A framework for implementing outsourcing schemes

En esta tesis se aborda el problema de la externalización segura de servicios de datos y computación. El escenario de interés es aquel en el que el usuario posee datos y quiere subcontratar un servidor en la nube (“Cloud”). Además, el usuario puede querer también delegar el cálculo de un subconjunto de sus datos al servidor. Se presentan dos aspectos de seguridad relacionados con este escenario, en concreto, la integridad y la privacidad y se analizan las posibles soluciones a dichas cuestiones, aprovechando herramientas criptográficas avanzadas, como el Autentificador de Mensajes Homomórfico (“Homomorphic Message Authenticators”) y el Cifrado Totalmente Homomórfico (“Fully Homomorphic Encryption”). La contribución de este trabajo es tanto teórica como práctica. Desde el punto de vista de la contribución teórica, se define un nuevo esquema de externalización (en lo siguiente, denominado con su término inglés Outsourcing), usando como punto de partida los artículos de [3] y [12], con el objetivo de realizar un modelo muy genérico y flexible que podría emplearse para representar varios esquemas de ”outsourcing” seguro. Dicho modelo puede utilizarse para representar esquemas de “outsourcing” seguro proporcionando únicamente integridad, únicamente privacidad o, curiosamente, integridad con privacidad. Utilizando este nuevo modelo también se redefine un esquema altamente eficiente, construido en [12] y que se ha denominado Outsourcinglin. Este esquema permite calcular polinomios multivariados de grado 1 sobre el anillo Z2k . Desde el punto de vista de la contribución práctica, se ha construido una infraestructura marco (“Framework”) para aplicar el esquema de “outsourcing”. Seguidamente, se ha testado dicho “Framework” con varias implementaciones, en concreto la implementación del criptosistema Joye-Libert ([18]) y la implementación del esquema propio Outsourcinglin. En el contexto de este trabajo práctico, la tesis también ha dado lugar a algunas contribuciones innovadoras: el diseño y la implementación de un nuevo algoritmo de descifrado para el esquema de cifrado Joye-Libert, en colaboración con Darío Fiore. Presenta un mejor comportamiento frente a los algoritmos propuestos por los autores de [18];la implementación de la función eficiente pseudo-aleatoria de forma amortizada cerrada (“amortized-closed-form efficient pseudorandom function”) de [12]. Esta función no se había implementado con anterioridad y no supone un problema trivial, por lo que este trabajo puede llegar a ser útil en otros contextos. Finalmente se han usado las implementaciones durante varias pruebas para medir tiempos de ejecución de los principales algoritmos.---ABSTRACT---In this thesis we tackle the problem of secure outsourcing of data and computation. The scenario we are interested in is that in which a user owns some data and wants to “outsource” it to a Cloud server. Furthermore, the user may want also to delegate the computation over a subset of its data to the server. We present the security issues related to this scenario, namely integrity and privacy and we analyse some possible solutions to these two issues, exploiting advanced cryptographic tools, such as Homomorphic Message Authenticators and Fully Homomorphic Encryption. Our contribution is both theoretical and practical. Considering our theoretical contribution, using as starting points the articles of [3] and [12], we introduce a new cryptographic primitive, called Outsourcing with the aim of realizing a very generic and flexible model that might be employed to represent several secure outsourcing schemes. Such model can be used to represent secure outsourcing schemes that provide only integrity, only privacy or, interestingly, integrity with privacy. Using our new model we also re-define an highly efficient scheme constructed in [12], that we called Outsourcinglin and that is a scheme for computing multi-variate polynomials of degree 1 over the ring Z2k. Considering our practical contribution, we build a Framework to implement the Outsourcing scheme. Then, we test such Framework to realize several implementations, specifically the implementation of the Joye-Libert cryptosystem ([18]) and the implementation of our Outsourcinglin scheme. In the context of this practical work, the thesis also led to some novel contributions: the design and the implementation, in collaboration with Dario Fiore, of a new decryption algorithm for the Joye-Libert encryption scheme, that performs better than the algorithms proposed by the authors in [18]; the implementation of the amortized-closed-form efficient pseudorandom function of [12]. There was no prior implementation of this function and it represented a non trivial work, which can become useful in other contexts. Finally we test the implementations to execute several experiments for measuring the timing performances of the main algorithms.

