Reviewerly/exHarmony huggingface dataset:
Enhancing Video Analytics Accuracy via Real-time Automated Camera Parameter Tuning

In Video Analytics Pipelines (VAP), Analytics Units (AUs) such as object detection and face recognition running on remote servers critically rely on surveillance cameras to capture high-quality video streams in order to achieve high accuracy. Modern IP cameras come with a large number of camera parameters that directly affect the quality of the video stream capture. While a few of such parameters, e.g., exposure, focus, white balance are automatically adjusted by the camera internally, the remaining ones are not. We denote such camera parameters as non-automated (NAUTO) parameters. In this paper, we first show that environmental condition changes can have significant adverse effect on the accuracy of insights from the AUs, but such adverse impact can potentially be mitigated by dynamically adjusting NAUTO camera parameters in response to changes in environmental conditions. We then present CamTuner, to our knowledge, the first framework that dynamically adapts NAUTO camera parameters to optimize the accuracy of AUs in a VAP in response to adverse changes in environmental conditions. CamTuner is based on SARSA reinforcement learning and it incorporates two novel components: a light-weight analytics quality estimator and a virtual camera that drastically speed up offline RL training. Our controlled experiments and real-world VAP deployment show that compared to a VAP using the default camera setting, CamTuner enhances VAP accuracy by detecting 15.9% additional persons and 2.6%--4.2% additional cars (without any false positives) in a large enterprise parking lot and 9.7% additional cars in a 5G smart traffic intersection scenario, which enables a new usecase of accurate and reliable automatic vehicle collision prediction (AVCP). CamTuner opens doors for new ways to significantly enhance video analytics accuracy beyond incremental improvements from refining deep-learning models.
ThingSpeak in the Wild

Cloud services are vital tools for storing, analyzing, and responding to data collected by sensors in the Internet of Things (IoT). With ThingSpeak, a popular web platform that provides these services, users can easily create cloud "channels" to receive, host, and visualize sensor data. In this study, we scrape public channels from 6,511 users to construct a comprehensive picture of both the ThingSpeak developer community and their applications. We release this data to support future work. From this data, we examine 37,989 visualizations and uncover relationships between application domains and visualization techniques utilized. Further, we investigate how ThingSpeak's interface impacts user design choices. To learn which channels most successfully disseminate information, we explore design patterns on channels "liked" on Facebook or discussed in ThingSpeak forums. Finally, we briefly comment on how services like ThingSpeak can better support users' needs moving forward.
Design of a Secured Medical Data Access Management Using Ethereum Smart Contracts, Truffle Suite and Web3

Securing and managing medical data in hospitals is one of the significant challenges still existing in healthcare. There can be different kinds of patients staying in hospitals with various diseases. All these medical data records need to be secured appropriately for future use and verification. In the hospital, there will be essential documents such as criminal cases and postmortem reports, although it is unclear if they are being handled properly or not. Even the hospital staff can alter these data. This paper proposes a blockchain-based secured medical data management system to manage access to each medical record in a network of hospitals. The proposed system has three main access management categories: one for securing general (fever or cold) medical report, category 2 for postmortem or crime reports security and category 3 for securing cancer /brain death /genetic disorder reports. Sensitive clinical data should not be visible to patients with cancer or genetic disorders as these patients have a higher rate of suicide attempts. Hence, the data is accessible only to doctors, family members, and researchers. The data related to the crime or postmortem reports have only limited access for those with legal permission to access and verify these types of reports. So through blockchain distributed ledger technology and smart contracts, we could store the data in a tamper-proof manner and manage the user access to these data.
A Survey of Blockchain-Based Electronic Voting Mechanisms in Sensor Networks

Electronic voting technology has the ability to accelerate the counting of ballots, reduce the cost of voting, and offer convenience for remote voters. Meanwhile, the efficiency of voting can be improved. Immutability, verifiability, and distribution are the main features blockchain can provide. Building an electronic voting system based on the blockchain can help to mitigate the security issues such as single-point failure and data manipulation. However, some blockchain systems are not feasible in the environment of sensor networks. In this paper, we propose a comparative analysis of blockchain-based electronic voting systems from the perspective of blockchain type, cryptography techniques, counting method, and security requirements. We also identify a possible new direction for the design of blockchain-based electronic voting systems for the reference of future research.
HeadFi II

