Browsing by Author "Hwang, JJ"

Now showing 1 - 15 of 15

A conventional approach to secret balloting in computer networks
(1996)
Hwang, JJ
;
交大名義發表
;
資訊管理與財務金融系註：原資管所+財金所
;
National Chiao Tung University
;
Department of Information Management and Finance
Cryptography has been applied to ballot voting in computer networks. Several proposals satisfy the objectives of privacy protection and sound security management. Social acceptance is another challenge to meet if this application is to be moved from theory to practice. In this paper cryptographic instruments are inserted into the conventional secret-voting procedure: preparing, distributing, casting, accumulating, and tabulating ballot papers. The conventional approach has a better chance of gaining social acceptance due to adequate social controls. Moreover, the scheme removes the assumption of existent anonymous-communication channels necessary for implementing several previous proposals, while using cryptographic instruments which are intelligible to usual voters and officials. Copyright (C) 1996 Elsevier Science Ltd.
A novel access control method using Morton number and prime factorization
(2000-12-01)
Chang, HKC
;
Hwang, JJ
;
Liu, HH
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
A novel scheme used for controlling access requests in security information system is proposed. In the proposed method, the system administrator chooses distinct prime numbers representing each atomic access right as well as four large prime numbers for encryption. By setting these representative prime numbers as input parameters, the proposed method applies a one-way function combining the Morton number theory transferring into a single value to derive the encrypted compound privilege (ECP). With ECP, verification of right of access can be achieved easily and secretly. Meanwhile, the proposed scheme provides the following advantages: (I) the verification of right of access can be effectively implemented using the Morton sequence with coordinate transformation; (2) the problem of dynamic access control also can be effectively implemented; (3) integrity and confidentiality while controlling system resources can be ensured; (4) the proposed method can decrease the redundancy of the access matrix in some specific circumstances. (C) 2000 Elsevier Science Inc. All rights reserved.
A secure one-time password authentication scheme using smart cards
(2002-11-01)
Yeh, TC
;
Shen, HY
;
Hwang, JJ
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Using the great one-time password concept,, the widely utilized one-way authentication scheme S/Key provides well protection against replay attacks. In this paper, S/key is enhanced to secure transactions in a critical environment. The proposed scheme is free from any of server spoofing attacks, pre-play attacks, and off-line dictionary attacks. A session key here is also established to provide confidentiality. Moreover, simplicity and efficiency are taken into consideration from the user's point of view. A smart card is applied to simplify the user login process and only the hash function is used to keep its efficiency. Therefore, the scheme proposed hereinafter is able to build a safer shield for sensitive transactions like on-line banking or on-line trading in bonds and securities.
A transactional-cycle approach to evidence management for dispute resolution
(2005-05-01)
Shao, MH
;
Hwang, JJ
;
Wu, SS
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Dispute resolution, a necessary function in electronic commerce, must rely on evidence that includes mechanisms to ensure non-repudiation of actions by the participants. In open systems comprising computer networks, this "non-repudiation service" is one type of security service defined in the ISO/IEC standards. These, as well as other literature, have defined a system framework for such a service. Evidence management is the central part. We propose a new methodology for evidence management with a model using a transactional cycle in which evidence is collected in compliance with the legal concept of chain-of-evidence. Evidence then exists as a set of relevant pieces instead of an atomic item. A case study involving credit-cardover-SSL transactions was used to demonstrate how the model works. Our aim was to present a new approach and show that evidence accountability can be better ensured. © 2004 Elsevier B.V. All rights reserved.
A trustworthy Internet auction model with verifiable fairness
(2001)
Liao, GY
;
Hwang, JJ
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Describes a novel Internet auction model achieving verifiable fairness, a requirement aimed at enhancing the trust of bidders in auctioneers. Distrust in remote auctioneers prevents bidders from participating in Internet auctioning. According to proposed survey reports, this study presents four characteristics that render the Internet untrustworthy for bidders. These intrinsic properties suggest that auction sites not only follow auction policies, but provide customers with evidence validating that the policies are applied fairly. Evidence of verifiable fairness provides bidders with a basis for confidence in Internet auctions. Cryptographic techniques are also applied herein to establish a novel auction model with evidence to manifest and verify every step of the auctioneer. Analysis results demonstrate that the proposed model satisfies various requirements regarding fairness and privacy. Moreover, in the proposed model, the losing bids remain sealed.
