Virtual Private Laboratories: Concept and Two Building Blocks♦
K. Matsuura
Interfaculty Initiative in Information Studies, University of Tokyo
Komaba 4-6-1, Meguro-ku
Tokyo 153-8505, JAPAN
Abstract-We are facing globalization of R&D
activities over network involving different branches,companies, and organizations. These activities can behelped a lot by Internet. However, we have to be careful
about security problems associated with such activities.
The purpose of this paper is to identify the security
problems and introduce the total system as a newconcept: Virtual Private Laboratories (VPLs).
Some of the identified problems are trivial but others
are not; the former can be solved by a direct use ofexisting cryptographic primitives and protocols, whereas
the latter needs new technologies and theories. Although
all of them are necessary for VPLs, this paper is focusedon two non-trivial building blocks and a theory: (1)academic database with multiple security functions, (2)data hiding for the purpose of entrusted data analysis,and (3) risk-management theory for digital objects
secured by applied cryptography. In particular, (2) isstudied in detail and difference from conventional datahiding is shown with respect to evaluation criteria.

I. INTRODUCTION
We are facing globalization of R&D activities over
network involving different branches, companies, andorganizations. We know a lot of domestic examples (e.g.
nano-technology consortium in Germany), and this trend isgoing to be international. These activities can be helped a lot
by cheap and flexible use of Internet. However, sinceInternet is an open network, we have to be very careful
about information-security problems [1]: access control,
entity authentication, data secrecy, management ofintellectual-property rights [2], availability [3, 4], and so on.
The purpose of this paper is to identify the security
problems and introduce a new concept for researchpromotion infrastructure in the network era.
In particular, firstly the problems are described in Section
II, which then introduces the total system as a new conceptof Virtual Private Laboratories (VPLs). Among the
problems, data hiding for VPLs is studied in detail in
Section III. Finally Section IV concludes the paper.
II. VIRTUAL PRIVATE LABORATORIES
A. Open Network, R&D, and Security
Once equipped with security mechanisms, open
networks can be used for wider range of applications.
A good example is an electronic commerce [5]. We
can develop on-line shopping protocols by using
SSL/TLS [6]. We can construct digital payment ordigital cash systems [7, 8] with the help of applied
cryptography. Another emerging example is an egovernment including electronic voting systems [9].
Thus, in an open network, we can find a lot of♦applications of information-security technologies for
either commercial or administrative purposes.
Here we point out another possibility of making useof security technologies. Suppose a joint research
project which involves researchers distributed overdifferent companies/universities. The researchers
exchange ideas with one another via e-mail. They
download or browse digital publications as well as
confidential tentative documents (e.g. design
prototypes). They may have a video conference. They
may complete on-line accounting forms. They want toshare their ideas, bibliographic knowledge,
information from their experiences (e.g. attendance ata conference), and so on. We can see that a lot of security
problems would appear in those academic/research
activities over network.
B. Security Problems
It is easy to make a list of trivial security issues.
Suppose that all the researchers can use the same
VPN (Virtual Private Network) [10] based on IPsec(IP security protocols) [11]. In the RFC on Security
Architecture for the Internet Protocol [12], the set of
security services that IPsec can provide includes
access control, connectionless integrity, data origin
authentication, rejection of replayed packets,
confidentiality, and limited traffic flow confidentiality.
In particular, the IP Authentication Header (AH) [13]provides connectionless integrity, data origin
authentication, and an optional anti-replay service.
The Encapsulating Security Payload (ESP) protocol[14] may provide confidentiality, and limited traffic
flow confidentiality. It also may provide
connectionless integrity, data origin authentication,
and an anti-replay service. Both AH and ESP can bevehicles for access control.
We then proceed to three non-trivial issues: twobuilding blocks and one basic but new theory.
The first one is an architecture of a secure database
designed for the networked academic/research
activities. Suppose that we want to protect a data set
composed of multiple attributes/components, and thateach of them needs its own security property. One text
component may have to be encrypted. Another text
component may have to be encrypted as well as
digitally signed. An image component may have to bewatermarked. Another component may contain only
the message authentication code (MAC) of a specificregion of the data. Some of them may have to be
associated with a secure audit log [15]. These
requirements may lead us to Provision-Based AccessControl (PBAC) [16] in which an access request isauthorized provided the requester takes certain
security actions. For example, we may have aThis work is partly supported by a research fund from International Communications Foundation.

