Journal of Information Security and Applications最新文献

Hierarchical Threshold Multi-Key Fully Homomorphic Encryption

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-12-03 DOI: 10.1016/j.jisa.2024.103919

Xiaohan Wan , Hao Lin , Mingqiang Wang , Wenting Shen

{"title":"Hierarchical Threshold Multi-Key Fully Homomorphic Encryption","authors":"Xiaohan Wan , Hao Lin , Mingqiang Wang , Wenting Shen","doi":"10.1016/j.jisa.2024.103919","DOIUrl":"10.1016/j.jisa.2024.103919","url":null,"abstract":"<div><div>Fully Homomorphic Encryption (FHE) supports computation on encrypted data without the need for decryption, thereby enabling secure outsourcing of computing to an untrusted cloud. Subsequently, motivated by application scenarios where private information is offered by different data owners, Multi-Key Fully Homomorphic Encryption (MKFHE) and Threshold Fully Homomorphic Encryption (ThFHE) were successively introduced. However, both MKFHE and ThFHE have some limitations: MKFHE requires the participation of all members during the decryption process and does not support decryption using a subset of members, while ThFHE requires pre-fixed participants and does not support dynamic joining or exiting.</div><div>To address these limitations, in this paper, we propose a new notion called Hierarchical Threshold Multi-key Fully Homomorphic Encryption (HTM-FHE), which combines the features of MKFHE and ThFHE, incorporating the advantages of both. Then we provide the first construction of HTM-FHE based on lattice, denoted as <span><math><mrow><mi>HTM</mi><mtext>-</mtext><mi>TFHE</mi></mrow></math></span>. Our scheme can evaluate a binary gate on ciphertexts encrypted under different groups’ public keys followed by a bootstrapping procedure. The semantic and simulation security of <span><math><mrow><mi>HTM</mi><mtext>-</mtext><mi>TFHE</mi></mrow></math></span> is proven under the LWE assumption. Furthermore, <span><math><mrow><mi>HTM</mi><mtext>-</mtext><mi>TFHE</mi></mrow></math></span> supports fine-grained access control for encrypted data, which provides benefits in practical applications.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"89 ","pages":"Article 103919"},"PeriodicalIF":3.8,"publicationDate":"2024-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142759297","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Color image encryption algorithm based on hybrid chaos and layered strategies

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-12-02 DOI: 10.1016/j.jisa.2024.103921

YongHui Huang, QiLin Zhang, YongBiao Zhao

{"title":"Color image encryption algorithm based on hybrid chaos and layered strategies","authors":"YongHui Huang, QiLin Zhang, YongBiao Zhao","doi":"10.1016/j.jisa.2024.103921","DOIUrl":"10.1016/j.jisa.2024.103921","url":null,"abstract":"<div><div>As the need for information security grows, chaotic system-based digital image encryption algorithms have gained considerable interest in recent years. However, many existing algorithms rely solely on a single chaotic mapping for pixel or bit-plane encryption. While these methods provide a certain level of security, there is still room for improvement, particularly in enhancing encryption depth. This paper proposes a color image encryption algorithm based on hybrid chaos and layered strategies to address this issue. First, We confirm the strong chaotic behavior of the newly introduced Chebyshev–Tent (CT) mapping through a detailed analysis of its chaotic properties, including the Lyapunov exponent, bifurcation diagram, NIST SP 800-22 test, sample entropy analysis, 0–1 test analysis, and sensitivity to initial conditions. The chaotic sequences generated by CT and Sine-Tent-Cosine (STC) mapping are then jointly incorporated into the scrambling and diffusion processes. Furthermore, to enhance the randomness of the scrambling process, we present a chaotic Fisher–Yates scrambling algorithm based on chaotic sequences to scramble different layers of the image. This layered encryption approach, which combines the advantages of multiple chaotic mappings, not only improves encryption depth but also increases complexity across different image dimensions. The experimental results and security assessments demonstrate the robustness and reliability of the proposed algorithm.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"89 ","pages":"Article 103921"},"PeriodicalIF":3.8,"publicationDate":"2024-12-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142759390","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Efficient and verifiable keyword search over public-key ciphertexts based on blockchain

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-12-02 DOI: 10.1016/j.jisa.2024.103924

