一种软件源的可信管控模型设计

基于对目前可信计算信任链及度量基准值采集流程存在的问题,提出了软件源的可信管控模型,实现软件的安全认定、度量基准值统一计算采集以及可信第三方的集中管控,为软件的可信运行奠定了基础,降低了可信度量值采集工作的复杂度,对软件源的可信管控实施具有一定的指导意义。此外,进行了软件可信表征格式和基于可信表征的可信度量流程设计,将软件源的可信延伸至软件加载的可信和软件运行的可信,较大程度地提升了软件全生命周期的可信证明强度。     

全流程用户体验管理的实现方法

以上海电信移动用户数据为基础，以语音业务场景为突破口，介绍用户体验全流程管控的关键实现方法，通过对跨域数据建模，发现影响体验及满意度的影响因素，在知识图谱构建根因分析、定位和方案推荐的基础上，自动形成上海电信随身办APP工单，派发至处理人员，闭环管控，实现全流程的CEM（用户体验管理）感知管控体系。     

可信的网络投票方案及其应用

提出了一个安全可信的网络投票系统方案。该方案以公钥基础设施为基础,采用盲签名技术实现投票的匿名性,最终达到在投票过程中保护数据安全和个人隐私的目的。     

DMSS-动态Merkle可信树签名方案

 本文通过构造子树及密钥的动态循环更新实现了二叉树的动态更新,改进了Merkle可信树签名方案中,签名数量的增加使得二叉树庞大导致签名效率低下的缺陷,使签名的数量不在受到二叉树大小的影响.此外,本文对改进后的方案进行了安全分析,分析结果表明,该签名方案具有原始Merkle可信树签名方案的安全性,并且,由于采用了分时间段的密钥管理方式,该方案还具有前向安全性.     

区块链技术在委托代征获票场景的应用

委托代征业务是税局通过委托代征资质开放给企业进行税收代征的一项业务，传统委托代征业务中企业对于业务交易真实性的保证和合规性校验较弱，开票数据的可追溯性差，虚开、漏开的情况难以杜绝，税局采用稽核的方式也很难从源头上保障企业侧数据的安全可信。利用区块链技术溯源、信息无法篡改等特点，凭借区块链打通多个应用系统，从数据采集到报账支付全流程关键数据上链存储，分公司、税务局可针对每条报账数据溯源查询，实现委托代征业务的全链条透明化监管。同时，与税务局之间打通链路，实现电子发票凭证的线上开具，通过将电子凭证上链，实现了业务流、支付流、票据流线上管控，打造了完整的委托代征业务开票闭环业务体系，实现了开票全程无纸化，全链条透明化监管。     

基于区块链的零知识位置证明方法研究

地理位置虚拟软件泛滥、民用卫星定位信号易模拟或篡改,致使地理位置可信认证难以实现。针对已有位置证明方案采用中心化架构存在单点失效和易引起集中攻击等安全风险,该文引入去中心化范式思路,利用区块链具有的去中心化、不可篡改、可追溯等特点,并结合零知识证明协议,提出了基于区块链的零知识位置证明方法,实现了以去中心化、保护隐私、高度准确、审查抵制的地理位置认证服务,从而确保用户所提供位置的准确性。该方法不仅能消除中心化位置证明的弊端,确保位置数据的机密性,而且被证明位置数据一旦上链后不可篡改,实现了不可抵赖性。测试分析结果表明:完整的证明流程(包含证明生成验证和上链全过程)实际测试每次平均用时约5 s,其中证明生成和验证的总耗时是50.5～55.5 ms。因此,算法具有较好的性能开销,可满足实际应用需求。     

密码学在工程招投标中的应用

论文研究了密码学在工程招投标中的应用,把招投标流程与密码学知识相结合,基于知识证明签名给出一个安全有效的电子招投标方案。该方案实现了投标人身份的匿名性、投标信息的不可否认性、可公开验证性、投标人不可伪装性等问题。     

嵌入式可信平台构建技术研究

为了解决嵌入式终端缺乏完整性度量和应用软件任意执行的问题,在研究可信计算技术、嵌入式可信密码模块和服务模块的基础上,通过引入星形链可信传递模型和软件签名验证机制,设计了在内核空间软件签名验证的实现方案,构建了针对嵌入式设备的可信平台体系结构。该嵌入式可信平台可保证终端的完整性和应用软件的可信启动,可防止恶意代码的破坏,有效提高了嵌入式终端设备的安全性和可信性。     