Biometric authentication of users through iris by using key binding and similarity preserving hash functions = Autenticación biométrica de usuarios a través del iris mediante la ocultación de claves y funciones resumen que preservan la similitud

El extraordinario auge de las nuevas tecnologías de la información, el desarrollo de la Internet de las Cosas, el comercio electrónico, las redes sociales, la telefonía móvil y la computación y almacenamiento en la nube, han proporcionado grandes beneficios en todos los ámbitos de la sociedad. Junto a éstos, se presentan nuevos retos para la protección y privacidad de la información y su contenido, como la suplantación de personalidad y la pérdida de la confidencialidad e integridad de los documentos o las comunicaciones electrónicas. Este hecho puede verse agravado por la falta de una frontera clara que delimite el mundo personal del mundo laboral en cuanto al acceso de la información. En todos estos campos de la actividad personal y laboral, la Criptografía ha jugado un papel fundamental aportando las herramientas necesarias para garantizar la confidencialidad, integridad y disponibilidad tanto de la privacidad de los datos personales como de la información. Por otro lado, la Biometría ha propuesto y ofrecido diferentes técnicas con el fin de garantizar la autentificación de individuos a través del uso de determinadas características personales como las huellas dáctilares, el iris, la geometría de la mano, la voz, la forma de caminar, etc. Cada una de estas dos ciencias, Criptografía y Biometría, aportan soluciones a campos específicos de la protección de datos y autentificación de usuarios, que se verían enormemente potenciados si determinadas características de ambas ciencias se unieran con vistas a objetivos comunes. Por ello es imperativo intensificar la investigación en estos ámbitos combinando los algoritmos y primitivas matemáticas de la Criptografía con la Biometría para dar respuesta a la demanda creciente de nuevas soluciones más técnicas, seguras y fáciles de usar que potencien de modo simultáneo la protección de datos y la identificacíón de usuarios. En esta combinación el concepto de biometría cancelable ha supuesto una piedra angular en el proceso de autentificación e identificación de usuarios al proporcionar propiedades de revocación y cancelación a los ragos biométricos. La contribución de esta tesis se basa en el principal aspecto de la Biometría, es decir, la autentificación segura y eficiente de usuarios a través de sus rasgos biométricos, utilizando tres aproximaciones distintas: 1. Diseño de un esquema criptobiométrico borroso que implemente los principios de la biometría cancelable para identificar usuarios lidiando con los problemas acaecidos de la variabilidad intra e inter-usuarios. 2. Diseño de una nueva función hash que preserva la similitud (SPHF por sus siglas en inglés). Actualmente estas funciones se usan en el campo del análisis forense digital con el objetivo de buscar similitudes en el contenido de archivos distintos pero similares de modo que se pueda precisar hasta qué punto estos archivos pudieran ser considerados iguales. La función definida en este trabajo de investigación, además de mejorar los resultados de las principales funciones desarrolladas hasta el momento, intenta extender su uso a la comparación entre patrones de iris. 3. Desarrollando un nuevo mecanismo de comparación de patrones de iris que considera tales patrones como si fueran señales para compararlos posteriormente utilizando la transformada de Walsh-Hadarmard. Los resultados obtenidos son excelentes teniendo en cuenta los requerimientos de seguridad y privacidad mencionados anteriormente. Cada uno de los tres esquemas diseñados han sido implementados para poder realizar experimentos y probar su eficacia operativa en escenarios que simulan situaciones reales: El esquema criptobiométrico borroso y la función SPHF han sido implementados en lenguaje Java mientras que el proceso basado en la transformada de Walsh-Hadamard en Matlab. En los experimentos se ha utilizado una base de datos de imágenes de iris (CASIA) para simular una población de usuarios del sistema. En el caso particular de la función de SPHF, además se han realizado experimentos