The field of cybersecurity is becoming very dynamic, and needs continuous evolution. This requires not only the formal and informal education, but a security mindset to be developed for our future workforce. This pane...
详细信息
ISBN:
(纸本)9781450381437
The field of cybersecurity is becoming very dynamic, and needs continuous evolution. This requires not only the formal and informal education, but a security mindset to be developed for our future workforce. This panel elaborates on some such aspects.
Local-first software manages and processes private data locally while still enabling collaboration between multiple parties connected via partially unreliable networks. Such software typically involves interactions wi...
详细信息
ISBN:
(纸本)9781450399012
Local-first software manages and processes private data locally while still enabling collaboration between multiple parties connected via partially unreliable networks. Such software typically involves interactions with users and the execution environment (the outside world). The decentralized nature of local-first software paired with the unpredictability of interactions driven from the outside world impede reasoning about their correctness. Yet, existing solutions to develop local-first software do not provide safety guarantees and instead expect developers to reason about concurrent interactions in an environment with unreliable network conditions. This is too much to ask of application developers, who are usually not experts in designing distributed systems. This work seeks to develop a programming model which facilitates the construction of local-first software and eradicates certain classes of safety and security problems by design. We do so by providing a dedicated local-first programming language and an accompanying automated verification procedure that can be integrated as part of the compilation process.
Dynamic Searchable Symmetric Encryption (DSSE) enables a user to perform encrypted search queries on encrypted data stored on a server. Recently, a notion of Forward privacy (FP) was introduced to guarantee that a new...
详细信息
ISBN:
(纸本)9781450381437
Dynamic Searchable Symmetric Encryption (DSSE) enables a user to perform encrypted search queries on encrypted data stored on a server. Recently, a notion of Forward privacy (FP) was introduced to guarantee that a newly added document cannot be linked to previous queries, and to thwart relative attacks and lessen information leakage and its consequences. However, in this paper we show that the forward-private schemes have no advantage (in preventing the related attacks) compared to traditional approaches, and previous attacks are still applicable on FP schemes. In FP approaches, access pattern leakage is still possible and can be employed to uncover the search pattern which can be used by passive and adaptive attacks. To address this issue, we construct a new parallelizable DSSE approach to obfuscate the access and search pattern. Our cost-efficient scheme supports both updates and searches. Our security proof and performance analysis demonstrate the practicality, efficiency, and security of our approach.
Linear L1-regularized models have remained one of the simplest and most effective tools in data science. Over the past decade, screening rules have risen in popularity as a way to eliminate features when producing the...
详细信息
ISBN:
(纸本)9798400714764
Linear L1-regularized models have remained one of the simplest and most effective tools in data science. Over the past decade, screening rules have risen in popularity as a way to eliminate features when producing the sparse regression weights of L1 models. However, despite the increasing need of privacy-preserving models for data analysis, to the best of our knowledge, no differentially private screening rule exists. In this paper, we develop the first private screening rule for linear regression. We initially find that this screening rule is too strong: it screens too many coefficients as a result of the private screening step. However, a weakened implementation of private screening reduces overscreening and improves performance.
In this paper, we extend Inner-Product Functional Encryption (IPFE), where there is just a vector in the key and a vector in the single sender's ciphertext, to two-client ciphertexts. More precisely, in our two-cl...