An analysis of online gaming crime characteristics
(2005)
Chen, YC
;
Chen, PS
;
Hwang, JJ
;
Korba, L
;
Song, R
Purpose - To arouse the public awareness of online gaming-related crimes and other societal influences so that these problems can be solved through education, laws and appropriate technologies. Design/methodology/approach - A total of 613 criminal cases of online gaming crimes that happened in Taiwan during 2002 were gathered and analyzed. They were analyzed for special features then focusing on the tendency for online gaming crime. Related prosecutions, offenders, victims, criminal methods, and so on, were analyzed. Findings - According to our analysis of online gaming characteristics in Taiwan, the majority of online gaming crime is theft (73.7 percent) and fraud (20.2 percent). The crime scene is mainly in internet cafes (54.8 percent). Most crimes are committed within the 12:00 to 14:00 time period (11.9 percent). Identity theft (43.4 percent) and social engineering (43.9 percent) are the major criminal means. The offenders (95.8 percent) and victims (87.8 percent) are mainly male and offenders always proceed alone (88.3 percent). The age of offenders is quite low (63.3 percent in the age range of 15-20), and 8.3 percent of offenders are under 15 years old. The offenders are mostly students (46.7 percent) and the unemployed (24 percent), most of them (81.9 percent) not having criminal records. The type of game giving rise to most of the criminal cases is Lineage Online (93.3 percent). The average value of the online gaming loss is about US$459 and 34.3 percent of criminal loss is between $100 and $300. Research limitations/implications - These criminal cases were retrieved from Taiwan in 2002. Some criminal behavior may have been limited to a certain area or a certain period. Practical implications - Provides a useful source of information and constructive advice for the public who will sense the seriousness and influence of online gaming crimes. Further, this topic may have implications on e-commence, e-services, or web-based activities beyond gaming. Originality/value - Since there is little published research in this area, this paper provides the public with a good and original introduction to a topic of growing importance.
Classifying video documents by hierarchical structure of video contents
(2000)
Liu, DR
;
Lin, CH
;
Hwang, JJ
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Recent advances in video database technology and increasing use of the World Wide Web allow users to access video documents on the Web. Moreover, advances in digital library technologies necessitate the storing of large quantities of video documents, Consequently, video documents must be categorized to assist the user in browsing and searching them by category. This study presents a novel approach to classifying video documents under classes in a predefined class hierarchy. Video documents are classified according to the structural weight of video contents, capturing their characteristics with respect to the hierarchical structure of the video data. Furthermore, while considering the hierarchical relationship among classes, the proposed technique strives for an appropriate balance between specificity and exhaustivity in video classification.
Greater protection for credit card holders: a revised SET protocol
(1998-01-01)
Hwang, JJ
;
Hsueh, SC
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
MasterCard International and VISA International recently proposed the Secure Electronic Transaction (SET) protocol. Constrained by being an extension of the existing card payment networks to the Internet, SET does not satisfy the concern about privacy infringement, in particular, caused by data aggregation. This paper revises SET, guided by the principle of information segregation and hiding. The revision allows cardholders to take part in account reporting, and offers them a credit card surrogate to conceal their credit card identification in the electronic marketplace. The result is a successful counter to privacy infringement in both the small scope of a transaction and the much broader scope of data aggregation. (C) 1998 Published by Elsevier Science Ltd.
Hiding digital information using a novel system scheme
(2001)
Yeh, WH
;
Hwang, JJ
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
This work builds on Lin and Lee's document protection scheme, termed as Confused Document Encrypting Scheme (CDES). to present a novel strategy that could hide digital information and provide secret communication between two communication parties. Lin and Lee invented a document protection scheme to transmit large quantities of secret information. However, their design strategy is only suitable for single-byte character-based text document. The proposed scheme presents a novel strategy that modifies the restrictions in Lin and Lees work. Any kind of digital data, not only the plain text, can be employed as a carrier or as a secret in the proposed system. The proposed method utilizes the hexadecimal representation of digital data in a manner that ensures it will have many practical applications. In addition, the procedure is easy to implement and capable of transmitting large quantities of secret information.
ID-based structured multisignature schemes
(2001)
Lin, CY
;
Wu, TC
;
Hwang, JJ
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
The signing structure of a multisignature scheme specifies the signing order for all signers when signing messages, and any multisignature not obeying the specified signing order will be verified as invalid. In accordance with the different responsibilities of the participant signers, the signing structure of a multisignature scheme could be further classified as the following three types: serial, parallel and mixed, where the mixed structure is regarded as the mix of the serial and the parallel, Based on the well-known ID-based public key system, we will propose three ID-based structured multisignature schemes and each scheme respectively realizes the serial, parallel and mixed signing structures. In the proposed schemes, the length of a multisignature is fixed and the verification of a multisignature is efficient, regardless of the number of signers involved, Besides, any invalid partial multisignature can be effectively identified during the generation of the multisignature.
