this book constitutes the refereed proceedings of the International conference on applications and Techniques in Information security, ATIS 2014, held in Melbourne, Australia, in November 2014. the 16 revised full pap...
ISBN:
(数字)9783662456705
ISBN:
(纸本)9783662456699;9783662456705
this book constitutes the refereed proceedings of the International conference on applications and Techniques in Information security, ATIS 2014, held in Melbourne, Australia, in November 2014. the 16 revised full papers and 8 short papers presented were carefully reviewed and selected from 56 submissions. the papers are organized in topical sections on applications; curbing cyber crimes; dataprivacy; digital forensics; security implementations.
Use of graph-structured data models is on the rise - in graph databases, in representing biological and healthcare data as well as geographical data. In order to secure graph- structured data, and develop cryptographi...
详细信息
ISBN:
(纸本)9781450322782
Use of graph-structured data models is on the rise - in graph databases, in representing biological and healthcare data as well as geographical data. In order to secure graph- structured data, and develop cryptographically secure schemes for graph databases, it is essential to formally define and develop suitable collision resistant one-way hashing schemes and show them they are efficient. the widely used Merkle hash technique is not suitable as it is, because graphs may be directed acyclic ones or cyclic ones. In this paper, we are addressing this problem. Our contributions are: (1) define the practical and formal security model of hashing schemes for graphs, (2) define the formal security model of perfectly secure hashing schemes, (3) describe constructions of hashing and perfectly secure hashing of graphs, and (4) performance results for the constructions. Our constructions use graph traversal techniques, and are highly efficient for hashing, redaction, and verification of hashes graphs. We have implemented the proposed schemes, and our performance analysis on both real and synthetic graph data sets support our claims. Copyright 2014 acm.
Monitoring location updates from mobile users has important applications in several areas, ranging from public safety and national security to social networks and advertising. However, sensitive information can be der...
详细信息
ISBN:
(纸本)9781450322782
Monitoring location updates from mobile users has important applications in several areas, ranging from public safety and national security to social networks and advertising. However, sensitive information can be derived from movement patterns, so protecting the privacy of mobile users is a major concern. Users may only be willing to disclose their locations when some condition is met, for instance in proximity of a disaster area, or when an event of interest occurs nearby. Currently, such functionality is achieved using searchable encryption. Such cryptographic primitives provide provable guarantees for privacy, and allow decryption only when the location satisfies some predicate. Nevertheless, they rely on expensive pairing-based cryptography (PBC), and direct application to the domain of location updates leads to impractical solutions. We propose secure and efficient techniques for private processing of location updates that complement the use of PBC and lead to significant gains in performance by reducing the amount of required pairing operations. We also implement two optimizations that further improve performance: materialization of results to expensive mathematical operations, and parallelization. Extensive experimental results show that the proposed techniques significantly improve performance compared to the baseline, and reduce the searchable encryption overhead to a level that is practical in a computing environment with reasonable resources, such as the cloud. Copyright 2014 acm.
the increased popularity of mobile devices widens opportunities for a user either to lose the device or to have the device stolen and compromised. At the same time, user interaction with a mobile device generates a un...
详细信息
ISBN:
(纸本)9781450322782
the increased popularity of mobile devices widens opportunities for a user either to lose the device or to have the device stolen and compromised. At the same time, user interaction with a mobile device generates a unique set of features such as dialed numbers, timestamps of communication activities, contacted base stations, etc. this work proposes several methods to identify the user based on her communications history. Specifically, the proposed methods detect an abnormality based on the behavior fingerprint generated by a set of features from the network for each user session. We present an implementation of such methods that use features from real SMS, and voice call records from a major tier 1 cellular operator. this can potentially trigger a rapid reaction upon an unauthorized user gaining control of a lost or stolen terminal, preventing data compromise and device misuse. the proposed solution can also detect background malicious traffic originated by, for example, a malicious application running on the mobile device. Our experiments with annonymized data from 10,000 users, representing over 14 million SMS and voice call detail records, show that the proposed methods are scalable and can continuously identify millions of mobile users while preserving dataprivacy, and achieving low false positives and high misuse detection rates with low storage and computation overhead. Copyright 2014 acm.
In this paper, we focus on the problem of dataprivacy on the cloud, particularly on access controls over stream data. the nature of stream data and the complexity of sharing data make access control a more challengin...