para comprobar su utilidad en el campo de análisis forense comparando archivos e imágenes con contenido similar y distinto. En este sentido, para cada uno de los esquemas se han calculado los ratios de falso negativo y falso positivo. ABSTRACT The extraordinary increase of new information technologies, the development of Internet of Things, the electronic commerce, the social networks, mobile or smart telephony and cloud computing and storage, have provided great benefits in all areas of society. Besides this fact, there are new challenges for the protection and privacy of information and its content, such as the loss of confidentiality and integrity of electronic documents and communications. This is exarcebated by the lack of a clear boundary between the personal world and the business world as their differences are becoming narrower. In both worlds, i.e the personal and the business one, Cryptography has played a key role by providing the necessary tools to ensure the confidentiality, integrity and availability both of the privacy of the personal data and information. On the other hand, Biometrics has offered and proposed different techniques with the aim to assure the authentication of individuals through their biometric traits, such as fingerprints, iris, hand geometry, voice, gait, etc. Each of these sciences, Cryptography and Biometrics, provides tools to specific problems of the data protection and user authentication, which would be widely strengthen if determined characteristics of both sciences would be combined in order to achieve common objectives. Therefore, it is imperative to intensify the research in this area by combining the basics mathematical algorithms and primitives of Cryptography with Biometrics to meet the growing demand for more secure and usability techniques which would improve the data protection and the user authentication. In this combination, the use of cancelable biometrics makes a cornerstone in the user authentication and identification process since it provides revocable or cancelation properties to the biometric traits. The contributions in this thesis involve the main aspect of Biometrics, i.e. the secure and efficient authentication of users through their biometric templates, considered from three different approaches. The first one is designing a fuzzy crypto-biometric scheme using the cancelable biometric principles to take advantage of the fuzziness of the biometric templates at the same time that it deals with the intra- and inter-user variability among users without compromising the biometric templates extracted from the legitimate users. The second one is designing a new Similarity Preserving Hash Function (SPHF), currently widely used in the Digital Forensics field to find similarities among different files to calculate their similarity level. The function designed in this research work, besides the fact of improving the results of the two main functions of this field currently in place, it tries to expand its use to the iris template comparison. Finally, the last approach of this thesis is developing a new mechanism of handling the iris templates, considering them as signals, to use the Walsh-Hadamard transform (complemented with three other algorithms) to compare them. The results obtained are excellent taking into account the security and privacy requirements mentioned previously. Every one of the three schemes designed have been implemented to test their operational efficacy in situations that simulate real scenarios: The fuzzy crypto-biometric scheme and the SPHF have been implemented in Java language, while the process based on the Walsh-Hadamard transform in Matlab. The experiments have been performed using a database of iris templates (CASIA-IrisV2) to simulate a user population. The case of the new SPHF designed is special since previous to be applied i to the Biometrics field, it has been also tested to determine its applicability in the Digital Forensic field comparing similar and dissimilar files and images. The ratios of efficiency and effectiveness regarding user authentication, i.e. False Non Match and False Match Rate, for the schemes designed have been calculated with different parameters and cases to analyse their behaviour.