situation where an entity X is allowed to have a writeaccess to data component Y on condition that X
encrypts Y with a specific key K1 and generates a
specific entry to a secure audit log. However, the useof PBAC for networked research is not trivial, anddue to the space limitation, unfortunately details arebeyond the scope of this paper.
The second is related with protection of intellectualproperty rights. Suppose that digital data distributed
over the network do not exactly keep their original bitstrings due to the use of watermarking. When we use
watermarking for the purpose of copyright protection ofdigital images [17], the difference between the original
and the watermarked images is usually evaluated byhuman recognition; if the user does not notice thedifference by looking at the images, the watermarking is
acceptable. This is a conventional scenario. On the other
hand, in the case of research promotion infrastructure, nota human user but a computer itself uses the digital data,
and thus the evaluation criteria might be different. For
instance, we may watermark our own measured data andthen entrust the analysis of the data to a remotely-locatedthird party (see Fig. 1). What if the watermarked data give
us results quite different from those given by the original
data? We may also watermark our own design criteria andthen ask the specific design to a third party. What if thewatermarked criteria give us a too different solution? In
accordance with the application, we should use anappropriate strategy to evaluate the effects ofwatermarking or data-hiding. We will revisit this in detaillater in Section III.

prices but also other important stochastic values. For
example, digital certificates may have confidence
values or trust metrics [18]. Access-grant tickets may
have priority numbers or QoS (Quality-of-Service)
values. Watermarked images may have innocencevalues about their origins in terms of copyrightprotection. Any product may be associated withinsurance contracts [19]. Reward points may be
attached. Those values may change unpredictably
over time and cause risks. At the worst case, thevalues get into defaults (e.g. the corresponding
certificate is revoked) and the holder may have afinancial damage (e.g. a digital ticket which the holder
believes is certified can no longer be used).
A popular way for hedging such stochastic risks is
to introduce derivatives or options typically regarding
their prices. In financial theory, encouraged by theseminal paper by Black and Scholes [20], optionpricing theories have been developed. Most of them
use assumptions including divisibility of theunderlying assets, which is not trivial in the case of
the digital objects (suppose, for instance, an object
digitally signed by an authority which is not always
accessible). Thus we are motivated to study option
pricing with models and assumptions suitable for
digital objects toward a new risk-management theory
in the digital world (a series of its framework
appeared in [21, 22]).
C. Concept of VPLs
Suppose that we provide non-trivial technologies
and/or theories to solve or improve the security
problems. Then the system as a whole is no longer a
direct use of VPN. Let us call such a total system as
Virtual Private Laboratories (VPLs). By using VPLs,
researchers in different institutions can get together andcooperate with one another over an open network, and theirresearch activities are promoted significantly as if they were
working in the same laboratories.
III. DATA-HIDING FOR VPLS

Fig. 1. Entrusted analysis of remotely-measured and thenwatermarked data.
Finally, the third issue is the risk management
theory in the networked research cooperation where
financial transactions are involved. In short, the risk isfrom an unpredictable change of security/trust-relatedparameters over time. This is, at a first glance, hard tobelieve; since digital objects can keep their original
bit strings virtually forever, one may expect that there
would be no risk of change. This is, unfortunately, notalways the case. Digital objects can have not only

