the most popular On-line Social Networks (OSNs) are based on centralized architectures where service providers (e.g., Facebook, Twitter, or Instagram) have full control over the data published by their user---a requir...
详细信息
ISBN:
(纸本)9781450393577
the most popular On-line Social Networks (OSNs) are based on centralized architectures where service providers (e.g., Facebook, Twitter, or Instagram) have full control over the data published by their user---a requirement of their business model, based on the monetization of the cited data [2]. In addition, such centralized architectures also increase the risk of censorship, surveillance, and information leakage [3]. Distributed On-line Social Networks (DOSNs), instead, are typically based on a P2P architecture, where there is no central service provider in control of user data. Indeed, the contents that are published on DOSNs are stored on user-provided devices, that also cooperate to execute the tasks needed to realize the intended service. Most of the popular DOSNs, in an effort to help users smoothly regulate content sharing in adherence to their privacy preferences, allow to organize users in groups. In this way, each user can choose to share content withthe users belonging to specific groups only. the lack of a (logically) centralized, third party managed, reliable infrastructure to guarantee content availability---whether a given user is on-line or not---has led to have the contents published by a user to be stored on the devices of other users as well. Indeed, such a choice increases the chances that at least one of the cooperating users device (and the contents stored therein) is online when the content is required. Given the two above introduced (conflicting) requirements: group-oriented privacy setting and distributed storage, a critical feature of DOSNs is that published contents must be properly protected by the DOSN infrastructure, in order to ensure that they can be accessed only by users that have the appropriate permissions---granted by the publishers. Hence, DOSNs require efficient solutions for protecting the privacy of the contents published by each user with respect to the other users of the social network. While some preliminary solutions hav
Studies in fields like psychology and sociology have revealed that reciprocity is a powerful determinant of human behavior. None of the existing accesscontrolmodels however captures this reciprocity phenomenon. In t...
详细信息
ISBN:
(纸本)9781450367530
Studies in fields like psychology and sociology have revealed that reciprocity is a powerful determinant of human behavior. None of the existing accesscontrolmodels however captures this reciprocity phenomenon. In this paper, we introduce a new kind of grant, which we call mutual, to express authorizations that actually do this, i.e., users grant access to their resources only to users who allow them access to theirs. We define the syntax and semantics of mutual authorizations and show how this new grant can be included in the Role-Based accesscontrol model, i.e., extend RBAC with it.
Relationship-based accesscontrol (ReBAC) provides a flexible approach to specify policies based on relationships between system entities, which makes them a natural fit for many modern information systems, beyond onl...
详细信息
ISBN:
(纸本)9781450367530
Relationship-based accesscontrol (ReBAC) provides a flexible approach to specify policies based on relationships between system entities, which makes them a natural fit for many modern information systems, beyond online social networks. In this paper we are concerned withthe problem of mining ReBAC policies from lower-level authorization information. Mining ReBAC policies can address transforming accesscontrol paradigms to ReBAC, reformulating existing ReBAC policies as more information becomes available, as well as inferring potentially unknown policies. Particularly, we propose a systematic algorithm for mining ReBAC authorization policies, and a first of its kind approach to mine graph transition policies that govern the evolution of ReBAC systems. Experimental evaluation manifests efficiency of the proposed approaches.
Inter-vehicle communication has the potential to significantly improve driving safety, but also raises security concerns. the fundamental mechanism to govern information sharing behaviors is accesscontrol. Since vehi...
详细信息
ISBN:
(纸本)9781450367530
Inter-vehicle communication has the potential to significantly improve driving safety, but also raises security concerns. the fundamental mechanism to govern information sharing behaviors is accesscontrol. Since vehicular networks have a highly dynamic and open nature, accesscontrol becomes very challenging. Existing works are not applicable to the vehicular world. In this paper, we develop a new accesscontrol model, openRBAC, and the corresponding mechanisms for accesscontrol in vehicular systems. Our approach lets the accessee define a relative role hierarchy, specifying all potential accessor roles in terms of their relative perception to the accessees. accesscontrol policies are defined for the relative roles in the hierarchy. Since the accessee has a clear understanding of the relative roles defined by itself, the policy definitions can be precise and less flawed.
We present CMCAP (context-mapped capabilities), a decentralized mechanism for specifying and enforcing adaptive accesscontrol policies for resource-centric security. Policies in CMCAP express runtime constraints defi...
