Abbildung von: Data and Applications Security and Privacy XXXII - Springer

Data and Applications Security and Privacy XXXII

32nd Annual IFIP WG 11.3 Conference, DBSec 2018, Bergamo, Italy, July 16-18, 2018, Proceedings

Florian Kerschbaum Stefano Paraboschi(Herausgeber*in)

Springer (Verlag)

Erschienen am 9. Juli 2018

XI, 350 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-319-95729-6 (ISBN)

53,49 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Preface
Organization
Contents
Administration
Modeling and Mitigating the Insider Threat of Remote Administrators in Clouds
1 Introduction
2 Preliminaries
2.1 Motivating Example
2.2 Remote Administrators, Maintenance Tasks, and Privileges
3 Models
3.1 Threat Model and Maintenance Task Assignment Model
3.2 Insider Threat Model
4 The Mitigation
4.1 Optimization-Based Mitigation
4.2 Use Cases
5 Simulations
6 Related Work
7 Conclusion
References
Blockchain-Based Auditing of Transparent Log Servers
1 Introduction
2 Requirements
3 Background and Related Work
3.1 Key Transparency
3.2 Gossiping
3.3 Blockchain
3.4 EthIKS
4 Architecture
4.1 Storage
4.2 Trusternity Smart Contract
4.3 Trusternity Server
4.4 Trusternity Client
4.5 Light Ethereum Wallet
4.6 Deployment Architecture
5 Security Analysis
5.1 Scenarios
5.2 Attack Simulation
5.3 Results
5.4 Detection of Malice
6 Evaluation
6.1 Network Overhead
6.2 Gas Cost
6.3 Final Result
7 Conclusion
References
Probabilistic Event Graph to Model Safety and Security for Diagnosis Purposes
1 Introduction
2 Background
3 The Model
3.1 The Event
3.2 The Attack Graph
3.3 Recombining PDF
3.4 Perspectives of the Probabilistic Recombinations
4 The Use Case
5 Related Work
6 Conclusions
References
Access Control Policies
Enabling the Deployment of ABAC Policies in RBAC Systems
1 Introduction
2 Preliminaries
2.1 RBAC
2.2 ABAC
3 ABAC to RBAC Translation
3.1 Problem Formulation
3.2 Approach
4 Experimental Comparison of Access Request Evaluation Cost in ABAC and RBAC
5 Maintenance Cost Comparison in ABAC and RBAC
5.1 Changes Requiring Direct Modification to the RBAC Policy
5.2 Changes Requiring Redoing of ABAC-RBAC Translation
6 Related Work
7 Conclusions and Future Work
References
Policy Languages and Their Suitability for Trust Negotiation
1 Introduction
2 Related Work
3 General Concepts of Trust Negotiation
4 Trust Negotiation Criteria
5 Analysis of Policy Languages
5.1 Privacy of Resources
5.2 Access Control to Resources
5.3 Usage Control of Resources
5.4 Exchange of Resources
5.5 Authority
5.6 Information Granularity
5.7 Context Sensitivity
5.8 Roles
5.9 Analysis Summary
6 Conclusion
References
Role of Apps in Undoing of Privacy Policies on Facebook
1 Introduction
2 Access Control in Facebook
3 Architecture of Facebook Platform
4 Experimental Scenarios of Access by Apps
4.1 App Finds Out User's Friends
4.2 App Can Access User Objects Despite ``Only Me'' Policy
4.3 App Can Find Out Other Apps Installed by the User
4.4 App and Advertiser Can Identify Users: Linkability
4.5 Analysis
5 Related Work and Discussion
6 Conclusion
References
Towards Adaptive Access Control
1 Introduction
2 Motivating Example
3 Adaptive Access Control
3.1 Behavioral Model
3.2 Contextual Behavior
3.3 Concept Drift
4 Evaluation
5 Conclusion
References
Privacy-Preserving Access and Computation
Oblivious Dynamic Searchable Encryption on Distributed Cloud Systems
1 Introduction
1.1 State-of-the-Art and Limitations
1.2 Our Research Objective and Contributions
2 Preliminaries and Building Blocks
