Editorial to the Special Issue on Recent Advances on Trust, Security and Privacy in Computing and Communications

With the rapid development and increasing complexity of computer systems and communication networks, user requirements for trust, security, and privacy are becoming more and more demanding. Therefore, there is a grand challenge that traditional security technologies and measures may not meet user requirements in open, dynamic, heterogeneous, mobile, wireless, and distributed computing environments. Thus, there is a strong need to build systems and networks in which various applications allow users to enjoy more comprehensive services while preserving trust, security, and privacy at the same time. As useful and innovative technologies, trusted computing and communications are attracting researchers with more and more attention. The scope of this special issue is broad and is representative of many important topics involving emerging technologies in the field of Trust, Security, Privacy, Forensics, and Data analytics. In addition, the articles selected through this special issue also present strong aspects on theoretical analysis, algorithms, and practical experience in their proposed schemes. The submissions to the Special Issue were significantly extended research papers from the 16th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (Trustcom 2017). This conference brings together researchers and practitioners around the world working on trusted computing and communications, with regard to trust, security, privacy, reliability, dependability, survivability, availability, and fault tolerance aspects of computer systems and networks. All the submissions for this special issue have been reviewed rigorously following the guidelines of Wiley Journal on Concurrency and Computation: Practice and Experience (CCPE). A majority of the reviewers represent expertise in their fields who provided high quality reviews for the manuscripts. The articles selected through a rigorous reviews process for this Special Issue are briefly presented in the rest of this guest editorial. The guest editors sincerely believe that this special issue on Trust, Security, and Privacy will be a great reading for the contemporary researchers worldwide. The guest editors would like to thank the editor-in-chief (EiC) Dr Geoffrey Fox of the Wiley Journal on Concurrency and Computation: Practice and Experience (CCPE) for the opportunity of this special issue. The guest editors are sincerely thankful to the many reviewers around the globe for their timely reviews without which this successful special issue would not have been possible. The guest editors thank the authors for their patience and dedication at all stages of the review process. The guest editors are also thankful to the Wiley production staffs for their help during the production of this special issue. Fault injection has been increasingly used both to attack software applications and to test system robustness. Detecting fault injection vulnerabilities has been approached with a variety of different but limited methods. Given-Wilson et al1 propose extension of a recently published general model checking–based process to detect fault injection vulnerabilities in binaries. This new extension makes the general process scalable to real-world implementations. The authors demonstrate their scheme by detecting vulnerabilities in different cryptographic implementations. Fault analysis of AEZ is based on AES using three 128-bit keys. Al Mahri et al2 analyzed AEZ 4.2 and investigated the fault issue showing all three 128-bit keys used in AEZ 4.2 can be uniquely retrieved using only three random valued single byte fault injections. Data publishing may suffer from privacy disclosures, especially, the case in transactional data such as web search and point of sales logs. Current potent privacy preserving mechanisms mainly focus on relational data. Bewong et al3 propose a new privacy metric for transactional data to prevent inference attacks. Their proposed scheme, Anony, ensures that the adversary learns no more about an intended victim than what is publicly available. In order to demonstrate the effectiveness of their scheme, the authors present empirical evaluation on three benchmark datasets. Jahan et al4 present selective read/write access to the outsourced data for clients using mobile devices supporting users from multiple domains. The authors use Ciphertext-Policy Attribute-based Encryption (CP-ABE) scheme that provides access control on encrypted outsourced data. The proposed scheme provides fine-grained read/write access to the users, accompanied with a lightweight signature scheme and computationally inexpensive user revocation mechanism suitable for resource-constrained mobile devices. Both theoretical analyses of the security protocol and experimental results measured from a real-world testbed strongly validate the proposed scheme. Yoking-proof scheme is a very useful mechanism in many IoT (Internet of Things) application areas such as health care and supply chain. However, existing yoking-proof scheme requires two or more rounds of communication to generate the yoking-proof. Sun et al5 investigate how to design the one-round yoking-proof scheme with computational efficiency. The scheme is designed with a new timestamp-based scheme for the RFID tag pair. The authors prove the security and privacy of the proposed scheme extending to more than two RFID tags along with one-round of communication to generate the yoking-proof. While Malware-based activities on recent years are slowing down, more and more sophisticated targeting malwares have been emerging. These new categories of Malwares share little or no common feature with traditional malware. Han et al6 present classifications of malicious tasks using decidable theory and prove that tasks performed by any software can be recursive and determinable. By establishing a mapping from software to task, they prove their proposition and demonstrate that presence of malwares in software is recursive. This issue would be incomplete without the article on IoT security. Secured authentication using 6LoWPAN networks is one of the important considerations among various IoT-based applications. Existing asymmetric key distribution scheme may not be a perfect choice as recent research shows that Lucky Thirteen attack has compromised Datagram Transport Layer Security (DTLS) with Cipher Block Chaining (CBC) mode for key establishment. Even though EAKES6Lo and S3 K techniques for key establishment follow the symmetric key establishment method, they strongly rely on a remote server and trust anchor. Baskaran et al7 present a Lightweight AUthentication Protocol (LAUP) using symmetric key method with no pre-shared keys between sensors and Edge Router in a 6LoWPAN environment. Their proposed scheme is formally verified using the Scyther security protocol verification tool and the protocol is implemented using COOJA simulator. Finally, the authors develop a Testbed to measure computation time and efficiency of LAUP scheme. The proposed scheme achieves less computational time and low power consumption compared to existing authentication protocols such as the EAKES6Lo and SAKES.