首页 > 最新文献

Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...最新文献

英文 中文
Constraint-enhanced role engineering via answer set programming 基于答案集规划的约束增强角色工程
Jinwei Hu, K. Khan, Y. Bai, Yan Zhang
Role engineering (RE) aims to develop and maintain appropriate role-based access control (RBAC) configurations. However, RE with constraints in place is not well-studied. Constraints usually describe organizations' security and business requirements. An inconsistency between configurations and constraints compromises security and availability, as it may authorize otherwise forbidden access and deprive users of due privileges. In this paper, we apply answer set programming (ASP) to discover RBAC configurations that comply with constraints and meet various optimization objectives. We first formulate the need of supporting constraints as a problem independent of and complementary to existing RE problems. We then present a flexible framework for translating the proposed problem to ASP programs. In this way, the problem can be addressed via ASP solvers. Finally, we demonstrate the effectiveness and efficiency of our approach through experimental results.
角色工程(RE)旨在开发和维护适当的基于角色的访问控制(RBAC)配置。然而,有约束的RE并没有得到很好的研究。约束通常描述组织的安全和业务需求。配置和约束之间的不一致会损害安全性和可用性,因为它可能会授权禁止的访问,并剥夺用户应有的特权。在本文中,我们应用答案集规划(ASP)来发现符合约束和满足各种优化目标的RBAC配置。我们首先将支持约束的需求表述为一个独立于现有可再生能源问题并与之互补的问题。然后,我们提出了一个灵活的框架,将提出的问题转换为ASP程序。这样,问题就可以通过ASP求解器来解决。最后,通过实验结果验证了该方法的有效性和高效性。
{"title":"Constraint-enhanced role engineering via answer set programming","authors":"Jinwei Hu, K. Khan, Y. Bai, Yan Zhang","doi":"10.1145/2414456.2414499","DOIUrl":"https://doi.org/10.1145/2414456.2414499","url":null,"abstract":"Role engineering (RE) aims to develop and maintain appropriate role-based access control (RBAC) configurations. However, RE with constraints in place is not well-studied. Constraints usually describe organizations' security and business requirements. An inconsistency between configurations and constraints compromises security and availability, as it may authorize otherwise forbidden access and deprive users of due privileges. In this paper, we apply answer set programming (ASP) to discover RBAC configurations that comply with constraints and meet various optimization objectives. We first formulate the need of supporting constraints as a problem independent of and complementary to existing RE problems. We then present a flexible framework for translating the proposed problem to ASP programs. In this way, the problem can be addressed via ASP solvers. Finally, we demonstrate the effectiveness and efficiency of our approach through experimental results.","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"11 1","pages":"73-74"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"90045997","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
Discovering records of private VoIP calls without wiretapping 发现没有窃听的私人VoIP通话记录
C. Jong, V. Gligor
Call-record analysis is one of the oldest tools used in defense, law-enforcement, and business intelligence. For example, the NSA collected over 1.9 trillion call records between 2001 and 2004 [1]. A call-record database allows both single link (e.g., time, initiation, frequency of a call) and cluster analysis of calls in the temporal, spatial, and frequency domains. It can also indicate overlaps among different clusters, such as those obtained from different investigations, and similarity of clusters, such as those obtained when a group of targets changes their phone numbers but not their communication habits [10, 12].
通话记录分析是用于国防、执法和商业智能的最古老的工具之一。例如,美国国家安全局在2001年至2004年间收集了超过1.9万亿个通话记录。呼叫记录数据库允许单链接(例如,呼叫的时间、起始、频率)和在时间、空间和频率域对呼叫进行聚类分析。它还可以表明不同聚类之间的重叠,例如通过不同的调查获得的聚类,以及聚类的相似性,例如当一组目标改变了他们的电话号码而不改变他们的通信习惯时获得的聚类[10,12]。
{"title":"Discovering records of private VoIP calls without wiretapping","authors":"C. Jong, V. Gligor","doi":"10.1145/2414456.2414495","DOIUrl":"https://doi.org/10.1145/2414456.2414495","url":null,"abstract":"Call-record analysis is one of the oldest tools used in defense, law-enforcement, and business intelligence. For example, the NSA collected over 1.9 trillion call records between 2001 and 2004 [1]. A call-record database allows both single link (e.g., time, initiation, frequency of a call) and cluster analysis of calls in the temporal, spatial, and frequency domains. It can also indicate overlaps among different clusters, such as those obtained from different investigations, and similarity of clusters, such as those obtained when a group of targets changes their phone numbers but not their communication habits [10, 12].","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"19 1","pages":"67-68"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"75588800","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Memoirs of a browser: a cross-browser detection model for privacy-breaching extensions 浏览器回忆录:一种针对隐私泄露扩展的跨浏览器检测模型
Cristiano Giuffrida, Stefano Ortolani, B. Crispo
Web browsers are undoubtedly one of the most popular user applications. This is even more evident in recent times, with Google introducing a platform where the browser is the only application provided to the user. With their modular and extensible architecture, modern browsers are also an appealing platforms for third-party software developers, who can easily publish new extensions to extend any standard web browser functionality. Extendability is a crucial feature that makes web browsers a very attractive service platform. From a security perspective, however, extensions opened up new opportunities for attacks. Most extensions do not require any special privilege to be installed, despite their ability to access all the user private data. Delegating the decision about extension's security to trusted parties is not a conclusive solution, given that privacy-breaching behavior has been found even in store-approved extensions [1].
