首页 > 最新文献

Information Security Journal: A Global Perspective最新文献

英文 中文
“The pull to do nothing would be strong”: limitations & opportunities in reporting insider threats "什么都不做的动力会很强":报告内部威胁的局限性与机遇
Pub Date : 2024-08-10 DOI: 10.1080/19393555.2024.2387347
Heather Holden, Victor Munro, Lina Tsakiris, Alex Wilner
{"title":"“The pull to do nothing would be strong”: limitations & opportunities in reporting insider threats","authors":"Heather Holden, Victor Munro, Lina Tsakiris, Alex Wilner","doi":"10.1080/19393555.2024.2387347","DOIUrl":"https://doi.org/10.1080/19393555.2024.2387347","url":null,"abstract":"","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"17 9","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-08-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141920990","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Prevention of DDoS attacks: a comprehensive review and future directions 预防 DDoS 攻击:全面回顾与未来方向
Pub Date : 2024-05-15 DOI: 10.1080/19393555.2024.2347243
Shail Saharan, Vishal Gupta
{"title":"Prevention of DDoS attacks: a comprehensive review and future directions","authors":"Shail Saharan, Vishal Gupta","doi":"10.1080/19393555.2024.2347243","DOIUrl":"https://doi.org/10.1080/19393555.2024.2347243","url":null,"abstract":"","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"28 9","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-05-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140974230","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Towards improving the security of wireless networks using secured session keys 利用安全会话密钥提高无线网络的安全性
Pub Date : 2024-05-06 DOI: 10.1080/19393555.2024.2347682
N.G. Nageswari Amma, T. Jayaraj, N. G. B. Amma
{"title":"Towards improving the security of wireless networks using secured session keys","authors":"N.G. Nageswari Amma, T. Jayaraj, N. G. B. Amma","doi":"10.1080/19393555.2024.2347682","DOIUrl":"https://doi.org/10.1080/19393555.2024.2347682","url":null,"abstract":"","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"360 20","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-05-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141006668","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Evaluating the status of information security management in faculty libraries: a case study of Allameh Tabatabai University 评估院系图书馆的信息安全管理状况:阿拉米赫-塔巴塔拜大学的案例研究
Pub Date : 2024-05-01 DOI: 10.1080/19393555.2024.2347255
Mila Malekolkalami, Leila Jabbari, Hassan Mantegh
{"title":"Evaluating the status of information security management in faculty libraries: a case study of Allameh Tabatabai University","authors":"Mila Malekolkalami, Leila Jabbari, Hassan Mantegh","doi":"10.1080/19393555.2024.2347255","DOIUrl":"https://doi.org/10.1080/19393555.2024.2347255","url":null,"abstract":"","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"240 2","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141056168","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Privacy preservation of inventory management using adaptive key generation with Hyperledger blockchain technology 利用超级账本区块链技术自适应生成密钥保护库存管理隐私
Pub Date : 2023-12-30 DOI: 10.1080/19393555.2023.2292996
Chinnaraj Govindasamy, Arokiasamy Antonidoss
{"title":"Privacy preservation of inventory management using adaptive key generation with Hyperledger blockchain technology","authors":"Chinnaraj Govindasamy, Arokiasamy Antonidoss","doi":"10.1080/19393555.2023.2292996","DOIUrl":"https://doi.org/10.1080/19393555.2023.2292996","url":null,"abstract":"","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":" 10","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-12-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139138256","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
An AI Based IDS Framework For Detecting DDoS Attacks In Cloud Environment 基于AI的云环境下DDoS攻击检测IDS框架
Pub Date : 2023-11-10 DOI: 10.1080/19393555.2023.2279535
S. Asha Varma, K. Ganesh Reddy
ABSTRACTCloud computing makes it easier for users to access resources from anywhere at any time. This is for as long as they have access to the internet connectivity by employing a “pay-as-you-use” model. Despite its merits, cloud computing faces shortcomings, notably the escalating security concerns linked with it. Distributed Denial of Service (DDoS) attack is a primary and biggest concert to the availability of the services offered by cloud. DDoS attacks use numerous machines to flood consumers with packets with high data overhead, flooding the network with unwanted traffic. Due to the obsolete datasets, many deep learning (DL) models are processing-intensive or may not successfully address new DDoS threats. This paper seeks to address this issue by proposing FEwDN, an AI-based DDoS detection framework that employs a hybrid approach, integrating machine learning and deep learning algorithms. The framework optimizes feature selection via ensemble techniques, enhancing accuracy by leveraging deep neural networks for traffic classification. The proposed framework is experimented on the CICDDoS2019 dataset and demonstrates superior performance over benchmark techniques across multiple metrics. The FEwDN outperforms well with other models against various performance metrics. This research strengthens cloud security and DDoS detection in modern clouds.KEYWORDS: Cloud computingDDoS attacksdeep learning techniquesmachine learning Disclosure statementNo potential conflict of interest was reported by the authors.
