2017 15th Annual Conference on Privacy, Security and Trust (PST)最新文献

Transforming Face-to-Face Identity Proofing into Anonymous Digital Identity Using the Bitcoin Blockchain 使用比特币区块链将面对面身份证明转变为匿名数字身份

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-28 DOI: 10.1109/PST.2017.00014

D. Augot, H. Chabanne, Olivier Clémot, William George

{"title":"Transforming Face-to-Face Identity Proofing into Anonymous Digital Identity Using the Bitcoin Blockchain","authors":"D. Augot, H. Chabanne, Olivier Clémot, William George","doi":"10.1109/PST.2017.00014","DOIUrl":"https://doi.org/10.1109/PST.2017.00014","url":null,"abstract":"The most fundamental purpose of blockchain technology is to enable persistent, consistent, distributed storage of information. Increasingly common are authentication systems that leverage this property to allow users to carry their personal data on a device while a hash of this data is signed by a trusted authority and then put on a blockchain to be compared against. For instance, in 2015, MIT introduced a schema for the publication of their academic certificates based on this principle. In this work, we propose a way for users to obtain assured identities based on face-to-face proofing that can then be validated against a record on a blockchain. Moreover, in order to provide anonymity, instead of storing a hash, we make use of a scheme of Brands to store a commitment against which one can perform zero-knowledge proofs of identity. We also enforce the confidentiality of the underlying data by letting users control a secret of their own.We show how our schema can be implemented on Bitcoin's blockchain and how to save bandwidth by grouping commitments using Merkle trees to minimize the number of Bitcoin transactions that need to be sent. Finally, we describe a system in which users can gain access to services thanks to the identity records of our proposal.","PeriodicalId":405887,"journal":{"name":"2017 15th Annual Conference on Privacy, Security and Trust (PST)","volume":"73 ","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-08-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"113990289","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 35

Classification and Distribution of RBAC Privilege Protection Changes in Wordpress Evolution (Short Paper) Wordpress演进中RBAC特权保护变化的分类与分布(短文)

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00048

Marc-André Laverdière, E. Merlo

{"title":"Classification and Distribution of RBAC Privilege Protection Changes in Wordpress Evolution (Short Paper)","authors":"Marc-André Laverdière, E. Merlo","doi":"10.1109/PST.2017.00048","DOIUrl":"https://doi.org/10.1109/PST.2017.00048","url":null,"abstract":"Role-Based Access Control (RBAC) is commonly used in web applications to protect information and restrict operations. Their security may be affected by source code changes between releases in unexpected ways. To prevent regression and vulnerabilities, developers need to validate them prior to each release, which may be a major undertaking. We automatically and statically determine privilege-level security impacts of code changes using privilege protection changes and apply a set-theoretic classification to them. To do so, we analyze code and determine the security privilege protection models of Web applications written in PHP using Pattern Traversal Flow Analysis (PTFA). We present the distribution of both privilege protection changes and their classification over 147 release pairs of WordPress, spanning from 2.0 to 4.5.1. We found that code changes had no impact on privilege protection in the 82 (56%) release pairs. The remaining 65 (44%) release pairs are affected by privilege protection changes. For the latter release pairs, only 0.30% of code is affected by privilege protection changes. We also found that the most common change categories are complete gains (40.81%), complete losses (17.99%) and substitution (20.10%). The automated identification and classification of privilege protection changes may help developers to more efficiently focus their effort during security reviews, verification, validation, testing, and repairs.","PeriodicalId":405887,"journal":{"name":"2017 15th Annual Conference on Privacy, Security and Trust (PST)","volume":"115 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117345271","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

SORTaki: A Framework to Integrate Sorting with Differential Private Histogramming Algorithms SORTaki:一个整合排序与微分私有直方图算法的框架

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00021

Doudalis Stylianos, S. Mehrotra

引用次数: 3

ABnews: A Fast Private Social Messaging System Using Untrusted Storage and Attribute-Based Encryption ABnews:使用不可信存储和基于属性的加密的快速私人社交消息传递系统

