Gina Gallegos-GarcĂa, Vincenzo Iovino, Alfredo Rial, Peter B. Roenne · 5 authors
In e-voting protocols, cryptographers must balance usability with strong security guarantees, such as privacy and verifiability. In traditional e-voting protocols, privacy is often provided by a trusted authority that learns the votes and computes the tally. Some protocols replace the trusted authority by a set of authorities, and privacy is guaranteed if less than a threshold number of authorities are corrupt. For verifiability, stronger security is demanded. Typically, corrupt authorities that try to fake the tally result must always be detected.To provide verifiability, many e-voting protocols use Non-Interactive Zero-Knowledge proofs (NIZK). Thanks to their non-interactive nature, NIZK allow anybody, including third parties that do not participate in the protocol, to verify the correctness of the tally. Therefore, NIZK can be used to obtain universal verifiability. Additionally, NIZK also improve usability because they allow voters to cast a vote non-interactively.The disadvantage of NIZK is that their security is based on setup assumptions such as the common reference string (CRS) or the random oracle model. The former requires a trusted party to generate a CRS. The latter, though a popular model for secure protocol design, has been shown to be unsound.We address the design of e-voting protocols that provide verifiability without any trust assumptions. We show that Non-Interactive Witness-Indistinguishable proofs can be used for this purpose. Our e-voting protocols are private under the Decision Linear assumption, while perfect individual verifiability, i.e. a fake tally is detected with probability 1, holds unconditionally. Perfect universal verifiability requires a trusted public bulletin board. We remark that our definition of verifiability does not consider eligibility or end-to-end verifiability. First, we present a general construction that supports any tally function. Then, we show how to efficiently instantiate it for specific types of elections through Groth-Sahai proofs.
Eli BenâSasson, Alessandro Chiesa, Michael A. Forbes, Ariel Gabizon · 6 authors
We present the first constructions of single-prover proof systems that achieve perfect zero knowledge (PZK) for languages beyond NP, under no intractability assumptions: 1. The complexity class #P has PZK proofs in the model of Interactive PCPs (IPCPs) [KR08], where the verifier first receives from the prover a PCP and then engages with the prover in an Interactive Proof (IP). 2. The complexity class NEXP has PZK proofs in the model of Interactive Oracle Proofs (IOPs) [BCS16,RRR16], where the verifier, in every round of interaction, receives a PCP from the prover. Our constructions rely on succinct simulators that enable us to "simulate beyond NP", achieving exponential savings in efficiency over [BCGV16]. These simulators crucially rely on solving a problem that lies at the intersection of coding theory, linear algebra, and computational complexity, which we call the succinct constraint detection problem, and consists of detecting dual constraints with polynomial support size for codes of exponential block length. Our two results rely on solutions to this problem for fundamental classes of linear codes: * An algorithm to detect constraints for Reed--Muller codes of exponential length. * An algorithm to detect constraints for PCPs of Proximity of Reed--Solomon codes [BS08] of exponential degree. The first algorithm exploits the Raz--Shpilka [RS05] deterministic polynomial identity testing algorithm, and shows, to our knowledge, a first connection of algebraic complexity theory with zero knowledge. Along the way, we give a perfect zero knowledge analogue of the celebrated sumcheck protocol [LFKN92], by leveraging both succinct constraint detection and low-degree testing. The second algorithm exploits the recursive structure of the PCPs of Proximity to show that small-support constraints are "locally" spanned by a small number of small-support constraints.
Sep 29, 2016·In Proceedings of the 12th International Conference on Availability, Reliability and Security (ARES '17). ACM, New York, NY, USA, Article 43, 2017
Distributed Hash Tables (DHT) are a common architecture for decentralized applications and, therefore, would be suited for privacy-aware applications. However, currently existing DHTs allow every peer to access any index. To build privacy-aware applications, we need to control this access. In this paper, we present k-rAC, a privacy-aware fine-grained AC for DHTs. For authentication, we present three different mechanisms based on public-key cryptography, zero-knowledge-proofs, and cryptographic hashes. For authorization, we use distributed AC lists. The security of our approach is based on k-resilience. We show that our approach introduces an acceptable overhead and discuss its suitability for different scenarios.
This thesis presents new results in three fundamental areas of public-key cryptography: integrity, authentication and confidentiality. In each case we design new primitives or improve the features of existing ones. The first chapter, dealing with integrity, introduces a non-interactive proof for proper RSA public key generation and a contract co-signature protocol in which a breach in fairness provides the victim with transferable evidence against the cheater. The second chapter, focusing on authentication, shows how to use time measurements to shorten zeroknowledge commitments and how to exploit bias in zero-knowledge challenges to gain efficiency. This chapter also generalizes Fiat-Shamir into a one-to-many protocol and describes a very sophisticated smart card fraud illustrating what can happen when authentication protocols are wrongly designed. The third chapter is devoted to confidentiality. We propose public-key cryptosystems where traditional hardness assumptions are replaced by refinements of the CAPTCHA concept and explore the adaptation of honey encryption to natural language messages. Our final contributions focus on identity-based encryption (IBE) showing how to add broadcast features to hierarchical IBE and how to use IBE to reduce vulnerability exposure time of during software patch broadcast.
BACKGROUND: Proliferation and expansion of security risks necessitates new measures to ensure authenticity and validation of GMOs. Watermarking and other cryptographic methods are available which conceal and recover the original signature, but in the process reveal the authentication information. In many scenarios watermarking and standard cryptographic methods are necessary but not sufficient and new, more advanced, cryptographic protocols are necessary. RESULTS: Herein, we present a new crypto protocol, that is applicable in broader settings, and embeds the authentication string indistinguishably from a random element in the signature space and the string is verified or denied without disclosing the actual signature. Results show that in a nucleotide string of 1000, the algorithm gives a correlation of 0.98 or higher between the distribution of the codon and that of E. coli, making the signature virtually invisible. CONCLUSIONS: This algorithm may be used to securely authenticate and validate GMOs without disclosing the actual signature. While this protocol uses watermarking, its novelty is in use of more complex cryptographic techniques based on zero knowledge proofs to encode information.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
We examine the power of statistical zero knowledge proofs (captured by the complexity class SZK) and their variants. First, we give the strongest known relativized evidence that SZK contains hard problems, by exhibiting an oracle relative to which SZK (indeed, even NISZK) is not contained in the class UPP, containing those problems solvable by randomized algorithms with unbounded error. This answers an open question of Watrous from 2002 [Aar]. Second, we "lift" this oracle separation to the setting of communication complexity, thereby answering a question of Göös et al. (ICALP 2016). Third, we give relativized evidence that perfect zero knowledge proofs (captured by the class PZK) are weaker than general zero knowledge proofs. Specifically, we exhibit oracles relative to which SZK is not contained in PZK, NISZK is not contained in NIPZK, and PZK is not equal to coPZK. The first of these results answers a question raised in 1991 by Aiello and HÄstad (Information and Computation), and the second answers a question of Lovett and Zhang (2016). We also describe additional applications of these results outside of structural complexity. The technical core of our results is a stronger hardness amplification theorem for approximate degree, which roughly says that composing the gapped-majority function with any function of high approximate degree yields a function with high threshold degree.