3 The Proposed ODSE Schemes
3.1 ODSE Models and Data Structures
3.2 ODSExorwo: Fast ODSE
3.3 ODSEitwo: Robust and IT-Secure ODSE
4 Security
4.1 Malicious Input Tolerance
5 Experimental Evaluation
5.1 Configurations
5.2 Overall Results
5.3 Detailed Cost Analysis
5.4 Experiment with Various Query Sizes
6 Conclusion
References
Privacy-Preserving Planarity Testing of Distributed Graphs
1 Introduction
2 Planarity Testing Using the Hanani-Tutte Theorem
3 Cryptographic Toolkit
3.1 Homomorphic Encryption
3.2 Deciding the Solvability of an Encrypted Linear System
4 Overview of the Proposed Planarity Testing Protocol
4.1 Testing the Number of Edges in the Unified Graph
4.2 A Privacy-Preserving Implementation of the Hanani-Tutte Planarity Test
5 First Stage: Testing the Size of the Unified Edge Set
6 Second Stage: Private Planarity Testing
6.1 Constructing an F-Encryption of the HT System
6.2 Determining the Solvability of an Encrypted Linear System
6.3 Privacy Analysis
6.4 Computational and Communication Costs
6.5 Reducing the Size of the HT System
7 Conclusions
References
Image Pixelization with Differential Privacy
1 Introduction
2 Related Work
3 Preliminaries
4 Differentially Private Pixelization
5 Experiments
5.1 Impact of b
5.2 Impact of m
5.3 Impact of
5.4 Runtime
5.5 Mitigation of CNN Attacks
6 Conclusion and Discussion
References
Integrity and User Interaction
Data Integrity Verification in Column-Oriented NoSQL Databases
1 Introduction
2 Background and Related Work
2.1 Column-Oriented Stores
2.2 System Model and Assumptions
2.3 Integrity and Attack Model
2.4 Related Work
2.5 MHT-based Approach
2.6 DS-Based Approach
2.7 Probabilistic Approach
2.8 Summary
3 Our Approach
3.1 Preliminaries
3.2 Correctness
3.3 Completeness
4 Security Analysis
4.1 Correctness
4.2 Completeness
5 Implementation and Experimental Results
5.1 Setup
5.2 Performance Analysis
5.3 Correctness Analysis
6 Conclusions and Future Directions
References
A Novel Hybrid Password Authentication Scheme Based on Text and Image
1 Introduction
2 Background and Related Work
3 The Novel Authentication Scheme
3.1 System Design
3.2 Security and Usability Analysis
4 Methodology
4.1 The Design and Apparatus
4.2 The Procedure
4.3 The Measurements
5 Results
5.1 The Password Analysis
5.2 The Results Based on the Survey Responses
6 Discussion
References
``It's Shocking!": Analysing the Impact and Reactions to the A3: Android Apps Behaviour Analyser
1 Introduction
2 Related Work
3 Technical Implementation: The A3 Tool
3.1 Log Reader Component
3.2 Data Mining Component
3.3 Graphical User Interface
4 The Design of the User Study
4.1 Recruitment
4.2 Enter Survey
4.3 Apps Privacy Behaviour: A One Week Analysis
4.4 Exit Survey
5 Results
5.1 General Exploration over the Data
5.2 User Expectation
5.3 App Resource Access Behaviour
5.4 Privacy Concern Aspects in Smartphone Apps
5.5 Reaction to the Transparency Tool
5.6 Additional Findings
5.7 Discussion
5.8 Limitations
6 Conclusion
References
Security Analysis and Private Evaluation
FlowConSEAL: Automatic Flow Consistency Analysis of SEAndroid and SELinux Policies
1 Introduction
2 Background
2.1 SELinux
2.2 Readers-Writers Flow Model (RWFM)
3 Consistency Problem of SELinux Policies
4 SELinux Policy Analysis: Our Approach
5 Experimental Analysis and Illustration
5.1 Analysis of Policies by FlowConSEAL
6 Related Work
7 Conclusions
References
On Understanding Permission Usage Contextuality in Android Apps
1 Introduction
2 Background
3 Methodology
