SciTePress - Affiliation Profile

Research.Publish.Connect.

*Please fill out at least one Field. *Value must be an number!

Title:
ISBN:
Year:
Acronym:
Subject:

Advanced Search Proceedings Search

If you're looking for an exact phrase use quotation marks on text fields.

*Please fill out at least one Field.

Title:
Author:
Affiliation:
Subject:

Advanced Search Papers Search

If you're looking for an exact phrase use quotation marks on text fields.

*Please fill out at least one Field.

Name:
Affiliation:
Country:
Conference:
Subject:

Advanced Search Authors Search

If you're looking for an exact phrase use quotation marks on text fields.

*Please fill out at least one Field.

Name:
Country:
Subject:

Advanced Search Affiliations Search

If you're looking for an exact phrase use quotation marks on text fields.

Proceedings

Proceedings Search *Please fill out at least one Field. *Value must be an number!

Title:
ISBN:
Year:
Acronym:
Subject:

Advanced Search Proceedings Search

If you're looking for an exact phrase use quotation marks on text fields.

Papers

Papers Search *Please fill out at least one Field.

Title:
Author:
Affiliation:
Subject:

Advanced Search Papers Search

If you're looking for an exact phrase use quotation marks on text fields.

Authors

Authors Search *Please fill out at least one Field.

Name:
Affiliation:
Country:
Conference:
Subject:

Advanced Search Authors Search

If you're looking for an exact phrase use quotation marks on text fields.

Advanced Search

Affiliation

Select a Subject
Refine Ontology Subject

University of Luxembourg, Luxembourg

Context (please use complete words only)

Field

Sort by

14 Papers

Can Contributing More Put You at a Higher Leakage Risk? The Relationship Between Shapley Value and Training Data Leakage Risks in Federated Learning

Topics: Privacy; Privacy Enhancing Technologies; Machine Learning Security and Privacy; Security and Privacy for Artificial Intelligence

Authors: Soumia El Mestari ¹ , Maciej Zuziak ² , Gabriele Lenzini ¹ and Salvatore Rinzivillo ²

Affiliations: ¹ SnT, University of Luxembourg, Esch Sur Alzette, Luxembourg , ² National Research Council, Pisa, Italy

Digital Object Identifier: 10.5220/0013639000003979

Proceedings of SECRYPT 2025, ISBN: 978-989-758-760-3

Quick Abstract

Federated Learning (FL) is a crucial approach for training large-scale AI models while preserving data locality, eliminating the need for centralised data storage. In collaborative learning settings, ensuring data quality is essential, and in FL, maintaining privacy requires limiting the knowledge accessible to the central orchestrator, which evaluates and manages client contributions. Accurately measuring and regulating the marginal impact of each client’s contribution needs specialised techniques. This work examines the relationship between one such technique—Shapley Values—and a client’s vulnerability to Membership inference attacks (MIAs). Such a correlation would suggest that the contribution index could reveal high-risk participants, potentially allowing a malicious orchestrator to identify and exploit the most vulnerable clients. Conversely, if no such relationship is found, it would indicate that contribution metrics do not inherently expose information exploitable for powerful privacy attacks. Our empirical analysis in a cross-silo FL setting demonstrates that leveraging contribution metrics in federated environments does not substantially amplify privacy risks.

Verifying Artifact Authenticity with Unclonable Optical Tags

Topics: Identification, Authentication and Non-Repudiation; Applied Cryptography; Security Protocols

Authors: Mónica Arenas , Gabriele Lenzini , Mohammadamin Rakeei , Peter Y. A. Ryan , Marjan Škrobot and Maria Zhekova

