Open Access. Powered by Scholars. Published by Universities.®
- Discipline
-
- Databases and Information Systems (142)
- Software Engineering (99)
- Artificial Intelligence and Robotics (37)
- Engineering (33)
- Business (30)
-
- Computer Engineering (29)
- Medicine and Health Sciences (25)
- OS and Networks (23)
- Data Storage Systems (22)
- Numerical Analysis and Scientific Computing (16)
- Theory and Algorithms (16)
- Health Information Technology (13)
- Graphics and Human Computer Interfaces (12)
- Social and Behavioral Sciences (12)
- Finance and Financial Management (11)
- E-Commerce (9)
- Public Affairs, Public Policy and Public Administration (8)
- Transportation (7)
- Programming Languages and Compilers (6)
- Computer and Systems Architecture (4)
- Digital Communications and Networking (4)
- Systems Architecture (4)
- Technology and Innovation (4)
- Management Information Systems (3)
- Communication (2)
- Law (2)
- Rehabilitation and Therapy (2)
- Keyword
-
- Privacy (47)
- Cloud computing (41)
- Access control (37)
- Security (31)
- Authentication (30)
-
- Privacy-preserving (28)
- Blockchain (27)
- Encryption (27)
- Searchable encryption (24)
- Attribute-based encryption (20)
- Data privacy (19)
- Servers (19)
- Cloud storage (18)
- Cryptography (18)
- Anonymity (16)
- RFID (15)
- Revocation (15)
- Homomorphic encryption (14)
- Android (13)
- Protocols (13)
- Machine learning (12)
- Digital signature (10)
- Information security (10)
- Keyword search (10)
- Proxy re-encryption (10)
- Bitcoin (9)
- Cloud Computing (9)
- Cybersecurity (9)
- Data outsourcing (9)
- Deep learning (9)
- Publication Year
Articles 691 - 720 of 1051
Full-Text Articles in Information Security
Identity-Based Lossy Encryption From Learning With Errors, Jingnan He, Bao Li, Xianhui Lu, Dingding Jia, Haiyang Xue, Xiaochao Sun
Identity-Based Lossy Encryption From Learning With Errors, Jingnan He, Bao Li, Xianhui Lu, Dingding Jia, Haiyang Xue, Xiaochao Sun
Research Collection School Of Computing and Information Systems
We extend the notion of lossy encryption to the scenario of identity-based encryption (IBE), and propose a new primitive called identity-based lossy encryption (IBLE). Similar as the case of lossy encryption, we show that IBLE can also achieve selective opening security. Finally, we present a construction of IBLE from the assumption of learning with errors.
Privacy-Preserving Offloading Of Mobile App To The Public Cloud, Yue Duan, Mu Zhang, Heng Yin, Yuzhe Tang
Privacy-Preserving Offloading Of Mobile App To The Public Cloud, Yue Duan, Mu Zhang, Heng Yin, Yuzhe Tang
Research Collection School Of Computing and Information Systems
To support intensive computations on resource-restricting mobile devices, studies have been made to enable the offloading of a part of a mobile program to the cloud. However, none of the existing approaches considers user privacy when transmitting code and data off the device, resulting in potential privacy breach. In this paper, we present the design and implementation of a system that automatically performs fine-grained privacy-preserving Android app offloading. It utilizes static analysis and bytecode instrumentation techniques to ensure transparent and efficient Android app offloading while preserving user privacy. We evaluate the effectiveness and performance of our system using two Android …
A New Public Remote Integrity Checking Scheme With User Privacy, Yiteng Feng, Yi Mu, Guomin Yang, Joseph Liu
A New Public Remote Integrity Checking Scheme With User Privacy, Yiteng Feng, Yi Mu, Guomin Yang, Joseph Liu
Research Collection School Of Computing and Information Systems
With a cloud storage, users can store their data files on a remote cloud server with a high quality on-demand cloud service and are able to share their data with other users. Since cloud servers are not usually regarded as fully trusted and the cloud data can be shared amongst users, the integrity checking of the remote files has become an important issue. A number of remote data integrity checking protocols have been proposed in the literature to allow public auditing of cloud data by a third party auditor (TPA). However, user privacy is not taken into account in most …
