensor networks (WSNs). In the recent past, lots of password-based multi-factor user authentication schemes have been developed by the researchers. However, most of them are not secure against various known attacks. Recently, two user authentication and key agreement schemes for WSNs are suggested by Chen and Chen (J Supercomput 77(12):13653–13675, 2021) and Qi and Chen (J Supercomput 77(12):13897–13910, 2021). They claim that their schemes are secure against all known attacks. We analyze the security of these schemes and demonstrate that these schemes are not secure against some common attacks (such as smart card lost attack) and do not provide common security features such as user untraceability and forward secrecy. By keeping all the merits of these schemes, we suggest a new provably secure user authentication and key agreement scheme using physically unclonable functions and elliptic curve cryptography. To verify the security and authentication properties of the suggested scheme, we use the well-known Proverif tool for formal security verification. We further prove its security informally. Finally, performance comparison with some recent schemes in terms of security features and computational cost is performed. Performance comparison results show the superiority of the suggested scheme over the existing schemes. [ABSTRACT FROM AUTHOR]

The emerging cloud infrastructure has escalated number of servers offering flexible and diverse remote services through public channels. However, user authentication in conventional single-server architecture necessitates multiple smart cards maintenance and passwords memorization to access different cloud servers. To address this limitation, researchers devised authentication protocols for multi-server architecture that offers scalable platform wherein users can access multiple servers with single registration. The multi-factor authentication protocols leverage biometric keys to bind users' physical characteristics with their identity, offering higher security than two-factor authentication protocols. However, the existing protocols for multi-server architecture are prone to replay, user impersonation, denial of service, server spoofing attacks and lack security functionalities such as user anonymity and untraceability, backward and forward secrecy, and session key security. Moreover, the incorporation of registration center (RC) to authenticate each pair of user-server in multi-server architecture can lead to computational bottleneck and single-point failure issues on RC. To overcome these security loopholes, we design a novel provably secure multi-factor elliptic curve cryptography (ECC) based authentication protocol for multi-server architecture with offline RC for cloud environment. The formal security analysis under widely accepted real-or-random (ROR) model and informal security analysis of proposed protocol demonstrate provision of security functionalities and resilience against potential security attacks. Furthermore, we adopt Scyther security verification tool to verify our protocol's correctness and security properties. The performance evaluation demonstrates that our protocol offers robust security functionalities with reasonable communication and computation overheads than state-of-the-art protocols. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) connect and link objects and people for creating, processing and sharing countless information. The use of IoT is widely spread in important life fields like smart farming, by collecting and transferring data from agricultural environment to cloud servers and farming experts. Ensure the security of the data transferred is always an important issue. Hence, many researchers have proposed secure schemes in IoT systems. However, these schemes still present some flaws and they are vulnerable against some known attacks as impersonation, man in the middle, session key disclosure, password guessing and stolen smart card. Besides, they are not all adaptable to lightweight devices. Therefore, the purpose of this present work is to ensure user's privacy and data confidentiality by authenticating all legitimate network members and securing their communications. Accordingly, we propose three schemes of authentication and key management taking into consideration not only the security requirements but also the resource limit of network devices. A formal security verification of the three schemes is performed using Burrows-Abadi-Needham (BAN) logic, Automated Validation of Internet Security Protocols and Applications (AVISPA) and Scyther verification tool. The results show that each scheme ensures mutual authentication and session key secrecy. They are secure against some known attacks as man in the middle, replay and impersonation. Besides, the performance analysis comparison show the lightness of the proposed schemes regarding recent related schemes and hence they are adaptable to different IoT devices. [ABSTRACT FROM AUTHOR]

Conventional demand-prediction methods predominantly rely on past user behaviors to predict regular future transportation demands using acquired user preference data. Nevertheless, predicting unforeseen travel demands arising from bad weather or emergency events remains challenging owing to the absence of data on such future contingencies. This study introduces a method to predict travel demand by leveraging search history data, which potentially signal unforeseen travel requirements. We elucidate the correlation between the search count and integrated circuit (IC) card usage on an aggregate level. Subsequently, we propose a two-stage analytical technique to estimate the number of IC card usages based on route-search counts. Our findings demonstrate that the proposed model has superior accuracy, and the route-search count plays a pivotal role in predicting the number of IC card usages, especially unforeseen shifts in demand. [ABSTRACT FROM AUTHOR]

