To see the other types of publications on this topic, follow the link: Application security verification standard.
Journal articles on the topic 'Application security verification standard'
Create a spot-on reference in APA, MLA, Chicago, Harvard, and other styles
Consult the top 50 journal articles for your research on the topic 'Application security verification standard.'
Next to every source in the list of references, there is an 'Add to bibliography' button. Press on it, and we will generate automatically the bibliographic reference to the chosen work in the citation style you need: APA, MLA, Harvard, Chicago, Vancouver, etc.
You can also download the full text of the academic publication as pdf and read online its abstract whenever available in the metadata.
Browse journal articles on a wide variety of disciplines and organise your bibliography correctly.
1
Hamdy, Safuat. "Der OWASP Application Security Verification Standard." Datenschutz und Datensicherheit - DuD 36, no. 11 (October 23, 2012): 797–800. http://dx.doi.org/10.1007/s11623-012-0274-4.
Full text
2
Bicaku, Ani, Markus Tauber, and Jerker Delsing. "Security standard compliance and continuous verification for Industrial Internet of Things." International Journal of Distributed Sensor Networks 16, no. 6 (June 2020): 155014772092273. http://dx.doi.org/10.1177/1550147720922731.
Full textAbstract:
Due to globalization and digitalization of industrial systems, standard compliance is gaining more attention. In order to stay competitive and remain in business, different sectors within industry are required to comply with multiple regulations. Compliance aims to fulfill regulations by including all measures imposed by laws and standards. Every device, application, or service implements several technologies at many levels, and standards support interoperability across them. They help to create global markets for industries and enable networked development in order to be successful and sustainable. This work highlights the importance of standard compliance and continuous verification in industrial Internet of Things and implements an automatic monitoring and standard compliance verification framework. In this work, we focus on security, safety, and organizational aspects of industrial Internet of Things. We identify a number of standards and best practice guidelines, which are used to extract security, safety, and organizational measurable indicator points. In addition, a metric model is provided that forms the basis for the necessary information needed for compliance verification, including requirements, standards, and metrics. Also, we present the prototype of the monitoring and standard compliance verification framework used to show the security compliance of an industrial Internet of Things use case.
3
Jendrian, Kai. "Überprüfung von Webanwendungen mit dem „OWASP Application Security Verification Standard 2009“." Datenschutz und Datensicherheit - DuD 34, no. 3 (February 24, 2010): 138–42. http://dx.doi.org/10.1007/s11623-010-0022-6.
Full text
4
Garmash, D. V., G. A. Maleeva, and S. O. Kandiy. "Draft of Rainbow electronic signature standard and its main properties and application possibilities." Radiotekhnika, no. 203 (December 23, 2020): 82–90. http://dx.doi.org/10.30837/rt.2020.4.203.07.
Full textAbstract:
According to the results of the second stage of the international competition for research and development of standards for asymmetric cryptographic transformations of the post-quantum period, the Rainbow electronic signature (ES) mechanism received a positive assessment and recognition as a finalist. Its important advantages over other post-quantum ESs consist in less complexity of direct and inverse transformations, i.e., signature generation and verification, as well as significantly reduced signature length. At the same time, the length of its public key is quite large. Therefore, it is thought that Rainbow is not suitable as a general-purpose ES algorithm to replace the algorithms currently defined in FIPS 186-4. In particular, large public keys make certificate chains extremely large. However, there are applications that do not need to send keys too often, so this disadvantage in these cases may be insignificant. Under these conditions, the Rainbow ES mechanism can find application, including that one increasing the diversity of postquantum ESs. Also, it is significantly problematic to limit the security levels of Rainbow ES 256 bits against classical and 128 bits against quantum cryptanalysis.
The subject of this article is the analysis and generalization of designs of the Oil-Vinegar public key authentication systems mechanism based on the Rainbow ES use. This is an important direction in creating secure and efficient authentication systems for practical applications using public keys, such as inexpensive smart cards, when speed is required in the production and verification of ES. A feature of such authentication mechanism is the implementation of the idea of a multilevel Oil-Vinegar system. It is believed that the ES-based authentication system should be more secure in terms of cryptographic stability and more efficient in terms of widespread use in low-power, etc. applications. The importance of solving this problem lies in the potential use of the Rainbow mechanism as a secure and highly efficient public-key authentication system based on ES.
5
Remlein, Piotr, and Urszula Stachowiak. "Security Verification in the Context of 5G Sensor Networks." Journal of Telecommunications and Information Technology 2 (March 30, 2021): 107–19. http://dx.doi.org/10.26636/jtit.2021.153221.
Full textAbstract:
In order to develop reliable safety standards for 5G sensor networks (SN) and the Internet of Things, appropriate verification tools are needed, including those offering the ability to perform automated symbolic analysis process. The Tamarin prover is one of such software-based solutions. It allows to formally prove security protocols. This paper shows the modus operandi of the tool in question. Its application has been illustrated using an example of an exchange of messages between two agents, with asynchronous encryption. The scheme may be implemented, for instance, in the TLS/DTLS protocol to create a secure cryptographic key exchange mechanism. The aim of the publication is to demonstrate that automated symbolic analysis may be relied upon to model 5G sensor networks security protocols. Also, a use case in which the process of modeling the DTLS 1.2 handshake protocol enriched with the TCP SYN Cookies mechanism, used to preventing DoS attacks, is presented
6
Vikhe, Ms Prajakta. "Secured Application Environment using Enhanced Graphical Passwords." International Journal for Research in Applied Science and Engineering Technology 9, no. VI (June 20, 2021): 1462–69. http://dx.doi.org/10.22214/ijraset.2021.35293.
Full textAbstract:
Today computer and mobile based applications has become an integral part of our life. Thus, there arises a need of a reliable security while using these applications using authentication techniques that are most secured and hard to crack. Today many authentication techniques are introduced for better security and replace textual authentication technique. But these techniques are proving insufficient, so new ways should be studied and introduced for better security. So, we are concentrating on two such techniques, first we studied graphical authentication systems using images. The one such technique called gRat which uses set of images for authentication was found to be useful. The second for searching a different authentication technique we came across ENP which explains how to provide security using to an application by using hashing, ascii, negation and cryptography together for a secured application. So, we find out that one technique is insufficient and more than two techniques should be combined together. So, in this paper we are recommending a dual authentication technique. First technique will be used for login id and other will be used for login password. The first technique uses a set of images with specific border colors for authentication and is called Graphical random authentication technique (gRat). In this technique a set of images with different boundary colors are displayed for the user which are shown randomly each time a user attempts a login ID. The user has to select the same set of images with same boundary color in same format for login ID verification than only second technique for login password will be shown. The second technique uses encryption and negative password together called as Encrypted negative password (ENP). In this technique while deciding a password a plain textual password is accepted from the user and then it is converted to hash code using hashing algorithm. Then the hash code is converted to an ascii code od 0’s and 1’s. Then negation is applied to the ascii where we get a negative text. The negative text is then encrypted. This process is followed in reverse while authentication. After second correct verification main application will be started. Both authentication data will be secured by Advanced encryption standard (AES) algorithm and saved on cloud. We are using public cloud Google drive as our cloud as it is free and more secured. Thus, while testing the application for authentication using both techniques together our system becomes very secured and almost unbreakable.
7
Dewani, Amirita, Pirah Memon, Veena Kumari, Anum Arain, Ayaz Jiskani, and Sania Bhatti. "Keyless Smart Home: An application of Home Security and Automation." Oriental journal of computer science and technology 11, no. 2 (May 7, 2018): 107–14. http://dx.doi.org/10.13005/ojcst11.02.06.