摘要云计算使用户可以更方便地随时随地访问资源。只要他们采用“按需付费”模式接入互联网,就可以享受这种服务。尽管有其优点,云计算也面临着缺点,尤其是与之相关的安全问题。分布式拒绝服务(DDoS)攻击是对云提供的服务可用性的主要和最大的威胁。DDoS攻击使用大量机器向消费者发送具有高数据开销的数据包,使网络充斥不必要的流量。由于过时的数据集,许多深度学习(DL)模型都是处理密集型的,或者可能无法成功应对新的DDoS威胁。本文试图通过提出FEwDN来解决这个问题,FEwDN是一种基于人工智能的DDoS检测框架,采用混合方法,集成了机器学习和深度学习算法。该框架通过集成技术优化特征选择,通过利用深度神经网络进行流量分类来提高准确性。所提出的框架在CICDDoS2019数据集上进行了实验,并在多个指标上证明了优于基准技术的性能。FEwDN在各种性能指标上优于其他模型。本研究加强了现代云中的云安全和DDoS检测。关键词:云计算ddos攻击深度学习技术机器学习披露声明作者未报告潜在利益冲突。
{"title":"An AI Based IDS Framework For Detecting DDoS Attacks In Cloud Environment","authors":"S. Asha Varma, K. Ganesh Reddy","doi":"10.1080/19393555.2023.2279535","DOIUrl":"https://doi.org/10.1080/19393555.2023.2279535","url":null,"abstract":"ABSTRACTCloud computing makes it easier for users to access resources from anywhere at any time. This is for as long as they have access to the internet connectivity by employing a “pay-as-you-use” model. Despite its merits, cloud computing faces shortcomings, notably the escalating security concerns linked with it. Distributed Denial of Service (DDoS) attack is a primary and biggest concert to the availability of the services offered by cloud. DDoS attacks use numerous machines to flood consumers with packets with high data overhead, flooding the network with unwanted traffic. Due to the obsolete datasets, many deep learning (DL) models are processing-intensive or may not successfully address new DDoS threats. This paper seeks to address this issue by proposing FEwDN, an AI-based DDoS detection framework that employs a hybrid approach, integrating machine learning and deep learning algorithms. The framework optimizes feature selection via ensemble techniques, enhancing accuracy by leveraging deep neural networks for traffic classification. The proposed framework is experimented on the CICDDoS2019 dataset and demonstrates superior performance over benchmark techniques across multiple metrics. The FEwDN outperforms well with other models against various performance metrics. This research strengthens cloud security and DDoS detection in modern clouds.KEYWORDS: Cloud computingDDoS attacksdeep learning techniquesmachine learning Disclosure statementNo potential conflict of interest was reported by the authors.","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"57 2","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-11-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"135092868","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Information security failures identified and measured – ISO/IEC 27001:2013 controls ranked based on GDPR penalty case analysis 识别和测量信息安全故障- ISO/IEC 27001:2013控制基于GDPR处罚案例分析排名
Pub Date : 2023-10-18 DOI: 10.1080/19393555.2023.2270984
M. Suorsa, P. Helo
This paper identifies the failures and impacts of information security, as well as the most effective controls to mitigate information security risks in organizations.Root cause analysis was conducted on all year 2020 GDPR penalty cases (n = 81) based on misconduct as defined in GDPR article 32: “security of processing.” ISO/IEC 27,001 controls were used as failure identifiers in the analysis. As a result, this study presents both the most frequent and most expensive information security failures and correspondingly ranks and presents the correlation of the controls observed in the analysis. From a theoretical perspective, our study contributes by bridging the gap between regulation and information security and introduces a statistical method to analyze the GDPR penalty cases, and provides previously unreported findings about information security failures and their respective solutions. From a practical perspective, the results of our study are useful for organizations which aspire to manage information security more effectively in order to prevent the most typical and expensive information security failures. Organizations, as well as auditors implementing and assuring the ISO 27001, may use our results as a guideline whereby controls should be applied and verified first in sequential order based on their impact and interdependence
