Computer Sciences Commons^™

Uncontrollable Privacy - The Right That Every Attacker Desires, Giannakis Antoniou, Stefanos Gritzalis

Australian Information Security Management Conference

The request of the Internet users enjoying privacy during their e-activities enforces the Internet society to develop techniques which offer privacy to the Internet users, known as Privacy Enhancing Technologies (PETs). Among the Internet users, there are attackers who desire more than anything else to enjoy privacy during their malicious actions, and a PET is what they were looking for. Thus, although a PET should offer privacy to the internet users, proper techniques should also be employed in order to help the victims during the investigation procedure and unveil the identification of the attackers. The paper summarizes the current design …

Electronic Surveillance In Hospitals: A Review, Sue Kennedy

Australian Information Security Management Conference

This paper focuses on the increasing use of electronic surveillance systems in hospitals and the apparent lack of awareness of the implications of these systems for privacy of the individual. The systems are used for identification and tracking of equipment, staff and patients. There has been little public comment or analysis of these systems with regard to privacy as their implementation has been driven by security issues. The systems that gather this information include video, smart card and more recently RFID systems. The system applications include tracking of vital equipment, labelling of blood and other samples, tracking of patients, new …

Making Research Real: Is Action Research A Suitable Methodology For Medical Information Security Investigations?, Patricia A. Williams

Australian Information Security Management Conference

In the medical field, information security is an important yet vastly underrated issue. Research into the protection of sensitive medical data is often technically focused and does not address information systems and behavioural aspects integral to effective information security implementation. Current information security policy and guidelines are strategically oriented which, whilst relevant to large organisations, are less supportive to smaller enterprises such as primary care practices. Further, the conservative nature of the medical profession has been shown to hinder investigation into information technology use and management, making effective improvement based on research problematical. It is an environment which relies greatly …

Security In Pervasive Computing: Current Status And Open Issues, Munirul Haque, Sheikh Iqbal Ahamed

Mathematics, Statistics and Computer Science Faculty Research and Publications

Million of wireless device users are ever on the move, becoming more dependent on their PDAs, smart phones, and other handheld devices. With the advancement of pervasive computing, new and unique capabilities are available to aid mobile societies. The wireless nature of these devices has fostered a new era of mobility. Thousands of pervasive devices are able to arbitrarily join and leave a network, creating a nomadic environment known as a pervasive ad hoc network. However, mobile devices have vulnerabilities, and some are proving to be challenging. Security in pervasive computing is the most critical challenge. Security is needed to …

Privacy Enhanced Superdistribution Of Layered Content With Trusted Access Control, Daniel J. T. Chong, Robert H. Deng

Research Collection School Of Computing and Information Systems

Traditional superdistribution approaches do not address consumer privacy issues and also do not reliably prevent the malicious consumer from indiscriminately copying and redistributing the decryption keys or the decrypted content. The layered nature of common digital content can also be exploited to efficiently provide the consumer with choices over the quality of the content, allowing him/her to pay less for lower quality consumption and vice versa. This paper presents a system that superdistributes encrypted layered content and (1) allows the consumer to select a quality level at which to decrypt and consume the content; (2) prevents the merchant from knowing …

Trust Negotiation For Open Database Access Control, Paul A. Porter

Theses and Dissertations

Hippocratic databases are designed to protect the privacy of the individuals whose personal information they contain. This thesis presents a model for providing and enforcing access control in an open Hippocratic database system. Previously unknown individuals can gain access to information in the database by authenticating to roles through trust negotiation. Allowing qualified strangers to access the database increases the usefulness of the system without compromising privacy. This thesis presents the design and implementation of two methods for filtering information from database queries. First, we extend a query modification method for use in an open database system. Second, we introduce …

Scalability In A Secure Distributed Proof System, Kazuhiro Minami, David Kotz

Dartmouth Scholarship

A logic-based language is often adopted in systems for pervasive computing, because it provides a convenient way to define rules that change the behavior of the systems dynamically. Those systems might define rules that refer to the users' context information to provide context-aware services. For example, a smart-home application could define rules referring to the location of a user to control the light of a house automatically. In general, the context information is maintained in different administrative domains, and it is, therefore, desirable to construct a proof in a distributed way while preserving each domain's confidentiality policies. In this paper, …

