With the fast development of Internet-of-Things (IoT) technologies, IoT big data and its applications are getting more and more useful. However, traditional IoT data management is fragile and vulnerable. Once the gathered data are untrusted or the stored data are tampered with deliberately from the internal users or attacked by an external hacker, then the tampered data have a serious problem to be utilized. To solve the problems of trust and security of IoT big data management, in this article, we propose a permissioned blockchain-based decentralized trust management and secure usage control scheme of IoT big data (called BlockBDM), upon which all the data operations and management, such as data gathering, invoking, transfer, storage, and usage, are processed over the blockchain smart contract. To encourage the IoT client to supply high-quality content, in our scheme, we design public-blockchain-based tokens reward mechanism for the high-quality data supply contribution. All the data processing and usage procedure can be recorded in a cryptography-signed and Merkle tree-based transaction(s) and block(s) with high-level security in a global and distributed ledger with tamper resistance. For data utilization and consumption, we propose secure usage control for digital rights management and token-based data consumption approach of high-value data from being violated or spread without any limitation. We implemented the BlockBDM scheme based on public and permissioned blockchain for IoT big data management. Finally, a large amount of evaluation manifests that the proposed BlockBDM scheme is feasible, secure, and scalable for decentralized trust management of IoT big data.

Blockchain-Enabled Decentralized Trust Management and Secure Usage Control of IoT Big Data

We describe a digital signature scheme in which the public key is fixed but the secret signing key is updated at regular intervals so as to provide a forward security property: compromise of the current secret key does not enable an adversary to forge signatures pertaining to the past. This can be useful to mitigate the damage caused by key exposure without requiring distribution of keys. Our construction uses ideas from the Fiat-Shamir and Ong-Schnorr identification and signature schemes, and is proven to be forward secure based on the hardness of factoring, in the random oracle model. The construction is also quite efficient.

A forward-secure digital signature scheme.

A novel system architecture for secure authentication and data sharing in cloud enabled Big Data Environment

We propose the first forward-secure signature scheme for which both signing and verifying are as efficient as for one of the most efficient ordinary signature schemes (Guillou-Quisquater [GQ88]), each requiring just two modular exponentiations with a short exponent. All previously proposed forward-secure signature schemes took significantly longer to sign and verify than ordinary signature schemes. Our scheme requires only fractional increases to the sizes of keys and signatures, and no additional public storage. Like the underlying [GQ88] scheme, our scheme is provably secure in the random oracle model.

Forward-secure signatures with optimal signing and verifying

Recently, the chaos theory has been dealt with as a decent approach to reducing the computational complexity of a cryptographic technique while fulfilling the security necessities. In an ID-based cryptographic system where public keys are distributed to individual users, the application of chaotic maps allows users to set their network addresses or names as their individual public keys. This makes the public key cryptographic technique very user-friendly in that the public key confirmation process can be very informal and direct. In such a design, no huge public key database is required, and therefore, those security issues arising as a result of the existence of a public key database can be avoided. The aim of this article is to go deep into the possibility of transforming a chaotic-map-based cryptosystem into an ID-based technique without having to build a new framework from scratch or to do adjustment to the chaotic maps.

An efficient ID-based cryptographic transformation model for extended chaotic-map-based cryptosystem

The great benefits introduced by big data analysis technology motivate both individuals and enterprises to collect and share the data over the internet. Although cloud storage provides a perfect platform for data sharing, the security issue becomes the principal obstacle to preventing users from outsourcing their data to cloud servers, especially when the data involve sensitive information. As a new variant of public-key encryption scheme, attribute-based encryption (ABE) provides a fuzzy matching between the data encryptor and decryptor. That is, the encryptor ensures that all those users with attributes satisfying the defined access policy can decrypt the shared data, but cannot identify which one can do that. Thus, the ABE scheme can preserve user privacy, and is regarded as a promising solution of securing data sharing in the cloud storage system. But the original ABE scheme cannot be directly deployed for several practical issues, such as key exposure and user revocation. In this paper, we simultaneously conquer the above two issues and put forward a forward and backward secure ciphertext-policy ABE scheme such that a revealed user secret key is useless for decrypting any ciphertexts. The proposed forward and backward secure ABE scheme is proved secure under a q-type assumption in the selective model, without random oracles. The performance discussion indicates that the proposed scheme provides stronger security guarantees than other similar ABE schemes, and thus is more desirable for cloud storage systems.

Forward and backward secure fuzzy encryption for data sharing in cloud computing

Biometric identification has developed rapidly in recent years because of its convenience and reliability. Due to the sensitivity of biometric data, many privacy-preserving biometric identification schemes have been put forward, exploiting either homomorphic encryption or matrix-transformation. However, existing schemes based on homomorphic encryption generally suffer from low computational efficiency, and existing matrix-transformation-based schemes are insufficiently secure. In this paper, we demonstrate that the matrix-transformation-based privacy-preserving biometric identification scheme recently proposed by Zhu et al. is vulnerable to a known-plaintext attack (KPA). To remedy this security flaw, we propose a new privacy-preserving biometric identification scheme, in which the property of the orthogonal matrix and additional randomness are utilized. Security analysis and comparisons indicate that our scheme can resist not only the KPA attack but also the more powerful chosen-plaintext attack (CPA), which is a reasonable attack in practice. Moreover, our scheme enjoys higher computational efficiency than other similar schemes, which implies our scheme can better support a huge database for practical biometric identification, and it also enhances privacy security of sensitive biometric data.

/pdf/an-efficient-biometric-identification-in-cloud-computing-3utunxcz9f.pdf

An Efficient Biometric Identification in Cloud Computing With Enhanced Privacy Security

Identity authentication is an important line of defense for network security, and passwords are still the mainstream of identity authentication. Password attacking is an important means of password security research. Probabilistic context-free grammar (PCFG) is the most effective password structure partitioning method at present. The string generation method based on neural network has powerful generalization ability. They effectively characterize the passwords on the substructure level and the character level respectively. In this paper, based on the merits of the above two models, we propose a password attacking method based on structure partition and bidirectional long short-term memory (BiLSTM) recurrent neural network, which is denoted as SPRNN model. Firstly, passwords are divided into abstract substructures. Then substrings of characters, digits and symbols in substructures are generated by using BiLSTM model to take account of the accuracy and generalization ability of the model. Finally, the method is verified by experiment on six real Chinese and English password datasets. The results show that in the context of a fixed number of guessing trials, the SPRNN model breaks the password 25% -30% more than Narayanan's method, about 10% than Weir et al.'s method password between the cross datasets.

A Password Cracking Method Based On Structure Partition and BiLSTM Recurrent Neural Network

Keyboard patterns are widely used in password construction, as they can be easily memorized with the aid of positions on the keyboard. Consequently, keyboard-pattern-based passwords has being the target in many dictionary attack models. However, most of the existing researches relies only on recognition methods defining keyboard pattern structures empirically or even manually. As a result, only those infamous keyboard patterns such as qwerty are recognized and many potential structures are not specified. Besides, there are limited studies focusing on the characteristics of keyboard patterns.

Qihui Zhang

Papers

Forward and backward secure fuzzy encryption for data sharing in cloud computing

An Efficient Biometric Identification in Cloud Computing With Enhanced Privacy Security

A Password Cracking Method Based On Structure Partition and BiLSTM Recurrent Neural Network

Studies of Keyboard Patterns in Passwords: Recognition, Characteristics and Strength Evolution

TG-SPSR: A Systematic Targeted Password Attacking Model