Web浏览器无疑是最流行的用户应用程序之一。最近,随着谷歌推出一个平台,浏览器是提供给用户的唯一应用程序,这一点更加明显。由于其模块化和可扩展的架构,现代浏览器对于第三方软件开发人员来说也是一个很有吸引力的平台,他们可以很容易地发布新的扩展来扩展任何标准的web浏览器功能。可扩展性是使web浏览器成为一个非常有吸引力的服务平台的关键特性。然而,从安全角度来看,扩展为攻击提供了新的机会。大多数扩展不需要安装任何特殊权限,尽管它们能够访问所有用户私有数据。考虑到即使在商店批准的扩展中也发现了侵犯隐私的行为,将扩展安全性的决定权委托给受信任的各方并不是一个决定性的解决方案[1]。
{"title":"Memoirs of a browser: a cross-browser detection model for privacy-breaching extensions","authors":"Cristiano Giuffrida, Stefano Ortolani, B. Crispo","doi":"10.1145/2414456.2414461","DOIUrl":"https://doi.org/10.1145/2414456.2414461","url":null,"abstract":"Web browsers are undoubtedly one of the most popular user applications. This is even more evident in recent times, with Google introducing a platform where the browser is the only application provided to the user. With their modular and extensible architecture, modern browsers are also an appealing platforms for third-party software developers, who can easily publish new extensions to extend any standard web browser functionality. Extendability is a crucial feature that makes web browsers a very attractive service platform. From a security perspective, however, extensions opened up new opportunities for attacks. Most extensions do not require any special privilege to be installed, despite their ability to access all the user private data. Delegating the decision about extension's security to trusted parties is not a conclusive solution, given that privacy-breaching behavior has been found even in store-approved extensions [1].","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"108 1","pages":"10-11"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74374854","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
CloudER: a framework for automatic software vulnerability location and patching in the cloud CloudER:用于在云中自动定位和修补软件漏洞的框架
Ping Chen, Dongyan Xu, Bing Mao
In a virtualization-based cloud infrastructure, customers of the cloud deploy virtual machines (VMs) with their own applications and customized runtime environments. The cloud provider supports the execution of these VMs without detailed knowledge of the guest applications and operating systems in the VMs. In addition to elastic resource provisioning for the VMs, a desirable "value-added" service the cloud provider can provide is the emergency response to runtime incidences of software bugs and vulnerabilities. The challenge is to facilitate the automatic runtime detection, location, and patching of the software vulnerability -- outside the VMs and without the source code. In this paper, we present CloudER, a cloud "emergency room" architecture that automatically detect, locate, and patch software vulnerabilities in cloud application binaries at runtime. CloudER leverages an existing taint-based system (Demand Emulation) for runtime anomaly detection, employs new algorithms for software vulnerability location and patch generation, and adapts a virtual machine introspection system (XenAccess) for dynamic patching. Our preliminary evaluation experiments with a number of real-world server applications show that CloudER achieves timely response to runtime software faults or attacks from outside the VMs. The main contributions of this paper are highlighted as follows: (1) CloudER is an integrated architecture that improves the runtime reliability of cloud applications. It covers the full life cycle of exploit detection, culprit instruction location, patch generation and application, and execution state recording and reset -- all performed from outside the protected VM and without the source code of the applications. (2) While leveraging existing techniques for taint-based exploit detection, CloudER involves new methods for culprit instruction location and binary patch generation. The methods cover some of the most common types of software vulnerabilities and the patches generated are of small size (tens of bytes). (3) CloudER incurs reasonable performance overhead to the application in comparison with running the application in an unprotected VM. The interruption to the production VM's execution (for culprit instruction location and patch generation) is less than half a minute in our experiments with real-world applications.