Min Han, Peng Xu

{"title":"Efficient and verifiable keyword search over public-key ciphertexts based on blockchain","authors":"Min Han, Peng Xu","doi":"10.1016/j.jisa.2024.103924","DOIUrl":"10.1016/j.jisa.2024.103924","url":null,"abstract":"<div><div>Public-key encryption with keyword search (PEKS) is a powerful cryptographic primitive that enables a receiver to search keywords over ciphertexts hosted on an honest-but-curious server in the asymmetric-key setting while hiding the keywords from the server. Many researchers have devoted their efforts to achieving expressive search, security against keyword guessing attacks, and efficient search performance. However, until now, no effective PEKS scheme can achieve verifiable search completeness in the standard PEKS security model. In practice, the server may intentionally or unintentionally lose the receivers’ data. Hence, verifiable search completeness is essential for receivers to audit the service quality of the server. To address this problem, this work develops a blockchain-based PEKS framework. This framework only utilizes the distributed ledger role of the blockchain, making it general. Additionally, we find that existing PEKS schemes cannot be efficiently deployed into the framework due to the inefficient use of randomness, which increases the ciphertext sizes. To tackle this problem, we utilize randomness reuse technique to propose a novel PEKS scheme. The proposed scheme achieves linear search complexity with respect to the total number of files in the dataset. To demonstrate the efficiency of our scheme, we perform comprehensive experiments to evaluate it and three other state-of-the-art schemes. The experimental results show that our PEKS scheme is superior to existing PEKS schemes in both the encryption and search phases and significantly reduces the sizes of generated ciphertexts.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"89 ","pages":"Article 103924"},"PeriodicalIF":3.8,"publicationDate":"2024-12-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142759391","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Deepfakes in digital media forensics: Generation, AI-based detection and challenges

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-12-01 DOI: 10.1016/j.jisa.2024.103935

Gueltoum Bendiab , Houda Haiouni , Isidoros Moulas , Stavros Shiaeles

{"title":"Deepfakes in digital media forensics: Generation, AI-based detection and challenges","authors":"Gueltoum Bendiab , Houda Haiouni , Isidoros Moulas , Stavros Shiaeles","doi":"10.1016/j.jisa.2024.103935","DOIUrl":"10.1016/j.jisa.2024.103935","url":null,"abstract":"<div><div>Deepfake technology presents significant challenges for digital media forensics. As deepfakes become increasingly sophisticated, the ability to detect and attribute manipulated media becomes more difficult. The main challenge lies in the realistic and convincing nature of deepfakes, which can deceive human perception and traditional forensic techniques. Furthermore, the widespread availability of open-source deepfake tools and increasing computational power contribute to the ease with which malicious actors can create and disseminate deepfakes. The challenges posed by deepfakes for digital media forensics are multifaceted. Therefore, the development of sophisticated detection algorithms, the creation of comprehensive datasets, and the establishment of legal frameworks are crucial in addressing these challenges. This paper provides a comprehensive analysis of current methods for deepfake generation and the issues surrounding their detection. It also explores the potential of modern AI-based detection techniques in combating the proliferation of deepfakes. This analysis aims to contribute to advancing deepfake detection by highlighting the limits of current detection techniques, the most relevant issues, the upcoming challenges, and suggesting future directions for research.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"88 ","pages":"Article 103935"},"PeriodicalIF":3.8,"publicationDate":"2024-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142757586","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Enhancing vulnerability detection efficiency: An exploration of light-weight LLMs with hybrid code features

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-11-30 DOI: 10.1016/j.jisa.2024.103925

Jianing Liu , Guanjun Lin , Huan Mei , Fan Yang , Yonghang Tai

{"title":"Enhancing vulnerability detection efficiency: An exploration of light-weight LLMs with hybrid code features","authors":"Jianing Liu , Guanjun Lin , Huan Mei , Fan Yang , Yonghang Tai","doi":"10.1016/j.jisa.2024.103925","DOIUrl":"10.1016/j.jisa.2024.103925","url":null,"abstract":"<div><div>Vulnerability detection is a critical research topic. However, the performance of existing neural network-based approaches requires further improvement. The emergence of large language models (LLMs) has demonstrated their superior performance in natural language processing (NLP) compared to conventional neural architectures, motivating researchers to apply LLMs for vulnerability detection. This paper focuses on evaluating the performance of various Transformer-based LLMs for source-code-level vulnerability detection. We propose a framework named VulACLLM (AST & CFG-based LLMs Vulnerability Detection), which leverages combined feature sets derived from abstract Syntax Tree (AST) and Control Flow Graph (CFG). The recall rate of VulACLLM in the field of vulnerability detection reached 0.73, while the F1-score achieved 0.725. Experimental results show that the proposed feature sets significantly enhance detection performance. To further improve the efficiency of LLM-based detection, we examine the performance of LLMs compressed using two techniques: Knowledge Distillation (KD) and Low-Rank Adaptation (LoRA). To assess the performance of these compressed models, we introduce efficiency metrics that quantify both performance loss and efficiency gains achieved through compression. Our findings reveal that, compared to KD, LLMs compressed with LoRA achieve higher recall, achieving a maximum recall rate of 0.82, while substantially reducing training time, taking only 20 min to complete one epoch, and disk size, requiring only 4.89 MB of memory. The experimental results demonstrate that LoRA compression effectively mitigates deployment challenges associated with large model sizes and high video memory consumption, enabling the deployment of LoRA-compressed LLMs on consumer-level GPUs without compromising vulnerability detection performance.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"88 ","pages":"Article 103925"},"PeriodicalIF":3.8,"publicationDate":"2024-11-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142757585","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Multi-ciphertext equality test heterogeneous signcryption scheme based on location privacy 基于位置隐私的多密文平等测试异构签名加密方案