LHL门限签名方案安全性分析

门限签名是群签名的推广,它在电子商务、身份认证以及信息安全领域有着广泛的应用。门限签名的重要安全要求是防伪造性。LHL门限签名方案是一个不需要可信中心的门限签名方案。根据一种针对它的合谋攻击方法,对LHL方案的安全性进行了分析、研究和探索,发现在LHL方案中通过伪造签名实施攻击无法通过部分签名的验证,同时对LHL签名方案的不足之处进行了一些改进,使其能够兼具匿名性与可追踪性。     

基于同态加密体制的通用可传递签名方案

通过分析基于大整数分解、离散对数和双线性对等数学问题的特殊可传递签名方案,抽象出了可传递签名实现方法的共性。以此为基础,提出了一个基于同态加密体制的通用可传递签名方案,该方案利用同态加密体制能支持密文运算的特性实现了可传递签名及验证的一般模型,为基于同态密码体制构造安全可靠的可传递签名方案提供了一种通用框架。其次,通过适当定义安全目标和设计安全性实验,完成了该通用可传递签名方案的可证明安全性,指出若使用的同态加密方案是CPA安全而标准签名是CMA安全的,则所提出的方案就达到CMA安全。最后,给出了该通用可传递签名方案并进行了性能分析与比较。     

AdaptiveMutate: a technique for privacy preservation

Mobile apps are known to be rich sources for gathering privacy-sensitive information about smartphone users. Despite the presence of encryption, passive network adversaries who have access to the network infrastructure can eavesdrop on the traffic and therefore fingerprint a user’s app by means of packet-level traffic analysis. Since it is difficult to prevent the adversaries from accessing the network, providing secrecy in hostile environments becomes a serious concern.In this study, we propose AdaptiveMutate, a privacy-leak thwarting technique to defend against the statistical traffic analysis of apps. First, we present a method for the identification of mobile apps using traffic analysis. Further, we propose a confusion system in which we obfuscate packet lengths, and/or inter-arrival time information leaked by the mobile traffic to make it hard for intruders to differentiate between the altered app traffic and the actual one using statistical analysis. Our aim is to shape one class of app traffic to obscure its features with the minimum overhead. Our system strives to dynamically maximize its efficiency by matching each app with the corresponding most dissimilar app. Also, AdaptiveMutate has an adaptive capability that allows it to choose the most suitable feature to mutate, depending on the type of apps analyzed and the classifier used, if known.We evaluate the efficiency of our model by conducting a comprehensive simulation analysis that mutates different apps to each other using AdaptiveMutate. We conclude that our algorithm is most efficient when we mutate a feature of one app to its most dissimilar one in another app. When applying the identification technique, we achieve a classification accuracy of 91.1%. Then, using our obfuscation technique, we are able to reduce this accuracy to 7%. Also, we test our algorithm against a recently published approach for mobile apps classification and we are able to reduce its accuracy from 94.8% to 17.9%. Additionally, we analyze the tradeoff between the shaping cost and traffic privacy protection, specifically, the associated overhead and the feasibility for real-time implementation.     

Repackaging Attack on Android Banking Applications and Its Countermeasures

Although anyone can easily publish Android applications (or apps) in an app marketplace according to an open policy, decompiling the apps is also easy due to the structural characteristics of the app building process, making them very vulnerable to forgery or modification attacks. In particular, users may suffer direct financial loss if this vulnerability is exploited in security-critical private and business applications, such as online banking. In this paper, some of the major Android-based smartphone banking apps in Korea being distributed on either the Android Market or the third party market were tested to verify whether a money transfer could be made to an unintended recipient. The experimental results with real Android banking apps showed that an attack of this kind is possible without having to illegally obtain any of the sender’s personal information, such as the senders public key certificate, the password to their bank account, or their security card. In addition, the cause of this vulnerability is analyzed and some technical countermeasures are discussed.     