Full textAbstract:
The rapid and revolutionary advancement in technology has increased the demand for advanced ubiquitous mobile applications in our daily lives. Home automation system uses collective smart technology to elevate sphere of security and human living standards. Wireless Smart home systems have been prototyped by researchers to realize different applications in vast contexts. In this paper we propose a keyless smart home security system which uses Bluetooth as a communication protocol to automate door locks based on a security code and predefined user credentials. The system combines Android phone as a signal sender to dispatch the input signal from an end users side, Bluetooth communication module as signal receiver, ARDUINO microcontroller as CPU and servo motor and light emitting diodes as an output. The system integrates two modules: one of which is Arduino microcontroller which is responsible for authentication and verification of security code and allows servo motor to process the output according to the received input. The second is android Application which provides an interface to the user to set credentials and security code which is then transmitted to the Arduino microcontroller via Bluetooth technology. Since Arduino and Android are open source, hence implementation rate of the proposed system is inexpensive and feasible.
8
Adil Yazdeen, Abdulmajeed, Subhi R. M. Zeebaree, Mohammed Mohammed Sadeeq, Shakir Fattah Kak, Omar M. Ahmed, and Rizgar R. Zebari. "FPGA Implementations for Data Encryption and Decryption via Concurrent and Parallel Computation: A Review." Qubahan Academic Journal 1, no. 2 (March 15, 2021): 8–16. http://dx.doi.org/10.48161/qaj.v1n2a38.
Full textAbstract:
In recent days, increasing numbers of Internet and wireless network users have helped accelerate the need for encryption mechanisms and devices to protect user data sharing across an unsecured network. Data security, integrity, and verification may be used due to these features. In internet traffic encryption, symmetrical block chips play an essential role. Data Encryption Standard (DES) and Advanced Encryption Standard (AES) ensure privacy encryption underlying data protection standards. The DES and the AES provide information security. DES and AES have the distinction of being introduced in both hardware and applications. DES and AES hardware implementation has many advantages, such as increased performance and improved safety. This paper provides an exhaustive study of the implementation by DES and AES of field programming gate arrays (FPGAs) using both DES and AES. Since FPGAs can be defined as just one mission, computers are superior to them.
9
KASHTANOV, Serhii F., Yury O. POLUKAROV, Oleksiy I. POLUKAROV, Liudmyla O. MITIUK, and Nataliia F. KACHYNSKA. "Specifics of modern security requirements for software of electronic machine control systems." INCAS BULLETIN 13, S (August 3, 2021): 87–97. http://dx.doi.org/10.13111/2066-8201.2021.13.s.9.
Full textAbstract:
The required level of safety of machines and mechanisms is achieved through the use of appropriate safety management systems for industrial equipment, including programmable electronic ones. Such systems usually include a variety of security devices for managing industrial equipment settings. Since electronic control systems are currently considered the most promising control systems in this area, the study of the security parameters of their application support determines the relevance of this study. This study analyses the main requirements of IEC 61508 and IEC 62061 standards for compliance with modern safety requirements of embedded and applied software for electronic control systems of machines and mechanisms. This study proposes an algorithm for step-by-step implementation of software for electronic machine control systems in accordance with basic security standards for both built-in and application software. Testing has been determined as the main method of verification of application software. Based on the results of the analysis, it was found that the specification of security requirements, both built-in and application software, should highlight the necessary characteristics of each subsystem, providing information that allows choosing the equipment that meets existing security requirements. Relevant recommendations are given on the specifics of practical application of these standards.
10
Pan, Mingming, Shiming Tian, Jindou Yuan, and Songsong Chen. "Simulation of Dynamic User Network Connection Anti-Interference and Security Authentication Method Based on Ubiquitous Internet of Things." Mathematical Problems in Engineering 2021 (June 21, 2021): 1–8. http://dx.doi.org/10.1155/2021/5687208.
Full textAbstract:
Ubiquitous Internet of Things includes criteria, applications, and technologies for providing standard data. The system can be used to establish a comprehensive data database to facilitate people to better analyze, organize, and use these data, so as to improve the reliability and sharing of data, to provide better services for users. The purpose of this study is to propose and establish a specific and reliable data exchange program to ensure the security of data exchange. Data security is to ensure the reliability of specific security exchange process. The emphasis of this study is the reliability analysis method and the verification method of exchange process behavior. Based on the analysis of all abnormal phenomena in the Internet of Things traffic, the basic characteristics of network traffic, the basic properties of network traffic, and the theory of multiterminal power communication network anti-interference model construction and noninterference model, the simulation experiment of anti-interference and security authentication method is carried out. The results show that, with the increase of the number of antennas, the false detection probability decreases from 10−1 to 10−4, which can achieve better performance in the detection of active users. When network is used in applications, HTTP + SSL is the most widely used application for data authentication and security authentication. The market of anti-interference technology is developing rapidly. The complex annual growth rate almost doubled in the international market, and the market scale was significantly expanded, with an annual growth rate of about 50%.
11
SangeethaPriya, N., L. Bharathi, S. Dola Sanjay, N. V. D. P. Murthy, and A. N. L. Harisha. "Optimal Multilevel Link Extend Umpiring Routing Based Secure Routing Protocol for Improving Privacy Standard in Wireless Sensor Networks." Journal of Computational and Theoretical Nanoscience 17, no. 12 (December 1, 2020): 5543–49. http://dx.doi.org/10.1166/jctn.2020.9451.
Full textAbstract:
Generally wireless sensor networks (WSN) are connected via a wireless medium to form a large amount of cooperative sensor nodes. Monitoring control is an important aspect of monitoring users in monitoring applications, such as wireless sensor networks, because of security. There are countless applications to pay for themselves but at the same time, their special properties offer a number of challenges, such as security and surveillance, control, and operation and complex system maintenance. WSN has already seen it on the Internet, from face-to-face security attacks. To propose an Optimal Multilevel Link extend umpiring routing (OML-EUR) based secure routing protocol for improving privacy standard in wireless sensor networks. Secure communication is also important in providing accurate and resource constraints at the sensor node at the moment. In this study, there are three of our contributions. Initially it monitors the neighbor network layer attacks for browsing the WSN on the transmission medium. Followed subscription a link establishment to monitoring the request packets through key transmission of WSN with secure routing protocols. By finding the secure communication as qualities of service verification among the modes to authenticate to transfer. The proposed system produce high secure performance by the result proves energy consumption and communication overhead as higher efficient than previous system.
12
Yang, Xiao-Dong, Li-Kun Xiao, Chun-Lin Chen, and Cai-Fen Wang. "A Strong Designated Verifier Proxy Re-Signature Scheme for IoT Environments." Symmetry 10, no. 11 (November 2, 2018): 580. http://dx.doi.org/10.3390/sym10110580.
Full textAbstract:
With the rapid popularization of the Internet of Things (IoT) in our daily lives, the communication security and identity privacy of IoT devices must be ensured. However, traditional authentication mechanisms utilized in IoT cannot completely ensure a user’s privacy when his/her messages are routed via an untrusted intermediate device. Strong designated-verifier proxy re-signature (SDVPRS) is a new cryptographic technology that combines the advantages of strong designated verifier signature and proxy re-signature. Therefore, SDVPRS is considered to be a better approach to maintain data integrity and protect the identity privacy of the signer in a resource-limited IoT device. Nevertheless, designing a secure SDVPRS scheme without random oracles is still a challenging task. In this paper, we mainly focus on such a construction by providing a new method. We first provide the formal definition of SDVPRS and its security model. Then, we present the first SDVPRS scheme, which is bidirectional, multi-use and non-transferable, and we prove its security under the standard complexity assumptions in the standard model. The analysis results show that our SDVPRS scheme can not only protect the privacy of the signer’s identity, but also provide non-delegatability for signature verification. We present an example of potential application to environmental monitoring systems using our SDVPRS scheme.