Earables are embedded devices that can be placed in, on, or around the ear to sense human motions and physiological activities over an extended period of time. However, today's earable design principle heavily relies on dedicated sensors (e.g., accelerometer, gyroscope, proximity sensor), which inevitably adds cost, weight, and power consumption to earable devices, constituting a critical bottleneck in their wide adoption. Moreover, the tight coupling of sensors with onboard microcontrollers makes existing earables difficult to program, raising the barrier of entry to earable computing.
Privacy-Preserving Blockchain-Based Authentication in Smart Energy Systems

Smart Energy Systems (SES) are the need of the hour, given the looming dangers of power crises amid changing climatic conditions. However, sensitive data play a critical role in such systems deserving high privacy and security protection. This paper proposes a novel blockchain-based authentication scheme that preserves privacy using the zero-knowledge protocol. During informal analysis, the proposed scheme shows resistance to various attacks such as man-in-the-middle attacks, replay attacks, impersonation attacks, privileged insider attacks, and ephemeral secret leakage attacks. The formal security verification using AVISPA regards the scheme as safe. In addition, the scheme supports critical features such as anonymity and untraceability within limited computational and communicational costs. A simulation of blockchain using Node.js shows only a linear increase in computation time with an increase in the number of blocks, and transactions, and an exponential increase with the number of nodes.
Adversarial Attacks Against Reinforcement Learning Based Tactical Networks: A Case Study

Dynamic changes caused by conditions such as challenging terrain or hostile encounters force tactical networks to be highly adaptable. To tackle this problem, new proposals implement Reinforcement Learning (RL) based solutions for routing in such complex environments. As high security is another crucial demand for tactical networks, we examine the vulnerability of one such solution against the novel attack vector of adversarial attacks specifically targeting RL algorithms. Utilizing a suite of varying attack methods, we find the targeted solution to be vulnerable to multiple attacks. Further, we found the best attacks to exploit knowledge about the victim agent to a high degree. Lastly, we outline the need for additional research exploring more complex attack strategies to expose the vulnerabilities of other RL proposals for tactical networks. This investigation may also ignite the design/implementation of defensive measures to increase robustness in vulnerable systems.
Data Sanitization Approach to Mitigate Clean-Label Attacks Against Malware Detection Systems

Machine learning (ML) models are increasingly being used in the development of Malware Detection Systems. Existing research in this area primarily focuses on developing new architectures and feature representation techniques to improve the accuracy of the model. However, recent studies have shown that existing state-of-the art techniques are vulnerable to adversarial machine learning (AML) attacks. Among those, data poisoning attacks have been identified as a top concern for ML practitioners. A recent study on clean-label poisoning attacks in which an adversary intentionally crafts training samples in order for the model to learn a backdoor watermark was shown to degrade the performance of state-of-the-art classifiers. Defenses against such poisoning attacks have been largely under-explored. We investigate a recently proposed clean-label poisoning attack and leverage an ensemble-based Nested Training technique to remove most of the poisoned samples from a poisoned training dataset. Our technique leverages the relatively large sensitivity of poisoned samples to feature noise that disproportionately affects the accuracy of a backdoored model. In particular, we show that for two state-of-the art architectures trained on the EMBER dataset affected by the clean-label attack, the Nested Training approach improves the accuracy of backdoor malware samples from 3.42% to 93.2%. We also show that samples produced by the clean-label attack often successfully evade malware classification even when the classifier is not poisoned during training. However, even in such scenarios, our Nested Training technique can mitigate the effect of such clean-label-based evasion attacks by recovering the model's accuracy of malware detection from 3.57% to 93.2%.
A Robust Self-Synchronized Quantum Key Distribution Protocol