A. Basic Procedures
We consider random data hiding described as follows.
Let y = (y1, y2, . . ., yN)T be given measurements ordesign criteria. Not devoted to a specific data-hiding
algorithm, we consider a two-step procedure:(a) Randomly choose a specified number of themeasurements (yj1, yj2, . . ., yjn)T.
(b) The chosen measurements are disturbed by white
noise.
In the following, n/N is referred to as density of thisdata-hiding. Let us denote the disturbed (i.e. watermarked)
data by Y, and define Signal to Noise Ratio as
SNR = 20log( ||y|| / (||Y - y||) ).
(1)
Next, to study inverse estimation in VPLs, we introduce
generalized inversion. Let us consider a system equation
Ax = y(2)where A = (a,jj) is a system coefficient matrix and y is agiven measurement. x = (x1, x2, . . ., xM)T is a set of design
parameters to be designed by a third party. For simplicity,
we assume that A is full-ranked. When the dimension of x
is smaller than that of y (i.e. M<N), the system equation (2)can not be completely satisfied. In other words, the system

is overdetermined. In this overdetermined case, ageneralized-inverse matrix
A+ = (ATA)-1AT(3)
of A is used to obtain a minimum square-error estimate(4)x+ = A+ywhere x+ is the solution of the following minimum squareerror problem
Minimize: ||Ax - y||.
(5)
When M=N, the system equation (2) has a uniquesolution x = A-1y. In other words, the system is welldetermined. Depending on the design constraint, however,
the third party encounters an overdetermined problem
even if M=N; if the client wants to reduce the designcomponents, the number of non-zero parameters may belimited. In designing beamforming arrays, for example,
the number of arrays is saved as the solution gets moresparse [23]. Let us suppose that only m(<M) parameters
are allowed to be non-zero. In this case, the third party
would search for (i1, i2, . . ., im) which minimizes the error||A_[i1, i2, . . ., im] (xi1, xi2, . . ., xim) - y||(6)
where the coefficient matrix is given by
A_[i1, i2, . . ., im] = (ai1 , ai2 , . . ., aim)(7)
aij = (a1,ij, a2,ij, . . ., aN,ij)T.
(8)
A random search would be described as follows:(a) Choose (i1, i2, . . ., im) and set the error E to be an
infinity.
(b) Compute a minimum-square error solution for (i1,i2, . . ., im) as
x_[i1, i2, . . ., im]+
= (0, . . ., 0, xi1, 0, . . ., 0, xi2, 0, . . ., 0, xim, 0, . . ., 0)T (10)where(xi1, xi2, . . ., xim)T = A_[i1, i2, . . ., im]+y.
(11)( c ) If ||Ax_[i1, i2, . . ., im]+ - y|| < E, then take the vector
x_[i1, i2, . . ., im]+ as a temporary solution and set
E = ||Ax_[i1, i2, . . ., im]+ - y||.
(12)(d) Change (i1, i2, . . ., im) randomly and return to (b).
It should be noted that the problem above is not a
simple parameter fitting. We must select m (out of M)
parameters which take non-zero values so that theresultant square-error fitting problem gives the “minimumof the minimum errors” among all the possible selections;for each selection (Step (a) or (d)), we solve the squareerror problem (Step (b)), and search for better selection(Step (c)).
B. Effects of Data Hiding (Simulation Setup)
In order to avoid disturbance by computational roundoff error, a small-scale situation M=N=10 is considered.
The coefficient matrix A and the measurement vector y are
randomly generated. y is then watermarked to be Y with adensity of 0.4.
A client entrusts the design to 10 third parties. These
parties are called servers. The servers are allowed to selectat most m=3 non-zero design parameters and search for abetter selection by the random search described in theprevious section. Each random search is iterated 10 times.
Among the results from all the servers, the client finds
the best one in terms of the square error. The server which
gives this minimum error is called a winner. By definition,
the winner is best in terms of the error for the watermarked
data Y. However, it is not guaranteed that the winner's
selection gives the minimum error for the original data y
as well. If this is guaranteed, we can use the watermarking
without affecting the competition. Unfortunately, we
could not have such a guarantee in general. This, in turn,motivated us to define an evaluation criterion as follows.