13
Hakeem, Shimaa A. Abdel, and HyungWon Kim. "Multi-Zone Authentication and Privacy-Preserving Protocol (MAPP) Based on the Bilinear Pairing Cryptography for 5G-V2X." Sensors 21, no. 2 (January 19, 2021): 665. http://dx.doi.org/10.3390/s21020665.
Full textAbstract:
5G-Vehicle-to-Everything (5G-V2X) supports high-reliability and low latency autonomous services and applications. Proposing an efficient security solution that supports multi-zone broadcast authentication and satisfies the 5G requirement is a critical challenge. In The 3rd Generation Partnership Project (3GPP) Release 16 standard, for Cellular- Vehicle-to-Everything (C-V2X) single-cell communication is suggested to reuse the IEEE1609.2 security standard that utilizes the Public Key Infrastructure (PKI) cryptography. PKI-based solutions provide a high-security level, however, it suffers from high communication and computation overhead, due to the large size of the attached certificate and signature. In this study, we propose a light-weight Multi-Zone Authentication and Privacy-Preserving Protocol (MAPP) based on the bilinear pairing cryptography and short-size signature. MAPP protocol provides three different authentication methods that enable a secure broadcast authentication over multiple zones of large-scale base stations, using a single message and a single short signature. We also propose a centralized dynamic key generation method for multiple zones. We implemented and analyzed the proposed key generation and authentication methods using an authentication simulator and a bilinear pairing library. The proposed methods significantly reduce the signature generation time by 16 times–80 times, as compared to the previous methods. Additionally, the proposed methods significantly reduced the signature verification time by 10 times–16 times, as compared to the two previous methods. The three proposed authentication methods achieved substantial speed-up in the signature generation time and verification time, using a short bilinear pairing signature.
14
Kim, Jiyoon, Daniel Gerbi Duguma, Sangmin Lee, Bonam Kim, JaeDeok Lim, and Ilsun You. "Scrutinizing the Vulnerability of Ephemeral Diffie–Hellman over COSE (EDHOC) for IoT Environment Using Formal Approaches." Mobile Information Systems 2021 (September 13, 2021): 1–18. http://dx.doi.org/10.1155/2021/7314508.
Full textAbstract:
Most existing conventional security mechanisms are insufficient, mainly attributable to their requirements for heavy processing capacity, large protocol message size, and longer round trips, for resource-intensive devices operating in an Internet of Things (IoT) context. These devices necessitate efficient communication and security protocols that are cognizant of the severe resource restrictions regarding energy, computation, communication, and storage. To realize this, the IETF (Internet Engineering Task Force) is currently working towards standardizing an ephemeral key-based lightweight and authenticated key exchange protocol called EDHOC (Ephemeral Diffie–Hellman over COSE). The protocol’s primary purpose is to build an OSCORE (Object Security for Constrained RESTful Environments) security environment by supplying crucial security properties such as secure key exchange, mutual authentication, perfect forward secrecy, and identity protection. EDHOC will most likely dominate IoT security once it becomes a standard. It is, therefore, imperative to inspect the protocol for any security flaw. In this regard, two previous studies have shown different security vulnerabilities of the protocol using formal security verification methods. Yet, both missed the vital security flaws we found in this paper: resource exhaustion and privacy attacks. In finding these vulnerabilities, we leveraged BAN-Logic and AVISPA to formally verify both EDHOC protocol variants. Consequently, we described these security flaws together with the results of the related studies and put forward recommended solutions as part of our future work.
15
Sbiaa, Fatma, Sonia Kotel, Medien Zeghid, Rached Tourki, Mohsen Machhout, and Adel Baganne. "High-Level Implementation of a Chaotic and AES Based Crypto-System." Journal of Circuits, Systems and Computers 26, no. 07 (March 17, 2017): 1750122. http://dx.doi.org/10.1142/s0218126617501225.
Full textAbstract:
Given the increasing complexity of cryptographic devices, testing their security level against existing attacks requires a fast simulation environment. SystemC is a standard language that is widely used for the modeling and the verification of complex systems. It is a promising candidate in Electronic System Level (ESL) which allows models to reach higher simulation speed. Accordingly, the Advanced Encryption Standard (AES) is one of the most known block ciphers. It is widely used in various applications in order to secure the sensitive data. It is considered to be secure. Still, some issues lie in the used key and the S-Box. This paper presents a SystemC implementation of a chaos-based crypto-processor for the AES algorithm. The design of the proposed architecture is studied using the SystemC tools. The proposed correction approach exploits the chaos theory properties to cope with the defaulting parameters of the AES algorithm. Detailed experimental results are given in order to evaluate the security level and the performance criteria. In fact, the proposed crypto-system presents numerous interesting features, including a high security level, a pixel distributing uniformity, a sufficiently large key-space with improved key sensitivity, and an acceptable speed.
16
Al-Khouri, Ali M. "Biometrics Technology and the New Economy." International Journal of Innovation in the Digital Economy 3, no. 4 (October 2012): 1–28. http://dx.doi.org/10.4018/jide.2012100101.
Full textAbstract:
Over the past decade, biometrics technology has evolved from a technology used primarily in forensics and a narrow scientific and technological field to an indispensable technology in public and private sectors expanding into areas calling for advanced security. Biometric technologies provide high levels of security and reliability to address requirements related to identification and verification of personal identities. In light of the ever increasing requirements for robust identity management, biometrics industry is evolving to play a central role in shaping the future economy. This article provides a comprehensive overview of biometrics technologies, its functions, areas of application, related international standards, and recent advances in the field. The second part of the article looks at the application of biometrics in the government sector worldwide, and the emerging pivotal role of biometrics in consolidating the foundations of the digital economies and sheds light on the experiences of the United Arab Emirates in deploying different advanced biometrics technologies in a wide range of applications. It also outlines the government plans to develop an identity management infrastructure to address multiple strategic objectives, some of which are related to revolutionizing public services and supporting the development of the digital economy.
17
Xi, Ning, Di Lu, Cong Sun, Jianfeng Ma, and Yulong Shen. "Distributed Secure Service Composition with Declassification in Mobile Clouds." Mobile Information Systems 2017 (2017): 1–13. http://dx.doi.org/10.1155/2017/7469342.
Full textAbstract:
The regional and dynamic characteristics of mobile clouds pose a great challenge on information flow security during service composition. Although secure verification approaches based on standard noninterference provide a solid assurance on information flow security of composite service, too strict constraints on service components may cause the failure of composition procedure. In order to ensure the availability of composite service, we specify the declassification policies based on cryptographic operations to allow data to be legally declassified. And we propose the improved distributed secure service composition framework and approach, which can realize different cloud platforms in multiple domains, cooperate with each other to complete the declassification, and secure composition procedure. Through the experiment and evaluation, it is indicated that our approach provides a more reliable and efficient way for secure service composition in mobile clouds.
18
Algarni, Abeer D., Ghada M. El Banby, Naglaa F. Soliman, Fathi E. Abd El-Samie, and Abdullah M. Iliyasu. "Efficient Implementation of Homomorphic and Fuzzy Transforms in Random-Projection Encryption Frameworks for Cancellable Face Recognition." Electronics 9, no. 6 (June 24, 2020): 1046. http://dx.doi.org/10.3390/electronics9061046.