The authors define a notion of adaptive proofs of knowledge (PoKs) in the random oracle model (ROM). These are proofs where the malicious prover can adaptively issue multiple statements and proofs, and where the extractor is supposed to extract a witness for each statement. They begin by studying the traditional notion of zeroâknowledge PoKs in the ROM and then show how to extend it to the case of adaptive adversaries and to simulation soundness, where the adversary can also learn simulated proofs. The authorsâ first main result is negative. Under common assumptions, they can show that the wellâknown FiatâShamirâSchnorr proof system is not adaptively secure. As for the second result, they prove that an existing construction due to Fischlin (Crypto 2005) yields adaptively secure simulationâsound PoKs in the ROM. Since the purpose of this work is to motivate and introduce adaptive proofs, they only briefly discuss some applications to other areas, for example that adaptive proofs seem to be exactly what one requires to construct chosenâciphertext attackâsecure publicâkey encryption from indistinguishability under chosen plaintext attack secure schemes.
We obtain lower tail estimates for the smallest singular value of random\nmatrices with independent but non-identically distributed entries.\nSpecifically, we consider $n\\times n$ matrices with complex entries of the form\n\\[ M = A\\circ X + B = (a_{ij}\\xi_{ij} + b_{ij}) \\] where $X=(\\xi_{ij})$ has iid\ncentered entries of unit variance and $A$ and $B$ are fixed matrices. In our\nmain result we obtain polynomial bounds on the smallest singular value of $M$\nfor the case that $A$ has bounded (possibly zero) entries, and $B= Z\\sqrt{n}$\nwhere $Z$ is a diagonal matrix with entries bounded away from zero. As a\nbyproduct of our methods we can also handle general perturbations $B$ under\nadditional hypotheses on $A$, which translate to connectivity hypotheses on an\nassociated graph. In particular, we extend a result of Rudelson and Zeitouni\nfor Gaussian matrices to allow for general entry distributions satisfying some\nmoment hypotheses. Our proofs make use of tools which (to our knowledge) were\npreviously unexploited in random matrix theory, in particular Szemer\\'edi's\nRegularity Lemma, and a version of the Restricted Invertibility Theorem due to\nSpielman and Srivastava.\n
Cryptography is known for it's ability to protect confidential information, but it can also be used for other purposes. One of them is for identity verification or authentication. One of the biggest disadvantages of traditional authencation method is at the end of the session, the verifier knows about secrets which is supposed to be known only by prover. In this paper, we implemented a ZeroKnowledge Proof-based secret ticket verification system using Feige Fiat Shamir protocol. The goal of this system is to help prover identified themselves to the verifier, but also prevent the verifier to understand anything about the prover's secret information. The system is also able to prevent ticket duplication or double-use of tickets by using an interactive proof verification method. By combining it with cryptography, not only we can achieve completeness and soundness property of Zero-Knowledge Proof, but we can also achieve information security property. Index Terms - Feige Flat Shamir, Verification, Zero Knowledge Proof.
The proliferation of Internet of Things (IoT) devices has transformed various sectors, improving efficiency and connectivity. However, this rise also significantly amplifies security vulnerabilities, exposing IoT ecosystems to various cyber threats. Traditional security mechanisms often fall short in addressing these vulnerabilities due to their centralized nature and scalability issues. Blockchain technology, recognized for its robust security features such as decentralization, transparency, and immutability, offers a promising alternative. This paper explores the application of advanced blockchain technologies, such as smart contracts, zero-knowledge proofs, and off-chain transactions, to enhance IoT security. Through theoretical analysis and empirical data, we demonstrate how blockchain can resolve critical security issues in IoT networks, including data integrity, device authentication, and secure communication. The findings suggest that integrating blockchain technology into IoT frameworks can significantly mitigate risks and bolster security. This research contributes to the academic discourse by highlighting practical implementations, challenges, and future perspectives on the convergence of blockchain and IoT technologies.
Abstract We present an efficient method for answering one-dimensional range and closest-point queries in a verifiable and privacy-preserving manner. We consider a model where a data owner outsources a dataset of key-value pairs to a server, who answers range and closest-point queries issued by a client and provides proofs of the answers. The client verifies the correctness of the answers while learning nothing about the dataset besides the answers to the current and previous queries. Our work yields for the first time a zero-knowledge privacy assurance to authenticated range and closest-point queries. Previous work leaked the size of the dataset and used an inefficient proof protocol. Our construction is based on hierarchical identity-based encryption. We prove its security and analyze its efficiency both theoretically and with experiments on synthetic and real data (Enron email and Boston taxi datasets).
One of todayâs main challenge related to cloud storage is to maintain the functionalities and the efficiency of customersâ and service providersâ usual environments while protecting the confidentiality of sensitive data. Deduplication is one of those functionalities: it enables cloud storage providers to save a lot of memory by storing only once a file uploaded several times. However, classical encryption schemes block deduplication. One needs to use a âmessage-locked encryptionâ scheme (MLE), which allows the detection of duplicates and the storage of only one encrypted file on the server, which can be decrypted by any owner of the file. However, in most existing scheme, a user can bypass this deduplication protocol. In this article, we provide servers verifiability for MLE schemes: the servers can verify that the ciphertexts are well-formed. This property forces a customer to prove that she complied to the deduplication protocol, thus preventing her to deviate from the prescribed functionality of MLE. Then, we provide an MLE scheme satisfying this new security property. To achieve the deduplication consistency, our construction primarily relies on zero-knowledge proofs. Unlike Abadi et al.âs MLE, we instantiate those proofs, so<br> that we obtain a more efficient scheme, secure in the random oracle model.
Planar nearrings play an important role in nearring theory, both from the structural side as being close to generalised nearfields, as well as from an applications perspective, in geometry and designs. We investigate the distributive elements of planar nearrings. If a planar nearring has nonzero distributive elements, then it is an extension of its zero multiplier part by an abelian group. In the case that there are distributive elements that are not zero multipliers, then this extension splits, giving an explicit description of the nearring. This generalises the structure of planar rings. We provide a family of examples where this does not occur, the distributive elements being precisely the zero multipliers. We apply this knowledge to the question of determining the generalized center of planar nearrings as well as finding new proofs of other older results.