Challenging Policies That Do Not Play Fair: A Credential Relevancy Framework Using Trust Negotiation Ontologies, Travis S. Leithead

Theses and Dissertations

This thesis challenges the assumption that policies will "play fair" within trust negotiation. Policies that do not "play fair" contain requirements for authentication that are misleading, irrelevant, and/or incorrect, based on the current transaction context. To detect these unfair policies, trust negotiation ontologies provide the context to determine the relevancy of a given credential set for a particular negotiation. We propose a credential relevancy framework for use in trust negotiation that utilizes ontologies to process the set of all available credentials C and produce a subset of credentials C' relevant to the context of a given negotiation. This credential relevancy …

Privacy Issues In The Era Of Ubiquitous Commerce, Holtjona Galanxhi, Fiona Fui-Hoon Nah

Research Collection School Of Computing and Information Systems

The vision of ubiquitous commerce (u-commerce) is realized through the convergence of electronic, mobile, television, voice and silent commerce applications. The ubiquity, universality, uniqueness, and unison of u-commerce will provide two principal benefits for individual users and companies: increased convenience as well as more personalized and customized services. However, u-commerce will also bring new issues such as a greater degree of privacy concerns that will impact individual users, companies, and the society at large. This paper proposes and elaborates on a conceptual framework for privacy in the u-commerce era. It combines Lessig’s macro-level perspective – the four-factor model of privacy …

Secure Context-Sensitive Authorization, Kazuhiro Minami, David Kotz

Dartmouth Scholarship

There is a recent trend toward rule-based authorization systems to achieve flexible security policies. Also, new sensing technologies in pervasive computing make it possible to define context-sensitive rules, such as “allow database access only to staff who are currently located in the main office.” However, these rules, or the facts that are needed to verify authority, often involve sensitive context information. This paper presents a secure context-sensitive authorization system that protects confidential information in facts or rules. Furthermore, our system allows multiple hosts in a distributed environment to perform the evaluation of an authorization query in a collaborative way; we …

Privacy-Preserving Top-N Recommendation On Horizontally Partitioned Data, Huseyin Polat, Wenliang Du

Electrical Engineering and Computer Science - All Scholarship

Collaborative filtering techniques are widely used by many E-commerce sites for recommendation purposes. Such techniques help customers by suggesting products to purchase using other users’ preferences. Today’s top-recommendation schemes are based on market basket data, which shows whether a customer bought an item or not. Data collected for recommendation purposes might be split between different parties. To provide better referrals and increase mutual advantages, such parties might want to share data. Due to privacy concerns, however, they do not want to disclose data. This paper presents a scheme for binary ratings-based top-N recommendation on horizontally partitioned data, in which two …

Privacy-Preserving Multivariate Statistical Analysis: Linear Regression And Classification, Wenliang Du, Yunghsiang S. Han, Shigang Chen

Electrical Engineering and Computer Science - All Scholarship

Analysis technique that has found applications in various areas. In this paper, we study some multivariate statistical analysis methods in Secure 2-party Computation (S2C) framework illustrated by the following scenario: two parties, each having a secret data set, want to conduct the statistical analysis on their joint data, but neither party is willing to disclose its private data to the other party or any third party. The current statistical analysis techniques cannot be used directly to support this kind of computation because they require all parties to send the necessary data to a central place. In this paper, We define …

Protecting Sensitive Credential Content During Trust Negotiation, Ryan D. Jarvis

Theses and Dissertations

Keeping sensitive information private in a public world is a common concern to users of digital credentials. A digital credential may contain sensitive attributes certifying characteristics about its owner. X.509v3, the most widely used certificate standard, includes support for certificate extensions that make it possible to bind multiple attributes to a public key contained in the certificate. This feature, although convenient, potentially exploits the certificate holder's private information contained in the certificate. There are currently no privacy considerations in place to protect the disclosure of attributes in a certificate. This thesis focuses on protecting sensitive credential content during trust negotiation …

Privacy-Preserving Collaborative Filtering Using Randomized Perturbation Techniques, Huseyin Polat, Wenliang Du