Affiliation: SnT, University of Luxembourg, Esch-sur-Alzette, Luxembourg

Digital Object Identifier: 10.5220/0012746500003767

Proceedings of SECRYPT 2024, ISBN: 978-989-758-709-2

Quick Abstract

We study the challenge of authenticating objects. This problem is relevant when buyers need proof that a purchase is authentic and not fake. Typically, manufacturers watermark their goods, give them IDs, and provide a certificate of authenticity. Buyers, for their part, check the IDs and verify the certificate. However, even if manufacturers are honest online registration and verification are vulnerable to hacking; servers can leak private data; goods out-for-delivery can have the ID cloned and can be replaced with imitations. We propose a cyber-physical solution that combines physical properties and cryptographic protocols and that is robust against a curious registry server and attempts to physical manipulation. Security depends on two elements: (I) a material inseparably joined with an object from which we can generate digital identities and other cryptographic tokens; (ii) two novel cryptographic protocols that ensure data and object integrity and authentication of agents and objects. Besides, we show that a material with all the desired security properties exists. We can use it to coat objects, and it has optical properties, such as unclonability, from which we can build secure cryptographic protocols. We formally prove our security claims with Proverif.

Can We Formally Catch Cheating in E-exams?

Topics: Security Frameworks, Architectures and Protocols; Vulnerability Analysis and Countermeasures; Authentication, Privacy and Security Models; Security Awareness and Education

Authors: Itzel Vazquez Sandoval and Gabriele Lenzini

Affiliation: Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0011007900003120

Proceedings of ICISSP 2022, ISBN: 978-989-758-553-1

Quick Abstract

Cheating in exams is a practice as old as exams themselves. Institutions and examiners have learned to mitigate traditional ways of cheating, such as the use of crib notes. Yet, the massive digitalization of the world has facilitated the application of electronic exams (e-exams), for which more innovative and sophisticated ways of cheating have emerged. The advent of Information and Communication Technology is changing the threat model as the e-exam environment is not restricted to a classroom anymore; and examiners are simply not well- equipped to supervise a digitally connected network. To a large extent, the research on the subject follows one of two main approaches: philosophical, focused on trying to understand the causes and behaviors of cheaters; or pragmatical, aimed at providing means for preventing or detecting fraudulent scenarios. Here, we take a different perspective and look at cheating as a theoretical information security problem. More specifically, we aim at finding specifications that allow us to unequivocally decide whether an examinee has tried to subvert an exam protocol by using unauthorized means to answer questions. We discuss how we could formalize such definitions and comment on different frameworks suitable for the task. Our discussion provides insights into future research directions towards devising formal frameworks for a rigorous study of cheating scenarios and thereby, the development of e-exam systems that would be resilient to such scenarios by design.

Privacy-preserving Copy Number Variation Analysis with Homomorphic Encryption

Topic: Implementation research or experience from implementation of digital health innovations

Authors: Hüseyin Demirci and Gabriele Lenzini

Affiliation: Interdisciplinary Center for Security Reliability and Trust (SnT), University of Luxembourg,

Digital Object Identifier: 10.5220/0011012400003123

Proceedings of Scale-IT-up 2022, ISBN: 978-989-758-552-4

Quick Abstract

Innovative pharma-genomics and personalized medicine services are now possible thanks to the availability for processing and analysis of a large amount of genomic data. Operating on such databases, is possible to test for predisposition to diseases by searching for genomic variants on whole genomes as well as on exomes, which are collections of protein coding regions called exons. Genomic data are therefore shared amongst research institutes, public/private operators, and third parties, creating issues of privacy, ethics, and data protection because genome data are strictly personal and identifying. To prevent damages that could follow a data breach—a likely threat nowadays—and to be compliant with current data protection regulations, genomic data files should be encrypted, and the data processing algorithms should be privacy-preserving. Such a migration is not always feasible: not all operations can be implemented straightforwardly to be privacy-preserving; a privacy-preserving version of an algorithm may not be as accurate for the purpose of biomedical analysis as the original; or the privacy-preserving version may not scale up when applied to genomic data processing because of inefficiency in computation time. In this work, we demonstrate that at least for a well- known genomic data procedure for the analysis of copy number variants called copy number variations (CNV) a privacy-preserving analysis is possible and feasible. Our algorithm relies on Homomorphic Encryption, a cryptographic technique to perform calculations directly on the encrypted data. We test our implementation for performance and reliability, giving evidence that it is practical to study copy number variations and preserve genomic data privacy. Our proof-of-concept application successfully and efficiently searches for a patient’s somatic copy number variation changes by comparing the patient gene coverage in the whole exome with a healthy control exome coverage. Since all the genomics data are securely encrypted, the data remain protected even if they are transmitted or shared via an insecure environment like a public cloud. Being this the first study for privacy-preserving copy number variation analysis, we demonstrate the potential of recent Homomorphic Encryption tools in genomic applications.

