Search

During the Coincheck incident, which recorded the largest damages in cryptocurrency history in 2018, it was demonstrated that using Mosaic token can have a certain effect. Although it seems attractive to employ tokens as countermeasures for cryptocurrency leakage, Mosaic is a specific token for the New Economy Movement (NEM) cryptocurrency and is not employed for other blockchain systems or cryptocurrencies. Moreover, although some volunteers tracked leaked NEM using Mosaic in the CoinCheck incident, it would be better to verify that the volunteers can be trusted. Simultaneously, if someone (e.g., who stole cryptocurrencies) can identify the volunteers, then that person or organization may be targets of them. In this paper, we propose an anonymous trust-marking scheme on blockchain systems that is universally applicable to any cryptocurrency. In our scheme, entities called token admitters are allowed to generate tokens adding trustworthiness or untrustworthiness to addresses. Anyone can anonymously verify whether these tokens were issued by a token admitter. Simultaneously, only the designated auditor and no one else, including nondesignated auditors, can identify the token admitters. Our scheme is based on accountable ring signatures and commitment, and is implemented on an elliptic curve called Curve25519, and we confirm that both cryptographic tools are efficient. Moreover, we also confirm that our scheme is applicable to Bitcoin, Ethereum, and NEM., An extended abstract appeared at the 3rd IEEE International Conference on Blockchain and Cryptocurrency, ICBC 2021. This is the full version

To obtain useful results in machine learning, it is required to collect data from multiple institutions and learn with larger-scale data. However, data collected from multiple institutions may contain a lot of personal information and should not be explicitly shared. The existing research has proposed various methods to protect privacy by using encryption or anonymization, but encryption causes large computational costs, and anonymization may greatly reduce the usefulness of data. In this research, we propose a privacy protection method using dimensionality reduction that is difficult to reverse while maintaining the high usefulness of data. The main idea of our method is that combining dimensionality reduction algorithms with noise addition is useful for privacy-preserving data analysis with high accuracy. Furthermore, we evaluate the effectiveness and security of this method and show the utility of the proposed method.

With recent technological developments, it has become natural for personal computers and Internet of Things(IoT) devices, such as smartphones and tablets, to remain constantly connected to the Internet. Malicious attackers are known to abuse malware to achieve their nefarious purposes, necessitating the implementation of defense systems as protection. Methods such as machine learning-based techniques, which have been utilized with great success in various fields such as image recognition and processing, and voice recognition, are used to prevent cyberattacks caused by malware. However, several adversarial attack methods have been proposed in recent years to induce malfunctions in machine learning-based models. In this study, we focus on malware detection field and treat the aforementioned issue from the perspectives of both attackers and defenders; subsequently, we propose a novel adversarial attack method, named IMAGE_RESOURCE attack, and a robust malware detection model, respectively, using dimension reduction and machine learning techniques. The robustness of the proposed model is evaluated using portable execution (PE) surface information obtained from the FFRI Dataset 2018. During robustness evaluation, distances (e.g., Euclidean distance) between the malware and benign files are measured, and the effectiveness of IMAGE_RESOURCE attack is estimated. Thus, we establish the effectiveness and superiority of the proposed model in terms of detection accuracy and robustness.

This paper introduces a new capability for group signatures called message-dependent opening. It is intended to weaken the high trust placed on the opener; i.e., no anonymity against the opener is provided by an ordinary group signature scheme. In a group signature scheme with message-dependent opening (GS-MDO), in addition to the opener, we set up an admitter that is not able to extract any user’s identity but admits the opener to open signatures by specifying messages where signatures on the specified messages will be opened by the opener. The opener cannot extract the signer’s identity from any signature whose corresponding message is not specified by the admitter. This paper presents formal definitions of GS-MDO and proposes a generic construction of it from identity-based encryption and adaptive non-interactive zero-knowledge proofs. Moreover, we propose two specific constructions, one in the standard model and one in the random oracle model. Our scheme in the standard model is an instantiation of our generic construction but the message-dependent opening property is bounded. In contrast, our scheme in the random oracle model is not a direct instantiation of our generic construction but is optimized to increase efficiency and achieves the unbounded message-dependent opening property. Furthermore, we also demonstrate that GS-MDO implies identity-based encryption, thus implying that identity-based encryption is essential for designing GS-MDO schemes.