Open access
Rings, Modules, and Algebras
Advanced Topics in Algebra
Advanced Differential Equations and Dynamical Systems
Pulmonary metastasectomy is analysed in this paper according to the rules of evidence-based medicine (EBM). Our knowledge of metastasectomy lacks several crucial factors necessary for the tenets of EBM: survival without surgery in this special group of patients; knowledge of the denominator from which the cases are selected; and the biological nature of the individual tumour. If metastasectomy were introduced today as a new treatment, it would not be accepted. Our analysis provides an alternative interpretation of 5-year survival rates of 40% after metastasectomy as being a result of selection of the patients at the benign end of the continuous spectrum of malignancies. It is therefore a statistical illusion. Given the many variables and the long-time course in many patients with or without metastasectomy, the effect of surgery can only be resolved by a randomized control two-armed trial, where the outcomes between an unoperated group (the natural history) and an operated group (the natural history modified by treatment) are compared. Absence of knowledge is readily accepted by many patients if candidly and respectfully explained and so a randomized trial is possible, appropriate and acceptable to a sufficient number of patients. To shed light on whether there is truly a survival benefit from metastasectomy, a randomized trial has been started. Pulmonary Metastasectomy in Colorectal Cancer (PulMiCC) has so far recruited 86 randomized patients and is open internationally. It is funded for a further 5 years. Interested groups are invited to join the trial. EBM has provided a logical way of defining the âindicationâ for treatment. An âindicationâ as used in medical English is the base around which we decide to recommend treatment to patients. It can be said to be the centre of the doctor's professional duty: to identify as unequivocally as possible the indication for treatment. To decide on an indication is to influence the fate of the patient. The indication has therefore to be surrounded by stringent and quality assured rules. The ideals of EBM have been of great value to patients, but at the same time we must not forget that the evidence has to be individualized. Indications for treatment may be reached from various forms of evidence and encapsulated in clinical guidelines or, when we are less certain, consensus statements. Clinical guidelines [1] seek to make irrefutable recommendations, based on the latest and best available evidence, while consensus statements are based on opinions and are more tentative. Nevertheless, we cannot expect even the most secure evidence-based guidelines to be implemented in 100% of patients. The guidance has to be personalized according to the treating doctor's view of the best interests of the individual patient. The ideals of EBM have also been of great value to doctors who have to advise for or against treatments. This can only be done conscientiously when we are able to point to evidence. The ideals of EBM have been of value to society so that we are all spared the distress and the cost of needless treatments. The introduction of new drugs and the indications for their use are now subject to stringent rules which must be adhered to. Surgical operations should be just as carefully considered. Society should not be asked to spend its precious resources on ineffective treatments. The nation's nurses and hospitals are a shared resource; the doctors as the main drivers of costs in a health system must be responsible for their proper use. The phrase Personalized Medicine came into use, as if in opposition to EBM, but it is a false dichotomy. The tightest evidence-based guideline should be overridden for some patients. That is to say they are âpersonalisedâ. But, with respect to lung metastasectomy, there are no clinical guidelines. The European Society of Thoracic Surgeons (ESTS) Lung Metastasectomy Working Group (LMWG) considered producing guidelines but concluded â⊠the level of evidence to support current practice is too low to set firm recommendations to the members of ESTS. In the absence of a randomized controlled trial looking at the effectiveness of pulmonary metastasectomy on survival and quality of life, it is unlikely that the current practice will ever be influencedâ [2]. More recently, the Society of Thoracic Surgeons (STS) has searched and not found evidence of the kind on which âtrustworthyâ clinical guidance can be based. The result is that there are no guidelines, in Europe or the USA because there is no trustworthy evidence base [1]. The leaders of ESTS' LMWG directed readers to the PulMiCC trial proposal [3]. That was more than 5 years ago. Since then, there have been many further publications but they do not introduce new information based on better evidence. They come to the same conclusions as were reached by the early follow-up studies in the 1970s and the registry data in the 1990s. In this article, we will go back to basics and examine the sources of evidence on which we might build the indication for metastasectomy. In the very earliest days of surgery for congenital heart disease, Maurice Campbell (1891â1973) made the important decision that the large number of patients they had seen at Guy's Hospital with congenital heart disease, untreatable up to that time, should be categorized in as much detail as possible. He asked that their clinical course be meticulously recorded. Without that record, he argued, future cardiologists and surgeons would never know how the newly introduced operations had altered the ânatural historyâ. What is the equivalent ânatural historyâ of lung metastases? The 5-year survival of patients with lung metastases is commonly assumed to approach zero. Is this a realistic estimate? It was contradicted by Ă berg's finding reported in 1980 of a 5-year survival rate of 25% for unoperated patients, similar to that of contemporary patients who had lung metastasectomy [4]. The data were few (3/12) and the confident limits are wide (6â57%) but they do not include zero [5]. A realistic estimate of the natural history of the disease is an absolute requirement. For present day patients with lung metastasis, we still do not have that essential information. There are registry data that provide the natural history of patients with cancer usually divided by stage. In Tables 1 and 2, we show cancer registry data for survival of all patients with colorectal cancer and sarcoma in the worst category in the registry, designated Stage 4. This includes only patients who already had metastases at the time of diagnosis. Even with metastases at presentation (and these are the minority in clinical series) there is a non-trivial number of 5-year survivors. It is of the order of 10% for colorectal cancer in the cancer registry. Therefore, the number for whom survival can be attributed to lung metastasectomy is already well short of the 40% that is generally inferred from follow-up studies. Survival rates of 40% after lung metastasectomy are compatible with selection of the most favourable patients with no beneficial effect from metastasectomy [7, 8]. For many diseases, the cancer registry survival data have improved decade by decade and hence the difference attributable to metastasectomy will have narrowed. We hope that improved survival is a reflection of better treatments and effective operations, but there are other statistical factors which we will now consider. Colorectal cancer Five-year survival data of patients with metastases at registration. Thames Cancer Registry cases registered as having metastases from colorectal cancer at the time of diagnosis in three decades from 1980 to 2009. It is unlikely that many of these patients underwent lung metastasectomy. For example the most active group in the Thames region at the time reported 29 patients having lung metastasectomy for carcinoma of any type in an 8-year period (<4 per annum) [6]. These 5-year survival figures provide an order of magnitude for the survival of registered patients with metastases of nearly 10%. If the most favourable quartile were identified as lung metastasectomy candidates but not operated on (10/25 = 0.4), âŒ40% survival would be observed [7, 8]. The colorectal cancer patients have usually not had metastases at the time of the primary resection and have already survived longer than 2â3 years from the time of diagnosis before lung metastasectomy. The authors acknowledge Henrich MĂžller for providing the data for inclusion in these tables. Colorectal cancer Five-year survival data of patients with metastases at registration. Thames Cancer Registry cases registered as having metastases from colorectal cancer at the time of diagnosis in three decades from 1980 to 2009. It is unlikely that many of these patients underwent lung metastasectomy. For example the most active group in the Thames region at the time reported 29 patients having lung metastasectomy for carcinoma of any type in an 8-year period (<4 per annum) [6]. These 5-year survival figures provide an order of magnitude for the survival of registered patients with metastases of nearly 10%. If the most favourable quartile were identified as lung metastasectomy candidates but not operated on (10/25 = 0.4), âŒ40% survival would be observed [7, 8]. The colorectal cancer patients have usually not had metastases at the time of the primary resection and have already