Search

In Location-Based Social Networks (LBSNs), registered users submit their reviews for visited point-of-interests (POIs) to the system providers (SPs). The SPs anonymously publish submitted reviews to build reputations for POIs. Unfortunately, the user profile and trajectory contained in reviews can be easily obtained by adversaries who SPs has compromised with. Even worse, existing techniques, such as cryptography and generalization, etc., are infeasible due to the necessity of public publication of reviews and the facticity of reviews. Inspired by pseudonym techniques, we propose an approach to exchanging reviews before users submit reviews to SPs. In our approach, we introduce two attacks, namely review-based location correlation attack (RLCA) and semantic-based long-term statistical attack (SLSA). RLCA can be exploited to link the real user by reconstructing the trajectory, and SLSA can be launched to establish a connection between locations and users through the difference of semantic frequency. To resist RLCA, we design a method named User Selection to Resist RLCA (USR-RLCA) to exchange reviews. We propose a metric to measure the correlation between a user and a trajectory. Based on the metric, USR-RLCA can select reviews resisting RLCA to exchange by suppressing the number of locations on each reconstructed trajectory below the correlation. However, USR-RLCA fails to resist SLSA because of ignoring the essential semantics. Hence, we design an enhanced USR-RLCA named User Selection to Resist SLSA (USR-SLSA). We first propose a metric to measure the indistinguishability of locations concerning the difference of semantic frequency in a long term. Then, USR-SLSA can select reviews resisting SLSA to exchange by allowing two reviews whose indistinguishability is below the probability difference after the exchange to be exchanged. Evaluation results verify the effectiveness of our approach in terms of privacy and utility., Competing Interests: No.

With the emergence and widespread application of cloud computing, the use of cloud platforms to solve the problem of secure multi-party computation has emerged as a new research direction. The traditional computation of a solid geometry is performed through mutual interactions between two parties, which is not suitable in an untrusted cloud computing environment. In this paper, we first design a basic protocol for a secure Euclidean distance calculation that is suitable for cloud platforms and can serve as a building block for other protocols on cloud platforms. Using the solution of the Euclidean distance problem as such a building block, we provide a new method that converts the problems of calculating solid triangular areas and solid tetrahedral volumes into the calculation of distances and determinants in three-dimensional space. Then, we discuss solid point-line distance calculations, which extent the idea of the spatial geometry security problem. We present protocols for the above problems and prove that the proposed protocols can resist conspiracy among users and the untrusted cloud platform so that they can effectively ensure the privacy of the users. We also analyze the performances of these solutions. The analysis results show that our scheme is more versatile., Competing Interests: The authors have declared that no competing interests exist.

Applications of wireless body area networks (WBANs) are extended from remote health care to military, sports, disaster relief, etc. With the network scale expanding, nodes increasing, and links complicated, a WBAN evolves to a body-to-body network. Along with the development, energy saving and data security problems are highlighted. In this paper, chaotic compressive sensing (CCS) is proposed to solve these two crucial problems, simultaneously. Compared with the traditional compressive sensing, CCS can save vast storage space by only storing the matrix generation parameters. Additionally, the sensitivity of chaos can improve the security of data transmission. Aimed at image transmission, modified CCS is proposed, which uses two encryption mechanisms, confusion and mask, and performs a much better encryption quality. Simulation is conducted to verify the feasibility and effectiveness of the proposed methods. The results show that the energy efficiency and security are strongly improved, while the storage space is saved. And the secret key is extremely sensitive, [Formula: see text] perturbation of the secret key could lead to a total different decoding, the relative error is larger than 100%. Particularly for image encryption, the performance of the modified method is excellent. The adjacent pixel correlation is smaller than 0.04 in different directions including horizontal, vertical, and diagonal; the entropy of the cipher image with a 256-level gray value is larger than 7.98.

In a general (k, n) scalable secret image sharing (SSIS) scheme, the secret image is shared by n participants and any k or more than k participants have the ability to reconstruct it. The scalability means that the amount of information in the reconstructed image scales in proportion to the number of the participants. In most existing SSIS schemes, the size of each image shadow is relatively large and the dealer does not has a flexible control strategy to adjust it to meet the demand of differen applications. Besides, almost all existing SSIS schemes are not applicable under noise circumstances. To address these deficiencies, in this paper we present a novel SSIS scheme based on a brand-new technique, called compressed sensing, which has been widely used in many fields such as image processing, wireless communication and medical imaging. Our scheme has the property of flexibility, which means that the dealer can achieve a compromise between the size of each shadow and the quality of the reconstructed image. In addition, our scheme has many other advantages, including smooth scalability, noise-resilient capability, and high security. The experimental results and the comparison with similar works demonstrate the feasibility and superiority of our scheme., Competing Interests: The authors have declared that no competing interests exist.

