CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy最新文献_第6页

Secure and efficient proof of storage with deduplication 安全有效的重复数据删除存储证明

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133603

Qingji Zheng, Shouhuai Xu

{"title":"Secure and efficient proof of storage with deduplication","authors":"Qingji Zheng, Shouhuai Xu","doi":"10.1145/2133601.2133603","DOIUrl":"https://doi.org/10.1145/2133601.2133603","url":null,"abstract":"Both security and efficiency are crucial to the success of cloud storage. So far, security and efficiency of cloud storage have been separately investigated as follows: On one hand, security notions such as Proof of Data Possession (PDP) and Proof of Retrievability (POR) have been introduced for detecting that the data stored in the cloud has been tampered with. On the other hand, the notion of Proof of Ownership (POW) has also been proposed to alleviate the cloud server from storing multiple copies of the same data, which could substantially reduce the consumption of both network bandwidth and server storage space. These two aspects are seemingly quite to the opposite of each other. In this paper, we show, somewhat surprisingly, that the two aspects can actually co-exist within the same framework. This is possible fundamentally because of the following insight: The public verifiability offered by PDP/POR schemes can be naturally exploited to achieve POW. This \"one stone, two birds\" phenomenon not only inspired us to propose the novel notion of Proof of Storage with Deduplication (POSD), but also guided us to design a concrete scheme that is provably secure in the Random Oracle model based on the Computational Diffie-Hellman (CDH) assumption.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"50 1","pages":"1-12"},"PeriodicalIF":0.0,"publicationDate":"2012-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"88009002","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 166

The privacy in the time of the internet: secrecy vs transparency 互联网时代的隐私:保密vs透明

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133618

M. Pontual, Andreas Gampe, Omar Chowdhury, B. Kone, Md. Shamim Ashik, W. Winsborough

{"title":"The privacy in the time of the internet: secrecy vs transparency","authors":"M. Pontual, Andreas Gampe, Omar Chowdhury, B. Kone, Md. Shamim Ashik, W. Winsborough","doi":"10.1145/2133601.2133618","DOIUrl":"https://doi.org/10.1145/2133601.2133618","url":null,"abstract":"In the current time of the Internet, specifically with the emergence of social networking, people are sharing both sensitive and non-sensitive information among each other without understanding its consequences. Federal regulations exist to mandate how sensitive information (e.g., SSN, health records, etc.) of a person can be shared (or, used) by organizations. However, there are no established norms or practices regarding how information that is deemed to be not sensitive may be used or shared. Furthermore, for the sake of transparency, different organizations reveal small amounts of non-sensitive information (i.e., photos, salaries, work hours, size of the houses, etc.) about their clients or employees. Although such information seems insignificant, the aggregation of it can be used to create a partial profile of a person which can later be used by malicious parties for robbery, extortion, kidnapping, etc. The goal of this work is to create awareness by demonstrating that it is plausible to create such a partial profile of a person just by crawling the Internet. For this, we have developed an open source framework that generates batch crawlers to create partial profiles of individuals. We also show empirical comparisons of the amount of information that can be gathered by using free and also paid websites.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"66 1","pages":"133-140"},"PeriodicalIF":0.0,"publicationDate":"2012-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"90739788","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Privacy analysis using ontologies 使用本体进行隐私分析