(a) For the final parameter selection by each server, theerror not for the watermarked data Y but for the original
data y is computed.
(b) If the winner is still best in terms of this error, thedata-hiding is regarded as acceptable in terms of therobustness.
This procedure is summarized in Fig. 2.

Fig. 2. Design competition among remote servers.
After repeating the procedure, we examined how often
the data-hiding was accepted. This rate is defined as therate of acceptance and used as an evaluation criterion.
C. Effects of Data Hiding (Simulation Result)
For each set of A and y, the simulation is carried out
K=100 times. Let the number of acceptance (= how manytimes the data-hiding is accepted) be L. The rate ofacceptance L/K is then given as in Fig. 3. The simulation
was carried out by using two different system matrices
whose condition numbers were different by far; one is1530.4 while the other is 11.97.
Let us discuss the implication of the simulation results.
In linear estimation theory, the condition number of asystem coefficient matrix is in close relation to therobustness against errors; larger condition numbers cause
larger disturbance. The results in Fig. 3 suggests that(I) for high SNRs, smaller condition number is betterand that(II) for low SNRs, the difference in condition number
has insignificant effects.
In the simulated situation, a threshold SNR between (I)and (II) is estimated to be around 18dB.
The condition number depends on how the design
problem is represented. When data-hiding algorithms are
efficient enough to yield SNRs much higher than thethreshold, the particular representation of the problem isimportant for reliable analysis.

(0.05, 0.99, 0.00). The two sensor arrangements givedifferent condition numbers of the system coefficientmatrix; the arrangement (I) gives cond(A)=4.11x1010
while the arrangement (II) gives cond(A)=3.02x109.

(a) cond(A)=1530.4(a) Sensor arrangement (I)(b) cond(A)=11.97
Fig. 3. Rate of acceptance vs. Signal-to-Noise Ratio.
cond(A) represents the condition number of systemcoefficient matrix A.
Medical-image processing can be a good application ofdata-hiding due to privacy issues. For example, in abiomagnetic imaging system, how to determine the active
positions in human brain or heart is a fundamental
problem [24]. In the competition scenario considered inthis paper, each component of the vector y represents themagnetic-flux density measured by each magnetic sensor.
Selection from the components of the vector x
corresponds to the estimation of the active points in thehuman brain or heart. The system coefficient matrix A
depends on the arrangement of the sensors including
detection-coil types. Our simulation results suggest thatthe arrangement of the magnetic sensors could be
optimized in terms of the robustness against data-hiding.
D. Effects of Data Hiding (Phantom Experiment)
We demonstrate the effect of better condition numbers
by using real data measured around a saline-filled
spherical phantom whose radius is 10.0cm. The phantom
simulated a human brain and was set up in a magneticallyshielded room. The phantom had a dipole electrode inside.
The electrode simulated an active neural activity by a
spiked current dipole. The resultant magnetic signals(magnetic-flux density bandpassed between 0.1-100Hz)
were sequentially recorded at N=10 locations. We used
two different sensor arrangements shown in Fig. 4. The
electrode was located at (-0.11, -0.14, 5.10) [cm] and themanual location error was estimated to be below 0.2cm.
The direction of the current dipole at the electrode was(b) Sensor arrangement (II)Fig. 4. Magnetic-sensors around a spherical phantom
whose radius is 10.0cm. Each arrangement has 10 sensors.
A dipole electrode is located at (-0.11, -0.14, 5.10) [cm]and directed as indicated by the small circle and line (φ).
Equally-spaced M=10 grid points (0, 0, 0.5), (0, 0,1.5), . . ., (0, 0, 9.5) [cm] were set up along z axis in theupper hemisphere (z>0) of the phantom. The currentdipole moments (y-component) at these grid points aredesign parameters to be determined. We allow two grid
points to have non-zero moments and want to find thecouple of points adjacent to the electrode: (0, 0, 4.5) and (0,0, 5.5). This corresponds to a simplified version of aproblem which asks us the active region along a given
sulcus in the brain. The coefficient matrices werecomputed by using the Biot-Savart law. Then we had acompetition similar to that in the former simulation:(a) The measurement was watermarked with a densityof 0.4 and sent to 10 servers.
(b) Each server replied after 10 iterations of the random
search.
( c ) By changing the watermark 100 times, we obtained
the rate of acceptance.