The number of Internet of Things (IoT) devices has increased recently and will increase further in the future. IoT devices are vulnerable, so vendors update and distribute firmware. At the time of firmware distribution, a huge number of IoT devices may connect to the firmware server and excessive network traffic may occur. Consequently, a method using a peer-to-peer file sharing system and a blockchain has been proposed. One study proposed an update scheme considering incentives for distributors to help with updating. However, this method requires the IoT devices, which have limited processing power, to decrypt encrypted files, and the distribution nodes to pay the transaction cost. This paper proposes a firmware distribution method that provides incentives for distributors to help with distribution to reduce the gas costs, using a smart contract and access control based on update records. The additional computations performed by IoT devices and distributors key management were reduced compared to those in previous studies by using access control instead of encryption. Further, the proposed approach was implemented and evaluated using a Raspberry Pi and laptop. The evaluation demonstrated that the gas cost per update was successfully lowered compared to the costs in previous studies.

Managing the flood of devices is a modern challenge in distributed networks as it is becoming increasingly difficult to manage the software updates needed to protect the devices from malicious attacks. Bitcoin, which is a blockchain-based system that relies on approximately 10,000 volunteer nodes to manage its ledger, faces similar problems. A centralized system mitigates this problem by enforcing update policies through one authority. In contrast, a distributed system with different update policies for different users could enter a worst-case scenario of sparse deployment due to forgotten updates or refusal to apply them. Nevertheless, we find that Bitcoin peer-software updates have been surprisingly successful in terms of evading this scenario. Therefore, we investigate the modeling of the impact caused by software version history and the remaining challenges, such as the inability to work well with update cycles. Consequently, we report that previous vulnerable software versions are still being used, and the share growth decelerates as the number of versions increases. Moreover, we clarify that the probability of recovering the adoption rate to previous levels is small, while surviving older versions increases the vulnerability of the network.

In recent years, increasingly many companies have entered the pay-as-you-go business because it has become easier to monitor services constantly due to the development and increase in the number of Internet of Things (IoT) devices. Research is in progress to introduce cryptographic assets into the payment, but if a private key is stolen, the cryptographic assets associated with it can be stolen. To address this issue, this paper proposes a secure automated payment system using contract wallets. This method ensures the security of cryptographic assets even if the private key is stolen. Secure automated payments are enabled by issuing transactions from IoT devices and using internal transactions to link contract wallets and smart contracts that handle the payment of cryptographic assets. Furthermore, the effectiveness of the proposed system is demonstrated on the Ethereum blockchain as a proof of concept, and the cost of gas is measured.

Trust of user address (i.e., wallet address) in Bitcoin is dependent on not who user is but the amount of Bitcoin currency in user’s wallet address. So we cannot necessarily trust a Bitcoin user with wallet address. Actually, there is no method for assigning trust to user addresses in Bitcoin. Although we can provide trust to user address by inserting certificate into Bitcoin transaction using OP_RETURN, it still has some problems about wastefulness. In this paper, we propose a new method that efficiently assigns trust to user address using Bitcoin transfer only, which does not need to use OP_RETURN. Our proposed method can realize a trust providing mechanism for “Blockchain 1.0” without adding any new function. Main idea of our method is that “token coin” (Bitcoin transfer itself) can be used as a trust providing mechanism. For feasibility study, we experimentally show the trust assigning in the Bitcoin testnet. Furthermore, our method can be easily adopted into other cryptocurrencies.

Blockchain is a service operated by a peer-to-peer type distributed network, and protocol control such as JSON-RPC is implemented as the interface for flexibility and operability. However, attacks that use protocol control against vulnerable and unmanaged interfaces have been reported. One of the methods to track cyber attacks on such a malicious user's network service is a honeypot that imitates the service and acquires attacker's behavior information. In this research, focusing on the Ethereum network, the behavior of malicious users is clarified using malicious communication history sent to simple honeypots installed in nine countries, Ethereum network information and darknet arrival packets. By analyzing these, the behavior of attackers and the tendency of requests were elucidated, and primary safety measures were established.