Electrical Engineering and Computer Science - All Scholarship

Collaborative Filtering (CF) techniques are becoming increasingly popular with the evolution of the Internet. E-commerce sites use CF systems to suggest products to customers based on like-minded customers' preferences. People use CF systems to cope with information overload. To conduct collaborative filtering, data from customers are needed. However, collecting high quality data from customers is not an easy task because many customers are so concerned about their privacy that they might decide to give false information. CF systems using these data might produce inaccurate recommendations. We propose a randomized perturbation technique to protect users' privacy while still producing accurate recommendations. …

Building Decision Tree Classifier On Private Data, Wenliang Du, Zhijun Zhan

Electrical Engineering and Computer Science - All Scholarship

This paper studies how to build a decision tree classifier under the following scenario: a database is vertically partitioned into two pieces, with one piece owned by Alice and the other piece owned by Bob. Alice and Bob want to build a decision tree classifier based on such a database, but due to the privacy constraints, neither of them wants to disclose their private pieces to the other party or to any third party. We present a protocol that allows Alice and Bob to conduct such a classifier building without having to compromise their privacy. Our protocol uses an untrusted …

A Practical Approach To Solve Secure Multi-Party Computation Problems, Wenliang Du, Zhijun Zhan

Electrical Engineering and Computer Science - All Scholarship

Secure Multi-party Computation (SMC) problems deal with the following situation: Two (or many) parties want to jointly perform a computation. Each party needs to contribute its private input to this computation, but no party should disclose its private inputs to the other parties, or to any third party. With the proliferation of the Internet, SMC problems becomes more and more important. So far no practical solution has emerged, largely because SMC studies have been focusing on zero information disclosure, an ideal security model that is expensive to achieve. Aiming at developing practical solutions to SMC problems, we propose a new …

Privacy-Preserving Cooperative Statistical Analysis, Wenliang Du, Mikhail J. Atallah

Electrical Engineering and Computer Science - All Scholarship

The growth of the Internet opens up tremendous opportunities for cooperative computation, where the answer depends on the private inputs of separate entities. Sometimes these computations may occur between mutually untrusted entities. The problem is trivial if the context allows the conduct of these computations by a trusted entity that would know the inputs from all the participants; however if the context disallows this then the techniques of secure multi-party computation become very relevant and can provide useful solutions. Statistic analysis is a widely used computation in real life, but the known methods usually require one to know the whole …

Secure Multi-Party Computation Problems And Their Applications: A Review And Open Problems, Wenliang Du, Mikhail J. Atallah

Electrical Engineering and Computer Science - All Scholarship

The growth of the Internet has triggered tremendous opportunities for cooperative computation, where people are jointly conducting computation tasks based on the private inputs they each supplies. These computations could occur between mutually untrusted parties, or even between competitors. For example, customers might send to a remote database queries that contain private information; two competing financial organizations might jointly invest in a project that must satisfy both organizations' private and valuable constraints, and so on. Today, to conduct such computations, one entity must usually know the inputs from all the participants; however if nobody can be trusted enough to know …

Formal Development Of Secure Email, Dan Zhou, Joncheng C. Kuo, Susan Older, Shiu-Kai Chin

Electrical Engineering and Computer Science - All Scholarship

Developing systems that are assured to be secure requires precise and accurate descriptions of specifications, designs, implementations, and security properties. Formal specification and verification have long been recognized as giving the highest degree of assurance. In this paper, we describe a software development process that integrates formal verification and synthesis. We demonstrate this process by developing assured sender and receiver C++ code for a secure electronic mail system, Privacy Enhanced Mail. We use higher-order logic for system-requirements specification, design specifications and design verification. We use a combination of higher-order logic and category theory and tools supporting these formalisms to refine …

Privacy Issues Dealing With Technology : A Review Of The Literature, Kimberly S. Mccoy

Graduate Research Papers

The sophisticated applications of technology are expanding everyday. Unfortunately, so are the many concerns individuals in society are having about their right to privacy. The actual regulations dealing with one's right to privacy has not expand as rapidly as the applications of technology. Individuals using various types of technology are under the assumption their activities are private; however, this is not the case. It does not seem to matter if you are using a computer for communications work, school, or in the "privacy" of your own home, there is absolutely no privacy when dealing with this type of technology.

This …