A New General Framework For Secure Public Key Encryption With Keyword Search, Rongmao Chen, Yi Mu, Guomin Yang, Fuchun Guo, Xiaofen Wang
A New General Framework For Secure Public Key Encryption With Keyword Search, Rongmao Chen, Yi Mu, Guomin Yang, Fuchun Guo, Xiaofen Wang
Research Collection School Of Computing and Information Systems
Public Key Encryption with Keyword Search (PEKS), introduced by Boneh et al. in Eurocrypt’04, allows users to search encrypted documents on an untrusted server without revealing any information. This notion is very useful in many applications and has attracted a lot of attention by the cryptographic research community. However, one limitation of all the existing PEKS schemes is that they cannot resist the Keyword Guessing Attack (KGA) launched by a malicious server. In this paper, we propose a new PEKS framework named Dual-Server Public Key Encryption with Keyword Search (DS-PEKS). This new framework can withstand all the attacks, including the …
Attribute-Based Encryption With Efficient Verifiable Outsourced Decryption, Baodong Qin, Robert H. Deng, Shengli Liu, Siqi Ma
Attribute-Based Encryption With Efficient Verifiable Outsourced Decryption, Baodong Qin, Robert H. Deng, Shengli Liu, Siqi Ma
Research Collection School Of Computing and Information Systems
Attribute-based encryption (ABE) with outsourced decryption not only enables fine-grained sharing of encrypted data, but also overcomes the efficiency drawback (in terms of ciphertext size and decryption cost) of the standard ABE schemes. In particular, an ABE scheme with outsourced decryption allows a third party (e.g., a cloud server) to transform an ABE ciphertext into a (short) El Gamal-type ciphertext using a public transformation key provided by a user so that the latter can be decrypted much more efficiently than the former by the user. However, a shortcoming of the original outsourced ABE scheme is that the correctness of the …
Attribute-Based Encryption With Efficient Verifiable Outsourced Decryption, Baodong Qin, Robert H. Deng, Shengli Liu, Siqi Ma
Attribute-Based Encryption With Efficient Verifiable Outsourced Decryption, Baodong Qin, Robert H. Deng, Shengli Liu, Siqi Ma
Research Collection School Of Computing and Information Systems
Attribute-based encryption (ABE) with outsourced decryption not only enables fine-grained sharing of encrypted data, but also overcomes the efficiency drawback (in terms of ciphertext size and decryption cost) of the standard ABE schemes. In particular, an ABE scheme with outsourced decryption allows a third party (e.g., a cloud server) to transform an ABE ciphertext into a (short) El Gamal-type ciphertext using a public transformation key provided by a user so that the latter can be decrypted much more efficiently than the former by the user. However, a shortcoming of the original outsourced ABE scheme is that the correctness of the …
Active Semi-Supervised Approach For Checking App Behavior Against Its Description, Ma Siqi, Shaowei Wang, David Lo, Deng, Robert H., Cong Sun
Active Semi-Supervised Approach For Checking App Behavior Against Its Description, Ma Siqi, Shaowei Wang, David Lo, Deng, Robert H., Cong Sun
Research Collection School Of Computing and Information Systems
Mobile applications are popular in recent years. They are often allowed to access and modify users' sensitive data. However, many mobile applications are malwares that inappropriately use these sensitive data. To detect these malwares, Gorla et al. Propose CHABADA which compares app behaviors against its descriptions. Data about known malwares are not used in their work, which limits its effectiveness. In this work, we extend the work by Gorla et al. By proposing an active and semi-supervised approach for detecting malwares. Different from CHABADA, our approach will make use of both known benign and malicious apps to predict other malicious …