本文确定了信息安全的故障和影响,以及减轻组织中信息安全风险的最有效控制。根据GDPR第32条“处理安全性”中定义的不当行为,对2020年所有GDPR处罚案例(n = 81)进行了根本原因分析。在分析中使用ISO/IEC 27,001控制作为失效标识符。因此,本研究提出了最频繁和最昂贵的信息安全故障,并相应地对分析中观察到的控制进行了排名和相关性。从理论的角度来看,我们的研究有助于弥合监管与信息安全之间的差距,并引入了一种统计方法来分析GDPR处罚案例,并提供了以前未被报道的关于信息安全失败的发现及其相应的解决方案。从实际的角度来看,我们的研究结果对那些渴望更有效地管理信息安全,以防止最典型和昂贵的信息安全故障的组织是有用的。组织,以及实施和确保ISO 27001的审核员,可以使用我们的结果作为指导方针,根据其影响和相互依赖性,控制应按顺序应用和验证
{"title":"Information security failures identified and measured – ISO/IEC 27001:2013 controls ranked based on GDPR penalty case analysis","authors":"M. Suorsa, P. Helo","doi":"10.1080/19393555.2023.2270984","DOIUrl":"https://doi.org/10.1080/19393555.2023.2270984","url":null,"abstract":"This paper identifies the failures and impacts of information security, as well as the most effective controls to mitigate information security risks in organizations.Root cause analysis was conducted on all year 2020 GDPR penalty cases (n = 81) based on misconduct as defined in GDPR article 32: “security of processing.” ISO/IEC 27,001 controls were used as failure identifiers in the analysis. As a result, this study presents both the most frequent and most expensive information security failures and correspondingly ranks and presents the correlation of the controls observed in the analysis. From a theoretical perspective, our study contributes by bridging the gap between regulation and information security and introduces a statistical method to analyze the GDPR penalty cases, and provides previously unreported findings about information security failures and their respective solutions. From a practical perspective, the results of our study are useful for organizations which aspire to manage information security more effectively in order to prevent the most typical and expensive information security failures. Organizations, as well as auditors implementing and assuring the ISO 27001, may use our results as a guideline whereby controls should be applied and verified first in sequential order based on their impact and interdependence","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"135883878","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Internet governance and cyber-security: a systematic literature review 互联网治理与网络安全:系统文献综述
Pub Date : 2023-10-16 DOI: 10.1080/19393555.2023.2268608
Salifu Yusif, Abdul Hafeez-Baig, Charles Anachanser
ABSTRACTThis study aims to uncover the challenges of Internet governing bodies to inform a trajectory for better cybersecurity governance and policy formulation. Using a systematic literature review approach, we found that the struggle for dominancy/power for the Internet continues to overshadow the calls for multi-stakeholder/multilateralism given 35 (47.3%) of the total (74) reviewed papers focused on varied issues and overlaps. The power-driven nature of the numerous Internet governing bodies against 14 (20%) of the total included studies calling for some form of the global representative body, including public health, if the quest for “.health” was to be successful. Another 23(21) (34%) were concerned over the implications of the problem of Internet governance on cybersecurity in general. The study also found that as the Internet and its governance issues offload the privacy and security burden and supervision concerns characterized the telecommunications are heightened in the context of social awareness in cyberspace, cybersecurity has become necessary with businesses and the government spending much time and resources to combat cyber-attacks, majority of which are inter-jurisdictional.KEYWORDS: CybersecuritycyberspaceInternetInternet governancemulti-stakeholder/multilateral Disclosure statementNo potential conflict of interest was reported by the author(s).Notes1. Repeated papers – papers that had more than one theme.