A Mobile App Search Engine

With the popularity of mobile apps on mobile devices based on iOS, Android, Blackberry and Windows Phone operating systems, the numbers of mobile apps in each of the respective native app stores are increasing in leaps and bounds. Currently there are close to one million mobile apps across these four major native app stores. Due to the enormous number of apps, both the constituents in the app ecosytem, consumers and app developers, face problems in ‘app discovery’. For consumers, it is a daunting task to discover the apps they like and need among the huge number of available apps. Likewise, for developers, enabling their apps to be discovered is a challenge. To address these issues, Mobilewalla (MW) an app search engine provides an independent unbiased search for mobile apps with semantic search capabilities. It has also developed an objective scoring mechanism based on user and developer involvement with an app. The scoring mechanism enables MW to provide a number of other ways to discover apps—such as dynamically maintained ‘hot’ lists and ‘fast rising’ lists. In this paper, we describe the challenges of developing the MW platform and how these challenges have been mitigated. Lastly, we demonstrate some of the key functionalities of MW.     

Identifying relevant segments of AI applications adopters – Expanding the UTAUT2’s variables

Artificial intelligence (AI) is a future-defining technology, and AI applications are becoming mainstream in the developed world. Many consumers are adopting and using AI-based apps, devices, and services in their everyday lives. However, research examining consumer behavior in using AI apps is scant. We examine critical factors in AI app adoption by extending and validating a well-established unified theory of adoption and use of technology, UTAUT2. We also explore the possibility of unobserved heterogeneity in consumers’ behavior, including potentially relevant segments of AI app adopters. To augment the knowledge of end users’ engagement and relevant segments, we have added two new antecedent variables into UTAUT2: technology fear and consumer trust. Prediction-orientated segmentation was used on 740 valid responses collected using a pre-tested survey instrument. The results show five segments with different behaviors that were influenced by the variables of the proposed model. Once known, the profiles were used to propose apps to AI developers to improve consumer engagement. The moderating effects of the added variables—technology fear and consumer trust—are also shown. Finally, we discuss the theoretical and managerial implications of our findings and propose priorities for future research.     

A data reduction scheme for active authentication of legitimate smartphone owner using informative apps ranking

Smartphones are vulnerable to fraudulent use despite having strong authentication mechanisms. Active authentication based on behavioral biometrics is a solution to protect the privacy of data in smart devices. Machine-learning-based frameworks are effective for active authentication. However, the success of any machine-learning-based techniques depends highly on the relevancy of the data in hand for training. In addition, the training time should be very efficient. Keeping in view both issues, we’ve explored a novel fraudulent user detection method based solely on the app usage patterns of legitimate users. We hypothesized that every user has a unique pattern hidden in his/her usage of apps. Motivated by this observation, we’ve designed a way to obtain training data, which can be used by any machine learning model for effective authentication. To achieve better accuracy with reduced training time, we removed data instances related to any specific user from the training samples which did not contain any apps from the user-specific priority list. An information theoretic app ranking scheme was used to prepare a user-targeted apps priority list. Predictability of each instance related to a candidate app was calculated by using a knockout approach. Finally, a weighted rank was calculated for each app specific to every user. Instances with low ranked apps were removed to derive the reduced training set. Two datasets as well as seven classifiers for experimentation revealed that our reduced training data significantly lowered the prediction error rates in the context of classifying the legitimate user of a smartphone.     

Download or swipe left: The role of complexity,future-oriented emotions and feature overload

With the intense competition in the mobile applications (apps) market, it is imperative for app providers to understand how visual stimuli from their apps can create a positive first impression and enhance the app download rates. In the present study, the mechanism through which visual complexity influences mobile app download intention is examined. Using a combination of convenience and snowball sampling, 218 participants were recruited to take part in a single-group post-test only quasi-experimental design. The findings of the study showed that visual complexity influences mobile app download intentions through the mediating role of two future-oriented emotions (i.e. hope and anticipated regret). Additionally, the study showed that the indirect effect of visual complexity on download intentions was moderated by feature overload with the importance of visual complexity significantly reducing as perceptions of feature overload increases. The proposed model explained 46% variance in the intentions to download a mobile app. The findings not only provide practical insights for mobile app developers and publishers but also theoretical insights on consumer decision making in the pre-use context of mobile apps.     