Blockchain is a service operated by a peer-to-peer type distributed network, and protocol control such as JSON-RPC is implemented as the interface for flexibility and operability. However, attacks that use protocol control against vulnerable and unmanaged interfaces have been reported. One of the methods to track cyber attacks on such a malicious user’s network service is a honeypot that imitates the service and acquires attacker’s behavior information. In this research, focusing on the Ethereum network, the behavior of malicious users is clarified using malicious communication history sent to simple honeypots installed in nine countries, Ethereum network information and darknet arrival packets. By analyzing these, the behavior of attackers and the tendency of requests were elucidated, and primary safety measures were established.

With the development of the Internet, web content is exponentially increasing. Along with this, web-based attacks such as drive-by download attacks and phishing have grown year on year. To prevent such attacks, URL blacklists are widely used. However, URL blacklists are not enough because they lack the ability to detect newly generated malicious URLs. In this paper, we propose an automatic query template generation method to detect malicious websites. Our method focus on URL query strings that contained similarities on malicious website groups. Additionally, we evaluate our proposed method with large-scale dataset and verify effectiveness. Consequently, our proposed method can grasp the characteristics of malicious campaigns; it can detect 11,292 malicious unique domains not detected by Google Safe Browsing. Moreover, our method achieved high precision in the seven months of experiments.

A ledger can be defined as a “book of permanent record.” With modern information technology, data have become economic resources if they are associated with exclusive owners and put into a ledger. It is shown in Chaps. 3 and 4 that IoT data can be transformed into productive resources while Chaps. 5 and 6 show that transaction data can be turned into money-like bank deposit currencies.

Visual homograph attack is a way that the attackers deceive victims about what domain they are communicating with by exploiting the fact that many characters look alike. The attack is growing into a serious problem and raising broad attention in reality when recently many brand domains have been attacked such as apple.com (Apple Inc.), adobe.com (Adobe Systems Incorporated), lloydsbank.co.uk (Lloyds Bank), etc. Therefore, how to detect visual homograph becomes a hot topic both in industry and research community. Several existing papers and tools have been proposed to find some homographs of a given domain based on different subsets of certain look-alike characters, or based on an analysis on the registered International Domain Name (IDN) database. However, we still lack a scalable and systematic approach that can detect sufficient homographs registered by attackers with a high accuracy and low false positive rate. In this paper, we construct a classification model to detect homographs and potential homographs registered by attackers using machine learning on feasible and novel features which are the visual similarity on each character and some selected information from Whois. The implementation results show that our approach can bring up to 95.90% of accuracy with merely 3.27% of false positive rate. Furthermore, we also make an empirical analysis on the collected homographs and found some interesting statistics along with concrete misbehaviors and purposes of the attackers.

APT (Advanced Persistent Threat) attack is increasing in recent years. APT attackers usually utilize malware called RAT (Remote Access Trojan) to access and control computers by stealth. The invasion method of RAT has been refined and it is extremely difficult to prevent its infection beforehand. Hence, an approach to detect RAT infection at the early stage after infection is important. However, there are two drawbacks in the existing early detection methods of RAT; (1) they do not become early detection in some circumstances; (2) they do not consider the RAT-like healthy software (e.g., system related software and antivirus software) for evaluation experiments. In this paper, we propose a detection method of RAT based on the new mechanism of early detection. Our evaluation experiments show that the proposed method can distinguish between RAT and the RAT-like healthy software with great accuracy.

Availability is very important for long-term use of wireless sensor networks WSNs, assuming the presence of an attacker. It is thus important to achieve secure communication among WSNs even if some sensor nodes are compromised. Self-healing WSNs possess the feature that a network automatically self-heals after node-capture attacks in order to achieve availability. The self-healing means that the ratio of compromised links decreases with time, even if the attacker corrupts sensor nodes of the network. In this paper, three kinds of self-healing schemes for WSNs are described, a polynomial-based self-healing scheme, a simple random key pre-distribution scheme with self-healing, and a proactive co-operative link self-healing scheme. Our contributions are the self-healing schemes with security evaluation, in which we conduct analytical evaluation and a simulation experiment of our schemes, and results obtained from both analysis and simulations indicate that our schemes are effective in self-healing. Furthermore, comparing three schemes, we clarify each difference and discuss optimal scheme under each different environments. © 2015 The Authors. Concurrency and Computation: Practice and Experience Published by John Wiley & Sons Ltd.