Continuous Non-Malleable Key Derivation And Its Application To Related-Key Security, Baodong Qin, Shenli Liu, Tsz Hon Yuen, Robert H. Deng, Kefei Chen
Continuous Non-Malleable Key Derivation And Its Application To Related-Key Security, Baodong Qin, Shenli Liu, Tsz Hon Yuen, Robert H. Deng, Kefei Chen
Research Collection School Of Computing and Information Systems
Related-Key Attacks (RKAs) allow an adversary to observe the outcomes of a cryptographic primitive under not only its original secret key e.g., s, but also a sequence of modified keys ϕ(s), where ϕ is specified by the adversary from a class Φ of so-called Related-Key Derivation (RKD) functions. This paper extends the notion of non-malleable Key Derivation Functions (nm-KDFs), introduced by Faust et al. (EUROCRYPT’14), to continuous nm-KDFs. Continuous nm-KDFs have the ability to protect against any a-priori unbounded number of RKA queries, instead of just a single time tampering attack as in the definition of …
Method For Matching Probabilistic Encrypted Data, Hwee Hwa Pang, Xuhua Ding
Method For Matching Probabilistic Encrypted Data, Hwee Hwa Pang, Xuhua Ding
Research Collection School Of Computing and Information Systems
Determining if a first encrypted data of a first data value is equal to a second encrypted data of a second data value. Comprising: a first cyclic group; a second cyclic group including a first element. Applying an operation to the first cyclic group to map its elements to an element in the second cyclic group. Randomly selecting a second element from the first cyclic group; producing the first encrypted data by mapping the second element and the first data value into one or more elements of the first cyclic group. Randomly selecting a third element from the first cyclic …
Electronic Contract Signing Without Using Trusted Third Party, Zhiguo Wan, Robert H. Deng, David Kuo Chuen Lee
Electronic Contract Signing Without Using Trusted Third Party, Zhiguo Wan, Robert H. Deng, David Kuo Chuen Lee
Research Collection School Of Computing and Information Systems
Electronic contract signing allows two potentially dis-trustful parties to digitally sign an electronic document “simultaneously” across a network. Existing solutions for electronic contract signing either require the involvement of a trusted third party (TTP), or are complex and expensive in communication and computation. In this paper we propose an electronic contract signing protocol between two parties with the following advantages over existing solutions: 1) it is practical and scalable due to its simplicity and high efficiency; 2) it does not require any trusted third party as the mediator; and 3) it guarantees fairness between the two signing parties. We achieve …
Software Watermarking Using Return-Oriented Programming, Haoyu Ma, Kangjie Lu, Xinjie Ma, Haining Zhang, Chunfu Jia, Debin Gao
Software Watermarking Using Return-Oriented Programming, Haoyu Ma, Kangjie Lu, Xinjie Ma, Haining Zhang, Chunfu Jia, Debin Gao
Research Collection School Of Computing and Information Systems
We propose a novel dynamic software watermarking design based on Return-Oriented Programming (ROP). Our design formats watermarking code into well-crafted data arrangements that look like normal data but could be triggered to execute. Once triggered, the pre-constructed ROP execution will recover the hidden watermark message. The proposed ROP-based watermarking technique is more stealthy and resilient over existing techniques since the watermarking code is allocated dynamically into data region and therefore out of reach of attacks based on code analysis. Evaluations show that our design not only achieves satisfying stealth and resilience, but also causes significantly lower overhead to the watermarked …
Privacy Leakage Analysis In Online Social Networks, Yan Li, Yingjiu Li, Qiang Yan, Deng, Robert H.
Privacy Leakage Analysis In Online Social Networks, Yan Li, Yingjiu Li, Qiang Yan, Deng, Robert H.