Métodos eficientes para criptografia baseada em reticulados.

Reticulados têm sido aplicados de diferentes maneiras em criptografia. Inicialmente utilizados para a destruição de criptossistemas, eles foram posteriormente aplicados na construção de novos esquemas, incluindo criptossistemas assimétricos, esquemas de assinatura cega e os primeiros métodos para encriptação completamente homomórfica. Contudo, seu desempenho ainda é proibitivamente lenta em muitos casos. Neste trabalho, expandimos técnicas originalmente desenvolvidas para encriptação homomórfica, tornando-as mais genéricas e aplicando-as no esquema GGH-YK-M, um esquema de encriptação de chave pública, e no esquema LMSV, a única construção homomórfica que não sucumbiu a ataques de recuperação de chaves IND-CCA1 até o momento. Em nossos testes, reduzimos o tamanho das chaves do GGH-YK-M em uma ordem de complexidade, especificamente, de O(n2 lg n) para O(n lg n), onde n é um parâmetro público do esquema. A nova técnica também atinge processamento mais rápido em todas as operações envolvidas em um criptossistema assimétrico, isto é, geração de chaves, encriptação e decriptação. A melhora mais significativa é na geração de chaves, que se torna mais de 3 ordens de magnitude mais rápida que resultados anteriores, enquanto a encriptação se torna por volta de 2 ordens de magnitude mais rápida. Para decriptação, nossa implementação é dez vezes mais rápida que a literatura. Também mostramos que é possível aumentar a segurança do esquema LMSV contra os ataques quânticos de recuperação de chaves recentemente publicados pela agência britânica GCHQ. Isso é feito através da adoção de reticulados não-ciclotômicos baseados em anéis polinomiais irredutíveis quase-circulantes. Em nossa implementação, o desempenho da encriptação é virtualmente idêntico, e a decriptação torna-se ligeiramente inferior, um pequeno preço a se pagar pelo aumento de segurança. A geração de chaves, porém, é muito mais lenta, devido à necessidade de se utilizar um método mais genérico e caro. A existência de métodos dedicados altamente eficientes para a geração de chaves nesta variante mais segura do LMSV permanece como um problema em aberto.

E-commerce business profile.

"W.O. 01-0247"--Colophon.

E-commerce business profile.

"This publication has been made available through a partnership of the Illinois Department of Commerce and Economic Opportunity's Illinois Entrepreneurship Network Business Information Center, the Small Business Development Center Network and the U.S. Small Business Administration."--p. [4] of cover.

Extension of the Internet tax moratorium : hearing before the Committee on Commerce, Science, and Transportation, United States Senate, One Hundred Seventh Congress, first session, March 14, 2001.

Issued on shipping list no. 2006-0110-P after being pulled from original shipping list no. 2006-0011-P.

Deploying internet commerce in lottery businesses:an executive guideline

Commerce is essentially the exchange of goods and services in various forms between sellers and buyers, together with associated financial transactions. Electronic Commerce (EC) is the process of conducing commerce through electronic means, including any electronic commercial activity supported by IT (information technology) (Adam and Yesha, 1996; Kambil, 1997; Yen, 1998). In this sense, EC is not totally new. Industries have used various EC platforms such as advertising on TV and ordering by telephone or fax. Internet Commerce (IC), or Web Commerce, is a specific type of EC (Maddox, 1998; Minoli D. and Minoli E., 1997). While some traditional EC platforms such as TV and telephone have been used to build “TV-gambling” and “telephone-betting” systems for conducting lottery business, Internet Lottery Commerce (ILC) has been assessed as the most promising type of EC in the foreseeable future. There are many social and moral issues relating to the conduct of lottery business on-line. However, this chapter does not debate these but deals only with business and technology issues. The purpose of this chapter is to provide a structured guide to senior executives and strategic planners who are planning on, or interested in, ILC deployment and operation. The guide consists of several stages: (1) an explanation of the industry segment’s traits, value chain, and current status; (2) an analysis of the competition and business issues in the Internet era and an evaluation of the strategic resources; (3) a planning framework that addresses major infrastructure issues; and (4) recommendations comprising the construction of an ILC model, suggested principles, and an approach to strategic deployment. The chapter demonstrates the case for applying the proposed guideline within the lottery business. Faced with a quickly changing technological context, it pays special attention to constructing a conceptual framework that addresses the key components of an ILC model. ILC fulfils the major activities in a lottery commerce value chain—advertising, selling and delivering products, collecting payments for tickets, and paying prizes. Although the guideline has been devised for lottery businesses, it can be applied to many other industry sectors.

