@conference {310, title = {An OAuth-Based Authorization Framework for Access Control in Remote Collaboration Systems}, booktitle = {National Cyber Summit}, year = {2018}, month = {06/2018}, address = {Huntsville, Alabama, USA}, abstract = {

Advanced human computer interaction systems have made it possible for helpers (professionals) to remotely collaborate with workers (individuals seeking assistance from the professionals). For example, a professional can remotely help a worker fix automobiles or electronics, identify how much of what medication to take, or perform household repairs. We have presented a system, Collaborative Appliance for Remote-help (CARE) that allows for such collaborations. Our system allows a skilled professional or other helper to remotely access and control a worker{\textquoteright}s locally deployed resources over the Internet. These locally deployed resources may include cameras, microphones, speakers, processors, and memory. The remote helper then directs the worker to perform specific tasks to complete the job at hand. Like other Internet of Things (IoT) based systems, CARE is inputconstrained. That is, a worker cannot provide input via a touch screen or keyboard.

The resources are accessed over the Internet. Thus, security and privacy are big concerns. In this paper, we present the authorization and access control framework for the inputconstrained CARE system. This framework has been implemented using the OAuth 2.0 Authorization Framework and has been designed to meet the needs of resource owners who have no technical knowledge. We have shown that our proposed framework is very effective and consistent with the access control guidelines set by the National Institute of Standards and Technology (NIST).

}, author = {Jonnada, Srikanth and Ram Dantu and Shrestha, Pradhumna and Ranasinghe, Ishan and Widick, Logan} } @conference {262, title = {Optimized and Secured Transmission and Retrieval of Vital Signs from Remote Devices}, booktitle = {2017 IEEE/ACM International Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE)}, year = {2017}, month = {July}, abstract = {

Smartphones and other mobile platforms provide a low cost and easily accessible method of monitoring patient health, and aid healthcare professionals in early detection of disease. Immediate access to the gathered data is an essential factor in effective patient care. But the current processes used for patients{\textquoteright} vital data collection is slow and error prone. This undermines the advantages of remote monitoring that mobile platforms for health monitoring provide. In this paper, we propose to upload the patient health information to the Cloud. We investigate three different models to transfer data from the smartphone to the Cloud-perform all computations in the smartphone, perform all computations in the Cloud, and divide the computations between the smartphone and the Cloud. The second approach was found to be infeasible due to very high latency in data transfer with a delay of 2.84 seconds at an upload speed of 2500 KBytes per second. In order to protect the privacy of patients, it is required by law that the data gathered from remote monitoring by using mobile platforms must be kept private, and be secured before uploading to the Cloud. This paper explores the use of prominent public key encryption algorithms and their performance on a mobile device to securely transmit confidential electronic personal health information to the Cloud. We analyze performance of three common public key encryption schemes -RSA, Diffie-Hellman, and ECC. It is shown that 160 bit key size in ECC scheme provides the same level of security that a 1024 bit key size does in RSA and Diffie-Hellman. Further, the encryption and decryption time required by ECC is three times less than the other two schemes. Hence, ECC not only requires a smaller key size to provide the same level of security, but also faster encryption and decryption times as compared to the other two schemes. This makes ECC algorithms suitable to be implemented in resource constrained mobile platforms. We also compared ECC curves from three different standards - NIST, SECG, and Brainpool - to determine the optimum ECC curve, and key size to encrypt data in the mobile phone platform. It is shown that the Brainpool curve performed better than the other two standards when the key size is less than 521 bits. We also measured the latency of uploading encrypted data in a wide variety of WiFi and mobile networks.

}, keywords = {Brainpool curve, Cloud computing, confidential electronic personal health information, data transfer, decryption, Diffie-Hellman, Diseases, ECC algorithms, ECC curves, encryption, error prone, health care, healthcare professionals, Mobile communication, mobile device, mobile health, mobile networks, mobile phone platform, patient care, patient health information, patient health monitoring, patient vital data collection, Performance evaluation, public key cryptography, public key encryption algorithms, remote devices, remote monitoring, resource constrained mobile platforms, RSA, secured transmission, Security, servers, smart phones, smartphones, vital signs, WiFi}, doi = {10.1109/CHASE.2017.55}, author = {Thiyagaraja, Shanti and Ram Dantu and Shrestha, Pradhumna and Thompson, Mark and Smith, Christopher} } @conference {107, title = {An opportunistic encryption extension for the DNS protocol}, booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on}, year = {2015}, month = {May}, abstract = {

Confidentiality for DNS transactions has been a low-priority concern in DNS security for a long time due to performance requirements for the functionality of DNS and the fact that data in the DNS is considered public. However, the information carried in DNS transactions, if collected and analyzed, can pose real threats to personal privacy. This makes DNS a good target for passive eavesdropping to collect data for many purposes some of which may be malicious. The protocol described in this document is intended to facilitate an opportunistic negotiation of encryption in the DNS to provide confidentiality for the last mile of DNS resolution. It defines procedures to discover encryption-aware servers and how to establish a relationship with them with minimum overhead.

}, keywords = {computer network security, cryptographic protocols, DNS protocol, DNS security, DNS transactions, encryption, Internet, opportunistic encryption extension, passive eavesdropping, performance requirements, personal privacy, pose real threats, Privacy, Protocols, Public key, servers}, doi = {10.1109/ISI.2015.7165976}, author = {Bucuti, Theogene and Ram Dantu} } @conference {83, title = {Opt-in Detection Based on Call Detail Records}, booktitle = {Proceedings of the 6th IEEE Conference on Consumer Communications and Networking Conference}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Las Vegas, NV, USA}, abstract = {

Opt-in phone calls or emails refer to promotional phone calls or emails that have been requested by the people receiving them. In this paper we propose a model based on dynamic sliding windows to detect opt-in phone calls based on mobile phone call detail records. This work is useful for detecting unwanted calls (e.g., spam) and commercial purposes. For validation of our results, we used actual call logs of 100 users collected at MIT by the Reality Mining Project group for a period of 8 months. The experimental results show that our model achieves good performance with 91\% accuracy.

}, isbn = {978-1-4244-2308-8}, url = {http://dl.acm.org/citation.cfm?id=1700527.1700690}, author = {Zhang, Huiqi and Ram Dantu} }