2022 6th International Conference on Cryptography, Security and Privacy (CSP)最新文献_第2页

Evaluation Study on Privacy Policies of Express Companies Based on Cloud Model 基于云模型的快递公司隐私政策评价研究

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/csp55486.2022.00012

Qian Zhang, W. Xie, Xinxiang Pan

{"title":"Evaluation Study on Privacy Policies of Express Companies Based on Cloud Model","authors":"Qian Zhang, W. Xie, Xinxiang Pan","doi":"10.1109/csp55486.2022.00012","DOIUrl":"https://doi.org/10.1109/csp55486.2022.00012","url":null,"abstract":"In the era of the Internet of things (IoT), smart logistics is quietly rising, but user privacy security has become an important factor hindering its development. Because privacy policy plays a positive role in protecting user privacy and improving corporate reputation, it has become an important part of smart logistics and the focus of express companies. In this paper, through the construction of the privacy policy evaluation index system of express companies, aiming at qualitative indicators that are difficult to evaluate, we introduce the cloud model evaluation method that can combine the qualitative and quantitative together, and comprehensively evaluate the privacy policy of five express companies in China from four indicators: general situation, user informed consent, information security control and personal rights protection. The results show that: Overall, the privacy policies of the five express companies have not reached the \"good\" level, and there is a certain gap between the privacy policies of different express companies. From the comparison of indicators, the five express companies generally score relatively good; However, the overall score of information security control index is relatively poor, and the other two indexes are quite different. Cloud model evaluation method has strong applicability for the evaluation of express company privacy policy, which provides a reference for improving the privacy policy formulation and improving the privacy protection level of China’s express delivery industry in the era of IoT.","PeriodicalId":187713,"journal":{"name":"2022 6th International Conference on Cryptography, Security and Privacy (CSP)","volume":"109 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122423277","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Computational Refinements for Post-Quantum Elliptic Curve Security 后量子椭圆曲线安全性的计算改进

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00014

E. Sakk

引用次数: 0

A Two-Stage Out-Of-Box Method for Detecting Side-Channel Attacks in Cloud Computing 云计算中检测侧信道攻击的两阶段开箱即用方法

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00035

Jiangyong Shi, Ping Kuang, Yongjun Wang, Yuexiang Yang

引用次数: 0

Teleporting Qubits Between Participants by Third-Party Center 第三方中心在参与者之间传送量子比特

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00008

Abdulbast A. Abushgra

引用次数: 0

A Class of Software-Layer DoS Attacks in Node.js Web Apps 一类基于Node.js Web应用的软件层DoS攻击

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00028

Tuong Phi Lau

{"title":"A Class of Software-Layer DoS Attacks in Node.js Web Apps","authors":"Tuong Phi Lau","doi":"10.1109/CSP55486.2022.00028","DOIUrl":"https://doi.org/10.1109/CSP55486.2022.00028","url":null,"abstract":"Application-level DoS attacks are occurring more frequently and raise more serious threats. Such attacks can be performed advantageously in node.js web apps, as these apps are built by third-party npm packages. Adversaries may inject malicious data into its client requests submitted to a victim server. It then may manipulate program states to pass the malicious input to sensitive APIs as long-running operations which are resided in npm modules required in the node.js web app. Once the sensitive APIs (e.g. pattern matching) can be called with hard-to-match input string, it may impose degradation of the worker pool’s throughput of the web server to interrupt web services accessed by Internet users. This attack vector is defined as Module-driven DoS (MDoS).This paper presents a class of software-level DoS so called MDoS, and an automated approach implementing inter-modular analysis to detect vulnerable npm modules exploitable for these vulnerabilities. The proposed method is evaluated on a dataset of 17,000 modules downloaded from the npm ecosystem. As a result, the automated analysis flagged out 355 vulnerable modules. Using manual code inspection found 237 true positives of 35 exposed to the MDoS, including 214 modules exploitable for launching ReDoS and 23 remaining ones suspicious for executing ReadDoS attacks indirectly.","PeriodicalId":187713,"journal":{"name":"2022 6th International Conference on Cryptography, Security and Privacy (CSP)","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114147173","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

RippleSign: Isogeny-Based Threshold Ring Signatures with Combinatorial Methods RippleSign:基于等同性的组合方法阈值环签名

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00010

Li Li, Maozhi Xu

引用次数: 0

Convex Hull Convolutive Non-negative Matrix Factorization Based Speech Enhancement For Multimedia Communication 基于凸壳卷积非负矩阵分解的多媒体通信语音增强

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00033

Dongxia Wang, Jie Cui, Jinghua Wang, Hua Tan, Ming Xu

引用次数: 1

A Proactively Defensive Low-Level Decision Center Model of Endogenous Security 内生性安全的主动防御低级决策中心模型

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00017

Liang Feilin, Li Tao, Hu Aiqu

引用次数: 0

Cyber-Security Enhanced Network Meta-Model and its Application 网络安全增强网络元模型及其应用

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00023

Xinli Xiong, Liang Guo, Yunfeng Zhang, Jingye Zhang

引用次数: 0

The Processing goes far beyond "the app" – Privacy issues of decentralized Digital Contact Tracing using the example of the German Corona-Warn-App 处理远远超出了“应用程序”——以德国Corona-Warn-App为例，分散数字联系人追踪的隐私问题

2022 6th International Conference on Cryptography, Security and Privacy (CSP) Pub Date : 2022-01-01 DOI: 10.1109/CSP55486.2022.00011

Rainer Rehak, C. R. Kühne

{"title":"The Processing goes far beyond \"the app\" – Privacy issues of decentralized Digital Contact Tracing using the example of the German Corona-Warn-App","authors":"Rainer Rehak, C. R. Kühne","doi":"10.1109/CSP55486.2022.00011","DOIUrl":"https://doi.org/10.1109/CSP55486.2022.00011","url":null,"abstract":"Since SARS-CoV-2 started spreading in Europe in early 2020, there has been a strong call for technical solutions to combat or contain the pandemic, with contact tracing apps at the heart of the debates. The EU’s General Data Protection Regulation (GDPR) requires controllers to carry out a data protection impact assessment (DPIA) where their data processing is likely to result in a high risk to the rights and freedoms (Art. 35 GDPR). A DPIA is a structured risk analysis that identifies and evaluates possible consequences of data processing relevant to fundamental rights in advance and describes the measures envisaged to address these risks or expresses the inability to do so.Based on the Standard Data Protection Model (SDM), we present the results of a scientific and methodologically clear DPIA. It shows that even a decentralized architecture involves numerous serious weaknesses and risks, including larger ones still left unaddressed in current implementations. It also found that none of the proposed designs operates on anonymous data or ensures proper anonymisation. It also showed that informed consent would not be a legitimate legal ground for the processing. For all points where data subjects’ rights are still not sufficiently safeguarded, we briefly outline solutions.","PeriodicalId":187713,"journal":{"name":"2022 6th International Conference on Cryptography, Security and Privacy (CSP)","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128063364","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0