Homomorphic Encryption (HE) is an emerging technology that enables computing on data while the data is encrypted. A major challenge with homomorphic encryption is that it takes extensive expert knowledge to design mea...
详细信息
ISBN:
(纸本)9781450368292
Homomorphic Encryption (HE) is an emerging technology that enables computing on data while the data is encrypted. A major challenge with homomorphic encryption is that it takes extensive expert knowledge to design meaningful and useful programs that are constructed from atomic HE operations. We present Ramparts to address this challenge. Ramparts provides an environment for developing HE applications in Julia, a high-level language, the same way as "cleartext" applications are typically written in Julia. Ramparts makes the following three contributions. First, we use symbolic execution to automate the construction of an optimized computation circuit where both the circuit size and multiplicative depth are chosen by the compiler. Second, Ramparts automatically selects the HE parameters for the generated circuit, which is typically done manually by an HE expert. Third, Ramparts automatically selects the plaintext encoding for input values, and performs input and output data transformations. These three operations are not easily performed by programmers who are not HE experts. Thus, Ramparts makes HE more widely available and usable by the the population of programmers. We compare our approach with Cingulata, the only previously known system that automatically generates circuits for HE computations. The HE circuits generated by Ramparts are significantly more efficient than the circuits compiled by Cingulata. For instance, our runtimes for key generation/circuit compilation and all online operations are more than one order of magnitude lower for a sample image processing application used for performance evaluation in our study.
The proceedings contain 41 papers. The topics discussed include: Ghostbuster: a fine-grained approach for anomaly detection in file system accesses;mining attributed graphs for threat intelligence;statistical security...
ISBN:
(纸本)9781450345231
The proceedings contain 41 papers. The topics discussed include: Ghostbuster: a fine-grained approach for anomaly detection in file system accesses;mining attributed graphs for threat intelligence;statistical security incident forensics against data falsification in smart grid advanced metering infrastructure;canonical completeness in lattice-based languages for attribute-based access control;SAMPAC: socially-aware collaborative multi-party access control;achieving differential privacy in secure multiparty data aggregation protocols on star networks;sound and static analysis of session fixation vulnerabilities in PHP web applications;a new bloom filter structure for searchable encryption schemes;seamless and secure Bluetooth LE connection migration;differentially-private big data analytics for high-speed research network traffic measurement;comprehensive method for detecting phishing emails using correlation-based analysis and user participation;PT-CFI: transparent backward-edge control flow violation detection using Intel processor trace;fault attacks on encrypted general purpose compute platforms;analysis of exception-based control transfers;detecting ROP with statistical learning of program characteristics;and large-scale identification of malicious singleton files.
privacy and security research has been very active concerning online social networks (OSN) as a vast amount of personal information is used and published (by users) within OSNs. However, most people do not pay attenti...
详细信息
ISBN:
(纸本)9781450356329
privacy and security research has been very active concerning online social networks (OSN) as a vast amount of personal information is used and published (by users) within OSNs. However, most people do not pay attention on what personal information they provide during registration. Depending on what information is provided in (public) OSN profiles, that data might be misused by attackers e.g., for cross-site profile cloning. This paper assesses data provided by the user during the registration of OSNs. Therefore, it is investigated how OSN registration processes are typically modeled, which information is needed to create a profile in OSNs and which attack scenarios can occur based on the provided data. The results contribute to the understanding of OSN registration process design as well as requested data and to replicate and reuse processes for further privacy and security investigations.
While the control of individuals over their personal data is increasingly seen as an essential component of their privacy, the word "control" is usually used in a very vague way, both by lawyers and by compu...
详细信息
ISBN:
(纸本)9781450356329
While the control of individuals over their personal data is increasingly seen as an essential component of their privacy, the word "control" is usually used in a very vague way, both by lawyers and by computer scientists. This lack of precision may lead to misunderstandings and makes it difficult to check compliance. To address this issue, we propose a formal framework based on capacities to specify the notion of control over personal data and to reason about control properties. We illustrate our framework with social network systems and show that it makes it possible to characterize the types of control over personal data that they provide to their users and to compare them in a rigorous way.