Full textAbstract:
To circumvent problems associated with dependence on traditional security systems on passwords, Personal Identification Numbers (PINs) and tokens, modern security systems adopt biometric traits that are inimitable to each individual for identification and verification. This study presents two different frameworks for secure person identification using cancellable face recognition (CFR) schemes. Exploiting its ability to guarantee irrevocability and rich diversity, both frameworks utilise Random Projection (RP) to encrypt the biometric traits. In the first framework, a hybrid structure combining Intuitionistic Fuzzy Logic (IFL) with RP is used to accomplish full distortion and encryption of the original biometric traits to be saved in the database, which helps to prevent unauthorised access of the biometric data. The framework involves transformation of spatial-domain greyscale pixel information to a fuzzy domain where the original biometric images are disfigured and further distorted via random projections that generate the final cancellable traits. In the second framework, cancellable biometric traits are similarly generated via homomorphic transforms that use random projections to encrypt the reflectance components of the biometric traits. Here, the use of reflectance properties is motivated by its ability to retain most image details, while the guarantee of the non-invertibility of the cancellable biometric traits supports the rationale behind our utilisation of another RP stage in both frameworks, since independent outcomes of both the IFL stage and the reflectance component of the homomorphic transform are not enough to recover the original biometric trait. Our CFR schemes are validated on different datasets that exhibit properties expected in actual application settings such as varying backgrounds, lightings, and motion. Outcomes in terms standard metrics, including structural similarity index metric (SSIM) and area under the receiver operating characteristic curve (AROC), suggest the efficacy of our proposed schemes across many applications that require person identification and verification.
19
Chawla, Ishaan. "Face Detection & Recognition using Tensor Flow: A Review." INTERNATIONAL JOURNAL OF COMPUTERS & TECHNOLOGY 18 (November 6, 2018): 7381–88. http://dx.doi.org/10.24297/ijct.v18i0.7924.
Full textAbstract:
Face recognition has become a popular topic of research recently due to increases in demand for security as well as the rapid development of mobile devices. There are many applications which face recognition can be applied to such as access control, identity verification, security systems, surveillance systems, and social media networks. Access control includes offices, computers, phones, ATMs, etc. Most of these forms currently do not use face recognition as the standard form of granting entry, but with advancing technologies in computers along with more refined algorithms, facial recognition is gaining some traction in replacing passwords and fingerprint scanners. Ever since the events of 9/11 there has been a more concerned emphasis on developing security systems to ensure the safety of innocent citizens. Namely in places such as airports and border crossings where identification verification is necessary, face recognition systems potentially have the ability to mitigate the risk and ultimately prevent future attacks from occurring. As for surveillance systems, the same point can be made if there are criminals on the loose. Surveillance cameras with face recognition abilities can aide in efforts of finding these individuals. Alternatively, these same surveillance systems can also help identify the whereabouts of missing persons, although this is dependent on robust facial recognition algorithms as well as a fully developed database of faces. And lastly, facial recognition has surfaced in social media applications on platforms such as Facebook which suggest users to tag friends who have been identified in pictures. It is clear that there are many applications the uses for facial recognition systems. In general, the steps to achieve this are the following: face detection, feature extraction, and lastly training a model.
20
KIFOR, C. V., N. TUDOR, and LAL MOHAN BARAL. "QUALITY SYSTEM FOR PRODUCTION SOFTWARE (QSPS): AN INNOVATIVE APPROACH TO IMPROVE THE QUALITY OF PRODUCTION SOFTWARE." International Journal of Software Engineering and Knowledge Engineering 23, no. 08 (October 2013): 1061–83. http://dx.doi.org/10.1142/s0218194013500319.
Full textAbstract:
A quality system for production software should be part of the quality management system of an organization and can be expressed as objectives in the form of processes, procedures, tools and responsibilities, designed and developed to fulfil the quality requirements. These usually are addressing the customers (external or internal), compliance with standards (effectiveness) waste reduction and better use of resources (efficiency) for continual improvement. Such systems are designed according to the requirements of the standards for quality management, software engineering and information security. Quality systems themselves could not provide all necessary means for driving the organization to the quality and excellence of a product. Still there are some gaps in the processes which are not covered by too generic standards and it is the organizational ability to cover the gaps in an appropriate way. The aim of this paper is to examine the effectiveness of our proposed conceptual QSPS model to reduce the gaps in the processes of an organization by enhancing the quality of production software. In order to achieve that goal, a mathematical representation of QSPS has been derived and an evaluation has been realized among different software quality methods. The reliability and validity of the QSPS has been examined through the practical application to the automotive industry considering the elements like: (i) Planning, time and cost evaluation (ii) Software requirements (management, risk, quality and security) (iii) Validation and verification of the implemented software before release (iv) Internal release of the software (v) Client release of the software (vi) Functional monitoring after release in the production and continuous improvement process (vii) Customer satisfaction. The results of mathematical simulation and practical application revealed that the proposed QSPS model showed superior phenomena compared with other known software quality methods and also expressed significant advantages, while using it on the production software. So, an effective application of QSPS would result in the smooth running of the production software to get a high quality product according to customer and standard requirements.
21
Mahmmod, Khalid Fazaa, Mohammed Muzahem Azeez, and Zeyad Hashem Ismael. "Design an active verification mechanism for certificates revocation in OCSP for internet authentication." International Journal of Electrical and Computer Engineering (IJECE) 10, no. 4 (August 1, 2020): 4208. http://dx.doi.org/10.11591/ijece.v10i4.pp4208-4216.
Full textAbstract:
No doubt that data security online is crucial. Therefore, great attention has been paid to that aspect by companies and organizations given its economic and social implications. Thus, online certificate status protocol (OCSP) is considered one of the most prominent protocol functioning in this field, which offers a prompt support for certificates online. In this research, a model designed based on field programable gate array (FPGA) using Merkel’s tree has been proposed to overcome the delay that might have occurred in sorting and authentication of certificates. Having adopted this model and with the assistance of Hash function algorithm, more than 50% of certificates have been processed in comparison with standard protocol. Moreover, certificates have been provided with substantial storage space with high throughput. Basically, Hash function algorithm has been designed to arrange and specify a site of verified or denied certificates within time of validity to protect servers from intrusion and clients from using applications with harmful contents.
22
Фігурка, Марія Василівна. "ОСОБЛИВОСТІ ВПРОВАДЖЕННЯ МІЖНАРОДНОГО СТАНДАРТУ ISO 50001 ДЛЯ ЗАБЕЗПЕЧЕННЯ ЕКОНОМІЧНОЇ СТАБІЛЬНОСТІ ЗАКЛАДІВ ВИЩОЇ ОСВІТИ В УКРАЇНІ." Bulletin of the Kyiv National University of Technologies and Design. Series: Economic sciences 127, no. 5 (March 29, 2019): 12–22. http://dx.doi.org/10.30857/2413-0117.2018.5.1.