survived longer than 2â3 years from the time of diagnosis before lung metastasectomy. The authors acknowledge Henrich MĂžller for providing the data for inclusion in these tables. Sarcoma Five-year survival data of patients with metastases at registration. Thames Cancer Registry cases registered as having metastases from bone or soft tissue sarcoma at the time of diagnosis in two decades from 1985 to 2004. The group designated to manage sarcoma in the Thames region at the time reported 43 patients having lung metastasectomy for carcinoma of any type in an 8-year period (âŒ5% per annum) [6], so these 5-year survival figures cannot be attributed to lung metastasectomy. Long survival after lung metastasectomy may reflect selection of patients with a favourable natural history of survival [9]. The authors acknowledge Henrich MĂžller for providing the data for inclusion in these tables. Sarcoma Five-year survival data of patients with metastases at registration. Thames Cancer Registry cases registered as having metastases from bone or soft tissue sarcoma at the time of diagnosis in two decades from 1985 to 2004. The group designated to manage sarcoma in the Thames region at the time reported 43 patients having lung metastasectomy for carcinoma of any type in an 8-year period (âŒ5% per annum) [6], so these 5-year survival figures cannot be attributed to lung metastasectomy. Long survival after lung metastasectomy may reflect selection of patients with a favourable natural history of survival [9]. The authors acknowledge Henrich MĂžller for providing the data for inclusion in these tables. Detection of metastases much earlier can now be achieved by more available health care and more sensitive diagnostic tests. If the diagnosis is made 1 year earlier, the recorded survival of the patient will be 1 year longer. This is called lead time bias and it creates an illusion of improving outcomes simply because the stop watch was started sooner. With the introduction of new methods of detection, we have been able to stage patients more precisely. Some patients diagnosed as Stage I lung cancer are now classified as Stage II because we can now see previously undetectable lymphatic involvement. This is called stage migration. Similarly, better detection of mediastinal node involvement with lung metastases, and the exclusion of these patients, produces a group for metastasectomy with a better natural history. Any difference in observed survival would be due to better selection, not to the metastasectomy. With computed tomography (CT) we were able to detect lung metastases. With the addition of positron emission tomography to CT, some patients with lung metastases are now seen to have unsuspected sites of cancer elsewhere in the body. This results in more exclusions, which has the effect of narrowing down the selection of patients in whom metastasectomy is âindicatedâ. The survival results will inevitably appear to be better. Higher 5-year survival in this more highly selected group may be a consequence of selection rather than metastasectomy. There is a distinction made in EBM between âefficacyâ and âeffectivenessâ [10]. Unfortunately, the two words are more or less interchangeable in every day English but in the language of EBM, efficacy is used for interventions that can be seen âto workâ. So if a surgeon removes a solitary lung metastasis and the pathologist reports cancer-free margins, the operation has efficacy; the metastasis has been removed. Whether the operation is âeffectiveâ in achieving the desired clinical outcome, which is to improve survival, the pathologist cannot say. Even after 5 years, patients may die of their same cancer and the metastasectomy can then be seen to have been ineffective as a means of cure [11]. There have been many clinical situations where repeated observation and experience were sufficient proof for a treatment to become established [11, 12]. Surgeons do not hesitate to relieve tension pneumothorax or to retrieve an inhaled object obstructing the trachea. Rightly no one asks them for randomized controlled trial (RCT) evidence. Cataract and hip surgery, and the relief of mitral and aortic stenosis, all entered practice without RCTs. In these examples, the surgeon deals with a single, clearly evident cause of the patient's problem, which is then promptly relieved by a mechanistically rational intervention. If these principles are used to test the effectiveness of lung metastasectomy, it fails the test. There are multiple factors involved and the time scale is measured in years, so the patient's survival at any time point up to and beyond 5 years cannot unequivocally be attributed to that surgical action. It is worth noting that, for treatments that can be seen to be effective by observation alone [11], the more severe the problem, the greater is the benefit to the patient. It is for that reason we are prepared to observe a small pneumothorax or a mild degree of aortic stenosis: it is for the severe cases that we know we should intervene. This is in contrast to lung metastasectomy. Patients selected for metastasectomy are the least severely affected among a heterogeneous they have metastases, longer to their and more EBM not to the patient's survival at any time point to the lung metastasectomy, without control We must that lung metastases are the cause of Patients in whom the only of cancer is the lung metastasis have a for survival, at least in the short They are not to die time so survival data are clearly in this There is an that we must to a lung metastasis because it in may to the mediastinal and from there as we will this is not the on which the practice of metastasectomy is the results are to be better if metastasectomy is a period of It is for a surgeon to to a tumour. were seen as a The in it is to all The of the indications for metastasectomy was that there should be a solitary or very few the should have been and that the patient should have the pulmonary to and the of lung to the These were and were the of set years It was also that there should have been an of time the primary This a further period of observation after the metastasis evident to that there was no or cancer the many follow-up this was found to be on years the primary surgery in cases of sarcoma and years for colorectal cancer This that only a few of all patients with lung metastases the and paper from is an example that was as the practice established The 5-year survival rate was 40% but the data were from patients operated on between and with a very wide of cancer That is an of than patients a this paper in for it to have been and more with it being the of for surgery, have several In the of lung metastasectomy, there are two by this is the in the degree of only one patient had a metastasectomy in a period If they found patients for metastasectomy that how large was the denominator from which the patients were A is the absence of any control These to Ă berg's of patients who were but not have lung metastasectomy. He found that some of them survived 5 years without metastasectomy [4]. The in this is the Registry of Lung in The analysis of patients, meticulously and clearly that the favourable factors for survival were an the primary resection of greater than years and a solitary The authors their words They these which is These are for cancer survival of treatment rather than being of a beneficial effect of metastasectomy The authors were also in their for further In their the registry would of surgery and other to be by randomized the registry as the that the in the registry of the few patients who from operation after being to have it would to the value of the That would have provided the of the unoperated survival for patients who are similar to having metastasectomy. That is the ânatural historyâ as There is important registry in which data were to practice as as possible. surgeons data on patients of all lung metastasectomy operations in their in a The point was patients who had a metastasectomy. The to the outcomes was as a as was the survival of patients metastasectomy. this of we can that than of patients with colorectal lung metastases have metastasectomy. This is with other in which this information can be If we this level of selection knowledge of for survival, it less that follow-up studies include 40% 5-year [7, 8]. These data are from a of the of time of in a lung cancer the for providing the data to this The are on the from the to the by the time in days were and the was We have the It can be seen that to have much longer than and lung The to the would have many years to a due to the of cancer and would have been unlikely to cause the of the patient. The patient would have with the before it any are seen for lung metastases and the same might be time as a means of patients for metastasectomy was in patients operated on from to In patients, the time was found to from to more than days by these patients, had metastasectomy and Patients with of less than days years whether operated on or Patients were and the metastases after They operated on with rates of do that is of course to any to them as as possible before they The was that a of patients with who had a period of and who had metastasectomy all survived for 5 years Patients with the metastases their a that has been used before in the of lung metastasectomy These various lead to that the of survival of patients after 5 years to the metastasectomy operation is a illusion with an of If we just on the data a of