2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)最新文献_第2页

Simulation of a Trust and Reputation Based Mitigation Protocol for a Black Hole Style Attack on VANETs 基于信任和声誉的黑洞型VANETs攻击缓解协议仿真

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00025

G. Primiero, Agostino Martorana, J. Tagliabue

引用次数: 9

An Analysis of Cyber Security Attack Taxonomies 网络安全攻击分类分析

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00028

R. Derbyshire, B. Green, D. Prince, A. Mauthe, D. Hutchison

引用次数: 28

Inferring OpenVPN State Machines Using Protocol State Fuzzing 使用协议状态模糊推断OpenVPN状态机

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00009

Lesly-Ann Daniel, E. Poll, Joeri de Ruiter

引用次数: 22

Authenticated Data Structures for Privacy-Preserving Monero Light Clients 保护隐私的Monero轻客户端的认证数据结构

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00010

Kevin Lee, Andrew K. Miller

引用次数: 4

Methods and Tools for GDPR Compliance Through Privacy and Data Protection Engineering 通过隐私和数据保护工程实现GDPR合规的方法和工具

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00021

Y. Martín, A. Kung

引用次数: 48

The Secret Processor Will Go to the Ball: Benchmark Insider-Proof Encrypted Computing 秘密处理器将参加舞会:基准防内部加密计算

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00027

Peter T. Breuer, Jonathan P. Bowen, Esther Palomar, Zhiming Liu

引用次数: 4

Interaction-Based Privacy Threat Elicitation 基于交互的隐私威胁引出

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00017

Laurens Sion, Kim Wuyts, Koen Yskout, D. Landuyt, W. Joosen

{"title":"Interaction-Based Privacy Threat Elicitation","authors":"Laurens Sion, Kim Wuyts, Koen Yskout, D. Landuyt, W. Joosen","doi":"10.1109/EuroSPW.2018.00017","DOIUrl":"https://doi.org/10.1109/EuroSPW.2018.00017","url":null,"abstract":"Threat modeling involves the systematic identification, elicitation, and analysis of privacy- and/or security-related threats in the context of a specific system. These modeling practices are performed at a specific level of architectural abstraction – the use of Data Flow Diagram (DFD) models, for example, is common in this context. To identify and elicit threats, two fundamentally different approaches can be taken: (1) elicitation on a per-element basis involves iteratively singling out individual architectural elements and considering the applicable threats, (2) elicitation at the level of system interactions (which involve the local context of three elements: a source, a data flow, and a destination) performs elicitation at the basis of system-level communication. Although not considering the local context of the element under investigation makes the former approach easier to adopt and use for human analysts, this approach also leads to threat duplication and redundancy, relies more extensively on implicit analyst expertise, and requires more manual effort. In this paper, we provide a detailed analysis of these issues with element-based threat elicitation in the context of LINDDUN, an element-driven privacy-by-design threat modeling methodology. Subsequently, we present a LINDDUN extension that implements interaction-based privacy threat elicitation and we provide indepth argumentation on how this approach leads to better process guidance and more concrete interpretation of privacy threat types, ultimately requiring less effort and expertise. A third standalone contribution of this work is a catalog of realistic and illustrative LINDDUN privacy threats, which in turn facilitates practical threat elicitation using LINDDUN.","PeriodicalId":326280,"journal":{"name":"2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126249181","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 24