详细信息
ISBN:
(纸本)9781450322782
In this paper, we focus on the problem of dataprivacy on the cloud, particularly on access controls over stream data. the nature of stream data and the complexity of sharing data make access control a more challenging issue than in traditional archival databases. We present Streamforce - a system allowing data owners to securely outsource their data to an untrusted (curious-but-honest) cloud. the owner specifies fine-grained policies which are enforced by the cloud. the latter performs most of the heavy computations, while learning nothing about the data content. To this end, we employ a number of encryption schemes, including deterministic encryption, proxy-based attribute based encryption and sliding-window encryption. In Streamforce, access control policies are modeled as secure continuous queries, which entails minimal changes to existing stream processing engines, and allows for easy expression of a wide-range of policies. In particular, Streamforce comes with a number of secure query operators including Map, Filter, Join and Aggregate. Finally, we implement Streamforce over an open-source stream processing engine (Esper) and evaluate its performance on a cloud platform. the results demonstrate practical performance for many real-world applications, and although the security overhead is visible, Streamforce is highly scalable. Copyright 2014 acm.
Sharing data with client-side encryption requires key management. Selecting an appropriate key management protocol for a given scenario is hard, since the interdependency between scenario parameters and the resource c...
详细信息
ISBN:
(纸本)9781450322782
Sharing data with client-side encryption requires key management. Selecting an appropriate key management protocol for a given scenario is hard, since the interdependency between scenario parameters and the resource consumption of a protocol is often only known for artificial, simplified scenarios. In this paper, we explore the resource consumption of systems that offer sharing of encrypted data within real-world scenarios, which are typically complex and determined by many parameters. For this purpose, we fist collect empirical datathat represents real-world scenarios by monitoring large-scale services within our organization. We then use this data to parameterize a resource consumption model that is based on the key graph generated by each key management protocol. the preliminary simulation runs we did so far indicate that this key-graph based model can be used to estimate the resource consumption of real-world systems for sharing encrypted data. Copyright is held by the author/owner(s).
In this paper, we present SobTrA, a Software-based Trust Anchor for ARM Cortex-A processors to protect systems against software-based attacks. SobTrA enables the implementation of a software-based secure boot controll...
详细信息
ISBN:
(纸本)9781450322782
In this paper, we present SobTrA, a Software-based Trust Anchor for ARM Cortex-A processors to protect systems against software-based attacks. SobTrA enables the implementation of a software-based secure boot controlled by a third party independent from the manufacturer. Compared to hardware-based trust anchors, our concept provides some other advantages like being updateable and also usable on legacy hardware. the presented software-based trust anchor involves a trusted third party device, the verifler, locally connected to the untrusted device, e.g., via the microSD card slot of a smartphone. the verifler is verifying the integrity of the untrusted device by making sure that a piece of code is executed untampered on it using a timing-based approach. this code can then act as an anchor for a chain of trust similar to a hardware-based secure boot. Tests on our prototype showed that tampered and untampered execution of SobTrA can be clearly and reliably distinguished. Copyright 2014 acm.
Android's permission system follows an "all or nothing" approach when installing an application. the end user has no way to know how the permissions are actually used by the application, and how the sens...
详细信息
data retention is a controversial instrument of governments and their agencies withthe background of fighting terrorism and crime. In 2006 the European Union (EU) passed the directive 2006/24/EC, which is about the r...
详细信息
ISBN:
(纸本)9781479932795
data retention is a controversial instrument of governments and their agencies withthe background of fighting terrorism and crime. In 2006 the European Union (EU) passed the directive 2006/24/EC, which is about the retention of data generated or processed in connection withthe provision of publicly available electronic communications services, or of public communications networks. Based on the Austrian approach, this paper shows how it is possible for governments to implement a data retention system supporting authorities while taking into account a best possible protection of their citizens' personal data and privacy. the authors implemented a proof-of-concept using a centrally managed service to exchange necessary retention data between corresponding authorities and provider. the concept is based on strong cryptographic algorithms ensuring end-to-end encryption while enabling central monitoring and administration. therefore it is in conformity withthe directive, as well as Austrian law, and enforces a core aspect to guarantee citizens privacy.
A large-scale sensing infrastructure can collect ample data to benefit many real-world applications. One promising application scenario is building management. However, exposure of the sensor data potentially reveals ...
详细信息
暂无评论