摘要本研究旨在揭示互联网管理机构面临的挑战,为更好的网络安全治理和政策制定提供信息。使用系统的文献回顾方法,我们发现,对互联网主导地位/权力的争夺继续掩盖了对多方利益相关者/多边主义的呼吁,因为总共(74)篇被审查的论文中有35篇(47.3%)专注于各种问题和重叠。众多互联网管理机构的权力驱动性质,占总数的14个(20%),其中包括呼吁建立某种形式的全球代表机构的研究,包括公共卫生机构,如果寻求"。“健康”就是成功。另有23人(21人)(34%)担心互联网治理问题对总体网络安全的影响。该研究还发现,随着互联网及其治理问题减轻了隐私和安全负担,以及在网络空间社会意识的背景下,电信行业的监管问题日益突出,网络安全已成为必要,企业和政府花费大量时间和资源来打击网络攻击,其中大多数是跨司法管辖区的攻击。关键词:网络安全网络空间互联网互联网治理多利益相关方/多边披露声明作者未报告潜在利益冲突。重复的论文——有多个主题的论文。
{"title":"Internet governance and cyber-security: a systematic literature review","authors":"Salifu Yusif, Abdul Hafeez-Baig, Charles Anachanser","doi":"10.1080/19393555.2023.2268608","DOIUrl":"https://doi.org/10.1080/19393555.2023.2268608","url":null,"abstract":"ABSTRACTThis study aims to uncover the challenges of Internet governing bodies to inform a trajectory for better cybersecurity governance and policy formulation. Using a systematic literature review approach, we found that the struggle for dominancy/power for the Internet continues to overshadow the calls for multi-stakeholder/multilateralism given 35 (47.3%) of the total (74) reviewed papers focused on varied issues and overlaps. The power-driven nature of the numerous Internet governing bodies against 14 (20%) of the total included studies calling for some form of the global representative body, including public health, if the quest for “.health” was to be successful. Another 23(21) (34%) were concerned over the implications of the problem of Internet governance on cybersecurity in general. The study also found that as the Internet and its governance issues offload the privacy and security burden and supervision concerns characterized the telecommunications are heightened in the context of social awareness in cyberspace, cybersecurity has become necessary with businesses and the government spending much time and resources to combat cyber-attacks, majority of which are inter-jurisdictional.KEYWORDS: CybersecuritycyberspaceInternetInternet governancemulti-stakeholder/multilateral Disclosure statementNo potential conflict of interest was reported by the author(s).Notes1. Repeated papers – papers that had more than one theme.","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-10-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"136143089","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Lattice attacks on pairing-based signatures 基于配对签名的点阵攻击
Pub Date : 2023-10-09 DOI: 10.1080/19393555.2023.2251476
Thierry Mefenza, Damien Vergnaud
ABSTRACTPractical implementations of cryptosystems often suffer from critical information leakage through side-channels (such as their power consumption or their electromagnetic emanations). For public-key cryptography on embedded systems, the core operation is usually group exponentiation – or scalar multiplication on elliptic curves – which is a sequence of group operations derived from the private-key that may reveal secret bits to an attacker (on an unprotected implementation). We present lattice-based polynomial-time (heuristic) algorithms that recover the signer’s secret in popular pairing-based signatures when used to sign several messages under the assumption that blocks of consecutive bits of the corresponding exponents are known by the attacker. Our techniques rely upon Coppersmith's method and apply to many signatures in the so-called exponent-inversion framework in the standard security model (i.e. Boneh-Boyen, Gentry and Pontcheval-Sanders signatures) as well as in the random oracle model (i.e. Sakai-Kasahara signatures).KEYWORDS: Coppersmith’s methodCryptanalysisLattice attacksMSC 68P25, 94A60Pairing-based signaturesSide-channel attacks Disclosure statementNo potential conflict of interest was reported by the authors.Notes1. For the ease of exposition, we consider so-called Type-1 bilinear maps (Galbraith et al. Citation2008), but our results apply to all possible instantiations of the considered signature schemes (i.e. using Type-1, Type-2, or Type-3 bilinear maps).2. It is well known that the computational complexity of Gröbner basis algorithm may be exponential or even doubly exponential. In our setting, the number of variables and the total total degree of the input polynomials are fixed and the theoretical complexity is polynomial in the field size (and thus in the security parameter).3. We recall that a combinatorial class is a finite or countable set on which a size function is defined, satisfying the following conditions: (i) the size of an element is a non-negative integer and (ii) the number of elements of any given size is finite.4. In order to reach this asymptotic bound, the constructed matrix is of huge dimension and the resulting polynomial system has a very large number of variables and the computation which is theoretically polynomial-time becomes in practice prohibitive.5. Pointcheval-Sanders signature scheme can be instantiated with Type-3 bilinear maps but for consistency and the ease of exposition, we present it using Type-1 bilinear maps.