follow-up studies of nearly patients that survival was if there was more than one metastasis and an of less than years. The is the same as that reached in the follow-up studies in the 1970s with by the in and with a more in Nevertheless, the surgeon authors concluded â⊠it to surgery for patients with two to is the point of the same analysis and an ever more statistical result and then it with the words to We an alternative It to not only to to operations without a realistic of benefit to patients, but it is to a that is so far at with the evidence. not the patient with metastases the in this and other metastasectomy has been to not provide What is now is that and are to be effective based on the for surgical metastasectomy. They are being as a less way of the same They are being introduced without on no more than surgical without evidence from control data There are and a result of better selection, less surgery or treatment, or for a of these 5-year survival rates of after lung metastasectomy colorectal cancer as an are now around the we become able to the more for we might see even better 5-year survival rates to That would further the in the effectiveness of metastasectomy, but it would be a statistical There is new evidence that a to the practice of metastasectomy. In the of colorectal the indication for lung metastasectomy, there is a that patients who have had primary resection should be to detect metastases as early as possible so that they can be There has been a of at detection of metastases with the to of the diagnosis with current The finding is that more not lead to improved This has been found in RCTs. It one might that earlier detection for treatment would improve That has not been the the tenets of EBM, the effectiveness of metastasectomy is one that a randomized trial to an An has the that it that the and factors are similar in It is in value only by of several RCTs. A treatment with as much as lung metastasectomy would not now be introduced into practice without RCTs. An is A of patients with lung metastases of whom in are to be 5-year based on Thames Cancer Registry data The patients are according to metastases and longer between primary surgery and metastasectomy These are They are also with longer survival after metastasectomy and are used for If of these patients are among the in the that would result in the observed 40% survival by selection Patients with three or more metastases and an of 1 year and of the are In the PulMiCC trial, may any patient whom they may but the patients between the possible and are the where there is most to be The carefully selected patient with a lung metastasis, with favourable can expect a survival, not but years, the The metastases that can be seen and are very unlikely to be the cause of the patient's If metastases are that might treatment to relieve the but in they are and to or distress the end of These should be shared with the patient. In some surgeons say they the patient hope is not medical and and by other than the many patients would be to be spared an operation that will not benefit The time of the year or two of their can be in better than surgery and Surgeons are to point that there is very low with metastasectomy. is not a of in introduced highly to of drugs to patients with of was based on Metastasectomy in low of and but surgery should only be done for a treatments because they do is not and interventions have a they up and time, and they a of we know that the of with a metastasis may be for some patients. information the nature of the disease and the of with or without a metastasis, the patient may still on an The indication then their We are not or and should be a without of the patient's is not to lung metastasectomy but to base the indications on rational the patient's and an interpretation of the evidence. information I What do Our current is based on of all the evidence that we are and if this evidence we would of
Smooth (or universal) projective hash functions were first introduced by Cramer and Shoup, at Eurocrypt'02, as a tool to construct efficient encryption schemes, indistinguishable under chosen-ciphertext attacks. Since then, they have found many other applications, including password-authenticated key exchange, oblivious transfer, blind signatures, and zero-knowledge arguments. They can be seen as implicit proofs of membership for certain languages. An important question is to characterize which languages they can handle.In this thesis, we make a step forward towards this goal, by introducing diverse modules. A diverse module is a representation of a language, as a submodule of a larger module, where a module is essentially a vector space over a ring. Any diverse module directly yields a smooth projective hash function for the corresponding language, and almost all the known smooth projective hash functions are constructed this way.Diverse modules are also valuable in their own right. Thanks to their algebraic structural properties, we show that they can be easily combined to provide new applications related to zero-knowledge notions, such as implicit zero-knowledge arguments (a lightweight alternative to non-interactive zero-knowledge arguments), and very efficient one-time simulation-sound (quasi-adaptive) non-interactive zero-knowledge arguments for linear languages over cyclic groups.
Andrew J. Engel, D. Scott Kreiner, Milan P. Stojanovic
Recently, Friedly et al. published a study on the effectiveness of epidural injections of steroids (ESIs) for lumbar spinal stenosis (LSS) [1]. Because of its apparent implications for clinical practice, this study attracted comments both in the professional [2] and lay press [3]. However, the study prompts reflection on a number of issues that extend beyond the conventional appraisal of a study. Those issues pertain to how physicians think about a condition, how it should be treated, and how to best assess the effectiveness of that treatment. The following article addresses those issues in the interest of informing physicians about how contemporary practices are confounded by lack of diagnostic discipline, and how this makes the conduct of controlled trials complicated and, therefore, makes the results difficult to assess. The cardinal issues are the symptoms of LSS; the diagnosis of LSS; the rationale for treatment; the consequent appropriate selection of patients; the outcomes assessment, either in practice or in a study including the reporting of those outcomes; and the need for rigorous control of the technical performance of the therapeutic intervention. Each of these issues has a critical bearing on appraising not only the literature on LSS, but also on how physicians treat this condition in conventional practice. The literature is profuse with heterogeneity in symptomology related to LSS. While there is no consensus in the current literature on acceptable LSS symptoms, the most commonly quoted symptoms are neurogenic claudication, radicular pain, and low back pain (LBP). Additional symptoms commonly mentioned in literature were fatigue and loss of power in the legs, anesthesia, and a feeling of numbness in the sacral dermatomes. In an attempt to achieve consensus, Katz et al. in 1995 published symptoms most strongly associated with the diagnosis of LSS (likelihood ratio â„ 2), which included advanced age, severe lower-extremity pain, and absence of pain when seated [4]. In a recent, randomized trial by Weinstein et al., Spine Patient Outcomes Research Trial (SPORT), enrollment criteria included LSS on cross-sectional imaging and symptoms of either neurogenic claudication or radicular pain [5]. Patients were randomized to surgery and non-operative treatment, with short-term results favoring surgery. However, similar benefits from surgery were noted in patients with and without neurogenic claudication. A subgroup analysis demonstrated that patients with predominant leg pain improved significantly more with surgery than predominant LBP patients [6]. Overall, neurogenic claudication is the most commonly mentioned symptom of LSS; although the North American Spine Society guidelines list back pain as the most common complaint with a prevalence of 95%, followed by claudication (91%), leg pain (71%), weakness (33%), and voiding disturbances (12%) [7]. Claudication was first described by Dejerine in association with syphilitic arteritis of the spinal cord [8]. Blau and Louge described six cases of intermittent claudication caused by protrusion of a lumbar disc [9]. A 1964 report of two cases of âintermittent claudication from compression of cauda equinaâ resolved by lumbar laminectomy by Brish et al. was published 3 years later [10]. The contemporary definition of neurogenic claudication includes decreased ability to walk and stand with discomfort that radiates beyond the spinal area into the buttocks and frequently into the thigh and lower leg; it is exacerbated by lumbar extension and improves with lumbar flexion [17]. If neurogenic claudication is considered a hallmark symptom of LSS, a recent review of seven randomized controlled trials (RCT) revealed that the actual presence of neurogenic claudication was used as eligibility criteria in only 71% of LSS studies. When neurogenic claudication was necessary for enrollment eligibility, its definition varied considerably across studies, including symptoms such as âfatigue or loss of sensation in the lower limbs aggravated by walkingâ or âsitting as a better position for symptom severity than standing