For different SNRs, we obtained rate of acceptance as
illustrated in Fig. 5. Thus the sensor arrangement with thesmaller condition number (i.e. sensor arrangement (II))
gives better robustness, which is consistent with the resultof the simulation.

Fig. 6. Contour map of the original magnetic fieldmeasured by sensor arrangement (I).
(a) For sensor arrangement (I)(b) For sensor arrangement (II)Fig. 5. Rate of acceptance vs. SNR for different sensor
arrangements. Sensor arrangement (II) gives the smaller
condition number and the better robustness.

Fig. 7. Contour map of a watermarked magnetic fieldsuch that the SNR is 23.3dB.

Let us revisit the conventional idea of watermark
evaluation: in the case of watermarked images, if
users do not notice the difference between the original
image and the watermarked image by looking at them,
the watermarking is regarded as acceptable. Our
experimental results show how this conventional
evaluation does not work in the case of entrusted data
analysis by remote computers.
Figure 6 shows a contour map of the original
magnetic flux density measured by sensor
arrangement (I). If it is watermarked, it can bechanged into Fig. 7. It can also be changed into Fig. 8.
The former has an SNR of 23.3dB. Although this islower than the threshold SNR found in Fig. 6 (a),conventional human recognition may accept thewatermarked image as a good one. By contrast, thelatter has an SNR of 35.8dB. Although this is higher
than the threshold SNR, human recognition may reject
the watermarked image. Thus the criterion for
entrusted data analysis can be different from theconventional one.

Fig. 8. Contour map of a watermarked magnetic fieldsuch that the SNR is 35.8dB.

IV.

CONCLUDING REMARKS

Aiming at promoting research activities over open
networks, this paper introduced a new concept of
Virtual Private Laboratories (VPLs) after identifying
security problems needed for the activities. The
problems include trivial ones and non-trivial ones.
With respect to the former, we saw what can be done
by a direct use of existing technologies. With respect
to the latter, we pointed out two technical building
blocks and a new challenge of theory: (1) academic
database with multiple security functions, (2) datahiding for the purpose of entrusted data analysis, and(3) risk-management theory for digital objects secured
by applied cryptography.
Among the identified problems, this paper studied(2) in detail; the effects of data-hiding were analyzed
in the context of entrusted data analysis. Specifically,an entrusted design competition was simulated. The
result suggests the importance of the representation ofa design problem; better-conditioned coefficientmatrices contribute to more robust competition if the
SNR is high enough. This finding was also supported
by measured magnetic data in a phantom experiment,
and thus we are sure that acceptance criteria forwatermarked-and-then-entrusted data can be different
from those for conventional watermarked data such as
digital images.
We will soon proceed to studies of other building
blocks, aiming at implementing a prototype of VPLs.
REFERENCES[1] P.W. Dowd and J.T. McHenry, “Network
Security: It's Time to Take It Seriously,” IEEE
Computer, vol. 31, no. 9, pp. 24-28, September
1998.
[2] J.C. Davis, “Protecting Intellectual Property in
Cyberspace,” IEEE Technology and Society
Magazine, vol. 17, no. 2, pp. 12-25, 1998.
[3] K. Matsuura and H. Imai, “Protection ofAuthenticated Key-Agreement Protocol against a
Denial-of-Service Attack,” Cientifica, vol. 2, no.
11, pp. 15-19, 1999 [Digests 1998 Int. Symp. Info.
Theory & Its Applications pp. 466-470, 1998.].
[4] K. Matsuura and H. Imai, “Modified Aggressive
Modes of Internet Key Exchange Resistant against
Denial-of-Service Attacks,” IEICE Trans. Info.
Sys., vol. E83-D, no. 5, pp. 972-979, May 2000.
[5] S. Hamilton, “E-Commerce for the 21stCentury,” IEEE Computer, vol. 30, no. 5, pp. 4447, May 1997.
[6] T. Dierks and C. Allen, “The TLS Protocol
Version 1.0,” RFC2246, January 1999.
[7] T. Okamoto and K. Ohta, “Disposable ZeroKnowledge
Authentications
and
Their
Applications to Untraceable Electronic Cash,” inAdvances in Cryptology --- CRYPTO'89, Lecture
Notes in Computer Science 435, Springer-Verlag,
Berlin, pp.481-496, 1990.
[8] D. Chaum and S. Brands, “Minting Electronic
Cash,” IEEE SPECTRUM, vol. 34, no. 2, pp. 3034, February 1997.
[9] K.R. Iversen, “A Cryptographic Scheme for
Computerized General Elections,” in Advancesin Cryptology --- CRYPTO'91, Lecture Notes in