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133627

M. Kost, J. Freytag

引用次数: 20

S2A: secure smart household appliances S2A:安全智能家电

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133628

Yuxin Chen, Bo Luo

{"title":"S2A: secure smart household appliances","authors":"Yuxin Chen, Bo Luo","doi":"10.1145/2133601.2133628","DOIUrl":"https://doi.org/10.1145/2133601.2133628","url":null,"abstract":"Security protection is an integral component for smart homes; however, smart appliances security has received little attention in the research community. Household appliances become very vulnerable if we introduce smart functions without proper security protection. In particular, smart access functions enable users to operate devices remotely. Meanwhile, smart devices are are also designed to support residential demand response, i.e. postpone non-urgent tasks to non-peak hours. However, remote adversaries could utilize such functions to manipulate smart appliances' operations without physically touching them. Such interferences, if not properly handled, could damage the smart devices, disturb owners' life or even harm the households' physical security.\u0000 In this paper, we present S2A, a security protection solution to be embedded in smart appliances. First, a SUP model is developed to quantify penalties from device security, usability and electricity price. We employ multi-criteria reinforcement learning to integrate the three factors to determine an optimal operation strategy. Next, to leverage the risk of forged control commands or pricing data, we present a realtime assessment mechanism based on Bayesian inference. Risk indices are further integrated into the SUP model to serve as weighting factors of corresponding decision criteria. Evaluation shows that S2A ensures appliances security while providing good usability and economical efficiency.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"10 1","pages":"217-228"},"PeriodicalIF":0.0,"publicationDate":"2012-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"73497224","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 32

An information theoretic privacy and utility measure for data sanitization mechanisms 一种数据清理机制的信息理论、隐私和实用措施

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133637

Mina Askari, R. Safavi-Naini, K. Barker

{"title":"An information theoretic privacy and utility measure for data sanitization mechanisms","authors":"Mina Askari, R. Safavi-Naini, K. Barker","doi":"10.1145/2133601.2133637","DOIUrl":"https://doi.org/10.1145/2133601.2133637","url":null,"abstract":"Data collection agencies publish sensitive data for legitimate purposes, such as research, marketing and etc. Data publishing has attracted much interest in research community due to the important concerns over the protection of individuals privacy. As a result several sanitization mechanisms with different notions of privacy have been proposed. To be able to measure, set and compare the level of privacy protection, there is a need to translate these different mechanisms to a unified system. In this paper, we propose a novel information theoretic framework for representing a formal model of a mechanism as a noisy channel and evaluating its privacy and utility. We show that deterministic publishing property that is used in most of these mechanisms reduces the privacy guarantees and causes information to leak. The great effect of adversary's background knowledge on this metric is concluded. We also show that using this framework we can compute the sanitization mechanism's preserved utility from the point of view of a data user. By using the specifications of a popular sanitization mechanism, k-anonymity, we analytically provide a representation of this mechanism to be used for its evaluation.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"32 1","pages":"283-294"},"PeriodicalIF":0.0,"publicationDate":"2012-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"83136915","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 22

Discovering access-control misconfigurations: new approaches and evaluation methodologies 发现访问控制错误配置:新方法和评估方法

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133613

Lujo Bauer, Yuan Liang, M. Reiter, Chad Spensky

{"title":"Discovering access-control misconfigurations: new approaches and evaluation methodologies","authors":"Lujo Bauer, Yuan Liang, M. Reiter, Chad Spensky","doi":"10.1145/2133601.2133613","DOIUrl":"https://doi.org/10.1145/2133601.2133613","url":null,"abstract":"Accesses that are not permitted by implemented policy but that share similarities with accesses that have been allowed, may be indicative of access-control policy misconfigurations. Identifying such misconfigurations allows administrators to resolve them before they interfere with the use of the system. We improve upon prior work in identifying such misconfigurations in two main ways. First, we develop a new methodology for evaluating misconfiguration prediction algorithms and applying them to real systems. We show that previous evaluations can substantially overestimate the benefits of using such algorithms in practice, owing to their tendency to reward predictions that can be deduced to be redundant. We also show, however, that these and other deductions can be harnessed to substantially recover the benefits of prediction. Second, we propose an approach that significantly simplifies the use of misconfiguration prediction algorithms. We remove the need to hand-tune (and empirically determine the effects of) various parameters, and instead replace them with a single, intuitive tuning parameter. We show empirically that this approach is generally competitive in terms of benefit and accuracy with algorithms that require hand-tuned parameters.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"12 1","pages":"95-104"},"PeriodicalIF":0.0,"publicationDate":"2012-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82042911","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 14