Blockchain technology has limitations in terms of scalability and throughput of transactions compared to other payment methods such as VISA and smart cards. But, Off-chain payment solves this issue by performing micro-transactions without communicating with the ledger. Similarly, Ethereum uses smart contracts to complete Off-chain transactions by constructing state and virtual channels. In this model, we develop an n-party payment system that uses state and virtual channels. The proposed model simultaneously executes different contract instances while they belong to other independent channels. Again, a virtual channel having n-intermediaries takes linear time to resolve payment channel disputes by transferring to the Blockchain. We introduce a global contract GSCC that solves the disputes in constant time in the worst case without including Blockchain. The dispute-solving process does not affect any intermediary node and ensures the intermediary is not losing coins. GSCC stores all the prior information of the active participants. But, GSCC has no communication overhead to other parties and ensures the execution of disputes with total conflict amount. The resultant model guarantees the execution of every contract, fair dispute resolution, and security balance. Our proposed theorems and zero-knowledge proof ensure the security of the n-party model. [ABSTRACT FROM AUTHOR]

In wireless sensor networks (WSNs), protocols with authentication and key agreement functions can enhance the security of the interaction between users and sensor nodes, guaranteeing the security of user access and sensor node information. Existing schemes have various security vulnerabilities and are susceptible to security attacks (e.g., masquerading user, password guessing, internal privilege, and MITT attacks), so they cannot meet the anonymity requirements or achieve forward security. To effectively improve the security performance of WSNs, an elliptic curve cryptography (ECC)-based three-factor authentication and key agreement scheme for WSNs is proposed. The scheme is based on the ECC protocol and combines biometrics, smart card and password authentication technology; uses a challenge/response mechanism to complete the authentication between users, gateways, and sensors; and negotiates a secure session key. The Burrows, Abadi and Needham logic for formal security analysis proves the correctness and security of the scheme, and the informal analysis of multiple known attacks proves that the scheme can resist various attacks and has high security characteristics. The feasibility of the scheme has been analysed and verified with the ProVerif tool. The efficiency analysis results show that the scheme is suitable for resource-constrained WSNs. [ABSTRACT FROM AUTHOR]

Wafer probe test plays a crucial role to distinguish the good dies from the remaining defected dies on the wafers via the probe card as the testing signal interface between the tester and the integrated circuits on the fabricated wafers. Unexpected probe card failures that happen during the testing process will affect testing quality, reduce overall equipment efficiency and productivity. In practice, the engineers rely on domain knowledge and the process of trial and error for fault diagnosis and troubleshooting. However, as the IC device features are continuously shrinking with an increasing number and density of the bond pads of the circuits on the wafer, fault diagnosis and troubleshooting for probe card have become complicated and time-consuming. To fill the gap, this study aims to develop a data-driven framework that integrates rough set theory and domain knowledge to derive effective decision rules to enhance the decision quality and efficiency for advanced quality control and smart manufacturing. An empirical study was conducted in a leading semiconductor testing company in Taiwan for validation. The proposed framework can shorten fault diagnosis procedure and enhance productivity, while enhancing probing test integrity to reduce both the producer risk and customer risk. The developed solution is implemented in real setting. [ABSTRACT FROM AUTHOR]

In the era of rapid technological advancement, the Internet of Things (IoT) has revolutionised healthcare through systems like the Telecare Medicine Information System (TMIS), designed to streamline patient-doctor interactions and enhance medical treatment. However, the transmission of sensitive patient data over inherently insecure Internet channels exposes it to a spectrum of security risks. Protecting patient medical privacy and ensuring system reliability necessitate mutual authentication between both patients and medical servers. TMIS relies on robust authentication mechanisms, and combining passwords and smart cards has been a recognised approach for mutual authentication. This research introduces an innovative three-factor authentication technique with perfect forward secrecy by leveraging the power of Elliptic Curve Cryptography (ECC) in tandem with smart cards. Additionally, we have incorporated biometric authentication with a Fuzzy Extractor technology to enhance the security and reliability of the system, setting a new standard for user authentication within the realm of Social IoT healthcare. The use of ECC in the method is justified due to its compact key size and robust security measures, making the solution both efficient and secure. The proposed method safeguards user privacy by permitting registered users to change their passwords without divulging their identity to the server. The Burrows–Abadi–Needham logic (also known as the BAN logic) serves as a proof-of-concept for the proposed scheme's security. Our system provides privacy protection along with mutual authentication and session key negotiation at a considerably low computation cost and communication cost of up to 71.03% compared to the other four relevant techniques, making it more useful in real-world scenarios. [ABSTRACT FROM AUTHOR]