Application of standard techniques to new data: is it publishable?

Question

I have been working at an internship this past summer, and have applied a relatively standard technique (formal analysis of a security protocol) to a new (company internal) protocol. The company are pushing me to try and get the analysis published in an academic journal. The results do not highlight anything of particular note (a few caveats and gotchas but nothing with substantial security implications), but simply provide a rigorous mathematical underpinning for their security assertions.

Is this something publishable? I feel it isn't because the only new bit is the protocol which was simply given to me (and is being published in its own right). If not how do I make the results of the analysis available? Obviously the analysis needs to be made public and peer review is vital (because otherwise nobody would trust the security claims). Do I just put it on the company website and hope people in the know stumble across it? Can I email appropriate people and hope they look at it?

Answer 1

You might consider sitting down with the people arguing for publication to try and understand why they consider it to be (potentially) publishable. It's possible, for example, that this new protocol addresses some issues not addressed by existing protocols; or addresses them more efficiently, or robustly, or is otherwise better in some way. In other words, it's possible that the protocol by itself (without your security analysis) is not publishable, and your security analysis by itself (without the novelties of the new protocol) is not publishable, but the two taken together may possibly be publishable.

Answer 2

I would not recommend just putting it on the company's website or emailing it to anyone - if you sent it for publication, you would get:

• peer review and feedback of your algorithms, assumptions and conclusions.

• potentially, validation for your application of the underlying rigorous mathematics.

Potentially, you could publish as an internal company white-paper.

Unless this is proprietary information, I would suggest that if you have had the work verified internally, perhaps ask them to be a co-author.

Being published would bring it to the attention of those in the same field, potentially allowing more valuable feedback and allowing further development and research to be performed on the work you have completed.

Finally, why not get published recognition for your work.

Answer 3

Obviously, without the details, I cannot say for sure, but I'd guess that Yes, it is publishable.

1. If more senior people think it is publishable (and it seems they have some experience with the scientific process even though this is an industry setting), then I tend to trust their judgement over yours. Often, when starting out, people tend to think that only major breakthroughs can be published; when it is very much not the case. This is a fairly common occurrence with young researchers: that they are too publication shy. (Others are too quick to think something is ready to be published).

2. It is obviously novel that this particular protocol has these properties even if the protocol itself has been published already (or is published separately) or the techniques to get to the result are also not novel. The question is whether it is interesting and non-obvious enough. If it is really a trivial thing, then it may not be worth publishing even if it novel. Alternatively, if the protocol itself is not very interesting or used, then it may be deemed not interesting, which is a different criterion from non-novel.

3. Given the above, the quality of the actual paper (as opposed to the raw analysis) will also need to be taken into account. It is more publishable if you can tie these particular results to a wider framework so as to locate it into a larger body of work. Again, it is hard to say for sure what this might be without knowing more details.