Full textAbstract:
The paper offers the research findings on the implementation feasibility and specifics of internal energy management in the institutions of higher education (IHE) in Ukraine, based on ISO 50001 international standard requirements as a part of total management system within the government vector of energy saving economy framework. The emphasis is maid on exploring the overall effects on the economic position of institutions of higher education from the growing utility costs burden that influences the education high quality maintenance as well as university competitiveness on the higher education market. Rationale is provided on the validity and commonality of methods, approaches and techniques for the implementation of the internal energy management system in institutions of higher education according to the ISO 50001 standard together with demonstrating the simplicity of the given standard integration into the current management systems. It is argued that on the one hand, the implementation of energy management systems in institutions of higher education assumes certain financial investment and administrative and organizational changes, on the other, it lays the basis for attracting funding for capital projects on infrastructure modernization. The benefits of the new version of the ISO 50001: 2018 standard have been investigated, their tendency to switching to the area of service sector have been specified and the application of its basic approaches to enhance energy management systems of institutions of higher education has been proposed. The study employed the following empirical and theoretical methods: expert analysis (study on the benefits of the international standards ISO 50001 series implementation); systems and analytical (to justify the feasibility of using international standard approaches while making management decisions within IHE). The motivation behind the implementation of IHE integrated management systems based on the requirements of the international standards of the ISO 50001 series has been explored. From the semantic analysis perspective, in the context of the research subject area, a hypothesis about the need to expand the application of ISO 500001 energy management systems has been put forward. During the verification of this hypothesis a relationship between energy saving policy and the IHE economic security has been substantiated. It is argued that energy management system is an organic element in strategic management architecture which affects the competitiveness of IHE.
23
Choi, Jusop, Junsung Cho, Hyoungshick Kim, and Sangwon Hyun. "Towards Secure and Usable Certificate-Based Authentication System Using a Secondary Device for an Industrial Internet of Things." Applied Sciences 10, no. 6 (March 13, 2020): 1962. http://dx.doi.org/10.3390/app10061962.
Full textAbstract:
As the number of controllers and devices increases in Industrial Internet of Things (IIoT) applications, it is essential to provide a secure and usable user authentication system for human operators who have to manage tens or hundreds of controllers and devices with his/her password. In this paper, we propose a formally verified certificate-based authentication system using a secondary network device for such IIoT applications. In the proposed system, a user’s sign key is encrypted with a secret key that can be computed with his/her password and a secret parameter in a secondary device to securely protect the sign key. To demonstrate the feasibility of the proposed system, we implemented a prototype with standard cryptographic algorithms (AES-256, RSA-3072, and ECDSA-256). The experiment results demonstrated that the execution time overhead of the sign key recovery process was 0.039 and 0.073 s, respectively, for RSA-3072 and ECDSA-256, which was marginal compared with the total execution time (0.383 s for RSA-3072 and 0.319 s for ECDSA-256) of the conventional system. We also verified the security of the proposed protocol using a formal verification tool called ProVerif.
24
Shah, Peer Azmat, Halabi B. Hasbullah, Ibrahim A. Lawal, Abubakar Aminu Mu’azu, and Low Tang Jung. "A TOTP-Based Enhanced Route Optimization Procedure for Mobile IPv6 to Reduce Handover Delay and Signalling Overhead." Scientific World Journal 2014 (2014): 1–16. http://dx.doi.org/10.1155/2014/506028.
Full textAbstract:
Due to the proliferation of handheld mobile devices, multimedia applications like Voice over IP (VoIP), video conferencing, network music, and online gaming are gaining popularity in recent years. These applications are well known to be delay sensitive and resource demanding. The mobility of mobile devices, running these applications, across different networks causes delay and service disruption. Mobile IPv6 was proposed to provide mobility support to IPv6-based mobile nodes for continuous communication when they roam across different networks. However, the Route Optimization procedure in Mobile IPv6 involves the verification of mobile node’s reachability at the home address and at the care-of address (home test and care-of test) that results in higher handover delays and signalling overhead. This paper presents an enhanced procedure, time-based one-time password Route Optimization (TOTP-RO), for Mobile IPv6 Route Optimization that uses the concepts of shared secret Token, time based one-time password (TOTP) along with verification of the mobile node via direct communication and maintaining the status of correspondent node’s compatibility. The TOTP-RO was implemented in network simulator (NS-2) and an analytical analysis was also made. Analysis showed that TOTP-RO has lower handover delays, packet loss, and signalling overhead with an increased level of security as compared to the standard Mobile IPv6’s Return-Routability-based Route Optimization (RR-RO).
25
Srinivasan, S., Kethineni Keerthi, Gummadi Tejaswi, and Kodali Divya Shobana. "Secure Storage of Electronic Health Records on Cloud Using Integrity Verification Auditing." Revista Gestão Inovação e Tecnologias 11, no. 2 (June 8, 2021): 2132–41. http://dx.doi.org/10.47059/revistageintec.v11i2.1835.
Full textAbstract:
Health care facilities have tried to keep sensitive patient information safe. Health information is important in identifying any stage of treatment. However, such information should be kept confidential and only available at health care facilities. To ensure data availability, health care data is now stored in the cloud and accessible online. But, this approach poses many threats due to the possibility of a patient data to be accessed by unauthorized personnel. Moreover, the standard data access control mechanisms are insufficient to ensure integrity of data due to numerous users. The constant adjustment of privileges also affected confidentiality. This paper proposes a novel approach in which the sensitive patient data in Electronic Health Records is hidden and stored more securely in the cloud. It uses a sanitization technique to detect sensitive data in the EHR and make use of identity based shared data integrity auditing to allow authorized access to the data. The web based application which uses the proposed technique is developed and tested to demonstrate its effectiveness.
26
Mamyrbayev, Orken, Aizat Kydyrbekova, Keylan Alimhan, Dina Oralbekova, Bagashar Zhumazhanov, and Bulbul Nuranbayeva. "Development of security systems using DNN and i & x-vector classifiers." Eastern-European Journal of Enterprise Technologies 4, no. 9(112) (August 31, 2021): 32–45. http://dx.doi.org/10.15587/1729-4061.2021.239186.
Full textAbstract:
The widespread use of biometric systems entails increased interest from cybercriminals aimed at developing attacks to crack them. Thus, the development of biometric identification systems must be carried out taking into account protection against these attacks. The development of new methods and algorithms for identification based on the presentation of randomly generated key features from the biometric base of user standards will help to minimize the disadvantages of the above methods of biometric identification of users. We present an implementation of a security system based on voice identification as an access control key and a verification algorithm developed using MATLAB function blocks that can authenticate a person's identity by his or her voice. Our research has shown an accuracy of 90 % for this user identification system for individual voice characteristics. It has been experimentally proven that traditional MFCCs using DNN and i and x-vector classifiers can achieve good results. The paper considers and analyzes the most well-known approaches from the literature to the problem of user identification by voice: dynamic programming methods, vector quantization, mixtures of Gaussian processes, hidden Markov model. The developed software package for biometric identification of users by voice and the method of forming the user's voice standards implemented in the complex allows reducing the number of errors in identifying users of information systems by voice by an average of 1.5 times. Our proposed system better defines voice recognition in terms of accuracy, security and complexity. The application of the results obtained will improve the security of the identification process in information systems from various attacks.
27
Deuber, Dominic, Matteo Maffei, Giulio Malavolta, Max Rabkin, Dominique Schröder, and Mark Simkin. "Functional Credentials." Proceedings on Privacy Enhancing Technologies 2018, no. 2 (April 1, 2018): 64–84. http://dx.doi.org/10.1515/popets-2018-0013.
Full textAbstract:
Abstract A functional credential allows a user to anonymously prove possession of a set of attributes that fulfills a certain policy. The policies are arbitrary polynomially computable predicates that are evaluated over arbitrary attributes. The key feature of this primitive is the delegation of verification to third parties, called designated verifiers. The delegation protects the privacy of the policy: A designated verifier can verify that a user satisfies a certain policy without learning anything about the policy itself. We illustrate the usefulness of this property in different applications, including outsourced databases with access control. We present a new framework to construct functional credentials that does not require (non-interactive) zero-knowledge proofs. This is important in settings where the statements are complex and thus the resulting zero-knowledge proofs are not efficient. Our construction is based on any predicate encryption scheme and the security relies on standard assumptions. A complexity analysis and an experimental evaluation confirm the practicality of our approach.