Improvement on Peyravian-Zunic's password authentication schemes
(2002-04-01)
Hwang, JJ
;
Yeh, TC
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Peyravian and Zunic (2000) presented two schemes for protecting password transmission and password change respectively. Like the traditional authentication scheme using passwords, the two new schemes are also vulnerable to attacks like guessing attacks, server spooling, and server data eavesdropping, This paper will give demonstrations on what have caused to these drawbacks, and more of that, two improved schemes are also proposed which are free from worries of those possible attacks.
New identity-based society oriented signature schemes from pairings on elliptic curves
(2005-01-05)
Lin, CY
;
Wu, TC
;
Zhang, FG
;
Hwang, JJ
;
資訊管理與財務金融系註：原資管所+財金所
In this paper, we will propose two identity-based society oriented signature schemes that allow a group of co-signers to collaboratively generate a single signature for a message. The first proposed scheme is designated with known signers and the second scheme is with anonymous signers. Both schemes make use of pairings on elliptic curves in construction and thus have the merits of simplicity in design and efficiency in performance. In the proposed scheme with anonymous signers, a signer may participate in several different signing groups and may join or leave a signing group dynamically in a secure and efficient manner. (C) 2003 Elsevier Inc. All rights reserved.
Online gaming cheating and security issue
(2005)
Chen, YC
;
Hwang, JJ
;
Song, RG
;
Yee, G
;
Korba, L
Along with the development of multimedia, animation, and network bandwidth, online gaming has become a very successful and outstanding industry recently, especially in Asia Pacific. However due to the lack of security consideration, legal regulation, management, auditing and related legislation, more and more players have violated the law or become the victims while they are indulging in the virtual world. Virtual properties are getting more and more valuable in the real-world marketplace, and trade or exchange of virtual properties between players have become prevalent. Unfortunately, using illegal fraudulent means or programs to grab others' UserID or password are increasing as well. This paper provides a detailed overview of the online cheating threat and the associated security flaws, examines its consequences for online businesses, and outlines technical solutions and implications.
Rules markup for automatic deployment of information security policies
(2001)
Hwang, JJ
;
Cheng, CW
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Information security policies define directive principles for information security management. These policies must be implemented in access control models. Role-Based Access Control (RBAC) is a paradigm, with which security policies can be developed from the perspectives of executive officers. Because "role" is tile core part of organizational dynamics, RBAC can provide a vision of adaptive information security management. In organizations, rights are assigned to proper roles and users (employees) are assigned responsibilities of certain roles. With the RBAC model, the function of information and network security can be managed in a flexible way, and better meet tile needs of doing business. XML (eXtensible Markup Language) offers a standard mean for information exchange, and must also be applicable to the exchange of definitions and contents of ACl for distributed applications. In this paper, we propose a classification of rules, which are the base of setting information policies. We also provide two sets of languages in XML: AML (Authorization Markup Language) to formulate these rules, and AUCL (AUthorization Code Language) to express access control information.
Securing on-line credit card payments without disclosing privacy information
(2003-05-01)
Hwang, JJ
;
Yeh, TC
;
Li, JB
;
資訊管理與財務金融系註：原資管所+財金所
;
Department of Information Management and Finance
Two revisions of the original Secure Electronic Transaction (SET) protocol are proposed to conceal cardholders' identities in the electronic marketplace in which cardholders' trust for banks can be reduced to a minimum. Constrained by being extensions of the existing card payment networks to the Internet, most on-line credit card payment schemes in use or proposed in recent papers assume the sensitive card information could be disclosed to all the participating banks. The assumption used to work well in traditional credit card payments before. However, negative impacts such as banking scandals, closure programs due to poor management, and security problems with Internet banking are all undermining cardholders' trust in banks. The issuer is the trusted bank selected by the cardholder, but the acquirer is not. To reveal the cardholder's sensitive card information to every possible acquirer implies potential risk. Based on the need-to-know principle, the two revisions are proposed to relax the assumption mentioned above. In our solutions, the sensitive card information is well protected along the way and can be extracted only by the issuer. A cardholder needs only to select a trustworthy issuer, instead of worrying about the possible breakdowns of every involved acquirer. The cost to achieve our more. secure schemes demands only minor information modifications on the legacy system. (C) 2002 Elsevier Science B.V. All rights reserved.