Quantum key distribution (QKD) is well known toward absolute communication security to distribute the keys of one-time pad cryptographic mechanisms, given the assumption of an error-free quantum channel. To explore the engineering practice of QKD, we consider an imperfect quantum channel and propose a robust self-synchronized QKD (SSQKD) protocol. By expanding the well known BB84 4-state QKD system to a 6-state protocol, the additional signal space is used for non-sacrificial detection and self-synchronized channel estimation. Performance evaluation verifies the effectiveness of this proposed SSQKD against phase-distortion in the quantum channel.
The Methodological Pitfall of Dataset-Driven Research on Deep Learning: An IoT Example

In this paper, we highlight a dangerous pitfall in the state-of-the-art evaluation methodology of deep learning algorithms. It results in deceptively good evaluation outcomes on test datasets, whereas the underlying algorithms remain prone to catastrophic failure in practice. We illustrate the pitfall in the context of an Internet-of-Things (IoT) application example and show that it occurs despite the use of cross-validation that breaks down the data into separate training, validation, and testing sets. The pitfall is illustrated by designing two target detection and classification algorithms. One is based on a recently proposed neural network architecture for embedded AI, and the other is based on a traditional machine learning approach with domain-inspired feature engineering. The neural network approach outperforms the traditional one on test data. Yet, it fails in deployment. The mechanics behind the failure are explained and linked to the way the algorithms are trained. Suggestions are presented to avoid the pitfall. The paper is a “call to arms” to improve the evaluation methodology of machine learning algorithms for mission-critical systems.
On the Limits of Learning a Discrete Memoryless Communication Channel

This paper explores bounds on the minimum number of channel probes required to learn sufficient information to establish reliable communication at a given communication rate (below channel capacity) for a discrete memoryless channel. Given a set of discrete channel input-output sample pairs (where for each discrete input value, the associated aggregate set of discrete output values observations is multinomially distributed), we leverage a non-asymptotic probably approximately correct (PAC) bound on the mutual information (channel capacity) between the label (discrete) random variable (RV) and the observation RV to establish a convergence rate for the worst case channel. Previous bounds (such as those based on Sanov's Theorem) provide high probability (i.e. PAC) bounds on the true mutual information that converge with rate <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$O(\log(N)/\sqrt{N})$</tex> , where N is the number of independent and identically distributed (i.i.d.) samples used to compute the empirical probability mass functions. Using an improved PAC sublevel-set bound, we sharpen the rate of convergence to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$O(\sqrt{\log(\log(N))\log(N)}/N)$</tex> .
Improving Bounds on Elliptic Curve Hidden Number Problem for ECDH Key Exchange

Elliptic Curve Hidden Number Problem (EC-HNP) was first introduced by Boneh, Halevi and Howgrave-Graham at Asiacrypt 2001. To rigorously assess the bit security of the Diffie–Hellman key exchange with elliptic curves (ECDH), the Diffie–Hellman variant of EC-HNP, regarded as an elliptic curve analogy of the Hidden Number Problem (HNP), was presented at PKC 2017. This variant can also be used for practical cryptanalysis of ECDH key exchange in the situation of side-channel attacks. In this paper, we revisit the Coppersmith method for solving the involved modular multivariate polynomials in the Diffie–Hellman variant of EC-HNP and demonstrate that, for any given positive integer d, a given sufficiently large prime p, and a fixed elliptic curve over the prime field $$\mathbb {F}_p$$ , if there is an oracle that outputs about $$\frac{1}{d+1}$$ of the most (least) significant bits of the x-coordinate of the ECDH key, then one can give a heuristic algorithm to compute all the bits within polynomial time in $$\log _2 p$$ . When $$d>1$$ , the heuristic result $$\frac{1}{d+1}$$ significantly outperforms both the rigorous bound $$\frac{5}{6}$$ and heuristic bound $$\frac{1}{2}$$ . Due to the heuristics involved in the Coppersmith method, we do not get the ECDH bit security on a fixed curve. However, we experimentally verify the effectiveness of the heuristics on NIST curves for small dimension lattices.
A ORGANIZAÇÃO DO ARQUIVO PESSOAL DE MARIA LAURA MOUZINHO LEITE LOPES DESAFIOS E PERSPECTIVAS

