Yanjun Zuo

Survivable RFID Systems: Issues, Challenges, and Techniques

Radio frequency identification (RFID) technique has been applied in high-security and high-integrity settings such as national defense, healthcare, and citizen identification. A tiny RFID tag is attached to a mobile object, which can be scanned and recognized by a reader. RFID offers opportunities for real-time item identification and inventory tracking. For applications using resource-restricted RFID tags and mobile hand-held readers, however, various risks could threaten their abilities to provide essential services to users. High mobility of the RFID system components and the open nature make an RFID system vulnerable to various attacks. Currently, although some techniques exist that might help improve survivability; there is still no complete proposal on survivability of an RFID system despite its growing popularity and importance in many applications. In this paper, we study survivability issues related to RFID systems and survey existing techniques whose usability and adaptability toward survivability would be beneficial. Survivability is defined as the ability of a system to continuously provide essential services to support the systems mission even in the presence of malicious attacks or system failures. We discuss the issues and challenges in developing survivable RFID systems and propose research directions.

Secure and private search protocols for RFID systems

In many real world applications, there is a need to search for RFID tagged items. In this paper, we propose a set of protocols for secure and private search for tags based on their identities or certain criteria they must satisfy. When RFID enabled systems become pervasive in our life, tag search becomes crucial. Surprisingly, the problem of RFID search has not been widely addressed in the literature. We analyzed the privacy and security features of the proposed tag search protocols, and concluded that our protocols provide tag identity privacy, tag source location privacy, and tag-reader communication privacy. For the first time, we propose a formal method to securely search RFID tags which satisfy certain search criteria.

Trust Computing for Social Networking

Trust plays an important role in a web-based social network. Given the open and dynamic nature of such an online virtual community, trust evaluation relies on transitive relationships among the direct and indirect neighbors of an evaluator. We propose a framework to evaluate the trustworthiness of a given node (e.g., a user) based on a set of trust chains and a trust graph. We will also systematically analyze the inherent relationships between the two approaches. Many terms presented in this paper are new, including a virtual trust chain, the capacity, completeness, and degree of a trust graph, and a base trust chain set for a complete trust graph. Our contributions also include algorithms outlining novel approaches for peer trust evaluation in social networks.

A Framework of Survivability Requirement Specification for Critical Information Systems

Survivability represents a systems ability to provide essential services in the presence of attacks and failures, and to recover full services in a timely manner when the environment improves. For many critical systems used in national defense, healthcare, and utility infrastructure, survivability is a key requirement. Currently, there is a lack of research on systematic reasoning and specification of the requirements for system survivability from a users perspective. In this paper, we present methods that enable users to specify measureable and certifiable survivability requirements and represent their survivability policy. A survivability decision model is proposed which complies with both survivability practical evidence and theoretical models. From the perspective of system acquisition and engineering, survivability requirement is the important first step in survivability specification, compliance formulation, and proof verification. A military Command and Control (C-2) system is used throughout the paper as an illustrative example for users survivability requirement specification and representation.

Changing Hands Together: A Secure Group Ownership Transfer Protocol for RFID Tags

In a Radio Frequency Identification (RFID) enabled system, RFID tags often need to change hands from one owner to another during their lifetime. In this paper, we investigate the application in a group context, i.e., transferring the ownership of a group of tags in one session. This is different from any previous work which focuses on either individual tag ownership transfer or grouping-proofs for simultaneous presence of multiple tags. We are the first to integrate these two aspects and develop a secure and private protocol for tag group ownership transfer. Our protocol resolves the problem of dual ownership which appeared in some previous work, where two entities possess the authentication information of the same tag for a certain period during the ownership transfer process. We evaluate our protocol using theoretical proofs and technical analysis.

Post-release information privacy protection: A framework and next-generation privacy-enhanced operating system

In today’s digital world, privacy issues have received widespread public attention. Current research on information privacy protection focuses on release control and subject identity obscurity. Little work has been done, however, to prevent a piece of private information from being misused after that information has been released to external entities. This paper focuses on information privacy protection in a post-release phase. Without entirely depending on the information collector, an information owner is provided with powerful means to control and audit how his/her released information will be used, by whom, and when. The goal is to minimize the asymmetry of information flow between an information owner and an information collector. A set of innovative owner-controlled privacy protection and violation detection techniques has been proposed: Self-destroying File, Mutation Engine System, Automatic Receipt Collection, and Honey Token-based Privacy Violation Detection. Next generation privacy-enhanced operating system, which supports the proposed mechanisms, is introduced. Such a privacy-enhanced operating system stands for a technical breakthrough, which offers new features to existing operating systems. We discuss the functionalities of such an operating system and the design guidelines. To our best knowledge, no similar technical work has been found to provide post-release information privacy protection.

Component based trust management in the context of a virtual organization

One of the difficulties in evaluating the trustworthiness of an object in a virtual organization is the lack of sufficient information to study how the object was formed and to what level its components should be trusted. If a subject could be provided with detailed information about the ingredients of a compound object, then the subject would be able to evaluate the trust level of that compound object with higher confidence. This paper introduces a scheme using labels associated with each object within the domain of a virtual organization to facilitate trust management. Each label supplies certain information regarding the originality of the associated object. Thus, partial trust (also called component trust) can be integrated to evaluate the composite trust of the compound object. Re-labeling enables object information update to accommodate the dynamic nature of a virtual organization. Indirect trust between two subjects can be calculated based on a trust network. Different subjects may view the same object with different trust values because they trust the components of the object to different degrees. This model uses recommendations supplied by other subjects to provide a dynamic and flexible way to adjust the trustworthiness of an object for a certain subject.

Damage Discovery in Distributed Database Systems

Damage assessment and recovery in a distributed database system in a post information attack detection scenario is a complicated process due to the indirect dependencies among (sub) transactions that are executed in various sites. Particularly, damage assessment in such a system requires collaborations among multiple participant sites as a result of distributed transactions. In this paper, we discuss two primary models, namely, centralized and peer-to-peer, to conduct damage assessment after an intrusion on a distributed database system is reported. For the centralized model, three different options have been presented. Advantages and disadvantages of each model are discussed.

Contemporary Issues in Handheld Computing Research

Mobile phones have become ubiquitous in todays society. However, mobile users are no longer satisfied with simple phones but instead expect ever more powerful functions to be available from their mobile devices. Advanced phones known as smartphones allow mobile users to perform a wide variety of advanced handheld functions such as browsing the mobile Internet or finding a nearby theater showing a specific movie. The design and development of these new, improved handheld functions require the help of handheld computing research. This article introduces handheld computing research using three themes: i mobile handheld devices, ii mobile computing, and iii current issues in handheld computing research. Information about other handheld topics of interest to researchers is given in the last section.

Two-level trust-based decision model for information assurance in a virtual organization

Like other unstructured decision problems, selection of external trustworthy objects are challenging particularly in a virtual organization (VO). Novel methods are desired to filter out invalid information as well as insecure programs. This paper presents a new, conceptual approach to support selection of objects. It is a two-level decision model, which helps a VO participant determine whether an external object can be accepted based on the objects quality and security features. This hierarchical decision-making process complies with both practical evidence and theoretical decision models. Its underlying concepts are logically sound and comprehensible. We illustrate the approaches using software selection.