Computer Science 576, Springer-Verlag, Berlin,
pp. 405-419, 1992.
[10] W.A. Arbaugh, J.R. Davin, D.J. Farber and J.M.
Smith, “Security for Virtual Private Intranets,”
IEEE Computer, vol. 31, no. 9, pp. 48-55,
September 1998.
[11] E. Kaufman and A. Newman, Implementing
IPsec: Making Security Work on VPNs, Intranets,
and Extranets, John Wiley&Sons, 1999.
[12] S. Kent and R. Atkinson, “Security Architecture
for the Internet Protocol,” RFC2401, November
1998.
[13] S. Kent and R. Atkinson, “IP Authentication
Header,” RFC2402, November 1998.
[14] S. Kent and R. Atkinson, “IP Encapsulating
Security Payload (ESP),” RFC2406, November
1998.
[15] B. Schneier and J. Kelsey, “Secure Audit Logs to
Support Computer Forensics,” ACM Trans. on
Information and System Security, vol. 2, no. 2, pp.
159-176, May 1999.
[16] S. Jajodia, M. Kudo and V.S. Subrahmanian,“Provisional Authorizations,” Chapter 8 in ECommerce Security and Privacy, A.K. Ghosh(ed.), Kluwer Academic Publishers, Boston, 2001.
[17] S. Katzenbeisser and F. Petitcolas (eds.),
Information
HidingTechniquesfor
Steganography and Digital Watermarking,
Artech House Publishers, Boston, 2000.
[18] M.K. Reiter and S.G. Stubblebine, “Resilient
Authentication using Path Independence,” IEEE
Trans. Comput., vol. 47, no. 12, pp. 1351-1362,
December 1998.
[19] M.K.
ReiterandS.G.
Stubblebine,“Authentication Metric Analysis and Design,”
ACM Trans. on Information and System Security,
vol. 2, no. 2, pp. 138-158, May 1999.
[20] F. Black and M. Scholes, “The Pricing of Options
and Corporate Liabilities,” Journal of Political
Economy, vol. 81, pp. 637-654, 1973.
[21] K. Matsuura, “Digital Security Tokens and Their
Derivatives,” in 7th International Conference of
the Society for Computational Economics(SCE'01), New Haven, CT, June 2001.
[22] K. Matsuura, “A Derivative of Digital Objects
and Estimation of Default Risks in Electronic
Commerce,”
inProceedingsofThirdInternational Conference on Information andCommunications Security (ICICS'01), S. Qing, T.
Okamoto and J. Zhou (Eds.), Lecture Notes in
Computer Science 2229, Springer-Verlag, Berlin,pp.90-94, November 2001.
[23] R.M. Leahy and B.D. Jeffs, “On the Design ofMaximally Sparse Beamforming Arrays,” IEEE
Trans. Antennas Propagat., vol. 39, no. 8, pp.
1178-1187, 1991.
[24] K. Matsuura and Y. Okabe, “Selective minimumnorm solution of the biomagnetic inverse
problem,” IEEE Trans. Biomed. Eng., vol. 42, no.
6, pp. 608-615, June 1995.