Cloud storage has been gaining in popularity as an on-line service for archiving, backup, and even primary storage of files. However, due to the data outsourcing, cloud storage also introduces new security challenges, which require a data audit and data repair service to ensure data availability and data integrity in the cloud. In this paper, we present the design and implementation of a network-coding-based Proof Of Retrievability scheme called ELAR, which achieves a lightweight data auditing and data repairing. In particular, we support direct repair mechanism in which the client can be free from the data repair process. Simultaneously, we also support the task of allowing a third party auditor (TPA), on behalf of the client, to verify the availability and integrity of the data stored in the cloud servers without the need of an asymmetric-key setting. The client is thus also free from the data audit process. TPA uses spot-checking which is a very efficient probabilistic method for checking a large amount of data. Extensive security and performance analysis show that the proposed scheme is highly efficient and provably secure.

Proof Of Retrievability (POR) is a protocol that supports a data owner to check whether the data stored in cloud servers is available, intact and retrievable. Based on the POR, network coding technique has been applied to increase efficiency and throughput in data transmission and data repair. Although many network coding-based PORs have been proposed, most of them have not considered a practical scenario in which not only the data owner can check and can retrieve the data stored in the untrusted servers, but also an untrusted user can check and can retrieve the data stored in the servers without learning the secret keys of the data owner. This scenario occurs commonly in reality. For instance, in a data provision-payment system, the user must pay money to get data stored in the servers. In this paper, we propose a new network coding-based POR, named POR-2P (a network coding-based POR for data Provision-Payment system), to deal with this scenario. Furthermore, the complexity analysis and the performance evaluation show that the POR-2P is very efficient and applicable for a real cloud system.

Security software such as anti-virus software and personal firewall are usually installed in every host within an enterprise network. There are mainly two kinds of security software: signature-based software and anomaly-based software. Anomaly-based software generally has a “threshold” that discriminates between normal traffic and malware communications in network traffic observation. Such a threshold involves the number of packets used for behavior checking by the anomaly-based software. Also, it indicates the number of packets sent from an infected host before the infected host is contained. In this paper, we propose a mathematical model that uses discrete mathematics known as combinatorics, which is suitable for situations in which there are a small number of infected hosts. Our model can estimate the threshold at which the number of infected hosts can be suppressed to a small number. The result from our model fits very well with the result of computer simulation using typical existing scanning malware and a typical network.

In key-recovery methods using smart cards, a user can recover the disk encryption key in cooperation with the system administrator, even if the user has lost the smart card including the disk encryption key. However, the disk encryption key is known to the system administrator in advance in most key-recovery methods. Hence user's disk data may be read by the system administrator. Furthermore, if the disk encryption key is not known to the system administrator in advance, it is difficult to achieve a key authentication. In this paper, we propose a scheme which enables to recover the disk encryption key when the user's smart card is lost. In our scheme, the disk encryption key is not preserved anywhere and then the system administrator cannot know the key before key-recovery phase. Only someone who has a user's smart card and knows the user's password can decrypt that user's disk data. Furthermore, we measured the processing time required for user authentication in an experimental environment using a virtual machine monitor. As a result, we found that this processing time is short enough to be practical.

Recently, cryptographic schemes based on the user's attributes have been proposed. An Attribute-Based Group Signature (ABGS) scheme is a kind of group signature schemes, where a user with a set of attributes can prove anonymously whether she has these attributes or not. An access tree is applied to express the relationships among some attributes. However, previous schemes do not provide the changing an access tree. In this paper, we propose a Dynamic ABGS scheme that enables an access tree to be changed. Our ABGS is efficient in that re-issuing of the attribute certificate previously issued for each user is not necessary. Moreover, calculations depending on the number of attributes are calculated on the domain of a pairing. Therefore, the number of calculations in a pairing does not depend on the number of attributes associated with a signature. Finally, we discuss how our ABGS can be applied to an anonymous survey for collection of attribute statistics.