Religion-focused dating apps: A Q methodology study on the uses of mutual

Dating apps have become an increasingly viable option for individuals seeking interpersonal romantic relationships. While there is significant research regarding user motivation on dating apps such as Bumble, Tinder, and Match.com, there is no published research that discusses the motivations of Mutual app users. Developed as a dating app to target members of The Church of Jesus Christ of Latter-Day Saints, Mutual allows users to find potential mates who share their religious background and specify their relationship readiness (from “Into Dating I Guess” to “Ready for a Ring”). This research aims to illuminate the various motivations, attitudes, and opinions of Mutual app users through Q methodology, which identifies perceptual groups among homogeneous populations through a factor analysis of participants’ agreement with similar statements regarding Mutual use. Findings indicated four factor groups: the Relationship Readies (i.e., those serious about dating), the Swipeaholics (i.e., those looking for entertainment), the Faithless (i.e., those who felt pressured to use Mutual), and the Eligible Optimists (i.e., those who saw the app as a convenient, entertaining way to date). Different from other research on dating apps, this study indicates that people may use a niche religion-focused dating app to find individuals with similar moral values or due to external pressure from others. Results warrant further investigation into niche dating apps.     

Design and implementation of a lightweight online certificate validation service

A PKI (public key infrastructure) provides for a digital certificate that can identify an individual or an organization. However, the existence of a certificate is a necessary but not sufficient evidence for its validity. The PKI needs to provide applications that use certificates with the ability to validate, at the time of usage, that a certificate is still valid (not revoked). One of the two standard protocols to check the revocation status of certificates is the Online Certificate Status Protocol (OCSP). In this article, we propose an OCSP-based implementation that enhances the performance of standard OCSP. In particular, we put special emphasis on those issues that affect security and performance when the validation service is deployed in a real scenario. Finally, we provide experimental results that show that our implementation outperforms standard OCSP.     

Systematic evaluation of mobile fitness apps: Apps as the Tutor,Recorder, Game Companion,and Cheerleader

Mobile fitness applications are innovating the ways in which smartphone users self-manage their health. Prior research found that app functions may impact app efficacy. However, research to date has not sought to systematically investigate how different combinations of app functions impact user response to apps, especially adoption intent. This article describes two studies on mobile fitness app characteristics and user attitudes. Study One used content analysis and hierarchical cluster analysis on 98 iPhone fitness apps and identified four app clusters: “Tutor”, “Recorder”, “Game Companion”, and “Cheerleader.” Tracking was the predominant function in current market, but tracking-focused Recorder apps received lowest user ratings among all app clusters. Users favored Tutor apps that combine exercise education and tracking, and Game Companion apps that combine gamification, tracking, and social functions. Function combinations, rather than standalone functions, impact app success. Following a Reasoned Action Approach, Study Two found various effects of individual differences (age, gender, BMI, eHealth literacy, smartphone experience, function preference) on user attitude toward different fitness app types. A comparison between two studies demonstrated a mismatch between market offerings and user needs regarding app functions. Implications of results for mobile fitness app design to improve consumer health and for theories are discussed.     

A look-ahead synthesis technique with backtracking for switching activity reduction in low power high-level synthesis

Research work done has shown that power consumption in digital integrated circuits can be effectively reduced by reducing the switching activity occurring on the functional modules. High-level synthesis of digital integrated circuits for low power often optimizes the switching activity during the two main synthesis processes, operation scheduling and module binding, which are usually performed one control step at a time in two separated stages. As the two processes are strongly interdependent, separate optimization of switching activity in a step-by-step manner frequently leads to sub-optimal solutions. In this paper, we propose a novel look-ahead synthesis technique with backtracking for the reduction of switching activity in low power high-level synthesis, which not only performs the scheduling and binding simultaneously in an integrated manner using a weighted bipartite technique, but also employs a branch and bound approach with look-ahead evaluation of switching activity for one or more control steps. The look-ahead technique generates multiple schedulings and bindings at the same time in one control step and uses each of them to generate more schedulings and bindings for the next one or more control steps. The best scheduling and binding pattern is then used for backtracking, therefore, effectively reducing the probability for the solutions to fall into local minimum. We tested the look-ahead algorithm with several published benchmarks and the experimental results obtained show that the switching activity can be reduced significantly, with an average of more than 50% reduction in switching activity for the tested benchmarks.