在基于虚拟化的云基础设施中,云客户使用自己的应用程序和定制的运行时环境部署虚拟机(vm)。云提供商支持这些虚拟机的执行,而不需要详细了解虚拟机中的客户机应用程序和操作系统。除了为虚拟机提供弹性资源外,云提供商还可以提供一个理想的“增值”服务,即对运行时软件错误和漏洞的紧急响应。挑战在于促进软件漏洞的自动运行时检测、定位和修补——在虚拟机之外,没有源代码。在本文中,我们介绍了CloudER,这是一种云“急诊室”架构,可以在运行时自动检测、定位和修补云应用程序二进制文件中的软件漏洞。CloudER利用现有的基于污点的系统(Demand Emulation)进行运行时异常检测,采用新算法进行软件漏洞定位和补丁生成,并采用虚拟机自省系统(XenAccess)进行动态补丁。我们对许多实际服务器应用程序的初步评估实验表明,CloudER能够及时响应运行时软件故障或来自虚拟机外部的攻击。本文的主要贡献如下:(1)CloudER是一个提高云应用运行时可靠性的集成架构。它涵盖了漏洞检测、罪魁祸首指令定位、补丁生成和应用程序以及执行状态记录和重置的整个生命周期——所有这些都是从受保护的VM外部执行的,不需要应用程序的源代码。(2)在利用现有的基于污染的漏洞检测技术的同时,CloudER涉及到罪犯指令定位和二进制补丁生成的新方法。这些方法涵盖了一些最常见的软件漏洞类型,并且生成的补丁很小(几十字节)。(3)与在未受保护的VM中运行应用程序相比,CloudER会对应用程序产生合理的性能开销。在我们对实际应用程序的实验中,对生产VM执行的中断(用于错误指令定位和补丁生成)不到半分钟。
{"title":"CloudER: a framework for automatic software vulnerability location and patching in the cloud","authors":"Ping Chen, Dongyan Xu, Bing Mao","doi":"10.1145/2414456.2414485","DOIUrl":"https://doi.org/10.1145/2414456.2414485","url":null,"abstract":"In a virtualization-based cloud infrastructure, customers of the cloud deploy virtual machines (VMs) with their own applications and customized runtime environments. The cloud provider supports the execution of these VMs without detailed knowledge of the guest applications and operating systems in the VMs. In addition to elastic resource provisioning for the VMs, a desirable \"value-added\" service the cloud provider can provide is the emergency response to runtime incidences of software bugs and vulnerabilities. The challenge is to facilitate the automatic runtime detection, location, and patching of the software vulnerability -- outside the VMs and without the source code. In this paper, we present CloudER, a cloud \"emergency room\" architecture that automatically detect, locate, and patch software vulnerabilities in cloud application binaries at runtime. CloudER leverages an existing taint-based system (Demand Emulation) for runtime anomaly detection, employs new algorithms for software vulnerability location and patch generation, and adapts a virtual machine introspection system (XenAccess) for dynamic patching. Our preliminary evaluation experiments with a number of real-world server applications show that CloudER achieves timely response to runtime software faults or attacks from outside the VMs. The main contributions of this paper are highlighted as follows: (1) CloudER is an integrated architecture that improves the runtime reliability of cloud applications. It covers the full life cycle of exploit detection, culprit instruction location, patch generation and application, and execution state recording and reset -- all performed from outside the protected VM and without the source code of the applications. (2) While leveraging existing techniques for taint-based exploit detection, CloudER involves new methods for culprit instruction location and binary patch generation. The methods cover some of the most common types of software vulnerabilities and the patches generated are of small size (tens of bytes). (3) CloudER incurs reasonable performance overhead to the application in comparison with running the application in an unprotected VM. The interruption to the production VM's execution (for culprit instruction location and patch generation) is less than half a minute in our experiments with real-world applications.","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"19 1","pages":"50"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"89897709","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
FlashOver: automated discovery of cross-site scripting vulnerabilities in rich internet applications flashhover:自动发现富互联网应用程序中的跨站点脚本漏洞
S. Acker, Nick Nikiforakis, Lieven Desmet, W. Joosen, F. Piessens
The last fifteen years have transformed the Web in ways that would seem unimaginable to anyone of the "few" Internet users of the year 1995 [8]. What began as a simple set of protocols and mechanisms facilitating the exchange of static documents between remote computers is now an everyday part of billions' of users life, technical and non-technical alike. The sum of a user's daily experience is composed of open standards, such as HTML, JavaScript and Cascading Style Sheets as well as proprietary plugins, such as Adobe's Flash [1] and Microsoft's Silverlight [6].