Companies are often motivated to evaluate their environmental sustainability, and to make public pronouncements about their performance with respect to quantitative sustainability metrics. Public trust in these declar...
详细信息
ISBN:
(纸本)9781450356329
Companies are often motivated to evaluate their environmental sustainability, and to make public pronouncements about their performance with respect to quantitative sustainability metrics. Public trust in these declarations is enhanced if the claims are certified by a recognized authority. Because accurate evaluations of environmental impacts require detailed information about industrial processes throughout a supply chain, protecting the privacy of input data in sustainability assessment is of paramount importance. We introduce a new paradigm, called privacy-preserving certification, that enables the computation of sustainability indicators in a privacy-preserving manner, allowing firms to be classified based on their individual performance without revealing sensitive information to the certifier, other parties, or the public. In this work, we describe different variants of the certification problem, highlight the necessary security requirements, and propose a provably-secure novel framework that performs the certification operations under the management of an authorized, yet untrusted, party without compromising confidential information.
Bluetooth Low Energy is a ubiquitous technology, with applications in the fitness, healthcare and smart home sectors, to name but a few. In this paper, we present an open-source Profiler for classifying the protection...
详细信息
ISBN:
(纸本)9781450356329
Bluetooth Low Energy is a ubiquitous technology, with applications in the fitness, healthcare and smart home sectors, to name but a few. In this paper, we present an open-source Profiler for classifying the protection level of data residing on a BLE device. Preliminary results obtained by executing the tool against several devices show that some BLE devices allow unauthenticated reads and writes from third party devices. This could expose them to a number of attacks and compromise the privacy, or even the physical safety, of the device owner.
Industrial control systems (ICS) are used to control and manage critical infrastructures and protecting these complex system and their interfaces, which can be exploited by internal and external attackers, are a vital...
详细信息
ISBN:
(纸本)9781450356329
Industrial control systems (ICS) are used to control and manage critical infrastructures and protecting these complex system and their interfaces, which can be exploited by internal and external attackers, are a vital security task. Sensors, as an interface device, are used by ICS to collect information about the physical environment and should be guarded against cyber attacks. This paper investigates how sensors can be used as a communication channel by hackers to send a malicious command and control into the ICS. Further, we examine how abusing sensory channel would lead to a data pattern, which can be detected by a proper signature-based intrusion detection system (IDS).
With the increasing inter-connection of operation technology to the IT network, the security threat to the Industrial Control System (ICS) is increasing daily. Therefore, it is critical to utilize formal verification ...
详细信息
ISBN:
(纸本)9781450356329
With the increasing inter-connection of operation technology to the IT network, the security threat to the Industrial Control System (ICS) is increasing daily. Therefore, it is critical to utilize formal verification technique such as model checking to mathematically prove the correctness of security and safety requirements in the controller logic before it is deployed on the field. However, model checking requires considerable effort for regular ICS users and control technician to verify properties. This paper, provides a simpler approach to the model checking of temperature process control system by first starting with the control module design without formal verification. Second, identifying possible vulnerabilities in such design. Third, verifying the safety and security properties with a formal method.
This paper describes how a privacy policy framework can be extended with timing information to not only decide if requests for data are allowed at a given point in time, but also to decide for how long such permission...
详细信息
ISBN:
(纸本)9781450359887
This paper describes how a privacy policy framework can be extended with timing information to not only decide if requests for data are allowed at a given point in time, but also to decide for how long such permission is granted. Augmenting policy decisions with expiration information eliminates the need to reason about access permissions prior to every individual data access operation. This facilitates the application of privacy policy frameworks to protect multimedia streaming data where repeated re-computations of policy decisions are not a viable option. We show how timing information can be integrated into an existing declarative privacy policy framework. In particular, we discuss how to obtain valid expiration information in the presence of complex sets of policies with potentially interacting policies and varying timing information.
暂无评论