We give protocols for the secure and private outsourcing of linear algebra computations, that enable a client to securely outsource expensive algebraic computations (like the multiplication of huge matrices) to two remote servers, such that the servers learn nothing about the customer's private input or the result of the computation,and any attempted corruption of the answer by the servers is detected with high probability. The computational work done locally by the client is linear in the size of its input and does not require the client to carry out locally any expensive encryptions of such input.The computational burden on the servers is proportional to the time complexity of the current practically used algorithms for solving the algebraic problem (e.g., proportional to n3 for multiplying two ntimesn matrices). If the servers were to collude against the client,then they would only find out the client's private inputs, but they would not be able to corrupt the answer without detection by the client.
{"title":"Private and Cheating-Free Outsourcing of Algebraic Computations","authors":"David Benjamin, M. Atallah","doi":"10.1109/PST.2008.12","DOIUrl":"https://doi.org/10.1109/PST.2008.12","url":null,"abstract":"We give protocols for the secure and private outsourcing of linear algebra computations, that enable a client to securely outsource expensive algebraic computations (like the multiplication of huge matrices) to two remote servers, such that the servers learn nothing about the customer's private input or the result of the computation,and any attempted corruption of the answer by the servers is detected with high probability. The computational work done locally by the client is linear in the size of its input and does not require the client to carry out locally any expensive encryptions of such input.The computational burden on the servers is proportional to the time complexity of the current practically used algorithms for solving the algebraic problem (e.g., proportional to n3 for multiplying two ntimesn matrices). If the servers were to collude against the client,then they would only find out the client's private inputs, but they would not be able to corrupt the answer without detection by the client.","PeriodicalId":422934,"journal":{"name":"2008 Sixth Annual Conference on Privacy, Security and Trust","volume":"5 7","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132536469","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Canadian government bodies are subject to a number of requirements, including legislation, regulations,directives and policies, that speaks to informational privacy. These have come to be considered synonymous with the completion of a Privacy Impact Assessment. Some go so far as to specifically require an assessment, but few speak to specific technical content. Nor are there process requirements for sustaining privacy standards once the assessment document is submitted. At best, recommendations are identified to enhance the privacy posture of a program area's information management practices, but there is no mechanism to ensure that they are implemented. We propose the PIA process be adapted to mandate privacy outcomes in terms of specific actions that must betaken once the assessment is complete. Starting with the established PIA document, the program area can identify how to best marry the privacy requirements with the established business processes supporting the service delivery line. The result would incorporate privacy outcomes as ongoing activities and include not only consideration of agency requirements for personal information management, but also the impact to an individual's informational privacy.
{"title":"Incorporating Privacy Outcomes: Teaching an Old Dog New Tricks","authors":"E. Brown, T. A. Kosa","doi":"10.1109/PST.2008.27","DOIUrl":"https://doi.org/10.1109/PST.2008.27","url":null,"abstract":"Canadian government bodies are subject to a number of requirements, including legislation, regulations,directives and policies, that speaks to informational privacy. These have come to be considered synonymous with the completion of a Privacy Impact Assessment. Some go so far as to specifically require an assessment, but few speak to specific technical content. Nor are there process requirements for sustaining privacy standards once the assessment document is submitted. At best, recommendations are identified to enhance the privacy posture of a program area's information management practices, but there is no mechanism to ensure that they are implemented. We propose the PIA process be adapted to mandate privacy outcomes in terms of specific actions that must betaken once the assessment is complete. Starting with the established PIA document, the program area can identify how to best marry the privacy requirements with the established business processes supporting the service delivery line. The result would incorporate privacy outcomes as ongoing activities and include not only consideration of agency requirements for personal information management, but also the impact to an individual's informational privacy.","PeriodicalId":422934,"journal":{"name":"2008 Sixth Annual Conference on Privacy, Security and Trust","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114644775","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
To enable a rich attribute-based authorization system, it is desirable that a large number of user attributes are available, possibly provided by multiple entities. The user may be required to aggregate his attributes and present them to a service provider to prove he has the right to access some service. In this paper, we present AttributeTrust - a policy-based privacy enhanced framework for aggregating user attributes and evaluating confidence in these attributes. We envision a future where attribute providers will be commonplace and service providers will face the problem of choosing one among multiple attribute providers that can provide the same user attribute. In AttributeTrust, we address this problem by means of a reputation system model based on transitive trust. Entities express confidence in other entities to supply trusted attributes, forming chains from a service provider to different attribute providers. A service provider uses this transitive reputation to decide whether to accept a particular attribute from a specific attribute provider.We discuss how the AttributeTrust model prevents common attacks on reputation systems. AttributeTrust differs from the current approaches by deriving its attack resistance from its specific context of attribute provisioning, its voting mechanism formulation, and unique properties of its confidence relationships.