过去的15年已经改变了网络,其方式对于1995年“少数”互联网用户中的任何人来说似乎都是不可想象的[8]。一开始只是一套简单的协议和机制,促进远程计算机之间的静态文档交换,现在已经成为数十亿用户日常生活的一部分,无论是技术上的还是非技术上的。用户日常体验的总和是由开放标准(如HTML、JavaScript和Cascading Style Sheets)以及专有插件(如Adobe的Flash[1]和微软的Silverlight[6])组成的。
{"title":"FlashOver: automated discovery of cross-site scripting vulnerabilities in rich internet applications","authors":"S. Acker, Nick Nikiforakis, Lieven Desmet, W. Joosen, F. Piessens","doi":"10.1145/2414456.2414462","DOIUrl":"https://doi.org/10.1145/2414456.2414462","url":null,"abstract":"The last fifteen years have transformed the Web in ways that would seem unimaginable to anyone of the \"few\" Internet users of the year 1995 [8]. What began as a simple set of protocols and mechanisms facilitating the exchange of static documents between remote computers is now an everyday part of billions' of users life, technical and non-technical alike. The sum of a user's daily experience is composed of open standards, such as HTML, JavaScript and Cascading Style Sheets as well as proprietary plugins, such as Adobe's Flash [1] and Microsoft's Silverlight [6].","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"3 1","pages":"12-13"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"79483739","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 43
Integrity walls: finding attack surfaces from mandatory access control policies 完整性墙:从强制访问控制策略中查找攻击面
H. Vijayakumar, Guruprasad Jakka, S. Rueda, Joshua Schiffman, T. Jaeger
Protecting host system integrity in the face of determined adversaries remains a major problem. Despite advances in program development and access control, attackers continue to compromise systems forcing security practitioners to regularly react to such breaches. While security practitioners may eventually learn which entry points in programs must be defended over a software's lifetime, new software and configuration options are frequently introduced, opening additional vulnerabilities to adversaries. The application developers' problem is to identify the program entry points accessible to adversaries and provide necessary defenses at these entry points before the adversaries use these to compromise the program. Unfortunately, this is a race that developers often lose. While some program vulnerable entry points are well-known (mostly network), the complexity of host systems makes it difficult to prevent local exploits should attackers gain control of any unprivileged processing. The question we explore in this paper is whether the program entry points accessible to adversaries can be found proactively, so defenses at these entry points can also be developed proactively.
在面对确定的对手时保护主机系统的完整性仍然是一个主要问题。尽管在程序开发和访问控制方面取得了进展,但攻击者继续危害系统,迫使安全从业人员定期对此类破坏作出反应。虽然安全从业人员可能最终会了解在软件的生命周期内必须保护程序中的哪些入口点,但经常会引入新的软件和配置选项,从而为对手打开额外的漏洞。应用程序开发人员的问题是确定攻击者可以访问的程序入口点,并在攻击者使用这些入口点危害程序之前在这些入口点提供必要的防御。不幸的是,这是一场开发者经常输掉的竞赛。虽然一些程序易受攻击的入口点是众所周知的(主要是网络),但如果攻击者获得对任何非特权处理的控制,主机系统的复杂性使得很难阻止本地漏洞利用。我们在本文中探讨的问题是,是否可以主动发现攻击者可以访问的程序入口点,因此这些入口点的防御也可以主动开发。
{"title":"Integrity walls: finding attack surfaces from mandatory access control policies","authors":"H. Vijayakumar, Guruprasad Jakka, S. Rueda, Joshua Schiffman, T. Jaeger","doi":"10.1145/2414456.2414500","DOIUrl":"https://doi.org/10.1145/2414456.2414500","url":null,"abstract":"Protecting host system integrity in the face of determined adversaries remains a major problem. Despite advances in program development and access control, attackers continue to compromise systems forcing security practitioners to regularly react to such breaches. While security practitioners may eventually learn which entry points in programs must be defended over a software's lifetime, new software and configuration options are frequently introduced, opening additional vulnerabilities to adversaries. The application developers' problem is to identify the program entry points accessible to adversaries and provide necessary defenses at these entry points before the adversaries use these to compromise the program. Unfortunately, this is a race that developers often lose. While some program vulnerable entry points are well-known (mostly network), the complexity of host systems makes it difficult to prevent local exploits should attackers gain control of any unprivileged processing. The question we explore in this paper is whether the program entry points accessible to adversaries can be found proactively, so defenses at these entry points can also be developed proactively.","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"1 1","pages":"75-76"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"89610967","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 44
Coercion resistance in authentication responsibility shifting 认证责任转移中的强制阻力
Payas Gupta, Xuhua Ding, Debin Gao
To meet the demand of scalability and usability, many real-world authentication systems have adopted the idea of responsibility shifting, explicitly or implicitly, where a user's responsibility of authentication is shifted to another entity, usually in case of failure of the primary authentication method. One example of responsibility shifting is in the fourth-factor authentication [1] whereby a user gets the crucial authentication assistance from a helper who takes over the responsibility. In the fourth-factor authentication system [1], subverting/coercing the helper (trustee) allows the adversary to log in without capturing the password of the user.