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00045

Yasushi Shinjo, Sota Naito, Kunyao Xiao, Akira Sato

{"title":"ABnews: A Fast Private Social Messaging System Using Untrusted Storage and Attribute-Based Encryption","authors":"Yasushi Shinjo, Sota Naito, Kunyao Xiao, Akira Sato","doi":"10.1109/PST.2017.00045","DOIUrl":"https://doi.org/10.1109/PST.2017.00045","url":null,"abstract":"Centralized social networking services (SNSs) or online social networks (OSNs) inherently have privacy concerns. Ciphertext-policy attribute-based encryption (CP-ABE) is an effective and promising tool for protecting privacy in centralized and distributed systems. However, a large effort is required to develop new practical social applications using CP-ABE. Furthermore, such applications often have performance problems because of the substantial computation time needed for ABE. This paper describes the design and implementation of the ABnews system, a Usenet-like social messaging system using ABE and untrusted storage. ABnews is fast because it eliminates the heavy computation of ABE from the interactive access to messages. ABnews inherits application programs from Usenet, and allows Usenet's rich newsreaders to be utilized without any modification. Furthermore, ABnews provides overlay social applications, including a private blogging service, a presence service, and one-to-one direct messaging, on top of bulletin board systems. The ABnews system has been implemented using the cpabe toolkit and Google Drive, which holds encrypted messages. Experimental results show that the overhead of CP-ABE is negligible when implementing such a messaging system on a current cloud storage service.","PeriodicalId":405887,"journal":{"name":"2017 15th Annual Conference on Privacy, Security and Trust (PST)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128634995","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Alice in Blockchains: Surprising Security Pitfalls in PoW and PoS Blockchain Systems 区块链中的爱丽丝:PoW和PoS区块链系统中令人惊讶的安全陷阱

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00057

T. P. Keenan

引用次数: 30

A Certified Core Policy Language 经过认证的核心政策语言

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00054

Bahman Sistany, A. Felty

引用次数: 4

Evidence-Based Trust Mechanism Using Clustering Algorithms for Distributed Storage Systems (Short Paper) 基于聚类算法的分布式存储系统基于证据的信任机制(短论文)

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00040

Giulia Traverso, Carlos Garcia Cordero, Mehrdad Nojoumian, R. Azarderakhsh, Denise Demirel, Sheikh Mahbub Habib, J. Buchmann

引用次数: 6

OTIDS: A Novel Intrusion Detection System for In-vehicle Network by Using Remote Frame 基于远程帧的车载网络入侵检测系统OTIDS

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00017

Hyunsung Lee, S. Jeong, H. Kim

{"title":"OTIDS: A Novel Intrusion Detection System for In-vehicle Network by Using Remote Frame","authors":"Hyunsung Lee, S. Jeong, H. Kim","doi":"10.1109/PST.2017.00017","DOIUrl":"https://doi.org/10.1109/PST.2017.00017","url":null,"abstract":"Controller Area Network (CAN) is a bus communication protocol which defines a standard for reliable and efficient transmission between in-vehicle nodes in real-time. Since CAN message is broadcast from a transmitter to the other nodes on a bus, it does not contain information about the source and destination address for validation. Therefore, an attacker can easily inject any message to lead system malfunctions. In this paper, we propose an intrusion detection method based on the analysis of the offset ratio and time interval between request and response messages in CAN. If a remote frame having a particular identifier is transmitted, a receiver node should respond to the remote frame immediately. In attack-free state, each node has a fixed response offset ratio and time interval while these values vary in attack state. Using this property, we can measure the response performance of the existing nodes based on the offset ratio and time interval between request and response messages. As a result, our methodology can detect intrusions by monitoring offset ratio and time interval, and it allows quick intrusion detection with high accuracy.","PeriodicalId":405887,"journal":{"name":"2017 15th Annual Conference on Privacy, Security and Trust (PST)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116458467","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 195

Differentially Private Instance-Based Noise Mechanisms in Practice 基于实例的差分噪声机制

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00022

Sébastien Canard, Baptiste Olivier, Tony Quertier

{"title":"Differentially Private Instance-Based Noise Mechanisms in Practice","authors":"Sébastien Canard, Baptiste Olivier, Tony Quertier","doi":"10.1109/PST.2017.00022","DOIUrl":"https://doi.org/10.1109/PST.2017.00022","url":null,"abstract":"Differential privacy is a widely used privacy model today, whose privacy guarantees are obtained to the price of a random perturbation of the result. In some situations, basic differentially private mechanisms may add too much noise to reach a reasonable level of privacy. To answer this shortcoming, several works have provided more technically involved mechanisms, using a new paradigm of differentially private mechanisms called instance-based noise mechanisms. In this paper, we exhibit for the first time theoretical conditions for an instance-based noise mechanism to be (∊,δ)-differentially private. We exploit the simplicity of these conditions to design a novel instance-based noise differentially private mechanism. Conducting experimental evaluations, we show that our mechanism compares favorably to existing instance-based noise mechanisms, either regarding time complexity or accuracy of the sanitized result. By contrast with some prior works, our algorithms do not involve the computation of all local sensitivities, a computational task which was proved to be NP hard in some cases, namely for statistic queries on graphs. Our framework is as general as possible and can be used to answer any query, which is in contrast with recent designs of instance-based noise mechanisms where only graph statistics queries are considered.","PeriodicalId":405887,"journal":{"name":"2017 15th Annual Conference on Privacy, Security and Trust (PST)","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128320462","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Context Sensitive and Secure Parser Generation for Deep Packet Inspection of Binary Protocols 基于上下文敏感和安全的二进制协议深度包检测解析器生成

2017 15th Annual Conference on Privacy, Security and Trust (PST) Pub Date : 2017-08-01 DOI: 10.1109/PST.2017.00019

Ali ElShakankiry, T. Dean

引用次数: 6