POR (Proof of Retrievability) is a protocol by which clients can distribute their data to cloud servers and can check if the data stored in the servers is available and intact. Based on the POR, the network coding is applied to improve network throughput. Although many network coding-based PORs have been proposed, most of them have not achieved the following practical features: direct repair and dynamic operations. In this paper, we propose the DD-POR (Dynamic operations and Direct repair in network coding-based POR) to address these shortcomings. When a server is corrupted, the DD-POR can support the direct repair in which the data stored in the corrupted server can be repaired using the data provided directly from the healthy servers. The client is thus free from the burden of data repair. Furthermore, the DD-POR allows the client to efficiently perform dynamic operations, i.e., modification, insertion and deletion.

Secret sharing scheme has been applied commonly in distributed storage for Big Data. It is a method for protecting outsourced data against data leakage and for securing key management systems. The secret is distributed among a group of participants where each participant holds a share of the secret. The secret can be only reconstructed when a sufficient number of shares are reconstituted. Although many secret sharing schemes have been proposed, they are still inefficient in terms of share size, communication cost and storage cost; and also lack robustness in terms of exact-share repair. In this paper, for the first time, we propose a new secret sharing scheme based on Slepian-Wolf coding. Our scheme can achieve an optimal share size utilizing the simple binning idea of the coding. It also enhances the exact-share repair feature whereby the shares remain consistent even if they are corrupted. We show, through experiments, how our scheme can significantly reduce the communication and storage costs while still being able to support direct share repair leveraging lightweight exclusive-OR (XOR) operation for fast computation.

Information is increasing quickly, database owners have tendency to outsource their data to an external service provider called Cloud Computing. Using Cloud, clients can remotely store their data without burden of local data storage and maintenance. However, such service provider is untrusted, therefore there are some challenges in data security: integrity, availability and confidentiality. Since integrity and availability are prerequisite conditions of the existence of a system, we mainly focus on them rather than confidentiality. To ensure integrity and availability, researchers have proposed network coding-based POR (Proof of Retrievability) schemes that enable the servers to demonstrate whether the data is retrievable or not. However, most of network coding-based POR schemes are inefficient in data checking and also cannot prevent a common attack in POR: small corruption attack. In this paper, we propose a new network coding-based POR scheme using dispersal code in order to reduce cost in checking phase and also to prevent small corruption attack.

In this paper, we propose a simple random key pre-distribution (RKP) scheme with self-healing for multiphase wireless sensor networks (WSNs) without even lightweight operations such as a hash function, in which the link compromised by node-capture attack in a WSN automatically self-heals with time. Our scheme can enhance the resiliency of existing RKP schemes by only updating the key pool of a server with time. As a result, processing of each sensor is still the same as in the RKP schemes. More interestingly, round synchronization is not necessary to be implemented in a node. Our contribution is the simple scheme with security evaluation, in which we conduct analytical evaluation and a simulation experiment of our scheme, and results obtained from both analysis and simulations indicate that our scheme is effective in self-healing.

Wireless Sensor Networks WSNs mainly consist of small, battery-operated, limited memory and limited computational power sensor nodes. It is important to achieve secure communication among WSNs even if some nodes are compromised. In this paper, three kinds of self-healing schemes for WSNs are described, a polynomial-based self-healing scheme RPoK, a proactive co-operative self-healing scheme POLISH, and a simple random key pre-distribution scheme with self-healing S-RKP. Comparing three schemes, we clarify each difference and discuss optimal scheme under each different environments.

This paper introduces a new capability of the group signature, called message-dependent opening. It is intended to weaken the higher trust put on an opener, that is, no anonymity against an opener is provided by ordinary group signature. In a group signature system with message-dependent opening (GS-MDO), in addition to the opener, we set up the admitter which is not able to open any user's identity but admits the opener to open signatures by specifying messages whose signatures should be opened. For any signature whose corresponding message is not specified by the admitter, the opener cannot extract the signer's identity from it. In this paper, we present formal definitions and constructions of GS-MDO. Furthermore, we also show that GS-MDO implies identity-based encryption, and thus for designing a GS-MDO scheme, identity-based encryption is crucial. Actually, we propose a generic construction of GS-MDO from identity-based encryption and adaptive NIZK proofs, and its specific instantiation from the Groth-Sahai proof system by constructing a new (k-resilient) identity-based encryption scheme which is compatible to the Groth-Sahai proof.