The Odyssey: Modeling Privacy Threats in a Brave New World 奥德赛:在一个美丽的新世界中建模隐私威胁

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00018

Rafa Gálvez, Seda Gurses

{"title":"The Odyssey: Modeling Privacy Threats in a Brave New World","authors":"Rafa Gálvez, Seda Gurses","doi":"10.1109/EuroSPW.2018.00018","DOIUrl":"https://doi.org/10.1109/EuroSPW.2018.00018","url":null,"abstract":"In the upcoming General Data Protection Regulation (GDPR), privacy by design and privacy impact assessments are given an even more prominent role than before. It is now required that companies build privacy into the core of their technical products. Recently, researchers and industry players have proposed employing threat modeling methods, traditionally used in security engineering, as a way to bridge these two GDPR requirements in the process of engineering systems. Threat modeling, however, typically assumes a waterfall process and monolithic design, assumptions that are disrupted with the popularization of Agile methodologies and Service Oriented Architectures. Moreover, agile service environments make it easier to address some privacy problems, while complicating others. To date, the challenges of applying threat modeling for privacy in agile service environments remain understudied. This paper sets out to expose and analyze this gap. Specifically, we analyze what challenges and opportunities the shifts in software engineering practice introduce into traditional Threat Modeling activities; how they relate to the different Privacy Goals; and what Agile principles and Service properties have an impact on them. Our results show that both agile and services make the end-toend analysis of applications more difficult. At the same time, the former allows for more efficient communications and iterative progress, while the latter enables the parallelization of tasks and the documentation of some architecture decisions. Additionally, we open a new research avenue pointing to Amazon Macie as an example of Machine Learning applications that aim to provide a solution to the scalability and usability of Privacy Threat Modeling processes.","PeriodicalId":326280,"journal":{"name":"2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"94 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131668446","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 17

It Takes a Village: A Community Based Participatory Framework for Privacy Design 它需要一个村庄:一个基于社区的参与式隐私设计框架

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00022

Darakhshan J. Mir, Yan Shvartzshnaider, Mark Latonero

{"title":"It Takes a Village: A Community Based Participatory Framework for Privacy Design","authors":"Darakhshan J. Mir, Yan Shvartzshnaider, Mark Latonero","doi":"10.1109/EuroSPW.2018.00022","DOIUrl":"https://doi.org/10.1109/EuroSPW.2018.00022","url":null,"abstract":"As data-centric technologies are increasingly being considered in social contexts that intervene in marginalized peoples' lives, we consider design paradigms to create systems that fulfill their unique privacy needs and requirements. Disempowered populations often experience disparate harms from the loss of privacy but, typically, have a limited role in formulating the scope and nature of such interventions, and accompanying (implicit or explicit) privacy policies and consequent engineering processes. This gap can be addressed by including recipient communities in designing these privacy policies. We propose a participatory design model for data-centric applications where privacy policies (norms) emerge out of participation of the community in the research/design process. The framework of Contextual Integrity which articulates privacy as respect for normative rules of information flow in specific contexts, lends itself well to enable a community-generated formulation of these privacy norms within the contexts of the proposed intervention. Employing formal logic, these privacy norms can then be used to engineer systems capable of regulating the flow of information as per the negotiated norms [1]. This entire process which we call Contextualized Participatory Privacy by Design, seeks to empower communities in negotiating and articulating their privacy norms, leading to the development of systems that are capable of enforcing what they deem as ethical, contextualized use of their data.","PeriodicalId":326280,"journal":{"name":"2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128879627","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Trusted Platform Modules in Cyber-Physical Systems: On the Interference Between Security and Dependability 网络物理系统中的可信平台模块:安全性与可靠性的干扰

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-01 DOI: 10.1109/EuroSPW.2018.00026

Andrea Höller, Ronald Toegl

{"title":"Trusted Platform Modules in Cyber-Physical Systems: On the Interference Between Security and Dependability","authors":"Andrea Höller, Ronald Toegl","doi":"10.1109/EuroSPW.2018.00026","DOIUrl":"https://doi.org/10.1109/EuroSPW.2018.00026","url":null,"abstract":"Cyber physical systems are the key innovation driver for many domains such as automotive, avionics, industrial process control, and factory automation. However, their interconnection potentially provides adversaries easy access to sensitive data, code, and configurations. If attackers gain control, material damage or even harm to people must be expected. To counteract data theft, system manipulation and cyber-attacks, security mechanisms must be embedded in the cyber physical system. Adding hardware security in the form of the standardized Trusted Platform Module (TPM) is a promising approach. At the same time, traditional dependability features such as safety, availability, and reliability have to be maintained. To determine the right balance between security and dependability it is essential to understand their interferences. This paper supports developers in identifying the implications of using TPMs on the dependability of their system.We highlight potential consequences of adding TPMs to cyber-physical systems by considering the resulting safety, reliability, and availability. Furthermore, we discuss the potential of enhancing the dependability of TPM services by applying traditional redundancy techniques.","PeriodicalId":326280,"journal":{"name":"2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"131 6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124251031","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10