摘要密码系统的实际实现经常遭受关键信息通过侧信道泄露的困扰(例如它们的功耗或电磁辐射)。对于嵌入式系统上的公钥加密,核心操作通常是群幂运算(或椭圆曲线上的标量乘法),这是由私钥派生的一系列组操作,可能会向攻击者透露秘密比特(在未受保护的实现上)。我们提出了基于格子的多项式时间(启发式)算法,该算法可以在假定攻击者知道相应指数的连续位块的情况下,在流行的基于配对的签名中用于签名多条消息时恢复签名者的秘密。我们的技术依赖于Coppersmith的方法,并适用于标准安全模型(即Boneh-Boyen, Gentry和Pontcheval-Sanders签名)以及随机oracle模型(即Sakai-Kasahara签名)中所谓的指数反转框架中的许多签名。关键词:Coppersmith的方法密码分析晶格攻击smsc 68P25, 94a60基于配对的签名侧通道攻击披露声明作者未报告潜在的利益冲突。为了便于说明,我们考虑所谓的1型双线性映射(Galbraith et al.)。Citation2008),但我们的结果适用于所考虑的签名方案的所有可能实例(即使用Type-1、Type-2或Type-3双线性映射)。众所周知,Gröbner基算法的计算复杂度可能是指数级甚至双指数级的。在我们的设置中,变量的数量和输入多项式的总总度是固定的,并且理论复杂度是字段大小的多项式(因此也是安全参数的多项式)。我们记得,组合类是一个有限的或可数的集合,在其上定义了一个大小函数,满足以下条件:(i)元素的大小是非负整数,(ii)任意给定大小的元素的数目是有限的。为了达到这个渐近界,所构造的矩阵具有巨大的维数,所得到的多项式系统具有非常多的变量,理论上是多项式时间的计算在实践中变得令人望而却步。Pointcheval-Sanders签名方案可以用Type-3双线性映射实例化,但为了一致性和说明的便利性,我们使用Type-1双线性映射来表示它。
{"title":"Lattice attacks on pairing-based signatures","authors":"Thierry Mefenza, Damien Vergnaud","doi":"10.1080/19393555.2023.2251476","DOIUrl":"https://doi.org/10.1080/19393555.2023.2251476","url":null,"abstract":"ABSTRACTPractical implementations of cryptosystems often suffer from critical information leakage through side-channels (such as their power consumption or their electromagnetic emanations). For public-key cryptography on embedded systems, the core operation is usually group exponentiation – or scalar multiplication on elliptic curves – which is a sequence of group operations derived from the private-key that may reveal secret bits to an attacker (on an unprotected implementation). We present lattice-based polynomial-time (heuristic) algorithms that recover the signer’s secret in popular pairing-based signatures when used to sign several messages under the assumption that blocks of consecutive bits of the corresponding exponents are known by the attacker. Our techniques rely upon Coppersmith's method and apply to many signatures in the so-called exponent-inversion framework in the standard security model (i.e. Boneh-Boyen, Gentry and Pontcheval-Sanders signatures) as well as in the random oracle model (i.e. Sakai-Kasahara signatures).KEYWORDS: Coppersmith’s methodCryptanalysisLattice attacksMSC 68P25, 94A60Pairing-based signaturesSide-channel attacks Disclosure statementNo potential conflict of interest was reported by the authors.Notes1. For the ease of exposition, we consider so-called Type-1 bilinear maps (Galbraith et al. Citation2008), but our results apply to all possible instantiations of the considered signature schemes (i.e. using Type-1, Type-2, or Type-3 bilinear maps).2. It is well known that the computational complexity of Gröbner basis algorithm may be exponential or even doubly exponential. In our setting, the number of variables and the total total degree of the input polynomials are fixed and the theoretical complexity is polynomial in the field size (and thus in the security parameter).3. We recall that a combinatorial class is a finite or countable set on which a size function is defined, satisfying the following conditions: (i) the size of an element is a non-negative integer and (ii) the number of elements of any given size is finite.4. In order to reach this asymptotic bound, the constructed matrix is of huge dimension and the resulting polynomial system has a very large number of variables and the computation which is theoretically polynomial-time becomes in practice prohibitive.5. Pointcheval-Sanders signature scheme can be instantiated with Type-3 bilinear maps but for consistency and the ease of exposition, we present it using Type-1 bilinear maps.","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"119 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-10-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"135094981","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Certificateless directed signature scheme without bilinear pairing 没有双线性配对的无证书有向签名方案