In INFOCOM 2010, Pietro, Oligeri, Soriente, and Tsudik (POST) proposed an intrusion-resilient system with forward and backward secrecy in mobile Unattended Wireless Sensor Networks (UWSNs), where sensors move according to some mobility model (random jump model and random waypoint model). In the POST scheme, each sensor encrypts its ephemeral key $K$ as a plaintext by using the sink's public key, and sends this cipher text and the encrypted sensed data by $K$. Although the POST scheme recommends the hybrid encryption, it does not follow the conventional hybrid encryption usage, i.e., the POST scheme is not necessarily secure. More concretely, $K$ must be regarded as a plaintext of the underlying public key system, and therefore the POST scheme requires at least one more encryption procedure (i.e, encryptions for both $K$ and the data) compared with the conventional hybrid encryption procedure. In this paper, we scrutinize the original POST intrusion-resilient system. We set deployed information as a seed used for generating a random number (which is applied for public key encryption). This procedure follows the conventional hybrid encryption usage, and random-number-leakage problem does not occur. In conclusion, we improve the POST scheme from the viewpoint of both security and efficiency without spoiling significant benefit points of the original one.

In INFOCOM 2009, Yu, Wei, Ramkumar and Guan have proposed the novel mechanism (called Yu's scheme), in which a forwarder can filter polluted messages before spreading the pollution in the XOR network coding systems. In order to perform such filtering, two or more message authentication codes (MACs) are used for this scheme. However, Yu's scheme has a problem that the number of MACs increases at every coding point, since it cannot operate MACs with the XOR network coding. This means that the MAC of Yu's scheme does not have homomorphic property. In this paper, we propose the first symmetric-key-based scheme not only to filter polluted messages but also to operate MACs with the XOR network coding on a forwarder. The XOR network coding of MACs produces improvement which does not increase the number of MACs at a coding point. Our scheme uses the UHFs-based MAC with a homomorphic property to hold homomorphic MAC, and hence it can aggregate MACs in our XOR network coding systems. We emphasize that a forwarder cannot straightforward filter polluted messages even if our scheme uses the UHFs-based MACs.

As well-known results, timed-release encryption (TRE) and public key encryption scheme with keyword search (PEKS) are very close to identity-based encryption (IBE), respectively. It seems natural that there is a close relationship between TRE and PEKS. However, no explicit bridge has been shown between TRE and PEKS so far. In this paper, we show that TRE can be generically constructed by PEKS with extended functionalities, called secure-channel free PEKS (SCF-PEKS) with adaptive security, and discuss the reason why PEKS and (nonadaptive) SCF-PEKS are not suitable for constructing TRE. In addition to this result, we also show that adaptive SCF-PEKS can be generically constructed by anonymous IBE only. That is, for constructing adaptive SCF-PEKS we do not have to require any additional cryptographic primitive compared to the Abdalla et al. PEKS construction (J. Cryptology 2008), even though adaptive SCF-PEKS requires additional functionalities. This result seems also independently interesting.

Identity-Based Proxy Re-Encryption (IB-PRE) has been proposed by Green and Ateniese (ACNS2007), where the proxy transforms a source ciphertext encrypted by a delegator's identity into a destination ciphertext that can be decrypted using a delegatee's secret key corresponding to the delegatee's identity. By using IB-PRE, we expect that mailing-list systems can be constructed without public key certificates. However, in all previous IB-PRE, information about whether a source ciphertext (encrypted by a mailing-list address) is the source of a destination ciphertext (encrypted by an e-mail address) or not, is revealed from both the source ciphertext and the destination ciphertext. In this paper, for the first time we propose an IB-PRE scheme with source hiding property, where no information about source identity is revealed from the destination ciphertext. Our work is the valuable and important milestone for establishing the secure PRE-based mailing-list system without public key certificates.

In many wireless sensor network applications, the data collection sink (base station) needs to find the aggregated statistics of the network. Readings from sensor nodes are aggregated at intermediate nodes to reduce the communication cost. However, the previous optimally secure in-network aggregation protocols against multiple corrupted nodes require two round-trip communications between each node and the base station, including the result-checking phase whose congestion is O(log n) where n is the total number of sensor nodes. In this paper, we propose an efficient and optimally secure sensor network aggregation protocol against multiple corrupted nodes by a weak adversary. Our protocol achieves one round-trip communication to satisfy optimal security without the result-checking phase, by conducting aggregation along with the verification, based on the idea of TESLA technique. Furthermore, we show that the congestion is constant. This means that our protocol suits large-scale wireless sensor networks.