3.1 Context Definition
3.2 Identifying Contexts
3.3 Extended Call Graph
4 Analysis and Results
5 Related Work
6 Conclusions and Future Work
References
Private yet Efficient Decision Tree Evaluation
1 Introduction
2 Cryptographic Tools
2.1 Additively Homomorphic Encryption
2.2 Oblivious Transfer
3 Private Comparison of Integers
3.1 Basic Protocol
3.2 Full Protocol
3.3 Further Settings
4 Application: Private Evaluation of Decision Trees
4.1 Problem Setup
4.2 From Public to Private Evaluation
5 Discussion
5.1 Security Considerations
5.2 Performance Analysis
5.3 Random Forests
6 Conclusion and Future Work
A Naor-Pinkas OT Protocol
References
Fixing Vulnerabilities
Breaking and Fixing the Security Proof of Garbled Bloom Filters
1 Introduction
1.1 Organization of the Paper
2 Preliminaries
2.1 Notations
2.2 Bloom Filters
2.3 Garbled Bloom Filters
2.4 Private Set Intersection Based on GBF
2.5 Original Proof of Security by Dong et al. confspsccsspsDongCW13
3 Invalidation of the Proof in confspsccsspsDongCW13
3.1 Generalization of the Counter-Example
4 Other GBF Constructions
4.1 Pinkas et al. confspsussspsPinkas0Z14: Same Situation as Dong et al. confspsccsspsDongCW13
4.2 Rindal and Rosulek confspseurocryptspsRindalR17: No Apparent Issues
5 New Proof of Security
5.1 New Case Distinction
5.2 New Proof of Security
6 Related Work
7 Conclusion
References
USBlock: Blocking USB-Based Keypress Injection Attacks
1 Introduction
2 Background
2.1 The USB Protocol
2.2 USB Protocol Security
2.3 BadUSB and IRON-HID
2.4 Rubber Ducky
2.5 BadAndroid
2.6 BadBIOS
2.7 Other Attacks
2.8 Defenses Against USB-Based Attacks
3 A Novel Approach for Detection of USB-Based Keypress Injection Attacks
3.1 Threat Model
3.2 Patterns of Keypress Injection Attacks
3.3 Keystroke Dynamics
3.4 USBlock: Blocking Malicious USB Packet Traffic
3.5 USBlock Defenses Against Advanced Attacks
3.6 Limitations of USBlock
4 Proof-of-Concept Implementation and Evaluation
4.1 Proof-of-Concept Implementation
4.2 Evaluation of Temporal Variations
4.3 Evaluation of Typing Dynamics
5 Conclusions and Future Work
References
Networked Systems
Virtually Isolated Network: A Hybrid Network to Achieve High Level Security
1 Introduction
2 Related Works
3 Network Architecture
3.1 Network Hardware Components
3.2 Network Communication
3.3 Security Features Guaranteed by Hardware Architecture
4 Our Proposed Encryption-then-Secret-Sharing Method
4.1 Our Secret Sharing Method
4.2 Our Novel Encrytion Scheme
4.3 Security Analysis
5 Experiment
5.1 Physical Unidirectional Network Link
5.2 Our Experiment
6 Conclusion
References
Fingerprinting Crowd Events in Content Delivery Networks: A Semi-supervised Methodology
1 Introduction
2 Methodology
2.1 Overview
2.2 Fingerprinting Crowd Events
2.3 Features Engineering
3 Experiments
3.1 Experiments Setup
3.2 Clustering and Augmentation Results
3.3 Classification Results
4 Related Work
5 Conclusion and Future Work
References
Assessing Attack Impact on Business Processes by Interconnecting Attack Graphs and Entity Dependency Graphs
1 Introduction
2 Background
2.1 CVSS Score
2.2 Attack Graph
2.3 Entity Dependency Graph
3 Approach Overview
3.1 Instantiate Knowledge Units
3.2 Prune Raw Interconnected Graph
3.3 Calculate Impact Score
4 Case Description
5 Case Study and Evaluation
5.1 Case Study Results
5.2 Analysis of Different Cases
5.3 Evaluation of Scalability
6 Related Work
7 Conclusion
References
Author Index

Systemvoraussetzungen

Als PDF speichern Als Link merken