Authentication and Key Management Automation in Decentralized Secure Email and Messaging via Low-entropy Secrets

Topics: Peer-To-Peer Security; Identification, Authentication and Non-Repudiation; Privacy; Applied Cryptography; Security Protocols

Authors: Itzel Vazquez Sandoval ¹ , Arash Atashpendar ² and Gabriele Lenzini ¹

Affiliations: ¹ SnT, University of Luxembourg, Luxembourg , ² SnT, University of Luxembourg, Luxembourg, itrust Consulting, Luxembourg

Digital Object Identifier: 10.5220/0009834001670179

Proceedings of SECRYPT 2020, ISBN: 978-989-758-446-6

Quick Abstract

We revisit the problem of entity authentication in decentralized end-to-end encrypted email and secure messaging to propose a practical and self-sustaining cryptographic solution based on password-authenticated key exchange (PAKE). This not only allows users to authenticate each other via shared low-entropy secrets, e.g., memorable words, without a public key infrastructure or a trusted third party, but it also paves the way for automation and a series of cryptographic enhancements; improves security by minimizing the impact of human error and potentially improves usability. First, we study a few vulnerabilities in voice-based out-of-band authentication, in particular a combinatorial attack against lazy users, which we analyze in the context of a secure email solution. Next, we propose solving the problem of secure equality test using PAKE to achieve entity authentication and to establish a shared high-entropy secret key. Our solution lends itself to offline settings, compatible with the inherently asynchronous nature of email and modern messaging systems. The suggested approach enables enhancements in key management such as automated key renewal and future key pair authentications, multi-device synchronization, secure secret storage and retrieval, and the possibility of post-quantum security as well as facilitating forward secrecy and deniability in a primarily symmetric-key setting. We also discuss the use of auditable PAKEs for mitigating a class of online guess and abort attacks in authentication protocols.

Dual-use Research in Ransomware Attacks: A Discussion on Ransomware Defence Intelligence

Topics: Malware Detection; Threat Awareness

Authors: Ziya Alper Genç and Gabriele Lenzini

Affiliation: Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0009000505850592

Proceedings of ICISSP 2020, ISBN: 978-989-758-399-5

Quick Abstract

Previous research has shown that developers rely on public platforms and repositories to produce functional but insecure code. We looked into the matter for ransomware, enquiring whether also ransomware engineers re-use the work of others and produce insecure code. By methodically reverse-engineering 128 malware executables, we have found that, out of 21 ransomware samples, 9 contain copy-paste code from public resources. Thanks to this finding, we managed to retrieve the decryption keys with which to nullify the ransomware attacks. From this fact, we recall critical cases of code disclosure in the recent history of ransomware and, arguing that ransomware are components in cyber-weapons, reflect on the dual-use nature of this research. We further discuss benefits and limits of using cyber-intelligence and counter-intelligence strategies that could be used against this threat.

Systematization of Threats and Requirements for Private Messaging with Untrusted Servers: The Case of e-Mailing and Instant Messaging

Topics: Security Frameworks, Architectures and Protocols; Authentication, Privacy and Security Models; Threat Awareness; Data and Software Security

Authors: Iraklis Symeonidis and Gabriele Lenzini

Affiliation: SnT, University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0009003805930602

Proceedings of ICISSP 2020, ISBN: 978-989-758-399-5

Quick Abstract

Modern email and instant messaging applications often offer private communications. In doing so, they share common concerns about how security and privacy can be compromised, how they should face similar threats, and how to comply with comparable system requirements. Assuming a scenario where servers may not be trusted, we review and analyze a list of threats specifically against message delivering, archiving, and contact synchronization. We also describe a list of requirements intended for whom undertakes the task of implementing secure and private messaging. The cryptographic solutions available to mitigate the threats and to comply with the requirements may differ, as the two applications are built on different assumptions and technologies.

