2015 IEEE Security and Privacy Workshops最新文献_第2页

Privacy-Preserving Statistical Analysis by Exact Logistic Regression 基于精确逻辑回归的隐私保护统计分析

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.14

David duVerle, Shohei Kawasaki, Yoshiji Yamada, Jun Sakuma, K. Tsuda

引用次数: 21

Towards More Security in Data Exchange: Defining Unparsers with Context-Sensitive Encoders for Context-Free Grammars 迈向数据交换中的更多安全:为上下文无关语法定义具有上下文敏感编码器的解析器

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.29

Lars Hermerschmidt, Stephan Kugelmann, Bernhard Rumpe

{"title":"Towards More Security in Data Exchange: Defining Unparsers with Context-Sensitive Encoders for Context-Free Grammars","authors":"Lars Hermerschmidt, Stephan Kugelmann, Bernhard Rumpe","doi":"10.1109/SPW.2015.29","DOIUrl":"https://doi.org/10.1109/SPW.2015.29","url":null,"abstract":"To exchange complex data structures in distributed systems, documents written in context-free languages are exchanged among communicating parties. Unparsing these documents correctly is as important as parsing them correctly because errors during unparsing result in injection vulnerabilities such as cross-site scripting (XSS) and SQL injection. Injection attacks are not limited to the web world. Every program that uses input to produce documents in a context-free language may be vulnerable to this class of attack. Even for widely used languages such as HTML and JavaScript, there are few approaches that prevent injection attacks by context-sensitive encoding, and those approaches are tied to the language. Therefore, the aim of this paper is to derive context-sensitive encoder from context-free grammars to provide correct unparsing of maliciously crafted input data for all context-free languages. The presented solution integrates encoder definition into context-free grammars and provides a generator for context-sensitive encoders and decoders that are used during (un)parsing. This unparsing process results in documents where the input data does neither influence the structure of the document nor change their intended semantics. By defining encoding during language definition, developers who use the language are provided with a clean interface for writing and reading documents written in that language, without the need to care about security-relevant encoding.","PeriodicalId":301535,"journal":{"name":"2015 IEEE Security and Privacy Workshops","volume":"471 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-05-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123449046","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

The Correctness-Security Gap in Compiler Optimization 编译器优化中的正确性与安全性差距

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.33

V. D'Silva, Mathias Payer, D. Song

引用次数: 106

Genomic Privacy and Direct-to-Consumer Genetics: Big Consumer Genetic Data -- What's in that Contract? 基因组隐私和直接面向消费者的遗传学:大消费者基因数据——合同里有什么?

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.19

A. Phillips

引用次数: 10

Nom, A Byte oriented, streaming, Zero copy, Parser Combinators Library in Rust Nom，一个面向字节，流，零拷贝，Rust中的解析器组合器库

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.31

Geoffroy Couprie

引用次数: 14

Grammatical Inference and Language Frameworks for LANGSEC LANGSEC的语法推理和语言框架

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.17

Kerry N. Wood, Richard E. Harang

引用次数: 4

On the Generality and Convenience of Etypes 论类型的通用性和方便性

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.16

W. M. Petullo, Joseph Suh

{"title":"On the Generality and Convenience of Etypes","authors":"W. M. Petullo, Joseph Suh","doi":"10.1109/SPW.2015.16","DOIUrl":"https://doi.org/10.1109/SPW.2015.16","url":null,"abstract":"The Ethos operating system provides a number of features which aid programmers as they craft robust computer programs. One such feature of Ethos is its distributed, mandatory type system -- Etypes. Etypes provides three key properties: (1) every Ethos object (e.g., A file or network connection) has a declared type, (2) Ethos forbids programs from writing ill-formed data to an object, and (3) Ethos forbids programs from reading ill-formed data from an object. In any case, programmers declare ahead of time the permitted data types, and Ethos' application of operating-system-level recognition simplifies their programs. This paper first investigates the generality of Etypes. Toward this end, we describe how to convert a grammar in Chomsky normal form into an Ethos type capable of expressing exactly the set of syntax trees which are valid vis-a-vis the grammar. Next, the paper addresses the convenience of Etypes. If Etypes does not make it easier to craft programs, then programmers will avoid the facilities it provides, for example by declaring string types which in fact serve to encode other types (here Etypes would check the string but not the encoded type). Finally, we present a sample distributed program for Ethos which makes use of the techniques we describe.","PeriodicalId":301535,"journal":{"name":"2015 IEEE Security and Privacy Workshops","volume":"74 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-05-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125952771","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Privacy by Design in Federated Identity Management 联邦身份管理中的隐私设计

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.24

R. Hoerbe, Walter Hötzendorfer

引用次数: 11

Efficient Secure Outsourcing of Genome-Wide Association Studies 全基因组关联研究的高效安全外包

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.11

Wen-jie Lu, Yoshiji Yamada, Jun Sakuma

引用次数: 26

Decentralizing Privacy: Using Blockchain to Protect Personal Data 去中心化隐私:使用区块链保护个人数据

2015 IEEE Security and Privacy Workshops Pub Date : 2015-05-21 DOI: 10.1109/SPW.2015.27

Guy Zyskind, Oz Nathan, A. Pentland

引用次数: 1868