It demonstrates the organization of the personal archive of Maria Laura Mouzinho Leite Lopes, using the theory and methods of Archival Science.It seeks to understand the trajectory of personal archives in the light of theory and methods within the scope of Archival Science.It presents the biography of Maria Laura Mouzinho Leite Lopes.Explains how the personal archive was donated to the Archive of the History of Science (AHC) of the Museu de Astronomia e Ciências Afins (MAST).It demonstrates that the methodological procedures adopted in the organization of the personal archive were guided by the maintenance of the inseparable link that exists between the documents and the functions and activities of the producer of the archive.Finally, it explains that the organization of
A Third is All You Need: Extended Partial Key Exposure Attack on CRT-RSA with Additive Exponent Blinding

At Eurocrypt 2022, May et al. proposed a partial key exposure (PKE) attack on CRT-RSA that efficiently factors N knowing only a $$\frac{1}{3}$$ -fraction of either most significant bits (MSBs) or least significant bits (LSBs) of private exponents $$d_p$$ and $$d_q$$ for public exponent $$e \approx N^{\frac{1}{12}}$$ . In practice, PKE attacks typically rely on the side-channel leakage of these exponents, while a side-channel resistant implementation of CRT-RSA often uses additively blinded exponents $$d^{\prime }_p = d_p + r_p(p-1)$$ and $$d^{\prime }_q = d_q + r_q(q-1)$$ with unknown random blinding factors $$r_p$$ and $$r_q$$ , which makes PKE attacks more challenging. Motivated by the above, we extend the PKE attack of May et al. to CRT-RSA with additive exponent blinding. While admitting $$r_pe\in (0,N^{\frac{1}{4}})$$ , our extended PKE works ideally when $$r_pe \approx N^{\frac{1}{12}}$$ , in which case the entire private key can be recovered using only $$\frac{1}{3}$$ known MSBs or LSBs of the blinded CRT exponents $$d^{\prime }_p$$ and $$d^{\prime }_q$$ . Our extended PKE follows their novel two-step approach to first compute the key-dependent constant $$k^{\prime }$$ ( $$ed^{\prime }_p = 1 + k^{\prime }(p-1)$$ , $$ed^{\prime }_q = 1 + l^{\prime }(q-1)$$ ), and then to factor N by computing the root of a univariate polynomial modulo $$k^{\prime }p$$ . We extend their approach as follows. For the MSB case, we propose two options for the first step of the attack, either by obtaining a single estimate $$k^{\prime }l^{\prime }$$ and calculating $$k^{\prime }$$ via factoring, or by obtaining multiple estimates $$k^{\prime }l^{\prime }_1,\ldots ,k^{\prime }l^{\prime }_z$$ and calculating $$k^{\prime }$$ probabilistically via GCD. For the LSB case, we extend their approach by constructing a different univariate polynomial in the second step of the LSB attack. A formal analysis shows that our LSB attack runs in polynomial time under the standard Coppersmith-type assumption, while our MSB attack either runs in sub-exponential time with a reduced input size (the problem is reduced to factor a number of size $$e^2r_pr_q\approx N^{\frac{1}{6}}$$ ) or in probabilistic polynomial time under a novel heuristic assumption. Under the settings of the most common key sizes (1024-bit, 2048-bit, and 3072-bit) and blinding factor lengths (32-bit, 64-bit, and 128-bit), our experiments verify the validity of the Coppersmith-type assumption and our own assumption, as well as the feasibility of the factoring step. To the best of our knowledge, this is the first PKE on CRT-RSA with experimentally verified effectiveness against 128-bit unknown exponent blinding factors. We also demonstrate an application of the proposed PKE attack using real partial side-channel key leakage targeting a Montgomery Ladder exponentiation CRT implementation.
Universal Ring Signatures in the Standard Model