Research Collection School Of Computing and Information Systems
Online Social Networks (OSNs) have become one of the major platforms for social interactions, such as building up relationship, sharing personal experiences, and providing other services. The wide adoption of OSNs raises privacy concerns due to personal data shared online. Privacy control mechanisms have been deployed in popular OSNs for users to determine who can view their personal information. However, user's sensitive information could still be leaked even when privacy rules are properly configured. We investigate the effectiveness of privacy control mechanisms against privacy leakage from the perspective of information flow. Our analysis reveals that the existing privacy control mechanisms …
Reconstruction Privacy: Enabling Statistical Learning, Ke Wang, Chao Han, Ada Waichee Fu, Raymond C. Wong, Philip S. Yu
Reconstruction Privacy: Enabling Statistical Learning, Ke Wang, Chao Han, Ada Waichee Fu, Raymond C. Wong, Philip S. Yu
Research Collection School Of Computing and Information Systems
Non-independent reasoning (NIR) allows the information about one record in the data to be learnt from the information of other records in the data. Most posterior/prior based privacy criteria consider NIR as a privacy violation and require to smooth the distribution of published data to avoid sensitive NIR. The drawback of this approach is that it limits the utility of learning statistical relationships. The differential privacy criterion considers NIR as a non-privacy violation, therefore, enables learning statistical relationships, but at the cost of potential disclosures through NIR. A question is whether it is possible to (1) allow learning statistical relationships, …
Understanding Natural Disasters As Risks In Supply Chain Management Through Web Data Analysis, Jimmy Ong, Zhaoxia Wang, Rick Siow Mong Goh, Xiao Feng Yin, Xin Xin, Xiuju Fu
Understanding Natural Disasters As Risks In Supply Chain Management Through Web Data Analysis, Jimmy Ong, Zhaoxia Wang, Rick Siow Mong Goh, Xiao Feng Yin, Xin Xin, Xiuju Fu
Research Collection School Of Computing and Information Systems
With the increasing trend of global outsourcing, companies are now facing ever more complexsupply chains. When a company operates over a large geographical area, the likelihood of disruptions ispotentially increased due to such unforeseen events as natural disasters, union strikes or social unrest. Inthis paper, we consider natural disasters as a form of risks in supply chains and propose to aid itsmanagement by analyzing Web data collected in real-time. Using Twitter "tweets" as our primary source ofWeb data, a real-time data crawler is developed to collect and analyze tweets that are identified as relevant tonatural disasters. In addition, a visualization …
Analysis And Improvement On A Biometric-Based Remote User Authentication Scheme Using Smart Cards, Fengtong Wen, Willy Susilo, Guomin Yang
Analysis And Improvement On A Biometric-Based Remote User Authentication Scheme Using Smart Cards, Fengtong Wen, Willy Susilo, Guomin Yang
Research Collection School Of Computing and Information Systems
In a recent paper (BioMed Research International, 2013/491289), Khan et al. proposed an improved biometrics-based remote user authentication scheme with user anonymity. The scheme is believed to be secure against password guessing attack, user impersonation attack, server masquerading attack, and provide user anonymity, even if the secret information stored in the smart card is compromised. In this paper, we analyze the security of Khan et al.’s scheme, and demonstrate that their scheme doesn’t provide user anonymity. This also renders that their scheme is insecure against other attacks, such as off-line password guessing attack, user impersonation attacks. Subsequently, we propose a …
Leakage-Resilient Password Entry: Challenges, Design, And Evaluation, Qiang Yan, Jin Han, Yingjiu Li, Jianying Zhou, Robert H. Deng
Leakage-Resilient Password Entry: Challenges, Design, And Evaluation, Qiang Yan, Jin Han, Yingjiu Li, Jianying Zhou, Robert H. Deng
Research Collection School Of Computing and Information Systems
Password leakage is one of the most serious threats for password-based user authentication. Although this problem has been extensively investigated over the last two decades, there is still no widely adopted solution. In this paper, we attempt to systematically understand the challenges behind this problem and investigate the feasibility of solving it. Since password leakage usually happens when a password is input during authentication, we focus on designing leakage-resilient password entry (LRPE) schemes in this study. We develop a broad set of design criteria and use them to construct a practical LRPE scheme named CoverPad, which not only improves leakage …