Relationship-based access control: its expression and enforcement through hybrid logic 基于关系的访问控制:通过混合逻辑表达和实施

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133616

G. Bruns, Philip W. L. Fong, I. Siahaan, M. Huth

引用次数: 86

Refinement-based design of a group-centric secure information sharing model 以组为中心的安全信息共享模型的改进设计

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133620

Wanying Zhao, Jianwei Niu, W. Winsborough

引用次数: 1

Revisiting link privacy in social networks 重新审视社交网络中的链接隐私

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133609

Suhendry Effendy, R. Yap, Felix Halim

{"title":"Revisiting link privacy in social networks","authors":"Suhendry Effendy, R. Yap, Felix Halim","doi":"10.1145/2133601.2133609","DOIUrl":"https://doi.org/10.1145/2133601.2133609","url":null,"abstract":"In this paper, we revisit the problem of the link privacy attack in online social networks. In the link privacy attack, it turns out that by bribing or compromising a small number of nodes (users) in the social network graph, it is possible to obtain complete link information for a much larger fraction of other non-bribed nodes in the graph. This can constitute a significant privacy breach in online social networks where the link information of nodes is kept private or accessible only to closely related nodes.\u0000 We show that the link privacy attack can be made even more effective with degree inference. Since online social networks typically have high degree, the link privacy attack becomes quite feasible even with an in-lookahead neighborhood of one (only friends can see a user's links/profile). To reduce the effect of the link privacy attack, we present several practical mitigation strategies -- non-uniform user privacy settings, approximation of the node degree information and a non-constant cost model for the attack. All the strategies are able to mitigate the privacy link attack by either reducing the effectiveness of the attack or by making it more expensive to mount. Interestingly, some of the more efficient strategies now become worse than the RANDOM strategy and the effect of a larger neighborhood which would otherwise make the attack even more efficient can be mitigated.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"1 1","pages":"61-70"},"PeriodicalIF":0.0,"publicationDate":"2012-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"90081679","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Towards end-to-end secure content storage and delivery with public cloud 通过公共云实现端到端的安全内容存储和交付

CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy Pub Date : 2012-02-07 DOI: 10.1145/2133601.2133633

Huijun Xiong, Xinwen Zhang, D. Yao, Xiaoxin Wu, Yonggang Wen

{"title":"Towards end-to-end secure content storage and delivery with public cloud","authors":"Huijun Xiong, Xinwen Zhang, D. Yao, Xiaoxin Wu, Yonggang Wen","doi":"10.1145/2133601.2133633","DOIUrl":"https://doi.org/10.1145/2133601.2133633","url":null,"abstract":"Recent years have witnessed the trend of leveraging cloud-based services for large scale content storage, processing, and distribution. Security and privacy are among top concerns for the public cloud environments. Towards end-to-end content security, we propose and implement CloudSeal, a scheme for securely sharing and distributing content via the public cloud. CloudSeal ensures the confidentiality of content in the public cloud environments with flexible access control policies for subscribers and efficient content distribution via content delivery network.\u0000 CloudSeal seamlessly integrates symmetric encryption, proxy-based re-encryption, k-out-of-n secret sharing, and broadcast revocation mechanisms. These algorithms allow CloudSeal to cache the major part of a stored cipher content object in the delivery network for content distribution, while keeping the minor part in the cloud storage for key management. The separation of subscription-based key management and confidentiality-oriented proxy-based re-encryption policies uniquely enables flexible and scalable deployment of the solution as well as strong security for cached content in the network. We have implemented CloudSeal on Amazon Web Services, including EC2, S3, and CloudFront. Through experimental evaluation, we demonstrate the end-to-end efficiency and scalability of CloudSeal.","PeriodicalId":90472,"journal":{"name":"CODASPY : proceedings of the ... ACM conference on data and application security and privacy. ACM Conference on Data and Application Security & Privacy","volume":"28 1","pages":"257-266"},"PeriodicalIF":0.0,"publicationDate":"2012-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"73709282","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 61