There are many cryptographic schemes with anonymity, such as group signatures. As one important property, anonymity revocation has been introduced. In such schemes, the fact of whether a signer's rights have been revoked or not is important additional information. For example, if a third party knows that there are many revoked members in a company, then the company's reputation may be damaged in many ways. People may think that there might be many problematic employees (who have bad behavior-s) in this company, there might be many people who have quit, i.e., the labor environment may not be good, and so on. To avoid such harmful rumors, in this paper, we propose an Anonymous Designated Verifier Signature (ADVS) scheme with revocation. In ADVS, a designated verifier can only verify a signature anonymously, and a third party cannot identify whether the rights of the signer have been revoked or not. We show two security-enhanced schemes as applications of our scheme: a biometric-based remote authentication scheme, and an identity management scheme.

Timed-Release Encryption (TRE) (proposed by May in 1993) prevents even a legitimate recipient decrypting a ciphertext before a semitrusted Time Server (TS) sends trapdoor sT assigned with a release time T of the encryptor's choice. Cathalo et al. (ICICS2005) and Chalkias et al. (ESORICS2007) have already considered encrypting a message intended to multiple recipients with the same release time. These schemes are efficient compared with previous TRE schemes with recipient-to-recipient encryption, since the most costly part (especially pairing computation) has only to be computed once, and this element is used commonly. One drawback of these schemes is the ciphertext size and computational complexity, which depend on the number of recipients N. In this paper, for the first time we propose Timed-Release Proxy Re-Encryption (TR-PRE) scheme. As in PRE, a semi-trusted proxy transforms a ciphertext under a particular public key (this can be regarded as a mailing list) into reencrypted ciphertexts under each recipient (who can be regarded as mailing list members). Even if the proxy transformation is applied to a TRE ciphertext, the release time is still effective. An encryptor can transfer N- dependent computation parts to the proxy. This function can be applied to multicast communication with a release time indication. For example, in an on-line examination, an examiner sends encrypted e-mails to each examinee, and each examination can be fairly opened at the same time. Our TR-PRE scheme is provably secure under both chosen-time period chosen-ciphertext attack (IND-CTCA) and replayable chosen-ciphertext attack (IND-RCCA) without random oracles.

Virtual machine monitors (VMMs), including hypervisors, are a popular platform for implementing various security functionalities. However, traditional VMMs require numerous components for providing virtual hardware devices and for sharing and protecting system resources among virtual machines (VMs), enlarging the code size of and reducing the reliability of the VMMs.This paper introduces a hypervisor architecture, called parapass-through, designed to minimize the code size of hypervisors by allowing most of the I/O access from the guest operating system (OS) to pass-through the hypervisor, while the minimum access necessary to implement security functionalities is completely mediated by the hypervisor. This architecture uses device drivers of the guest OS to handle devices, thereby reducing the size of components in the hypervisor to provide virtual devices. This architecture also allows to run only single VM on it, eliminating the components for sharing and protecting system resources among VMs.We implemented a hypervisor called BitVisor and a parapass-through driver for enforcing storage encryption of ATA devices based on the parapass-through architecture. The experimental result reveals that the hypervisor and ATA driver require approximately 20 kilo lines of code (KLOC) and 1.4 KLOC respectively.

Virtual Machine Monitors (VMMs), also called hypervisors, can be used to construct a trusted computing base (TCB) enhancing the security of existing operating systems. The complexity of a VMM-based TCB causes the high risk of security vulnerabilities. Therefore, this paper proposes a two-step execution mechanism to reduce the complexity of a VMM-based TCB. We propose a method to separate a conventional VMM-based TCB into the following two parts: (1) A thin hypervisor with security services and (2) A special guest OS for security preprocessing. A special guest OS performing security tasks can be executed in advance. After shutting down the special guest OS, a hypervisor obtains preprocessing security data and next boots a target guest OS to be protected. Thus, the proposed two-step execution mechanism can reduce run-time codes of a hypervisor. This paper shows a design, a prototype implementation and measurement results of lines of code using BitVisor, a VMM-based TCB we have developed.