详细信息
ISBN:
(纸本)9781450367530
We present CMCAP (context-mapped capabilities), a decentralized mechanism for specifying and enforcing adaptive accesscontrol policies for resource-centric security. Policies in CMCAP express runtime constraints defined as containment domains with context-mapped capabilities, and ephemeral sandboxes for dynamically enforcing desired information flow properties while preserving functional correctness for the sandboxed programs. CMCAP is designed to remediate DAC's weakness and address the inflexibility that makes current MAC frameworks impractical to the common user. We use a Linux-based implementation of CMCAP to demonstrate how a program's dynamic profile is used for accesscontrol and intrusion prevention.
Advancement in machine learning techniques in recent years has led to deep learning applications on source code. While there is little research available on the subject, the work that has been done shows great potenti...
详细信息
ISBN:
(纸本)9781450367530
Advancement in machine learning techniques in recent years has led to deep learning applications on source code. While there is little research available on the subject, the work that has been done shows great potential. We believe deep learning can be leveraged to obtain new insight into automated accesscontrol policy verification. In this paper, we describe our first step in applying learning techniques to accesscontrol, which consists of developing word embeddings to bootstrap learning tasks. We also discuss the future work on identifying accesscontrol enforcement code and checking accesscontrol policy violations, which can be enabled by word embeddings.
this paper proposes Concurrent-access Obfuscated Store (CAOS), a construction for remote data storage that provides access-pattern obfuscation in a honest-but-curious adversarial model, while allowing for low bandwidt...
详细信息
ISBN:
(纸本)9781450367530
this paper proposes Concurrent-access Obfuscated Store (CAOS), a construction for remote data storage that provides access-pattern obfuscation in a honest-but-curious adversarial model, while allowing for low bandwidth overhead and client storage. Compared to other approaches, the main advantage of CAOS is that it supports concurrent access without a proxy, for multiple read-only clients and a single read-write client. Concurrent access is achieved by letting clients maintain independent maps that describe how the data is stored. Even though the maps might diverge from client to client, the protocol guarantees that clients will always have access to the data. Efficiency and concurrency are achieved at the expense of perfect obfuscation: in CAOS the extent to which access patterns are hidden is determined by the resources allocated to its built-in obfuscation mechanism. To assess this trade-off we provide both a security and a performance analysis of CAOS. We additionally provide a proof-of-concept implementation(1).
Protecting software from illegal access, intentional modification or reverse engineering is an inherently difficult practical problem involving code obfuscation techniques and real-time cryptographic protection of cod...
详细信息
ISBN:
(纸本)9781450367530
Protecting software from illegal access, intentional modification or reverse engineering is an inherently difficult practical problem involving code obfuscation techniques and real-time cryptographic protection of code. In traditional systems a secure element (the "dongle") is used to protect software. However, this approach suffers from several technical and economical drawbacks such as the dongle being lost or broken. We present a system that provides such dongles as a cloud service, and more importantly, provides the required cryptographic material to controlaccess to software functionality in real-time. this system is developed as part of an ongoing nationally funded research project and is now entering a first trial stage with stakeholders from different industrial sectors.
Online Social Networks (OSNs), such as Facebook and Twitter, are popular platforms that enable users to interact and socialize through their networked devices. the social nature of such applications encourages users t...
详细信息
ISBN:
(纸本)9781450367530
Online Social Networks (OSNs), such as Facebook and Twitter, are popular platforms that enable users to interact and socialize through their networked devices. the social nature of such applications encourages users to share a great amount of personal data with other users and the OSN service providers, including pictures, personal views, location check-ins, etc. Nevertheless, recent data leaks on major online platforms demonstrate the ineffectiveness of the accesscontrol mechanisms that are implemented by the service providers, and has led to an increased demand for provably secure privacy controls. To this end, we introduce Hide In the Crowd (HITC), a flexible system that leverages encryption-based accesscontrol, where users can assign arbitrary decryption privileges to every data object that is posted on the OSN platforms. the decryption privileges can be assigned on the finest granularity level, for example, to a hand-picked group of users. HITC is designed as a browser extension and can be integrated to any existing OSN platform without the need for a third-party server. We describe our prototype implementation of HITC over Twitter and evaluate its performance and scalability.
暂无评论