28
Paul, Shubhra Deb, and Swarup Bhunia. "SILVerIn: Systematic Integrity Verification of Printed Circuit Board Using JTAG Infrastructure." ACM Journal on Emerging Technologies in Computing Systems 17, no. 3 (June 25, 2021): 1–28. http://dx.doi.org/10.1145/3460232.
Full textAbstract:
A printed circuit board (PCB) provides necessary mechanical support to an electronic system and acts as a platform for connecting electronic components. Counterfeiting and in-field tampering of PCBs have become significant security concerns in the semiconductor industry as a result of increasing untrusted entities in the supply chain. These counterfeit components may result in performance degradation, profit reduction, and reputation risk for the manufacturers. While Integrated Circuit (IC) level authentication using physical unclonable functions (PUFs) has been widely investigated, countermeasures at the PCB level are scarce. These approaches either suffer from significant overhead issues, or opportunistic counterfeiters can breach them like clockwork. Besides, they cannot be extended to system-level (both chip and PCB together), and their applications are also limited to a specific purpose (i.e., either counterfeiting or tampering). In this article, we introduce SILVerIn , a novel systematic approach to verify the authenticity of all chips used in a PCB as well as the board for combating attacks such as counterfeiting, cloning, and in-field malicious modifications. We develop this approach by utilizing the existing boundary scan architecture (BSA) of modern ICs and PCBs. As a result, its implementation comes at a negligible (∼0.5%) hardware overhead. SILVerIn is integrated into a PCB design during the manufacturing phase. We implement our technique on a custom hardware platform consisting of an FPGA and a microcontroller. We incorporate the industry-standard JTAG (Joint Test Action Group) interface to transmit test data into the BSA and perform hands-on measurement of supply current at both chip and PCB levels on 20 boards. We reconstruct these current values to digital signatures that exhibit high uniqueness, robustness, and randomness features. Our approach manifests strong reproducibility of signatures at different supply voltage levels, even with a low-resolution measurement setup. SILVerIn also demonstrates a high resilience against machine learning-based modeling attacks, with an average prediction accuracy of ∼51%. Finally, we conduct intentional alteration experiments by replacing the on-board FPGA to replicate the scenario of PCB tampering, and the results indicate successful detection of in-field modifications in a PCB.
29
Hussien, Hassan Mansur, Sharifah Md Yasin, Nur Izura Udzir, and Mohd Izuan Hafez Ninggal. "Blockchain-Based Access Control Scheme for Secure Shared Personal Health Records over Decentralised Storage." Sensors 21, no. 7 (April 2, 2021): 2462. http://dx.doi.org/10.3390/s21072462.
Full textAbstract:
Blockchain technology provides a tremendous opportunity to transform current personal health record (PHR) systems into a decentralised network infrastructure. However, such technology possesses some drawbacks, such as issues in privacy and storage capacity. Given its transparency and decentralised features, medical data are visible to everyone on the network and are inappropriate for certain medical applications. By contrast, storing vast medical data, such as patient medical history, laboratory tests, X-rays, and MRIs, significantly affect the repository storage of blockchain. This study bridges the gap between PHRs and blockchain technology by offloading the vast medical data into the InterPlanetary File System (IPFS) storage and establishing an enforced cryptographic authorisation and access control scheme for outsourced encrypted medical data. The access control scheme is constructed on the basis of the new lightweight cryptographic concept named smart contract-based attribute-based searchable encryption (SC-ABSE). This newly cryptographic primitive is developed by extending ciphertext-policy attribute-based encryption (CP-ABE) and searchable symmetric encryption (SSE) and by leveraging the technology of smart contracts to achieve the following: (1) efficient and secure fine-grained access control of outsourced encrypted data, (2) confidentiality of data by eliminating trusted private key generators, and (3) multikeyword searchable mechanism. Based on decisional bilinear Diffie–Hellman hardness assumptions (DBDH) and discrete logarithm (DL) problems, the rigorous security indistinguishability analysis indicates that SC-ABSE is secure against the chosen-keyword attack (CKA) and keyword secrecy (KS) in the standard model. In addition, user collusion attacks are prevented, and the tamper-proof resistance of data is ensured. Furthermore, security validation is verified by simulating a formal verification scenario using Automated Validation of Internet Security Protocols and Applications (AVISPA), thereby unveiling that SC-ABSE is resistant to man-in-the-middle (MIM) and replay attacks. The experimental analysis utilised real-world datasets to demonstrate the efficiency and utility of SC-ABSE in terms of computation overhead, storage cost and communication overhead. The proposed scheme is also designed and developed to evaluate throughput and latency transactions using a standard benchmark tool known as Caliper. Lastly, simulation results show that SC-ABSE has high throughput and low latency, with an ultimate increase in network life compared with traditional healthcare systems.
30
Sulavko, Alexey. "Highly reliable authentication based on handwritten passwords using hybrid neural networks with protection of biometric templates from being compromised." Information and Control Systems, no. 4 (August 24, 2020): 61–77. http://dx.doi.org/10.31799/1684-8853-2020-4-61-77.
Full textAbstract:
Introduction: Biometrics-to-code converters based on neural networks are the ideological basis for a series of GOST R 52633 standards (unparalleled anywhere in the world) and can be used in the development of highly reliable biometric authentication and electronic signature with biometric activation. Purpose: Developing a model of a biometrics-to-code converter for highly reliable biometric authentication by handwritten passwords with high resistance to attacks on knowledge extraction. Results: We demonstrated the vulnerability of neural networks which makes it possible to perform quick directed enumeration of competing examples in order to compromise a biometric pattern and the personal key of its owner. We described a method of effective protection against this attack, and proposed a hybrid model for a biometrics-to-code converter based on a new type of hybrid neural networks, which does not compromise the biometric standard and the user’s key (password), being resistant to such attacks. The high reliability and effectiveness of the proposed model has been experimentally confirmed in handwritten password verification. The reliability indicators for generating a key from a handwritten password were: FRR = 11.5%, FAR = 0.0009% with a key length of 1024 bits (taking into account the presented fakes of a handwritten pattern). Practical relevance: The results can be used in information security applications or electronic document management.
31
Chien, Hung-Yu. "Two-Level-Composite-Hashing Facilitating Highly Efficient Anonymous IoT and D2D Authentication." Electronics 10, no. 7 (March 26, 2021): 789. http://dx.doi.org/10.3390/electronics10070789.
Full textAbstract:
Resource limitation is quite popular in many Internet of Things (IoT) devices and eavesdropping on the identities of IoT devices could reveal the sensitive information; therefore, high efficiency (computation and communication) and anonymity protection are two desirable properties in IoT authentication and in device-to-device (D2D) authentication. Conventionally, dynamic pseudonyms are widely adopted to protect the device identity privacy in IoT authentication and in D2D communications; however, the conventional mechanisms of pseudonym-renewing and pseudonym-bound-public-keys updating could be very costly or be vulnerable to the desynchronization-based denial-of-service (DoS) attacks. In this paper, we propose a novel 2-level composite hashing (2LCH) mechanism to mitigate the problems, and propose the 2LCH-based anonymous IoT and D2D authentication schemes. The schemes simultaneously achieve high efficiency and strong anonymity for such environments; once two devices successfully complete one instance of the server-assist anonymous authentication, they can run several instances of the direct D2D anonymous authentication without the involvement of the server. The merits of the schemes include: (1) high efficiency in terms of computation and communication; (2) easy and efficient generation/synchronization of dynamic pseudonyms; (3) robustness to both desynchronization-based DoS attacks and the unreliable connections; (4) easy application to the existent IoT architectures and standards; and (5) formal security verification.