or walkingâ [24]. Similar to the variability in defining neurogenic claudication, all studies in this review presented imaging findings consistent with LSS, but a detailed radiological definition of LSS was provided only 57% of the time. The emphasis on neurologic features in the original literature was consistent with the proposed pathology [17,19,11â13]. By definition LSS is a narrowing of the spinal canal; therefore, it is logical that pain and neurologic symptoms would be a result of compromise of the nerve roots contained within the canal. The same link is missing for back pain: The pathophysiology of such a mechanism has neither been explained, nor supported in the literature. All the experimental and clinical evidence points to back pain arising from sources other than the nerve roots, such as the intervertebral discs, the zygapophysial joints, the sacroiliac joint, or perhaps the back muscles. Until proven otherwise, it becomes more rational to infer that the back pain reported by patients with LSS arises from one or another of these structures, rather than being caused by compression or ischemia of the cauda equina. This has been demonstrated in a study of patients with radiographic LSS, where the actual source of the patientâs back pain was traced to the zygapophysial joints, which was then treated by medial branch radiofrequency neurotomy [14]. In contrast to low back pain, it seems theoretically plausible that patients with LSS could present with radicular pain. However, it is important to note the differences between radicular pain caused by disc protrusion and neurogenic claudication caused by spinal stenosis. Although both are similar in clinical presentation, they have significant differences in pathophysiology and natural history analogous to the example comparing exercise induced angina and myocardial infarction (although both present with pain and are due to the same underlying principles). These differences can affect treatment outcomes and for that reason it is important to exactly identify the symptomatology of LSS before selecting a treatment modality or designing an outcome study. Despite the fact that LSS has been recognized for over 50 years, there is lack of consistency in use of this nomenclature: whether LSS is a clinical entity, a radiologic observation, or a term describing an anatomical state of the lumbar spine [15]. Historically, the first comprehensive report of LSS by Verbiest in 1954 described seven cases of a clinical condition in which there were symptoms of compression of the caudal nerve roots on standing or walking, but not at rest [16]. In all cases myelography showed a block in the lumbar region and narrowing of the spinal canal was found during surgery. The author suggested that the narrowing was due to encroachment on the spinal canal by the articular processes and that decompression of the dural sheath may be followed by complete relief. An updated and more accurate anatomical definition of LSS proposes that central LSS may result from a decrease in the anteroposterior, transversal, or combined canal diameter secondary to loss of disc height with or without bulging of the intervertebral disc; and hypertrophy of the facet joints and the ligamentum flavum [5]. The same process can also lead to lateral recess and foraminal spinal stenosis. The pathophysiology of LSS has been attributed to mechanical compression, ischemia, or both, of the lumbosacral nerve roots due to narrowing of the lateral and central vertebral canals [17,18]. The likely mechanism of ischemia is mechanical compression leading to further pressure on the venules surrounding the nerve roots causing its engorgement leading to ischemic and inflammatory nerve impairment [6,19â21]. Despite the anatomical description of LSS, the fact that up to 21% of asymptomatic subjects have significant radiographic findings of LSS poses an obstacle in reaching a consensus on diagnostic criteria for LSS, and also raises questions regarding the pathophysiologic mechanisms [22â24]. These findings imply that even detailed radiographic criteria alone (as summarized by Steurer et al. [25]) do not establish that LSS is the cause of a patientâs symptoms. The actual cause would be additional pathologic change leading to symptoms. A similar mechanism exists in coronary artery disease. Patients with atherosclerotic plaques causing coronary artery narrowing can be asymptomatic, only have exercised-induced angina, only have non-pain symptoms such as shortness of breath, or they could even suffer from an acute myocardial infarction. If an author presented a study to the New England Journal of Medicine for a treatment of coronary artery disease, with inclusion criteria limited to the presence of atherosclerosis and shortness of breath, it is probable that the article would not be published. This is because the authors would have failed to exclude other common causes of shortness of breath such as chronic obstructive pulmonary disease, asthma, anemia, and even a pulmonary embolism. Even if the proposed treatment were effective for atherosclerosis, the study would only demonstrate a positive effect if the authors were lucky enough to enroll a large percentage of subjects with this disease versus those with another. Unfortunately this exact problem is endemic in spine research. Due to the lack of a clear diagnostic algorithm for patients with spine pathology, both clinical care and even highly publicized research studies suffer from the critical flaw of heterogeneity [26]. It seems that LSS might be promoted to a diagnosis only if the attributable symptoms, and the cause of those symptoms, are stipulated; all too often this is not done in the literature. Perhaps the reason is that the possible combinations are too diverse both for anatomical variations (central, lateral recess, foraminal, size of stenosis) and symptoms of LSS. It would be very cumbersome to stipulate all the variations. However, lack of discipline in this regard is not without significance for studying the outcomes of ESIs since certain combinations may provide evidence for the use of such treatment, but for others the evidence may be lacking. In order to establish a diagnosis, a consensus on diagnostic criteria, including a combination of objective radiographic anatomical findings and patient symptoms, needs to exist. An explicit rationale for the use of epidural steroids for LSS has rarely been stated. The analgesic mechanism of action of steroids has not been clearly explained and accepted. The most accepted theory is the role of steroids in suppressing inflammation. In the lumbar spine, the inflammatory mediators can be present in elevated concentrations in degenerative discs [27] and may contribute to sensitization of peripheral nociceptors via prostaglandins [28]. Alternatively, steroids have been shown to decrease the ectopic discharge in injured nerves and decrease nerve conduction in small fibers [29,30]. These theories form a foundation for the role of steroids in treatment of radicular pain, with or without radiculopathy, caused by acute lumbar disc herniation even without full scientific proof. As opposed to acute disc herniation, the evidence for the role of inflammation in LSS is sparse, and therefore provides a weaker rationale for use of epidural steroids. In vitro evidence exists that inflammation can increase ligamentum flavum hypertrophy [31â33], but no evidence exists that steroids or oral anti-inflammatory medications can address that inflammation. There is some evidence that inflammation is involved to some degree in nerve root pathology in LSS [10,34]. It is possible that some unknown mechanism of epidural steroids (or other substances injected into epidural space along with steroids) may have beneficial effect in patients suffering from spinal stenosis related pain. Future research may shed light on this. Until then, a sound scientific rationale for the use of epidural steroids is not robust. It is important to have some knowledge of the expected outcomes of the disease in the absence of treatment. In the case of Friedly et al., the authors demonstrate pain relief nearing 40% in pooled subjects at 6 weeks post-procedure. This improvement is substantially greater than the typically predicted placebo response [35â37]. Additionally, there are other studies showing responses following epidural injections in the treatment of lumbar stenosis [38â41]. In some spine conditions, such as herniated discs, patient improvements at 6 weeks following a procedure may be attributed to either the natural history of the disease or the intervention provided to the patient. In the case of lumbar stenosis, the known natural history of the disease is typically not improvement over time [42]. When designing a prospective trial, all variables that may affect the outcome should be accounted for in determining the appropriate study size. In the case of spinal stenosis, this should include procedural variables such as: medication utilized, dosage, and route of injection. It would also include patient variables that may affect the outcome including: degree of stenosis, severity of symptoms, and duration of symptoms. Although Friedly et al. should be commended for performing a large RCT on 400 subjects, it is unfortunate that these multiple independent variables were grouped and analyzed together. Patients with a variety of diagnoses and symptom severities were injected in an assortment of ways with a myriad of medications. It is