Biometric Authentication On Iphone And Android: Usability, Perceptions, And Influences On Adoption, Rasekhar Bhagavatula, Blase Ur, Kevin Iacovino, Su Mon Kywe, Lorrie Faith Cranor, Marios Savvides
Biometric Authentication On Iphone And Android: Usability, Perceptions, And Influences On Adoption, Rasekhar Bhagavatula, Blase Ur, Kevin Iacovino, Su Mon Kywe, Lorrie Faith Cranor, Marios Savvides
Research Collection School Of Computing and Information Systems
While biometrics have long been promoted as the future of authentication, the recent introduction of Android face unlock and iPhone fingerprint unlock are among the first large-scale deployments of biometrics for consumers. In a 10-participant, within-subjects lab study and a 198-participant online survey, we investigated the usability of these schemes, along with users ’ experiences, attitudes, and adoption decisions. Participants in our lab study found both face unlock and fingerprint unlock easy to use in typical scenarios. The notable exception was that face unlock was completely unusable in a dark room. Most participants preferred fingerprint unlock over face unlock or …
Software Puzzle: A Countermeasure To Resource-Inflated Denial-Of-Service Attacks, Yongdong Wu, Zhigang Zhao, Bao Feng, Robert H. Deng
Software Puzzle: A Countermeasure To Resource-Inflated Denial-Of-Service Attacks, Yongdong Wu, Zhigang Zhao, Bao Feng, Robert H. Deng
Research Collection School Of Computing and Information Systems
Denial-of-service (DoS) and distributed DoS (DDoS) are among the major threats to cyber-security, and client puzzle, which demands a client to perform computationally expensive operations before being granted services from a server, is a well-known countermeasure to them. However, an attacker can inflate its capability of DoS/DDoS attacks with fast puzzle-solving software and/or built-in graphics processing unit (GPU) hardware to significantly weaken the effectiveness of client puzzles. In this paper, we study how to prevent DoS/DDoS attackers from inflating their puzzle-solving capabilities. To this end, we introduce a new client puzzle referred to as software puzzle. Unlike the existing client …
Multidimensional Context Awareness In Mobile Devices, Zhuo Wei, Robert H. Deng, Jialie Shen, Jixiang Zhu, Kun Ouyang, Yongdong Wu
Multidimensional Context Awareness In Mobile Devices, Zhuo Wei, Robert H. Deng, Jialie Shen, Jixiang Zhu, Kun Ouyang, Yongdong Wu
Research Collection School Of Computing and Information Systems
With the increase of mobile computation ability and the development of wireless network transmission technology, mobile devices not only are the important tools of personal life (e.g., education and entertainment), but also emerge as indispensable "secretary" of business activities (e.g., email and phone call). However, since mobile devices could work under complex and dynamic local and network conditions, they are vulnerable to local and remote security attacks. In real applications, different kinds of data protection are required by various local contexts. To provide appropriate protection, we propose a multidimensional context (MContext) scheme to comprehensively model and characterize the scene and …
Improving Internet Security Through Mandatory Information Disclosure, Qian Tang, Andrew B. Whinston
Improving Internet Security Through Mandatory Information Disclosure, Qian Tang, Andrew B. Whinston
Research Collection School Of Computing and Information Systems
Although disclosure has long been considered as a solution to internalize externalities, mandatory security information disclosure is still in debate. We propose a mandatory disclosure mechanism based on existing data. The information is disclosed as straightforward rankings of organizations for users to understand, interpret, and make comparisons. As a result, the disclosure can influence organizations through reputational effects. We created a public website to disclose information regularly and conducted a quasi-experiment on outgoing spam to test the effectiveness of our mechanism on four matched country groups. For each treated country, we released the ranking list of top 10 most spamming …
Ambiguous Optimistic Fair Exchange: Definition And Constructions, Qiong Huang, Guomin Yang, Duncan S. Wong, Willy Susilo
Ambiguous Optimistic Fair Exchange: Definition And Constructions, Qiong Huang, Guomin Yang, Duncan S. Wong, Willy Susilo
Research Collection School Of Computing and Information Systems