Pub Date : 2023-10-06 DOI: 10.1080/19393555.2023.2260800
Mojtaba Goodarzi, Ziba Eslami, Nasrollah Pakniat
ABSTRACTIn Eurocrypt’96, the concept of Designated Verifier Signature was proposed. Such signatures can only be verified by a single designated verifier specified during signature creation. However, there exist situations in which the signer, as well as the designated verifier, should be equipped with the ability to check the validity of the signature. At the same time, either of them should be able to help third parties to verify the signature. This is achieved by Directed Signature Schemes. In this paper, we consider directed signatures in the certificateless cryptography setting and propose an efficient pairing-free certificateless directed signature (CLDS) scheme. Then, we prove that the proposed CLDS scheme meets the needed security requirements in the random oracle model and under the assumption of the hardness of discrete logarithm and Gap Diffie-Hellman problems. We also compare the proposed scheme with the related ones to indicate the overall superiority of the proposed CLDS scheme.KEYWORDS: Certificateless cryptographydesignated verifierdigital signaturedirected signaturepairing-free Disclosure statementNo potential conflict of interest was reported by the author(s).
摘要在1996年的Eurocrypt中,提出了指定验证者签名的概念。此类签名只能由创建签名时指定的单个指定验证者进行验证。但是,在某些情况下,签名者以及指定的验证者都应该具备检查签名有效性的能力。同时,他们中的任何一方都应该能够帮助第三方验证签名。这是通过定向签名方案实现的。本文考虑了无证书加密设置中的有向签名,提出了一种高效的无对无证书有向签名方案。然后,在离散对数和Gap Diffie-Hellman问题的硬度假设下,我们证明了所提出的CLDS方案在随机oracle模型下满足所需的安全性要求。我们还将所提出的方案与相关方案进行了比较,以表明所提出的CLDS方案的总体优势。关键词:无证书加密指定验证者数字签名定向签名无修复披露声明作者未报告潜在利益冲突。
{"title":"Certificateless directed signature scheme without bilinear pairing","authors":"Mojtaba Goodarzi, Ziba Eslami, Nasrollah Pakniat","doi":"10.1080/19393555.2023.2260800","DOIUrl":"https://doi.org/10.1080/19393555.2023.2260800","url":null,"abstract":"ABSTRACTIn Eurocrypt’96, the concept of Designated Verifier Signature was proposed. Such signatures can only be verified by a single designated verifier specified during signature creation. However, there exist situations in which the signer, as well as the designated verifier, should be equipped with the ability to check the validity of the signature. At the same time, either of them should be able to help third parties to verify the signature. This is achieved by Directed Signature Schemes. In this paper, we consider directed signatures in the certificateless cryptography setting and propose an efficient pairing-free certificateless directed signature (CLDS) scheme. Then, we prove that the proposed CLDS scheme meets the needed security requirements in the random oracle model and under the assumption of the hardness of discrete logarithm and Gap Diffie-Hellman problems. We also compare the proposed scheme with the related ones to indicate the overall superiority of the proposed CLDS scheme.KEYWORDS: Certificateless cryptographydesignated verifierdigital signaturedirected signaturepairing-free Disclosure statementNo potential conflict of interest was reported by the author(s).","PeriodicalId":103842,"journal":{"name":"Information Security Journal: A Global Perspective","volume":"115 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-10-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"135351180","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
Information Security Journal: A Global Perspective
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1