User anonymity is one of the key security features of an authenticated key agreement especially for communicating messages via an insecure network. Owing to the better properties and higher performance of chaotic theory, the chaotic maps have been introduced into the security schemes, and hence numerous key agreement schemes have been put forward under chaotic-maps. Recently, Xie et al. released an enhanced scheme under Farash et al.'s scheme and claimed their improvements could withstand the security loopholes pointed out in the scheme of Farash et al., i.e., resistance to the off-line password guessing and user impersonation attacks. Nevertheless, through our careful analysis, the improvements were released by Xie et al. still could not solve the problems troubled in Farash et al‥ Besides, Xie et al.'s improvements failed to achieve the user anonymity and the session key security. With the purpose of eliminating the security risks of the scheme of Xie et al., we design an anonymous password-based three-party authenticated key agreement under chaotic maps. Both the formal analysis and the formal security verification using AVISPA are presented. Also, BAN logic is used to show the correctness of the enhancements. Furthermore, we also demonstrate that the design thwarts most of the common attacks. We also make a comparison between the recent chaotic-maps based schemes and our enhancements in terms of performance.

The Telecare Medicine Information Systems (TMISs) provide an efficient communicating platform supporting the patients access health-care delivery services via internet or mobile networks. Authentication becomes an essential need when a remote patient logins into the telecare server. Recently, many extended chaotic maps based authentication schemes using smart cards for TMISs have been proposed. Li et al. proposed a secure smart cards based authentication scheme for TMISs using extended chaotic maps based on Lee's and Jiang et al.'s scheme. In this study, we show that Li et al.'s scheme has still some weaknesses such as violation the session key security, vulnerability to user impersonation attack and lack of local verification. To conquer these flaws, we propose a chaotic maps and smart cards based password authentication scheme by applying biometrics technique and hash function operations. Through the informal and formal security analyses, we demonstrate that our scheme is resilient possible known attacks including the attacks found in Li et al.'s scheme. As compared with the previous authentication schemes, the proposed scheme is more secure and efficient and hence more practical for telemedical environments.

The telecare medical information systems (TMISs) enable patients to conveniently enjoy telecare services at home. The protection of patient's privacy is a key issue due to the openness of communication environment. Authentication as a typical approach is adopted to guarantee confidential and authorized interaction between the patient and remote server. In order to achieve the goals, numerous remote authentication schemes based on cryptography have been presented. Recently, Arshad et al. (J Med Syst 38(12): 2014) presented a secure and efficient three-factor authenticated key exchange scheme to remedy the weaknesses of Tan et al.'s scheme (J Med Syst 38(3): 2014). In this paper, we found that once a successful off-line password attack that results in an adversary could impersonate any user of the system in Arshad et al.'s scheme. In order to thwart these security attacks, an enhanced biometric and smart card based remote authentication scheme for TMISs is proposed. In addition, the BAN logic is applied to demonstrate the completeness of the enhanced scheme. Security and performance analyses show that our enhanced scheme satisfies more security properties and less computational cost compared with previously proposed schemes.

Machine learning plays an important role in constructing intrusion detection models. However, the information era is an era of data. With the continuous increase in data size and the growth of data dimensions, the ability of a single classifier is becoming limited in predicting samples. In this paper, we present an ensemble method using random subspace in which an extreme learning machine (ELM) is chosen as the base classifier. To optimize the ensemble model, an ensemble pruning method based on the bat algorithm (BA) is proposed. Meanwhile, a fitness function based on the accuracy and diversity of an ensemble is defined in the BA to obtain an improved classifier subset. Three public datasets, the KDD99, NSL and Kyoto datasets, are adopted to assess the robustness of the method. The empirical results indicate that the ensemble method based on random subspace can improve the accuracy and robustness over the use of an individual ELM. The results also show that compared with when all the sub-classifiers are used in the ensemble, the pruning framework can not only achieve comparable or better performance but also save substantial computing resources in an intrusion detection system (IDS). [ABSTRACT FROM AUTHOR]