Optimistic fair exchange (OFE) is a protocol for solving the problem of exchanging items or services in a fair manner between two parties, a signer and a verifier, with the help of an arbitrator which is called in only when a dispute happens between the two parties. In almost all the previous work on OFE, after obtaining a partial signature from the signer, the verifier can present it to others and show that the signer has indeed committed itself to something corresponding to the partial signature even prior to the completion of the transaction. In some scenarios, this capability given …
Detecting Camouflaged Applications On Mobile Application Markets, Mon Kywe Su, Yingjiu Li, Huijie Robert Deng, Jason Hong
Detecting Camouflaged Applications On Mobile Application Markets, Mon Kywe Su, Yingjiu Li, Huijie Robert Deng, Jason Hong
Research Collection School Of Computing and Information Systems
Application plagiarism or application cloning is an emerging threat in mobile application markets. It reduces profits of original developers and sometimes even harms the security and privacy of users. In this paper, we introduce a new concept, called camouflaged applications, where external features of mobile applications, such as icons, screenshots, application names or descriptions, are copied. We then propose a scalable detection framework, which can find these suspiciously similar camouflaged applications. To accomplish this, we apply text-based retrieval methods and content-based image retrieval methods in our framework. Our framework is implemented and tested with 30,625 Android applications from the official …
Android Or Ios For Better Privacy Protection?, Jin Han, Qiang Yan, Debin Gao, Jianying Zhou, Huijie Robert Deng
Android Or Ios For Better Privacy Protection?, Jin Han, Qiang Yan, Debin Gao, Jianying Zhou, Huijie Robert Deng
Research Collection School Of Computing and Information Systems
With the rapid growth of the mobile market, security of mobile platforms is receiving increasing attention from both research community as well as the public. In this paper, we make the first attempt to establish a baseline for security comparison between the two most popular mobile platforms. We investigate applications that run on both Android and iOS and examine the difference in the usage of their security sensitive APIs (SS-APIs). Our analysis over 2,600 applications shows that iOS applications consistently access more SS-APIs than their counterparts on Android. The additional privileges gained on iOS are often associated with accessing private …
Semantics-Aware Android Malware Classification Using Weighted Contextual Api Dependency Graphs, Mu Zhang, Yue Duan, Heng Yin, Zhiruo Zhao
Semantics-Aware Android Malware Classification Using Weighted Contextual Api Dependency Graphs, Mu Zhang, Yue Duan, Heng Yin, Zhiruo Zhao
Research Collection School Of Computing and Information Systems
The drastic increase of Android malware has led to a strong interest in developing methods to automate the malware analysis process. Existing automated Android malware detection and classification methods fall into two general categories: 1) signature-based and 2) machine learning-based. Signature-based approaches can be easily evaded by bytecode-level transformation attacks. Prior learning-based works extract features from application syntax, rather than program semantics, and are also subject to evasion. In this paper, we propose a novel semantic-based approach that classifies Android malware via dependency graphs. To battle transformation attacks, we extract a weighted contextual API dependency graph as program semantics to …
Stopwatch: A Cloud Architecture For Timing Channel Mitigation, Peng Li, Debin Gao, Michael K Reiter
Stopwatch: A Cloud Architecture For Timing Channel Mitigation, Peng Li, Debin Gao, Michael K Reiter
Research Collection School Of Computing and Information Systems
This article presents StopWatch, a system that defends against timing-based side-channel attacks that arise from coresidency of victims and attackers in infrastructure-as-a-service clouds. StopWatch triplicates each cloud-resident guest virtual machine (VM) and places replicas so that the three replicas of a guest VM are coresident with nonoverlapping sets of (replicas of) other VMs. StopWatch uses the timing of I/O events at a VM’s replicas collectively to determine the timings observed by each one or by an external observer, so that observable timing behaviors are similarly likely in the absence of any other individual, coresident VMs. We detail the design and …
Web Application Vulnerability Prediction Using Hybrid Program Analysis And Machine Learning, Lwin Khin Shar, Lionel Briand, Hee Beng Kuan Tan