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-11-27 DOI: 10.1016/j.jisa.2024.103918

Shufen Niu , Qi Liu , Wei Liu , Runyuan Dong , Peng Ge

{"title":"Multi-ciphertext equality test heterogeneous signcryption scheme based on location privacy","authors":"Shufen Niu , Qi Liu , Wei Liu , Runyuan Dong , Peng Ge","doi":"10.1016/j.jisa.2024.103918","DOIUrl":"10.1016/j.jisa.2024.103918","url":null,"abstract":"<div><div>The scale of network communication users is increasing daily, and massive user information are interacted with and stored in the network. The exchange of information between entities in different communication environments will not only promote the dynamic development of culture and economy, but also bring the risk of data redundancy and privacy leakage, which will have many negative effects. With the development of digitalization of privacy information on the Internet, incidents of privacy data leakage continue to occur. Interacting with network data not only provides each communication user with a shared space for personal information but also poses a great risk of exposing user privacy data. To solve the above problems, our work proposes a heterogeneous signcryption scheme for multi-party and multi-ciphertext equality test. In the scheme, the communication users in the Identity-Based Cryptosystem (IBC) and the Certificateless Cryptosystem (CLC) can communicate securely in many ways; Different cryptographic systems use different system parameters. In addition, our scheme has the advantage of high communication efficiency compared with the equality test of a single ciphertext. The signcryption system based on IBC and CLC is adopted, which eliminates the problem of certificate management in the traditional public key cryptosystem and ensures the confidentiality and authentication of data. The introduction of multi-ciphertext equality test can enable secure retrieval of multiple ciphertexts by multiple data users at the same time and improve the efficiency of ciphertext retrieval in multi-user environments. Under the random oracle model, the proposed scheme has proved to satisfy unforgeability, confidentiality under the computational Diffie–Hellman problem. Experimental results indicate that our proposal achieves better performance.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"88 ","pages":"Article 103918"},"PeriodicalIF":3.8,"publicationDate":"2024-11-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142723272","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A novel blockchain-based anonymous roaming authentication scheme for VANET 基于区块链的新型 VANET 匿名漫游认证方案

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-11-26 DOI: 10.1016/j.jisa.2024.103922

Xingxing Chen , Qingfeng Cheng , Weidong Yang , Xiangyang Luo

{"title":"A novel blockchain-based anonymous roaming authentication scheme for VANET","authors":"Xingxing Chen , Qingfeng Cheng , Weidong Yang , Xiangyang Luo","doi":"10.1016/j.jisa.2024.103922","DOIUrl":"10.1016/j.jisa.2024.103922","url":null,"abstract":"<div><div>With the widespread application of vehicular ad-hoc networks, ensuring secure and seamless cross-regional roaming for mobile users and obtaining corresponding services has become a focal point. However, designing an efficient and secure roaming authentication protocol is challenging due to the confidentiality and privacy issues that data transmission during the roaming authentication process may cause and the limited computational capabilities of mobile devices. Researchers have proposed many security-oriented schemes to address this thorny challenge. However, many state-of-the-art schemes need help meeting various security requirements and facing privacy leakage and single points of failure. Recently, Xue et al. proposed a distributed authentication scheme for roaming services in mobile vehicular networks based on smart contracts. Regrettably, it is noted that their scheme is vulnerable to ephemeral key leakage attacks. Further, we present a blockchain-based anonymous roaming authentication scheme called BARA, which changes how session keys are generated and significantly reduces on-chain storage costs using probabilistic data structure techniques. We utilize Scyther and Burrows–Abadi–Needham (BAN) logic to prove the security of BARA and compare it with similar protocols in terms of computation, communication, and revocation check. The analysis results demonstrate that BARA achieves a good balance between security performance and execution efficiency.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"88 ","pages":"Article 103922"},"PeriodicalIF":3.8,"publicationDate":"2024-11-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142703293","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Efficient quantum algorithms to break group ring cryptosystems 破解群环密码系统的高效量子算法