highly likely that statisticians and researchers will utilize this dataset for future subgroup analyses of these variables. However, this dataset should be scrutinized closely as each of these subgroups may not have sufficient numbers to facilitate an appropriate independent analysis. Choosing a proper study design is the best way to answer the proposed clinical question. In general, RCTs are felt to provide the highest level of evidence. There are two types of RCTs available from which to choose. An explanatory study will test a treatment against a placebo or âshamâ to determine efficacy of the treatment. A pragmatic RCT will test one treatment against another to determine which treatment is superior. Friedly et al. chose the question âAre epidural injections of steroids plus lidocaine better than lidocaine alone for reducing pain and improving function in patients with lumbar central canal spinal stenosis?,â thereby selecting a pragmatic RCT study design. While the use of high quality observational studies and pragmatic RCTs has been supported by the Grades of Recommendation, Assessment, Development and Evaluation (GRADE) system [43], an explanatory RCT would be a preferred study design choice for large, multicenter trials. It would provide the highest level of evidence and better address the question of whether epidural steroids are an effective treatment for spinal stenosis. Some physicians believe that injecting lidocaine, as it relates to intermediate-term, or 6-week relief, is a placebo treatment. This argument is founded on the action of the medication and known duration of local anesthetic effects. However, there is certainly reason to question whether administration of any substance into the epidural space is a placebo treatment [44]. Therefore, in order to conduct a valid explanatory RCT a true placebo group is necessary. In study design, an investigator determines the desired patient population early on. Diagnostic inclusion and exclusion criteria must be clearly defined in order for the reader of the article to determine if the study population is relevant to his or her own practice. In determining whether or not a treatment is effective, the investigator must choose outcome measures to evaluate the effectiveness of the treatment. The ideal outcome measure will evaluate the direct impact the treatment has on the diagnosis. For example, when evaluating a medication for hyperglycemia, fasting blood sugar level is an ideal outcome measure. In the case of most spine procedures, outcome measures are typically related to the pain and dysfunction that the condition causes. To determine the effectiveness of treatment in this realm, we rely on patient-reported outcomes. These measures typically assess outcomes such as symptoms (e.g., pain, claudication), function (e.g., ability to walk, perform activities of daily living), health status, health-related quality of life, and satisfaction with treatment. The validity and reliability of outcome measures are an integral of an and selection is the degree to which a or other measure test and no change is or across or is the degree to which a measure it is to measure. measures need to be for the diagnosis being For the study of pain, the for pain and the for pain have been When studying back pain, other outcome have been and In the study of lumbar stenosis, the Claudication also to as the and have been The outcome measures have a significant impact on evaluating how effective a treatment For example, when evaluating a treatment for lumbar radicular pain, appropriate outcome measures would evaluate pain, for back and leg pain, and for However, in the case of lumbar stenosis back pain is not a defining of the condition, an investigator would typically choose an outcome measure to address the of this condition, neurogenic claudication. outcome measures are and include the no direct studies to on ESIs for lumbar spinal stenosis, including the Friedly et al. have used appropriate and outcome measures as the for this Friedly et al. a but not for spinal stenosis. Until outcomes measures are the between an effective treatment and may be difficult to In the it has been conventional to report group outcomes. This is a in the literature that can result in a of the true outcomes. (or rely on a pain to a A of is not frequently found in patients with Even if it is it is to be present a treatment. This is true if the treatment results in a of patients with complete or complete pain relief. on a treatment that results in only and is not only but also to an actual treatment response from any patient. The appropriate therefore, should be a The definition of may to the condition and can be defined by The most commonly used example is pain relief and of although studies very rigorous and definition of such as complete relief of pain with full of to and no use of other health care have been reported treatment pain with from efficacy of of steroids for the treatment of lumbar radicular by and by the American of The alone is not a certain percentage of patients may have in one that not that the same percentage of patients will have in another study or clinical practice. In that percentage can on how subjects were included in the study. In order to for these the should be The the and highest percentage of patients could In an observational if this the intervention likely has no In a pragmatic if the of the two treatment there is likely no in effectiveness between the two could be or of no to In an explanatory if the of the and likely caused the beneficial of the treatment. These of analysis need to be to the question of spinal stenosis. from ESIs in patients with spinal stenosis exist. et al. have demonstrated in an observational study that of patients can have complete pain relief with ESIs the not include patients from treatment. An observational study whether the improvement was caused by the by associated with the or if patients improved because of the natural While can be used as a secondary outcome analysis of on outcome measures should be the the studies of ESIs for spinal stenosis, including Friedly et al., not provide for the outcome It would also be to whether the treatment the need for other health such as surgery. While the in pain both as important a in surgery would be a more response to treatment. As with all studies, the full is ability to the outcomes to patients is limited and as these do not treatment for spinal stenosis. the current state of the evidence to the use of epidural injections in the treatment of patients with LSS, questions are and more research is even the most comprehensive study to clearly demonstrated that the of steroids in a population by a variety of provides no as to injecting local anesthetic alone into the epidural space for patients with LSS on imaging [1]. However, since this study was a study only the effectiveness of steroids over lidocaine, it be used to answer the question of whether are effective for LSS. This would a study. any trial that diagnostic treated patients with a variety of symptoms in a variety of and failed to report complete outcomes could not provide any As a multicenter trial, it provide an of as present clinical practice in the but it may not a test of the of epidural steroids for LSS. is that the outcomes from this randomized controlled trial, with its will be used to a treatment. with that one can be injections for a patient population with lumbar spinal stenosis on which to be how they are in clinical practice, do not have a treatment effect beyond that of The authors to for his and of the Spine for review and and and of the Spine for review and comments on the A also to and Spine Society for and with the of this
Yao et al. (A note on the feasibility of generalized universal composability. Theory and Applications of Models of Computation pp. 474â485, 2007; A note on the feasibility of generalised universal composability. Mathematical Structures in Computer Science , 19 (1), pp. 193â205) claimed a potential limitation on the class of protocols that could be securely implemented in the generalized universal composability (GUC) framework proposed by Canetti et al. (Universally composable security with global setup. Lecture Notes in Computer Science , pp. 61â85, 2007). Specifically, Yao et al. presented a concrete attack on a GUC Zero Knowledge (GUCZK) protocol, a natural adaptation Blum's ZK proof for Directed Hamiltonicity using the general GUC feasibility of Canetti et al. (Universally composable security with global setup. Lecture Notes in Computer Science , pp. 61â85, 2007). Interestingly, the attack was not analysed in the GUC model in Yao et al. (A note on the feasibility of generalised universal composability. Mathematical Structures in Computer Science 19 (1), pp. 193â205, 2009) but in the FUC model , a new UC-like framework proposed in the same work. Nonetheless, Yao et al. (A note on the feasibility of generalised universal composability. Mathematical Structures in Computer Science 19 (1), pp. 193â205, 2009) argued that, in light of this attack, GUC would lose its concurrent general composability and proof of knowledge properties. Concretely, they argue that GUC composability would now be with respect to some adversaries with limited access to external arbitrary protocols. In this work, we show that the claimed attack from Yao et al. is indeed harmless and does not contradict the security of the mentioned GUCZK protocol, thus restoring the general feasibility for GUC.