Web Application Vulnerability Prediction Using Hybrid Program Analysis And Machine Learning, Lwin Khin Shar, Lionel Briand, Hee Beng Kuan Tan
Research Collection School Of Computing and Information Systems
Due to limited time and resources, web software engineers need support in identifying vulnerable code. A practical approach to predicting vulnerable code would enable them to prioritize security auditing efforts. In this paper, we propose using a set of hybrid (staticþdynamic) code attributes that characterize input validation and input sanitization code patterns and are expected to be significant indicators of web application vulnerabilities. Because static and dynamic program analyses complement each other, both techniques are used to extract the proposed attributes in an accurate and scalable way. Current vulnerability prediction techniques rely on the availability of data labeled with vulnerability …
Attribute-Based Signing Right Delegation, Weiwei Liu, Yi Mu, Guomin Yang
Attribute-Based Signing Right Delegation, Weiwei Liu, Yi Mu, Guomin Yang
Research Collection School Of Computing and Information Systems
Attribute-based signature and proxy signature are both very useful in many real-world applications. In this paper, we combine the special features of both signatures and propose an attribute-based proxy signature scheme, where the original signer, who possesses a set of attributes, can delegate his/her signing right to a designated proxy signer. By verifying the signature, a verifier can be convinced that the signature is generated by the proxy signer who has obtained the delegation from a legitimate signer whose attributes satisfy a predicate. However, the verifier cannot tell from the signature who is the original signer. We provide the formal …
Analyzing The Dangers Posed By Chrome Extensions, Lujo Bauer, Shaoying Cai, Limin Jia, Timothy Passaro, Yuan Tian
Analyzing The Dangers Posed By Chrome Extensions, Lujo Bauer, Shaoying Cai, Limin Jia, Timothy Passaro, Yuan Tian
Research Collection School Of Computing and Information Systems
A common characteristic of modern web browsers is that their functionality can be extended via third-party addons. In this paper we focus on Chrome extensions, to which the Chrome browser exports a rich API: extensions can potentially make network requests, access the local file system, get low-level information about running processes, etc. To guard against misuse, Chrome uses a permission system to curtail an extension's privileges. We demonstrate a series of attacks by which extensions can steal data, track user behavior, and collude to elevate their privileges. Although some attacks have previously been reported, we show that subtler versions can …
Lossy Trapdoor Relation And Its Applications To Lossy Encryption And Adaptive Trapdoor Relation, Haiyang Xue, Xianhui Lu, Bao Li, Yamin Liu
Lossy Trapdoor Relation And Its Applications To Lossy Encryption And Adaptive Trapdoor Relation, Haiyang Xue, Xianhui Lu, Bao Li, Yamin Liu
Research Collection School Of Computing and Information Systems
Peikert and Waters proposed the notion of lossy trapdoor function in STOC 2008. In this paper, we propose a relaxation of lossy trapdoor function, called lossy trapdoor relation. Unlike the lossy trapdoor function, lossy trapdoor relation does not require completely recovering the input but a public computable injective map of it. Interestingly, the lossy trapdoor relation maintains the application of lossy trapdoor function on the lossy encryption. Moreover, motivated by the construction of adaptive trapdoor relation proposed by Wee (Crypto 2010), we introduce all-but-one verifiable lossy trapdoor relation which is in fact a relaxation of all-but-one lossy trapdoor function. – …
Verifiable Computation On Outsourced Encrypted Data, Junzuo Lai, Robert H. Deng, Hwee Hwa Pang, Jian Weng
Verifiable Computation On Outsourced Encrypted Data, Junzuo Lai, Robert H. Deng, Hwee Hwa Pang, Jian Weng
Research Collection School Of Computing and Information Systems
On one hand, homomorphic encryption allows a cloud server to perform computation on outsourced encrypted data but provides no verifiability that the computation is correct. On the other hand, homomorphic authenticator, such as homomorphic signature with public verifiability and homomorphic MAC with private verifiability, guarantees authenticity of computation over outsourced data but does not provide data confidentiality. Since cloud servers are usually operated by third-party providers which are almost certain to be outside the trust domain of cloud users, neither homomorphic encryption nor homomorphic authenticator suffices for verifiable computation on outsourced encrypted data in the cloud. In this paper, we …