Determinants of B2B e-commerce adoption in Saudi Arabian firms

Business-to-business (B2B) electronic commerce (e-commerce) has become an increasingly important initiative among organisations. The factors affecting the adoption decisions have been well-documented but there is a paucity of empirical studies that examine the adoption of e-commerce in developing economies in the Arab world. The aim of our study is to provide insights into the salient e-commerce adoption issues by focusing on Saudi Arabian businesses. We developed a conceptual model for B2B e-commerce adoption incorporating six factors. Survey data from 450 businesses were used to test the model and hypotheses. The analysis demonstrates that, (1) when e-commerce preliminary adoption is investigated, organizational IT readiness, management support and regulatory environment emerge as the strongest factor, (2) pressure from customers may not have much effect on the preliminary adoption of e-commerce by companies, but does significantly influence on the utilisation of e-commerce by firms, and (3) Saudi Arabia has a strong ICT infrastructure for supporting e-commerce practices. Taken together, these findings on the multi-dimensionality of e-commerce adoption show that preliminary adoption and utilisation of ecommerce are not only different measures of ecommerce adoption, but also have different determinants. The implications of the findings are discussed and suggestions for future inquiry are presented.

An investigation into the factors affecting e-commerce adoption decisions by SMEs:a study in Saudi Arabia

Electronic commerce (e-commerce) has become an increasingly important initiative among Small and Medium Enterprises (SMEs) as both a great opportunity and as a source of competition. The factors affecting adoption decisions of e-commerce by SMEs have been well documented, but there is a paucity of empirical studies that examine the adoption of e-commerce in the Arab world. The aim of this chapter is to provide insights into the salient e-commerce adoption issues by focusing on Saudi Arabian businesses. This chapter investigates the state of e-commerce adoption and analyses the factors that determine the extent to which SMEs in Saudi Arabia are inclined towards deploying e-commerce technologies. This research was designed using a qualitative approach through exploratory case studies selected from firms in Saudi Arabia. The findings contribute towards a better conceptual and practical understanding of the main factors driving SMEs to adopt e-commerce. The study has found that the level of e-commerce implementation has yet to mature and customer readiness for Internet shopping has to improve before e-commerce reaches the levels of maturity seen in other regions of the world. This study highlights several directions for future inquiry and implications for policymakers and managers who are involved in efforts to introduce complex innovations such as e-commerce into their organisations or are interested in expanding their e-commerce applications and generating more revenue.

Documento electrónico y título valor electrónico

El presente trabajo tiene por objeto precisar los conceptos jurídicos doctrinarios sobre documento, documento electrónico y título valor electrónico, fundamentándonos en la ley modelo de comercio electrónico aprobada por la ONU, la legislación de la Unión Económica Europea, la Ley 527 de l999, el decreto reglamentario No 1.747 del 11 de septiembre de 2000, la legislación complementaria sobre protección de derechos fundamentales, la doctrina y la jurisprudencia. Para ello, diremos que el comercio electrónico se enmarca dentro de la preceptiva del artículo 2 de la Constitución Política que consagra como principios del Estado social de Derecho la libertad de empresa, la intervención del Estado para regular la economía, y la protección de los derechos fundamentales de la persona humana y propiciar el bienestar de todos los ciudadanos. Por ello esta actividad puede ser desarrollada libremente por cualquier persona, siempre que respete los derechos fundamentales, como el derecho a la intimidad, la dignidad, la información, la salud pública, el habeas data, el sistema penal, la seguridad nacional y el interés general. Nos dedicaremos entonces a analizar qué se entiende por documento, características, requisitos de validez, prueba y eficacia de los documentos electrónicos y aplicación en las transacciones de bolsa y similares, el documento electrónico, el título valor electrónico y el tratamiento legal que al documento se le da en nuestra legislación.

DR-NEGOTIATE - A system for automated agent negotiation with defeasible logic-based strategies

This paper reports on a system for automated agent negotiation, based on a formal and executable approach to capture the behavior of parties involved in a negotiation. It uses the JADE agent framework, and its major distinctive feature is the use of declarative negotiation strategies. The negotiation strategies are expressed in a declarative rules language, defeasible logic, and are applied using the implemented system DR-DEVICE. The key ideas and the overall system architecture are described, and a particular negotiation case is presented in detail.