32
Zhang, Li-li, Qi Zhao, Li Wang, and Ling-yu Zhang. "Research on Urban Traffic Signal Control Systems Based on Cyber Physical Systems." Journal of Advanced Transportation 2020 (October 20, 2020): 1–16. http://dx.doi.org/10.1155/2020/8894812.
Full textAbstract:
In this paper, we present a traffic cyber physical system for urban road traffic signal control, which is referred to as UTSC-CPS. With this proposed system, managers and researchers can realize the construction and simulation of various types of traffic scenarios, the rapid development, and optimization of new control strategies and can apply effective control strategies to actual traffic management. The advantages of this new system include the following. Firstly, the fusion architecture of private cloud computing and edge computing is proposed for the first time, which effectively improves the performance of software and hardware of the urban road traffic signal control system and realizes information security perception and protection in cloud and equipment, respectively, within the fusion framework; secondly, using the concept of parallel system, the depth of real-time traffic control subsystem and real-time simulation subsystem is realized. Thirdly, the idea of virtual scene basic engine and strategy agent engine is put forward in the system design, which separates data from control strategy by designing a general control strategy API and helps researchers focus on control algorithm itself without paying attention to detection data and basic data. Finally, considering China, the system designs a general control strategy API to separate data from control strategy. Most of the popular communication protocols between signal controllers and detectors are private protocols. The standard protocol conversion middleware is skillfully designed, which decouples the field equipment from the system software and achieves the universality and reliability of the control strategy. To further demonstrate the advantages of the new system, we have carried out a one-year practical test in Weifang City, Shandong Province, China. The system has been proved in terms of stability, security, scalability, practicability and rapid practice, and verification of the new control strategy. At the same time, it proves the superiority of the simulation subsystem in the performance and simulation scale by comparing the different-scale road networks of Shunyi District in Beijing and Weifang City in Shandong Province. Further tests were conducted using real intersections, and the results were equally valid.
33
McAteer, Ian, Ahmed Ibrahim, Guanglou Zheng, Wencheng Yang, and Craig Valli. "Integration of Biometrics and Steganography: A Comprehensive Review." Technologies 7, no. 2 (April 8, 2019): 34. http://dx.doi.org/10.3390/technologies7020034.
Full textAbstract:
The use of an individual’s biometric characteristics to advance authentication and verification technology beyond the current dependence on passwords has been the subject of extensive research for some time. Since such physical characteristics cannot be hidden from the public eye, the security of digitised biometric data becomes paramount to avoid the risk of substitution or replay attacks. Biometric systems have readily embraced cryptography to encrypt the data extracted from the scanning of anatomical features. Significant amounts of research have also gone into the integration of biometrics with steganography to add a layer to the defence-in-depth security model, and this has the potential to augment both access control parameters and the secure transmission of sensitive biometric data. However, despite these efforts, the amalgamation of biometric and steganographic methods has failed to transition from the research lab into real-world applications. In light of this review of both academic and industry literature, we suggest that future research should focus on identifying an acceptable level steganographic embedding for biometric applications, securing exchange of steganography keys, identifying and address legal implications, and developing industry standards.
34
Obeid, Fadi, and Philippe Dhaussy. "Formal Verification of Security Pattern Composition: Application to SCADA." Computing and Informatics 38, no. 5 (2019): 1149–80. http://dx.doi.org/10.31577/cai_2019_5_1149.
Full text
35
Leduc, G., and F. Germeau. "Verification of security protocols using LOTOS-method and application." Computer Communications 23, no. 12 (July 2000): 1089–103. http://dx.doi.org/10.1016/s0140-3664(99)00239-x.
Full text
36
Sy, B. K. "Secure Computation for Biometric Data Security—Application to Speaker Verification." IEEE Systems Journal 3, no. 4 (December 2009): 451–60. http://dx.doi.org/10.1109/jsyst.2009.2035979.
Full text
37
Wimala, Mia, Bob Zirads, and Rindu Evelina. "Water Security in Green Campus Assessment Standard." E3S Web of Conferences 93 (2019): 02003. http://dx.doi.org/10.1051/e3sconf/20199302003.
Full textAbstract:
The importance of fresh water in human life entails people to be conscious of conserving the resources since only one percent of the total fresh water on the earth is easily accessible. Green campus is a concept implemented by campuses where policies are lead to ecological points of view. This research aims to update the UI GreenMetric standard, focusing on Water (WA) category as a recommendation for Universitas Indonesia as the initiator. Referrals from other related standards, i.e. STARS® and Greenship were done on developing the category with its contents. Furthermore, the re-weighting and re-scoring system of the newly developed category were carried out using Analytical Hierarchy Process method, adjusted to the existing laws/regulations in Indonesia. For verification purposes, a study on campus performance at Universitas Katolik Parahyangan, was conducted using the newly developed category. The proposed strategies were then set to improve the campus performance in the future.
38
Jo, Young-Hoo, Seong-Yun Jeon, Jong-Hyuk Im, and Mun-Kyu Lee. "Security Analysis and Improvement of Fingerprint Authentication for Smartphones." Mobile Information Systems 2016 (2016): 1–11. http://dx.doi.org/10.1155/2016/8973828.
Full textAbstract:
Currently, an increasing number of smartphones are adopting fingerprint verification as a method to authenticate their users. Fingerprint verification is not only used to unlock these smartphones, but also used in financial applications such as online payment. Therefore, it is very crucial to secure the fingerprint verification mechanism for reliable services. In this paper, however, we identify a few vulnerabilities in one of the currently deployed smartphones equipped with fingerprint verification service by analyzing the service application. We demonstrate actual attacks via two proof-of-concept codes that exploit these vulnerabilities. By the first attack, a malicious application can obtain the fingerprint image of the owner of the victimized smartphone through message-based interprocess communication with the service application. In the second attack, an attacker can extract fingerprint features by decoding a file containing them in encrypted form. We also suggest a few possible countermeasures to prevent these attacks.
39
Gao, Min. "Research on the Application of Spatial Logic in the Security Protocol Verification of Computer." Applied Mechanics and Materials 513-517 (February 2014): 2379–83. http://dx.doi.org/10.4028/www.scientific.net/amm.513-517.2379.
Full textAbstract:
The security protocol is the core technology of the network communication security system which can maintain the security of the network environment effectively. With the increasing of the amount of network data, how to make security protocol to meet customers needs for network and information security and how to improve the efficiency of the security agreement are the focuses of exploration of the field of computer security. This paper introduces the security agreement composite form based on the theory of computer logic program, strand space model theory and certification test method. It also expands the Kailar logic and concludes the automotive verification algorithm of security protocol AAAP-KM algorithm. At last, this paper verifies the effectiveness and fastness of AAAP-KM algorithm taking the KM security protocol for example which provide a theoretical reference and technical support for the application and research of cyberspace logical security agreement.
40
TAKAHASHI, Kenta, and Shinji HIRATA. "Cancelable Biometrics with Provable Security and Its Application to Fingerprint Verification." IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences E94-A, no. 1 (2011): 233–44. http://dx.doi.org/10.1587/transfun.e94.a.233.