Ring signatures allow a user to sign messages on behalf of an ad hoc set of users - a ring - while hiding her identity. The original motivation for ring signatures was whistleblowing [Rivest et al. ASIACRYPT'01]: a high government employee can anonymously leak sensitive information while certifying that it comes from a reliable source, namely by signing the leak. However, essentially all known ring signature schemes require the members of the ring to publish a structured verification key that is compatible with the scheme. This creates somewhat of a paradox since, if a user does not want to be framed for whistleblowing, they will stay clear of signature schemes that support ring signatures. In this work, we formalize the concept of universal ring signatures (URS). A URS enables a user to issue a ring signature with respect to a ring of users, independently of the signature schemes they are using. In particular, none of the verification keys in the ring need to come from the same scheme. Thus, in principle, URS presents an effective solution for whistleblowing. The main goal of this work is to study the feasibility of URS, especially in the standard model (i.e. no random oracles or common reference strings). We present several constructions of URS, offering different trade-offs between assumptions required, the level of security achieved, and the size of signatures:
Attaining GOD Beyond Honest Majority with Friends and Foes

In the classical notion of multiparty computation (MPC), an honest party learning private inputs of others, either as a part of protocol specification or due to a malicious party's unspecified messages, is not considered a potential breach. Several works in the literature exploit this seemingly minor loophole to achieve the strongest security of guaranteed output delivery via a trusted third party, which nullifies the purpose of MPC. Alon et al. (CRYPTO 2020) presented the notion of Friends and Foes ( $$\texttt{FaF}$$ ) security, which accounts for such undesired leakage towards honest parties by modelling them as semi-honest (friends) who do not collude with malicious parties (foes). With real-world applications in mind, it's more realistic to assume parties are semi-honest rather than completely honest, hence it is imperative to design efficient protocols conforming to the $$\texttt{FaF}$$ security model. Our contributions are not only motivated by the practical viewpoint, but also consider the theoretical aspects of $$\texttt{FaF}$$ security. We prove the necessity of semi-honest oblivious transfer for $$\texttt{FaF}$$ -secure protocols with optimal resiliency. On the practical side, we present QuadSquad, a ring-based 4PC protocol, which achieves fairness and GOD in the $$\texttt{FaF}$$ model, with an optimal corruption of 1 malicious and 1 semi-honest party. QuadSquad is, to the best of our knowledge, the first practically efficient $$\texttt{FaF}$$ secure protocol with optimal resiliency. Its performance is comparable to the state-of-the-art dishonest majority protocols while improving the security guarantee from abort to fairness and GOD. Further, QuadSquad elevates the security by tackling a stronger adversarial model over the state-of-the-art honest-majority protocols, while offering a comparable performance for the input-dependent computation. We corroborate these claims by benchmarking the performance of QuadSquad. We consider the application of liquidity matching that deals with sensitive financial transaction data, where $$\texttt{FaF}$$ security is apt. We design a range of $$\texttt{FaF}$$ secure building blocks to securely realize liquidity matching as well as other popular applications such as privacy-preserving machine learning. Inclusion of these blocks makes QuadSquad a comprehensive framework.
GUC-Secure Commitments via Random Oracles: New Impossibility and Feasibility

In the UC framework, protocols must be subroutine respecting; therefore, shared trusted setup might cause security issues. To address this drawback, Generalized UC (GUC) framework is introduced by Canetti et al. (TCC 2007). In this work, we investigate the impossibility and feasibility of GUC-secure commitments using global random oracles (GRO) as the trusted setup. In particular, we show that it is impossible to have a 2-round (1-round committing and 1-round opening) GUC-secure commitment in the global observable RO model by Canetti et al. (CCS 2014). We then give a new round-optimal GUC-secure commitment that uses only Minicrypt assumptions (i.e. the existence of one-way functions) in the global observable RO model. Furthermore, we also examine the complete picture on round complexity of the GUC-secure commitments in various global RO models.