Search

Wireless Sensor Networks WSNs mainly consist of small, battery-operated, limited memory and limited computational power sensor nodes. It is important to achieve secure communication among WSNs even if some nodes are compromised. In this paper, three kinds of self-healing schemes for WSNs are described, a polynomial-based self-healing scheme RPoK, a proactive co-operative self-healing scheme POLISH, and a simple random key pre-distribution scheme with self-healing S-RKP. Comparing three schemes, we clarify each difference and discuss optimal scheme under each different environments.

This paper introduces a new capability of the group signature, called message-dependent opening. It is intended to weaken the higher trust put on an opener, that is, no anonymity against an opener is provided by ordinary group signature. In a group signature system with message-dependent opening (GS-MDO), in addition to the opener, we set up the admitter which is not able to open any user's identity but admits the opener to open signatures by specifying messages whose signatures should be opened. For any signature whose corresponding message is not specified by the admitter, the opener cannot extract the signer's identity from it. In this paper, we present formal definitions and constructions of GS-MDO. Furthermore, we also show that GS-MDO implies identity-based encryption, and thus for designing a GS-MDO scheme, identity-based encryption is crucial. Actually, we propose a generic construction of GS-MDO from identity-based encryption and adaptive NIZK proofs, and its specific instantiation from the Groth-Sahai proof system by constructing a new (k-resilient) identity-based encryption scheme which is compatible to the Groth-Sahai proof.

In INFOCOM 2009, Yu, Wei, Ramkumar and Guan have proposed the novel mechanism (called Yu's scheme), in which a forwarder can filter polluted messages before spreading the pollution in the XOR network coding systems. In order to perform such filtering, two or more message authentication codes (MACs) are used for this scheme. However, Yu's scheme has a problem that the number of MACs increases at every coding point, since it cannot operate MACs with the XOR network coding. This means that the MAC of Yu's scheme does not have homomorphic property. In this paper, we propose the first symmetric-key-based scheme not only to filter polluted messages but also to operate MACs with the XOR network coding on a forwarder. The XOR network coding of MACs produces improvement which does not increase the number of MACs at a coding point. Our scheme uses the UHFs-based MAC with a homomorphic property to hold homomorphic MAC, and hence it can aggregate MACs in our XOR network coding systems. We emphasize that a forwarder cannot straightforward filter polluted messages even if our scheme uses the UHFs-based MACs.

In this paper we propose the first proactive co-operative link self-healing (POLISH) scheme, in which the secure link compromised in WSNs automatically self-heals with time, without the help of a server. Our scheme updates a secure link using the random data transmitted from the neighboring sensor nodes, based on the idea of the POSH scheme. It is necessary to newly take the security of a link between sensors into consideration in our scheme since such security is not considered in the POSH scheme. We conduct analytical evaluation and a simulation experiment for our scheme, and the results indicate that our scheme is very effective in self-healing.

As well-known results, timed-release encryption (TRE) and public key encryption scheme with keyword search (PEKS) are very close to identity-based encryption (IBE), respectively. It seems natural that there is a close relationship between TRE and PEKS. However, no explicit bridge has been shown between TRE and PEKS so far. In this paper, we show that TRE can be generically constructed by PEKS with extended functionalities, called secure-channel free PEKS (SCF-PEKS) with adaptive security, and discuss the reason why PEKS and (nonadaptive) SCF-PEKS are not suitable for constructing TRE. In addition to this result, we also show that adaptive SCF-PEKS can be generically constructed by anonymous IBE only. That is, for constructing adaptive SCF-PEKS we do not have to require any additional cryptographic primitive compared to the Abdalla et al. PEKS construction (J. Cryptology 2008), even though adaptive SCF-PEKS requires additional functionalities. This result seems also independently interesting.

Identity-Based Proxy Re-Encryption (IB-PRE) has been proposed by Green and Ateniese (ACNS2007), where the proxy transforms a source ciphertext encrypted by a delegator's identity into a destination ciphertext that can be decrypted using a delegatee's secret key corresponding to the delegatee's identity. By using IB-PRE, we expect that mailing-list systems can be constructed without public key certificates. However, in all previous IB-PRE, information about whether a source ciphertext (encrypted by a mailing-list address) is the source of a destination ciphertext (encrypted by an e-mail address) or not, is revealed from both the source ciphertext and the destination ciphertext. In this paper, for the first time we propose an IB-PRE scheme with source hiding property, where no information about source identity is revealed from the destination ciphertext. Our work is the valuable and important milestone for establishing the secure PRE-based mailing-list system without public key certificates.

In many wireless sensor network applications, the data collection sink (base station) needs to find the aggregated statistics of the network. Readings from sensor nodes are aggregated at intermediate nodes to reduce the communication cost. However, the previous optimally secure in-network aggregation protocols against multiple corrupted nodes require two round-trip communications between each node and the base station, including the result-checking phase whose congestion is O(log n) where n is the total number of sensor nodes. In this paper, we propose an efficient and optimally secure sensor network aggregation protocol against multiple corrupted nodes by a weak adversary. Our protocol achieves one round-trip communication to satisfy optimal security without the result-checking phase, by conducting aggregation along with the verification, based on the idea of TESLA technique. Furthermore, we show that the congestion is constant. This means that our protocol suits large-scale wireless sensor networks.

There are many cryptographic schemes with anonymity, such as group signatures. As one important property, anonymity revocation has been introduced. In such schemes, the fact of whether a signer's rights have been revoked or not is important additional information. For example, if a third party knows that there are many revoked members in a company, then the company's reputation may be damaged in many ways. People may think that there might be many problematic employees (who have bad behavior-s) in this company, there might be many people who have quit, i.e., the labor environment may not be good, and so on. To avoid such harmful rumors, in this paper, we propose an Anonymous Designated Verifier Signature (ADVS) scheme with revocation. In ADVS, a designated verifier can only verify a signature anonymously, and a third party cannot identify whether the rights of the signer have been revoked or not. We show two security-enhanced schemes as applications of our scheme: a biometric-based remote authentication scheme, and an identity management scheme.