Accomplishing Transparency within the General Data Protection Regulation

Topics: Privacy Enhancing Technologies; Legal and Regulatory Issues; Security Awareness and Education; Privacy, Security and Trust in Social Media

Authors: Dayana Spagnuelo ¹ , Ana Ferreira ² and Gabriele Lenzini ¹

Affiliations: ¹ SnT - University of Luxembourg and Luxembourg , ² CINTESIS - University of Porto and Portugal

Digital Object Identifier: 10.5220/0007366501140125

Proceedings of ICISSP 2019, ISBN: 978-989-758-359-9

Quick Abstract

Transparency is a user-centric principle proposed to empower users to hold data processors accountable for the usage and the processing of the user’s personal data. Accomplishing transparency may come with some resistance because it requires significant architectural changes, but it is mandatory by law under the recently approved General Data Protection Regulation. To help the transition, we systematically review what Transparency Enhancing Technologies can help to accomplish transparency in agreement with technical requirements that we elicited from the Regulation’s articles. We discuss our findings in the domain of medical data systems, where accomplishing transparency looks particularly controversial due to sensitivity of the personal medical data.

Related Ontology Subjects/Areas/Topics (2)

Information and Systems Security

Privacy Enhancing Technologies

Towards a Lawful Authorized Access: A Preliminary GDPR-based Authorized Access

Topics: Requirements Engineering; Data-driven Software Engineering; Software and Systems Modeling; Software Development Lifecycle

Authors: Cesare Bartolini ¹ , Said Daoudagh ² , Gabriele Lenzini ¹ and Eda Marchetti ³

Affiliations: ¹ Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg and Luxembourg , ² Istituto di Scienza e Tecnologie dell’Informazione “A. Faedo”, CNR, via G. Moruzzi 1, 56124, Pisa, Italy, Computer Science Department, University of Pisa, Pisa and Italy , ³ Istituto di Scienza e Tecnologie dell’Informazione “A. Faedo”, CNR, via G. Moruzzi 1, 56124, Pisa and Italy

Digital Object Identifier: 10.5220/0007978703310338

Proceedings of ICSOFT 2019, ISBN: 978-989-758-379-7

Quick Abstract

The General Data Protection Regulation (GDPR)’s sixth principle, Integrity and Confidentiality, dictates that personal data must be protected from unauthorised or unlawful processing. To this aim, we propose a systematic approach for authoring access control policies that are by-design aligned with the provisions of the GDPR. We exemplify it by considering realistic use cases.

Related Ontology Subjects/Areas/Topics (5)

Artificial Intelligence		Knowledge-Based Systems		Symbolic Systems
Knowledge Management and Information Sharing		Requirements Engineering

A Security Analysis, and a Fix, of a Code-Corrupted Honeywords System

Topics: Security Frameworks, Architectures and Protocols; Security Architecture and Design Analysis; Authentication, Privacy and Security Models; Threat Awareness

Authors: Ziya Alper Genç , Gabriele Lenzini , Peter Y. A. Ryan and Itzel Vazquez Sandoval

Affiliation: University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0006609100830095

Proceedings of ICISSP 2018, ISBN: 978-989-758-282-0

Quick Abstract

In 2013 Juels and Rivest introduced the Honeywords System, a password-based authentication system designed to detect when a password file has been stolen. A Honeywords System stores passwords together with indistinguishable decoy words so when an intruder steals the file, retrieves the words, and tries to log-in, he does not know which one is the password. By guessing one from the decoy words, he may not be lucky and reveal the leak. Juels and Rivest left a problem open: how to make the system secure even when the intruder corrupted the login server’s code. In this paper we study and solve the problem. However, since “code corruption” is a powerful attack, we first define rigorously the threat and set a few assumptions under which the problem is still solvable, before showing meaningful attacks against the original Honeywords System. Then we elicit a fundamental security requirement, implementing which, we are able to restore the Honeywords System’s security despite a corrupted login service. We verify the new protocol’s security formally, using ProVerif for this task. We also implement the protocol and test its performance. Finally, at the light of our findings, we discuss whether it is still worth using a fixed honeywords-based system against such a powerful threat, or whether it is better, in order to be resilient against code corruption attacks, to design afresh a completely different password-based authentication solution.