This paper presents a novel access control framework reducing the access control problem to a traditional decision problem, thus allowing a policy designer to reuse tools and techniques from the decision theory. We pr...
详细信息
In the current time of the Internet, specifically with the emergence of social networking, people are sharing both sensitive and non-sensitive information among each other without understanding its consequences. Feder...
详细信息
With the extreme popularity of Web and online social networks, a large amount of personal information has been made available over the Internet. On the other hand, advances in information retrieval, data mining and kn...
详细信息
Current smartphone platforms provide ways for users to control access to information about their location. For instance, on the iPhone, when an application requests access to location information, the operating system...
详细信息
ISBN:
(纸本)9781450316668
Current smartphone platforms provide ways for users to control access to information about their location. For instance, on the iPhone, when an application requests access to location information, the operating system asks the user whether to grant location access to this application. In this paper, we study how users are using these controls. Do iPhone users allow applications to access their location? Do their decisions differ from application to application? Can we predict how a user will respond for a particular application, given their past responses for other applications? We gather data from iPhone users that sheds new light on these questions. Our results indicate that there are different classes of users: some deny all applications access to their location, some allow all applications access to their location, and some selectively permit a fraction of their applications to access their location. We also find that apps can be separated into different classes by what fraction of users trust the app with their location data. Finally, we investigate using machine learning techniques to predict users' location-sharing decisions;we find that we are sometimes able to predict the user's actual choice, though there is considerable room for improvement. If it is possible to improve the accuracy rate further, this information could be used to relieve users of the cognitive burden of individually assigning location permissions for each application, allowing users to focus their attention on more critical matters.
Online social networks (OSNs) such as Facebook and Google+ have transformed the way our society communicates. However, this success has come at the cost of user privacy;in today's OSNs, users are not in control of...
详细信息
We provide a detailed analysis of two largely unexplored aspects of the security decisions made by the Android op-erating system during the app installation process: update integrity and UID assignment. To inform our ...
详细信息
ISBN:
(纸本)9781450316668
We provide a detailed analysis of two largely unexplored aspects of the security decisions made by the Android op-erating system during the app installation process: update integrity and UID assignment. To inform our analysis, we collect a dataset of Android application metadata and ex-tract features from these binaries to gain a better under-standing of how developers interact with the security mech-anisms invoked during installation. Using the dataset, we find empirical evidence that Android's current signing ar-chitecture does not encourage best security practices. We also find that limitations of Android's UID sharing method force developers to write custom code rather than rely on OS-level mechanisms for secure data transfer between apps. As a result of our analysis, we recommend incrementally de-ployable improvements, including a novel UID sharing mech-anism with applicability to signature-level permissions. We additionally discuss mitigation options for a security bug in Google's Play store, which allows apps to transparently obtain more privileges than those requested in the manifest.
The proceedings contain 27 papers. The topics discussed include: distributed data usage control for web applications: a social network implementation;MyABDAC: compiling XacmL policies for attribute-based database acce...
ISBN:
(纸本)9781450304665
The proceedings contain 27 papers. The topics discussed include: distributed data usage control for web applications: a social network implementation;MyABDAC: compiling XacmL policies for attribute-based database access control;implementation and performance evaluation of privacy-preserving fair reconciliation protocols on ordered sets;an empirical assessment of approaches to distributed enforcement in role-based access control (RBAC);a language for provenance access control;non-interactive editable signatures for assured data provenance;identifying a critical threat to privacy through automatic image classification;k-out-of-n oblivious transfer based on homomorphic encryption and solvability of linear equations;mixture of gaussian models and bayes error under differential privacy;relationship-based access control: protection model and policy language;and enforcing physically restricted access control for remote data.
This paper addresses the making of security decisions, such as access-control decisions or spam filtering decisions, under uncertainty, when the benefit of doing so outweighs the need to absolutely guarantee these dec...
详细信息
This talk gives a personal perspective on the topic area of this new conference on data and applicationsecurity and privacy, the difficult nature of the challenge we are confronting and possible research thrusts that...
详细信息
ISBN:
(纸本)9781450304665
This talk gives a personal perspective on the topic area of this new conference on data and applicationsecurity and privacy, the difficult nature of the challenge we are confronting and possible research thrusts that may help us progress to an effective scientific discipline in this arena. Copyright 2011 acm.
暂无评论