Timed-Release Encryption (TRE) (proposed by May in 1993) prevents even a legitimate recipient decrypting a ciphertext before a semitrusted Time Server (TS) sends trapdoor sT assigned with a release time T of the encryptor's choice. Cathalo et al. (ICICS2005) and Chalkias et al. (ESORICS2007) have already considered encrypting a message intended to multiple recipients with the same release time. These schemes are efficient compared with previous TRE schemes with recipient-to-recipient encryption, since the most costly part (especially pairing computation) has only to be computed once, and this element is used commonly. One drawback of these schemes is the ciphertext size and computational complexity, which depend on the number of recipients N. In this paper, for the first time we propose Timed-Release Proxy Re-Encryption (TR-PRE) scheme. As in PRE, a semi-trusted proxy transforms a ciphertext under a particular public key (this can be regarded as a mailing list) into reencrypted ciphertexts under each recipient (who can be regarded as mailing list members). Even if the proxy transformation is applied to a TRE ciphertext, the release time is still effective. An encryptor can transfer N- dependent computation parts to the proxy. This function can be applied to multicast communication with a release time indication. For example, in an on-line examination, an examiner sends encrypted e-mails to each examinee, and each examination can be fairly opened at the same time. Our TR-PRE scheme is provably secure under both chosen-time period chosen-ciphertext attack (IND-CTCA) and replayable chosen-ciphertext attack (IND-RCCA) without random oracles.

In a k-Times Anonymous Authentication (k-TAA) scheme, Application Providers (APs) authenticates each group member in k times. A user can preserve his/her own privacy and an AP can restrict the number of used services to just k-times, since users are identified if they access an AP more than k times. In all previous schemes, each AP assumes the same k for all users. Added to this, total anonymity of unlinkability requires large computation amount such as pairing computations compared with non-anonymous schemes. In this paper, we propose a selectable k-TAA scheme with relaxed anonymity. Relaxed anonymity is an intermediate level of privacy required between total anonymity and linkability, where authentication executions for the same AP are linkable, but an authentication execution with an AP v 0 and an authentication execution with an AP v 1 (v 0 ? v 1) are unlinkable. Our authentication algorithm is efficient than existing ones thanks to this relaxed notion.

An Attribute-Based Encryption (ABE) is an encryption scheme, where users with some attributes can decrypt ciphertexts associated with these attributes. However, the length of the ciphertext depends on the number of attributes in previous ABE schemes. In this paper, we propose a new Ciphertext-Policy Attribute-Based Encryption (CP-ABE) with constant ciphertext length. Moreover, the number of pairing computations is also constant.

One of the worst threats present in an enterprise network is the propagation of “scanning malware” (e.g., scanning worms and bots). It is important to prevent such scanning malware from spreading within an enterprise network. It is especially important to suppress scanning malware infection to less than a few infected hosts. We estimated the timing of containment software to block “scanning malware” in a homogeneous enterprise network. The “combinatorics proliferation model”, based on discrete mathematics, developed in this study derives a threshold that gives the number of the packets sent by a victim that must not be exceeded in order to suppress the number of infected hosts to less than a few. This model can appropriately express the early state under which an infection started. The result from our model fits very well to the result of computer simulation using a typical existing scanning malware and an actual network.

A second-price sealed-bid auction is that a bidder who offers the highest price gets a good in the second highest price. This style of auction solves the problems of both an English auction and a first-price sealed-bid auction. An electronic first-price sealed-bid auction cannot directly be applied to a second-price sealed-bid auction which keeps the highest bid secret. We propose the verifiable discriminant function of the po-th root. Our auction scheme satisfies public verifiability of auction results, and also does not have a single entity who knows the highest bid value even after an auction. Furthermore the bidding cost of our scheme is lower than that of the previous one.

An English auction is the most familiar type of auctions. Generally, an electronic auction has mainly two entities, the registration manager(RM) who treats the registration of bidders, and the auction manager(AM) who holds auctions. Before starting an auction, a bidder who wants to participate in English auction is registered to RM with her/his information. An electronic English auction protocol should satisfy the following nine properties, (a)Anonymity, (b)Traceability, (c)No framing, (d)Unforgeability, (e)Fairness, (f)Verifiability, (g)Unlikability among different auctions, (h)Linkability in an auction, and (i)Efficiency of bidding. Furthermore from the practical point of view we add two properties (j)One-time registration and (k)Easy revocation. A group signature is adapted to an English auction in order to satisfy (a), (b), and (f)[18]. However such a direct adoption suffers from the most critical drawbacks of efficiency in group signatures. In this paper we propose more realistic electronic English auction scheme, which satisfies all of these properties. Four notable features of our scheme are: (1) both of bidding and verification of bids are done quite efficiently by introducing a bulletin board, (2) anonymity for RM, AM and any participant can be realized to plural auctions by only one-time registration, (3) RM can easily revoke a bidder, and (4) nobody can impersonate any bidder.

In this paper, a new type of user identification system based on characteristics (biometrics) for keystroke is proposed. In this system, we do not require any special devices. We utilize two basic parameters: Press-Time, when a user presses a key, Release-Time, when a uses releases the key. Release-Time is a new parameter. By using Release-Time, a user can be identified much more clearly than using only Press-Time. Furthermore, even if a password is stolen, the attacker can hardly find how the owner types because of user’s biometrics for keystroke. Hence this system can overcome the weak point of password checking schemes.