In a k-Times Anonymous Authentication (k-TAA) scheme, Application Providers (APs) authenticates each group member in k times. A user can preserve his/her own privacy and an AP can restrict the number of used services to just k-times, since users are identified if they access an AP more than k times. In all previous schemes, each AP assumes the same k for all users. Added to this, total anonymity of unlinkability requires large computation amount such as pairing computations compared with non-anonymous schemes. In this paper, we propose a selectable k-TAA scheme with relaxed anonymity. Relaxed anonymity is an intermediate level of privacy required between total anonymity and linkability, where authentication executions for the same AP are linkable, but an authentication execution with an AP v 0 and an authentication execution with an AP v 1 (v 0 ? v 1) are unlinkable. Our authentication algorithm is efficient than existing ones thanks to this relaxed notion.

In recent years, as the data processed by governmental or commercial organizations increases, cases involving information leak have risen. It is difficult to control information on many distributed end-point computers using conventional security mechanisms. Therefore, we have been proposed a novel secure VMM (Virtual Machine Monitor) architecture which is used as a foundation of security policy enforcement on distributed computers. This paper especially introduces Role-based Access Control (RBAC) to the ID management framework in a secure VMM system. Our proposal will reduce costs for distributed policies updates. Proposed RBAC mechanism employs attribute certificates (ACs) to handle userpsilas roles. This paper shows design and prototype implementation based on PKI-based ID card and proven open source VMM software, QEMU.

Information leakage has recently become a serious problem. Because a user's disk might contain a lot of confidential information, it should be encrypted and the encryption key protected securely. Disk security has been improved by storing the encryption key in a hardware token such as a smart card or USB device. There must be some way to recover the encryption key when the token is lost, but to prevent information leakage the encryption key should not be known by the system administrator and should not be able to be recovered by malicious users inside the system. Here we describe a scheme that can limit key recovery when the user's smart card is lost and can do so without the administrator knowing the key. The smart card is used for generating the key and for improving the user authentication.

One of the worst threats present in an enterprise network is the propagation of “scanning malware” (e.g., scanning worms and bots). It is important to prevent such scanning malware from spreading within an enterprise network. It is especially important to suppress scanning malware infection to less than a few infected hosts. We estimated the timing of containment software to block “scanning malware” in a homogeneous enterprise network. The “combinatorics proliferation model”, based on discrete mathematics, developed in this study derives a threshold that gives the number of the packets sent by a victim that must not be exceeded in order to suppress the number of infected hosts to less than a few. This model can appropriately express the early state under which an infection started. The result from our model fits very well to the result of computer simulation using a typical existing scanning malware and an actual network.

In this paper, a new type of user identification system based on characteristics (biometrics) for keystroke is proposed. In this system, we do not require any special devices. We utilize two basic parameters: Press-Time, when a user presses a key, Release-Time, when a uses releases the key. Release-Time is a new parameter. By using Release-Time, a user can be identified much more clearly than using only Press-Time. Furthermore, even if a password is stolen, the attacker can hardly find how the owner types because of user’s biometrics for keystroke. Hence this system can overcome the weak point of password checking schemes.

This paper investigates methods that allow a third-party authority to control contents transmitted using a public key infrastructure. Since public key encryption schemes are normally designed not to leak even partial information of plaintext, traditional public key encryption schemes do not allow such controlling by an authority. In the proposed schemes, an authority specifies some set of forbidden messages, and anyone can detect a ciphertext that encrypts one of the forbidden messages. The syntax of public key encryption with such a functionality (restrictive public key encryption), formal definitions of security requirement for restrictive public key encryption schemes, and an efficient construction of restrictive public key encryption are given. In principle, restrictive public key encryption schemes can be constructed by adding an NIZK proof that proves whether the encrypted messages are not prohibited. However if one uses the general NIZK technique to construct such a noninteractive proof, the scheme becomes extremely inefficient. In order to avoid such an inefficient construction, the construction given in this paper uses techniques of Teranishi et al., Boudot, and Nakanishi et al. One of the possible applications of restrictive public key encryption is protecting a public key infrastructure from abuse by terrorists by disallowing encryption of crime-related keywords. Another example is to perform format-check of a ballot in an electronic voting, by disallowing encryption of irregular format voting.