详细信息
ISBN:
(纸本)9781450394505
In this paper, we extend Inner-Product Functional Encryption (IPFE), where there is just a vector in the key and a vector in the single sender's ciphertext, to two-client ciphertexts. More precisely, in our two-client functional encryption scheme, there are two data Providers who can independently encrypt vectors alpha and y for a data consumer who can, from a functional decryption key associated to a vector alpha, compute Sigma alpha(i)x(i)y(i) = x. center dot Diag(alpha) center dot y(inverted perpendicular). Ciphertexts are linear in the dimension of the vectors, whereas the functional decryption keys are of constant size. We study two interesting particular cases: 2-party Inner-Product Functional Encryption, with alpha = (1,..., 1). There is a unique functional decryption key, which enables the computation of x center dot y(inverted perpendicular) by a third party, where.. and.. are provided by two independent clients;Inner-Product Functional Encryption with a Selector, with x = x(0)parallel to x(1) and y = (b) over bar (n)parallel to b(n) is an element of {1(n)parallel to 0(n),0(n)parallel to 1(n)}}, for some bit b, on the public coefficients alpha = alpha(0)parallel to alpha(1), in the functional decryption key, so that one gets x(b) center dot alpha(inverted perpendicular)(b), where x and b are provided by two independent clients. This result is based on the fundamental Product-Preserving Lemma, which is of independent interest. It exploits Dual Pairing Vector Spaces (DPVS), with security proofs under the SXDH assumption. We provide two practical applications to medical diagnosis for the latter IPFE with a selector, and to money-laundering detection for the former 2-party IPFE, both with strong privacy properties, adaptative security and the use of labels granting a Multi-Client Functional Encryption (MCFE) security for the scheme, thus enabling its use in practical situations.
Nowadays, people rely heavily on online services in their daily lives such as communication, education, shopping, and entertainment. While online services offer convenience in daily living, users often receive a large...
详细信息
ISBN:
(纸本)9798400714764
Nowadays, people rely heavily on online services in their daily lives such as communication, education, shopping, and entertainment. While online services offer convenience in daily living, users often receive a large number of spams as a result. While previous studies have linked spam receipt primarily to user behavior, this research proposes that spam can serve as a forensic indicator of data leaks by websites. To test our hypothesis, we conducted an experiment to deploy 148 honeypots across 370 websites spanning 12 communities. We monitored and audited the spams received by our honeypots for 47 weeks and analyzed their nature, pattern and origin. The results reveal that some legitimate websites leak user data despite having privacy policy statements. The findings also highlight that some websites automatically enroll users in newsletters or mailing lists without asking consent during the sign-up. This issue arises from conflating privacy policies with spam subscription and third party share agreements. To address these issues we suggest that regulators enforce websites to separate subscription agreement from privacy policy statements, and direct consent for third party share be requested at sign up. Also, websites should evaluate third party chain to ensure user data protection.
Studies have shown website privacy policies are too long and hard to comprehend for their target audience. These studies and a more recent body of research that utilizes machine learning and natural language processin...
详细信息
ISBN:
(纸本)9781450381437
Studies have shown website privacy policies are too long and hard to comprehend for their target audience. These studies and a more recent body of research that utilizes machine learning and natural language processing to automatically summarize privacy policies greatly benefit, if not rely on, corpora of privacy policies collected from the web. While there have been smaller annotated corpora of web privacy policies made public, we are not aware of any large publicly available corpus. We use DMOZ, a massive open-content directory of the web, and its manually categorized 1.5 million websites, to collect hundreds of thousands of privacy policies associated with their categories, enabling research on privacy policies across different categories/market sectors. We review the statistics of this corpus and make it available for research. We also obtain valuable insights about privacy policies, e.g., which websites post them less often. Our corpus of web privacy policies is a valuable tool at the researchers' disposal to investigate privacy policies. For example, it facilitates comparison among different methods of privacy policy summarization by providing a benchmark, and can be used in unsupervised machine learning to summarize privacy policies.
The proceedings contain 18 papers. The topics discussed include: distributed random number generation method on smart contracts;loan chain: a blockchain-based framework for smart credit lending;blockchain-based securi...
ISBN:
(纸本)9781450396622
The proceedings contain 18 papers. The topics discussed include: distributed random number generation method on smart contracts;loan chain: a blockchain-based framework for smart credit lending;blockchain-based security governance framework of agricultural product traceability data;research progress and trend prospect of blockchain technology application in logistics and supply chain information system under pandemic-hit;a blockchain-based electricity retail contracts management system;computational experimental evaluation of the time variance of cryptocurrency mining using cryptographic hash functions;optimization of student physical health data cycle under computer blockchain technology;design and implementation of electronic medical record system based on Hyperledger fabric;trusted blockchain-based data fingerprinting differential-traceability and SkipList indexing methods in privacy protection;and a blockchain-enabled location privacy-preserving under local differential privacy for internet of vehicles.
暂无评论