{"title":"AttributeTrust A Framework for Evaluating Trust in Aggregated Attributes via a Reputation System","authors":"A. Mohan, D. Blough","doi":"10.1109/PST.2008.28","DOIUrl":"https://doi.org/10.1109/PST.2008.28","url":null,"abstract":"To enable a rich attribute-based authorization system, it is desirable that a large number of user attributes are available, possibly provided by multiple entities. The user may be required to aggregate his attributes and present them to a service provider to prove he has the right to access some service. In this paper, we present AttributeTrust - a policy-based privacy enhanced framework for aggregating user attributes and evaluating confidence in these attributes. We envision a future where attribute providers will be commonplace and service providers will face the problem of choosing one among multiple attribute providers that can provide the same user attribute. In AttributeTrust, we address this problem by means of a reputation system model based on transitive trust. Entities express confidence in other entities to supply trusted attributes, forming chains from a service provider to different attribute providers. A service provider uses this transitive reputation to decide whether to accept a particular attribute from a specific attribute provider.We discuss how the AttributeTrust model prevents common attacks on reputation systems. AttributeTrust differs from the current approaches by deriving its attack resistance from its specific context of attribute provisioning, its voting mechanism formulation, and unique properties of its confidence relationships.","PeriodicalId":422934,"journal":{"name":"2008 Sixth Annual Conference on Privacy, Security and Trust","volume":"58 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124815005","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
One of the key issues with the practical applicability of Proof-Carrying Code (PCC) and its related methods is the difficulty in communicating and storing the proofs which are inherently large. The approaches proposed to alleviate this, suffer from drawbacks of their own especially the enlargement of the trusted computing base, in which any bug may cause an unsafe program to be accepted. We propose a generic extended PCC framework (EPCC) in which, instead of the proof, a proof generator for the program in question is transmitted. This framework enables the execution of the proof generator and the recovery of the proof on the consumer side in a secure manner.
{"title":"Encoding the Program Correctness Proofs as Programs in PCC Technology","authors":"Heidar Pirzadeh, Danny Dubé","doi":"10.1109/PST.2008.20","DOIUrl":"https://doi.org/10.1109/PST.2008.20","url":null,"abstract":"One of the key issues with the practical applicability of Proof-Carrying Code (PCC) and its related methods is the difficulty in communicating and storing the proofs which are inherently large. The approaches proposed to alleviate this, suffer from drawbacks of their own especially the enlargement of the trusted computing base, in which any bug may cause an unsafe program to be accepted. We propose a generic extended PCC framework (EPCC) in which, instead of the proof, a proof generator for the program in question is transmitted. This framework enables the execution of the proof generator and the recovery of the proof on the consumer side in a secure manner.","PeriodicalId":422934,"journal":{"name":"2008 Sixth Annual Conference on Privacy, Security and Trust","volume":"358 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134292396","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
In previous works, we proposed a routing approach where nodes in a wireless sensor network (WSN) rely on trusted neighbors and neighborspsila reputation to dynamically select the best route to the destination. In this paper, we extend these previous works by adding mobile nodes to the WSN and investigating how the movements of nodes in a mobile WSN affect the success rate of routing data from a source to a destination. We also implement hostile nodes to test how our route selection and reputation mechanisms cope in their presence.
{"title":"An Efficient Reputation-Based Routing Mechanism for Wireless Sensor Networks: Testing the Impact of Mobility and Hostile Nodes","authors":"N. Lewis, N. Foukia","doi":"10.1109/PST.2008.31","DOIUrl":"https://doi.org/10.1109/PST.2008.31","url":null,"abstract":"In previous works, we proposed a routing approach where nodes in a wireless sensor network (WSN) rely on trusted neighbors and neighborspsila reputation to dynamically select the best route to the destination. In this paper, we extend these previous works by adding mobile nodes to the WSN and investigating how the movements of nodes in a mobile WSN affect the success rate of routing data from a source to a destination. We also implement hostile nodes to test how our route selection and reputation mechanisms cope in their presence.","PeriodicalId":422934,"journal":{"name":"2008 Sixth Annual Conference on Privacy, Security and Trust","volume":"353 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132313653","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：