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-11-26 DOI: 10.1016/j.jisa.2024.103923

Ann Dooms , Carlo Emerencia

引用次数: 0

Towards an intelligent and automatic irrigation system based on internet of things with authentication feature in VANET 在 VANET 中开发基于物联网并具有认证功能的智能自动灌溉系统

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-11-26 DOI: 10.1016/j.jisa.2024.103927

Huijing Zhang, Minbo Li

{"title":"Towards an intelligent and automatic irrigation system based on internet of things with authentication feature in VANET","authors":"Huijing Zhang, Minbo Li","doi":"10.1016/j.jisa.2024.103927","DOIUrl":"10.1016/j.jisa.2024.103927","url":null,"abstract":"<div><div>Agriculture is essential for global livelihoods and economic stability, making efficient water management crucial. The Internet of Things (IoT) has revolutionized smart farming, offering advanced solutions such as precision irrigation systems. This paper presents an intelligent and automatic irrigation system that integrates IoT with vehicular ad-hoc networks (VANETs), with a particular focus on authentication and key agreement features. The system employs an energy-aware fuzzy routing algorithm and a neural network to optimize irrigation strategies based on real-time sensor data, including temperature and soil moisture. Key agreement mechanisms within the VANET framework ensure secure and authenticated communication between devices, safeguarding the integrity and confidentiality of irrigation data and control commands. This integration allows users to manage and monitor the irrigation system through mobile devices such as smartphones and computers, providing real-time insights and control. The proposed system is designed to be cost-effective, portable, and adaptable to various agricultural environments, including farms and greenhouses. Simulation results demonstrate that our system not only enhances network lifetime and power efficiency but also offers superior security and key management compared to existing protocols like WSN-IoT and LEACH. This approach addresses critical challenges in both secure communication and efficient water management, presenting a significant advancement in smart irrigation technologies.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"88 ","pages":"Article 103927"},"PeriodicalIF":3.8,"publicationDate":"2024-11-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142703292","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

IDPriU: A two-party ID-private data union protocol for privacy-preserving machine learning IDPriU：用于保护隐私的机器学习的双方 ID 私有数据联盟协议

IF 3.8 2区计算机科学

Journal of Information Security and Applications Pub Date : 2024-11-25 DOI: 10.1016/j.jisa.2024.103913

Jianping Yan , Lifei Wei , Xiansong Qian , Lei Zhang

{"title":"IDPriU: A two-party ID-private data union protocol for privacy-preserving machine learning","authors":"Jianping Yan , Lifei Wei , Xiansong Qian , Lei Zhang","doi":"10.1016/j.jisa.2024.103913","DOIUrl":"10.1016/j.jisa.2024.103913","url":null,"abstract":"<div><div>Due to significant data security concerns in machine learning, such as the data silo problem, there has been a growing trend towards the development of privacy-preserving machine learning applications. The initial step in training data across silos involves establishing secure data joins, specifically private data joins, to ensure the consistency and accuracy of the dataset. While the majority of current research focuses on the inner join of private data, this paper specifically addresses the privacy-preserving full join of private data and develops two-party unbalanced private data full join protocols utilizing secure multi-party computation tools. Notably, our paper introduces the novel component of Private Match-and-Connect (PMC), which performs a union operation on the ID and feature values, and ensure the secret sharing of the resulting union set. Each participant receives only a portion of the secret share, thereby guaranteeing data security during the pre-processing phase. Furthermore, we propose the two-party ID-private data union protocol (IDPriU), which facilitates secure and accurate matching of feature value shares and ID shares and also enables the data alignment. Our protocol represents a significant advancement in the field of privacy-preserving data preprocessing in machine learning and privacy-preserving federated queries. It extends the concept that private data joins are limited to inner connections, offering a novel approach by Private Set Union (PSU). We have experimentally implemented our protocol and obtained favorable results in terms of both runtime and communication overhead.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"88 ","pages":"Article 103913"},"PeriodicalIF":3.8,"publicationDate":"2024-11-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142703291","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0