BenoĂźt Libert, Fabrice Mouhartem, Thomas Peters, Moti Yung
Digital signatures are perhaps the most important base for authentication and trust relationships in large scale systems. More specifically, various applications of signatures provide privacy and anonymity preserving mechanisms and protocols, and these, in turn, are becoming critical (due to the recently recognized need to protect individuals according to national rules and regulations). A specific type of signatures called "signatures with efficient protocols", as introduced by Camenisch and Lysyanskaya (CL), efficiently accommodates various basic protocols and extensions like zero-knowledge proofs, signing committed messages, or re-randomizability. These are, in fact, typical operations associated with signatures used in typical anonymity and privacy-preserving scenarios.
Abstract We formalize and construct black-box accumulation (BBA), a useful building block for numerous important user-centric protocols including loyalty systems, refund systems, and incentive systems (as, e.g., employed in participatory sensing and vehicle-to-grid scenarios). A core requirement all these systems share is a mechanism to let users collect and sum up values (call it incentives, bonus points, reputation points, etc.) issued by some other parties in a privacy-preserving way such that curious operators may not be able to link the different transactions of a user. At the same time, a group of malicious users may not be able to cheat the system by pretending to have collected a higher amount than what was actually issued to them. As a first contribution, we fully formalize the core functionality and properties of this important building block. Furthermore, we present a generic and non-interactive construction of a BBA system based on homomorphic commitments, digital signatures, and non-interactive zero-knowledge proofs of knowledge. For our construction, we formally prove security and privacy properties. Finally, we propose a concrete instantiation of our construction using Groth-Sahai commitments and proofs as well as the optimal structure-preserving signature scheme of Abe et al. and analyze its efficiency.
The growing use of computers in modern control systems has led to the develop- ment of complex dynamic systems known as hybrid systems, which integrates both discrete and continuous systems. Given that hybrid systems are systems that operates in real time allowing for changes in continuous state over time periods, and discrete state changes across zero time, their modelling, analysis and verification becomes very difficult. The formal verifications of such systems based on specifications that can guar- antee their behaviour is very important especially as it pertains to safety critical applications. Accordingly, addressing such verifications issues are important and is the focus of this thesis. In this thesis, in order to actualise the specification and verification of hybrid systems, Interval Temporal Logic(ITL) was adopted as the underlying formalism given its inherent characteristics of providing methods that are flexible for both propositional and first-order reasoning regarding periods found in hardware and software systemâs descriptions. Given that an interval specifies the behaviour of a system, specifications of such systems are therefore represented as a set of intervals that can be used to gain an understanding of the possible behaviour of the system in terms of its composition whether in sequential or parallel form. ITL is a powerful tool that can handle both forms of composition given that it offers very strong and extensive proof and specifi- cation techniques to decipher essential system properties including safety, liveliness and time projections.However, a limitation of ITL is that the intervals within its framework are considered to be a sequence of discrete states. Against this back- drop, the current research provides an extension to ITL with the view to deal with verification and other related issues that centres around hybrid systems. The novelty within this new proposition is new logic termed SPLINE Interval Temporal Logic (SPITL) in which not only a discrete behaviour can be expressed, but also a continuous behaviour can be represented in the form of a spline i.e. the interval is considered to be a sequence of continuous phases instead of a sequence of discrete states. The syntax and semantics of the newly developed SPITL are provided in this thesis and the new extension of the interval temporal logic using a hybrid system as a case study. The overall framework adopted for the overall struc- ture of SPITL is based on three fundamental steps namely the formal specification of hybrid systems is expressed in SPLINE Interval Temporal Logic, followed by the executable subset of ITL, called Tempura, which is used to develop and test a hybrid system specification that is written in SPITL and finally a runtime verification tool for ITL called AnaTempura which is linked with Matlab in order to use them as an integrated tool for the verification of hybrid systems specification. Overall, the current work contributes to the growing body of knowledge in hybrid systems based on the following three major milestones namely: i. the proposition of a new logic termed SPITL; ii. executable subset, Tempura, integrated with SPITL specification for hybrid systems; and iii. the development of a tool termed Ana Tempura which is integrated with Matlab to ensure accurate runtime verification of results.
An internal model based method is used to estimate the structural displacements under ambient excitation using only acceleration measurements. Strain measurements are incorporated to expand the method to single span concrete bridges subjected to moving vehicle loads. The structural response is assumed to remain the linear range for the duration of the loading. The excitation is assumed to be with zero mean and relatively broad bandwidth such that at least one of the fundamental modes of the structure is excited and dominates in the response. Using the structural modal parameters and partial knowledge of the load, their respective internal models can be established. These internal models can then be used to form an autonomous state-space representation of the system. It is shown that structural displacements, velocities, and accelerations are the states of such a system, and it is fully observable when the measured output contains structural accelerations only. Reliable estimates of structural displacements are obtained using the standard Kalman filtering technique. These displacement estimates can be used to determine the moment demand and provide insight into whether this demand is exceeding the capacity of the bridge. The effectiveness and robustness of the proposed method has been demonstrated and evaluated via numerical simulations of an eight-story lumped mass model along with a simply supported single span concrete bridge subjected to a moving traffic load. Experimental data of a three-story frame excited by ground accelerations from an actual earthquake record is also used. Lastly, field data from an inverted arch concrete bridge is analyzed as proof of concept for deployment of a structural health monitoring system for the purpose of displacement estimations.