With the purpose of ensuring secure communication through wireless environments, authenticated key agreement protocols with user anonymity are widely investigated. Inspired by the semi-group property of Chebyshev maps and multiple servers in the network environment, Tsai et al. proposed a novel chaotic maps-based anonymous authenticated key agreement protocol based on multiserver architecture. Unfortunately, we observe that the Tsai et al. protocol falls to key-compromise impersonation attack, which opens the door for an attacker to launch an offline password-guessing attack. Moreover, the Tsai et al. protocol also unfortunately violates the session key security. Elaborating on the security of chaotic maps-based authenticated key agreement, we present an enhanced protocol employing biometrics that attempts to repair the security pitfalls found in Tsai et al. Security analysis shows that the enhanced protocol satisfies more security attributes while retaining the merits of the original protocol. We also present a formal proof of the enhanced protocol with the Burrows-Abadi-Needham logic. The performance of our protocol is evaluated with its predecessor protocols, and the comparative results show that it outperforms the predecessor protocols in terms of better trade-off between desirable security attributes and computational overhead. Copyright © 2016 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

With the greatest advancement of information technology, mobile communication has become more widespread and prevalent. When a mobile user intends to enjoy the services offered by a remote server, he needs to be authenticated before constructing a session key with the corresponding server. Numerous authentication schemes have been provided with the purpose of validating the legitimacy of a mobile user. Recently, Xie et al. presented a modified two-factor authenticated key exchange to eliminate the security flaws of Chen et al. Xie et al. claimed that the enhanced design was more secure than the design of Chen et al. Unfortunately, we identified that the proposed scheme by Xie et al. was insecure against user impersonation, insider and trace attacks and did fail to provide verification in login phase. To enhance the security and efficiency, we then proposed an anonymous authenticated key exchange scheme for mobile client-server environment. We demonstrated that the proposed scheme was immune to many attacks including attacks observed in the scheme of Xie et al. We also use a formal proof, namely Burrows-Abadi-Needham logic, to analyze the proposed scheme. In addition, the proposed scheme possesses a lower computation overheads than the other related schemes. Copyright © 2016 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

Biometrics authenticated schemes using smart cards have attracted much attention in multi-server environments. Several schemes of this type where proposed in the past. However, many of them were found to have some design flaws. This paper concentrates on the security weaknesses of the three-factor authentication scheme by Mishra et al. After careful analysis, we find their scheme does not really resist replay attack while failing to provide an efficient password change phase. We further propose an improvement of Mishra et al.’s scheme with the purpose of preventing the security threats of their scheme. We demonstrate the proposed scheme is given to strong authentication against several attacks including attacks shown in the original scheme. In addition, we compare the performance and functionality with other multi-server authenticated key schemes. [ABSTRACT FROM AUTHOR]

There is an increasing demand of an anonymous authentication to secure communications between numerous different network members while preserving privacy for the members. In this study, we address this issue by using an ID based authenticated and key agreement protocol to improve the recent protocol proposed by Xue et al. They claimed that their protocol could resist masquerade and insider attacks. Unfortunately, we find that Xue et al.’s protocol is not only really insecure against masquerade and insider attacks but also vulnerable to off-line password guessing attack. Therefore, a slight modification to their protocol is proposed to improve their shortcomings. Moreover, our protocol does not use timestamps, so it is not required to synchronize the time. As a result, according to our performance and security analyses, we can prove that our proposed protocol can enhance efficiency and improve security in comparison to previous protocols. [ABSTRACT FROM AUTHOR]

ABSTRACT We propose a new public-key cryptosystem named conjugacy search problem-based Diffie-Hellman integrated encryption scheme (CSP-DHIES), by using conjugation-related assumptions for a special monoid of matrices of truncated multi-variable polynomials over the ring ℤ12 where the CSP is assumed to be intractable. Our construction can be viewed as the first noncommunicative variant of the well-known DHIES cryptosystem. Under the assumptions of the intractability of the CSP-based hash Diffie-Hellman problem and the CSP-based oracle Diffie-Hellman problem, our scheme is provably secure against both chosen-plaintext attacks and secure against chosen-ciphertext attacks. Our proofs are constructed in the standard model. We also discuss the possibility of implementing our proposal using braid groups. Copyright © 2011 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]