Full text
41
Han, KyungHyun, Trong-Kha Nguyen, Hun Joe, Seong Oun Hwang, and Chaeho Lim. "Cost-Effective and Active Security Verification Framework for Web Application Vulnerabilities." KIPS Transactions on Computer and Communication Systems 5, no. 8 (August 31, 2016): 189–96. http://dx.doi.org/10.3745/ktccs.2016.5.8.189.
Full text
42
Li, Xiao Le, Yong Jun Luo, Yu Liang, and Ying Wen. "Design and Verification of Security Protocol for Information Transmission in Digital Campus." Advanced Materials Research 532-533 (June 2012): 1230–34. http://dx.doi.org/10.4028/www.scientific.net/amr.532-533.1230.
Full textAbstract:
This paper mainly studies application of formal design for security protocols in digital campus. With a comprehensive analysis on security requirements of information transmission in digital campus, an information transmission model is built from the viewpoint of information security. Based on this model, a new security protocol, called DCIT for short, is designed. The formal analysis shows that secrecy, integrity, availability, controllability, non-repudiation and identifiability of information during transmission could be insured by DCIT, which could be used as a direction for development of various application systems in digital campus, from the viewpoint of information security.
43
Bicaku, Ani, Christoph Schmittner, Patrick Rottmann, Markus Tauber, and Jerker Delsing. "Security Safety and Organizational Standard Compliance in Cyber Physical Systems." Infocommunications journal, no. 1 (2019): 2–9. http://dx.doi.org/10.36244/icj.2019.1.1.
Full textAbstract:
In Industry 4.0 independent entities should interoperate to allow flexible and customized production. To assure the parties that individual components are secured to inter-operate, we investigate automated standard compliance. The standard compliance is defined based on given sets of security and safety requirements for which measurable indicator points are derived. Those reflect configurations of systems recommended by security, safety or process management relevant standards and guidelines, which help to demonstrate the state of compliance. We propose in this paper an approach to automate such an assessment when components are inter-operating with each other by using a monitoring and standard compliance verification framework. The framework will assure the parties that services or devices within their organizations operate in a secure and standard compliant way, without compromising the underlying infrastructure.
44
Ahamad, Shaik Shakeel, V. N. Sastry, and Siba K. Udgata. "A Secure Mobile Wallet Framework with Formal Verification." International Journal of Advanced Pervasive and Ubiquitous Computing 4, no. 2 (April 2012): 1–15. http://dx.doi.org/10.4018/japuc.2012040101.
Full textAbstract:
This paper proposes a Secure Mobile Wallet Framework (SMWF) using WPKI (Wireless Public Key Infrastructure) and UICC (Universal Integrated Circuit Card) by defining (a) a procedure of personalizing UICC by the client, (b) a procedure of provisioning and personalization (Mutual Authentication and Key Agreement Protocol) of Mobile Payments Application (which is on UICC) by the Bank and (c) our proposed mobile wallet is will have mobile wallet manager managed by CA (acting as TSM), every mobile application is independent, protected by firewalls and encrypted data is stored in the mobile wallet application. Their proposed Mobile Wallet ensures end to end security. The authors’ proposed SMWF is compared with recent works and found to be better in terms of generating client’s credentials, implementation of WPKI in UICC, personalization of mobile payment application by the bank and in ensuring end to end security (i.e., from Mobile Payments Application in UICC to the Bank Server). The proposed mobile payment protocol originating from Mobile Payment Application (which is on UICC) to the Bank Server realizes Fair Exchange ensures Confidentiality, Authentication, Integrity and Non Repudiation, prevents double spending, over spending and money laundering, and withstands replay, Man in the Middle (MITM) and Impersonation attacks. Proposed mobile payment protocol is formally verified using AVISPA and Scyther Tool and presented with results.
45
Kumari, Kamlesh, and Sanjeev Rana. "Offline Signature Verification using Intelligent Algorithm." International Journal of Engineering & Technology 7, no. 4.12 (October 4, 2018): 69. http://dx.doi.org/10.14419/ijet.v7i4.12.20995.
Full textAbstract:
Signature verification is important in banking, legal, financial transactions for security purpose. Offline signature verification is a complex task because active information i.e. temporal information is missing in static image. There is no standard feature extraction method for offline signature identification as in case of other behavior modalities e.g. in automatic speech recognition like LPCC (Linear Predictive Ceptral Coefficients).Our research presents an intelligent algorithm for feature extraction based on image difference of genuine signature image and questioned signature image. Six features i.e. average object area, entropy, standard deviation, mean, Euler no., and area are analyzed. Best results are reported using combination of Average Object Area, Mean, Euler No. and Area. CEDAR (Center of Excellence for Document Analysis) database is used for offline signature verification. The database consists of static signature samples taken from 55 users. The Proposed algorithm is quite efficient as it is less computationally. Experiments are performed with both models i.e. Writer-Independent (WI) system and Writer-Dependent.
46
Hur, Hwan Seok, Sung Hoon Kang, and Seung Joo Kim. "A Proposal for "Security Verification Method for Implementation of Secure Android Mobile Application"." KIPS Transactions on Computer and Communication Systems 2, no. 10 (October 31, 2013): 445–60. http://dx.doi.org/10.3745/ktccs.2013.2.10.445.
Full text
47
LIU Junxiu, XIAO Long, LU Liuxiu, and SU Xiaowei. "Fast Information Security Verification Method and its Application in Electric Energy Management Terminal." Journal of Convergence Information Technology 7, no. 2 (February 29, 2012): 217–24. http://dx.doi.org/10.4156/jcit.vol7.issue2.26.
Full text
48
Bernardi, S., U. Gentile, S. Marrone, J. Merseguer, and R. Nardone. "Security modelling and formal verification of survivability properties: Application to cyber–physical systems." Journal of Systems and Software 171 (January 2021): 110746. http://dx.doi.org/10.1016/j.jss.2020.110746.
Full text
49
NAGY, MARIUS, and SELIM G. AKL. "ENTANGLEMENT VERIFICATION WITH AN APPLICATION TO QUANTUM KEY DISTRIBUTION PROTOCOLS." Parallel Processing Letters 20, no. 03 (September 2010): 227–37. http://dx.doi.org/10.1142/s0129626410000181.
Full textAbstract:
We develop an entanglement verification method not based on Bell inequalities, that achieves a higher reliability per number of qubits tested than existing procedures of this kind. Used in a quantum cryptographic context, the method gives rise to a new protocol for distributing classical keys through insecure quantum channels. The cost of quantum and classical communication is significantly reduced in the new protocol, while its security is increased with respect to other entanglement-based protocols exchanging the same number of qubits. To achieve this performance, our scheme relies on a simple quantum circuit and the ability to store qubits.
50
Arora, Shakti, and Surjeet Dalal. "An Optimized Cloud Architecture for Integrity Verification." Journal of Computational and Theoretical Nanoscience 16, no. 12 (December 1, 2019): 5067–72. http://dx.doi.org/10.1166/jctn.2019.8565.
Full textAbstract:
Cloud has become popular in today’s environment of IT industry where all types of services whether hardware, software, or storage can be availed at one place and can be used efficiently. When we use hardware and software then there is very less chance of risk but when we deal with storage then we are storing our personal data on the cloud which is not transparent to user. In proposed model we introduced hybrid technique which provides security and assurance beyond Service Level Agreement. We proposed a strong integrity verification mechanism at the time of recovering a file/data. Hardness/strength of the key or the shared file is increased up to maximum level i.e., 7.9. Integrity of the proposed system is compared with the standard cloud’s integrity and approximately we gain 60% higher level of integrity other than the standard cloud nodes.