为了满足可扩展性和可用性的需求,许多现实世界的身份验证系统都采用了责任转移的思想,或显式或隐式地将用户的身份验证责任转移给另一个实体,通常是在主要身份验证方法失败的情况下。责任转移的一个例子是第四因素身份验证[1],其中用户从承担责任的助手那里获得关键的身份验证协助。在四因素身份验证系统[1]中,颠覆/强迫助手(受托人)允许攻击者在不获取用户密码的情况下登录。
{"title":"Coercion resistance in authentication responsibility shifting","authors":"Payas Gupta, Xuhua Ding, Debin Gao","doi":"10.1145/2414456.2414512","DOIUrl":"https://doi.org/10.1145/2414456.2414512","url":null,"abstract":"To meet the demand of scalability and usability, many real-world authentication systems have adopted the idea of responsibility shifting, explicitly or implicitly, where a user's responsibility of authentication is shifted to another entity, usually in case of failure of the primary authentication method. One example of responsibility shifting is in the fourth-factor authentication [1] whereby a user gets the crucial authentication assistance from a helper who takes over the responsibility. In the fourth-factor authentication system [1], subverting/coercing the helper (trustee) allows the adversary to log in without capturing the password of the user.","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"26 1","pages":"97-98"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"80255043","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Expressive CP-ABE with partially hidden access structures 部分隐藏访问结构的表达性CP-ABE
Junzuo Lai, R. Deng, Yingjiu Li
At Eurocrypt 2005, Sahai and Waters [7] introduced the concept of attribute-based encryption (ABE). ABE enables public key based one-to-many encryption and is envisioned as a promising cryptographic primitive for realizing scalable and fine-grained access control systems. There are two kinds of ABE schemes [1], key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE) schemes. This paper, our concern is on the latter.
在2005年的Eurocrypt会议上,Sahai和Waters提出了基于属性的加密(ABE)的概念。ABE支持基于一对多的公钥加密,并被设想为实现可扩展和细粒度访问控制系统的有前途的加密原语。[1]有两种ABE方案,密钥策略ABE (KP-ABE)和密文策略ABE (CP-ABE)方案。本文关注的是后者。
{"title":"Expressive CP-ABE with partially hidden access structures","authors":"Junzuo Lai, R. Deng, Yingjiu Li","doi":"10.1145/2414456.2414465","DOIUrl":"https://doi.org/10.1145/2414456.2414465","url":null,"abstract":"At Eurocrypt 2005, Sahai and Waters [7] introduced the concept of attribute-based encryption (ABE). ABE enables public key based one-to-many encryption and is envisioned as a promising cryptographic primitive for realizing scalable and fine-grained access control systems. There are two kinds of ABE schemes [1], key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE) schemes. This paper, our concern is on the latter.","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"40 1","pages":"18-19"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74033172","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 156
Privacy-preserving alibi systems 保护隐私的不在场证明系统
Benjamin Davis, Hao Chen, M. Franklin
An alibi provides evidence of a person's past location and can be critical in proving ones innocence. An alibi involves two parties: the owner, who benefits from the alibi, and the corroborator, who testifies for the owner. As mobile devices become ubiquitous, they can determine where we are and what we are doing, and help us to establish evidence of our location as they accompany us on our daily activities. Existing location-based services like Google Latitude can already track and record our every move, but these systems require us to reveal our identity when recording our location. This leaves our privacy at risk, and requires a trusted third party to maintain our location information.
不在场证明提供了一个人过去去过的地方的证据,对证明一个人的清白至关重要。不在场证明涉及两方:从不在场证明中获益的所有者,以及为所有者作证的确证人。随着移动设备变得无处不在,它们可以确定我们在哪里,我们在做什么,并在我们的日常活动中陪伴我们,帮助我们建立我们位置的证据。现有的基于位置的服务,如谷歌纬度,已经可以跟踪和记录我们的一举一动,但这些系统在记录我们的位置时要求我们透露自己的身份。这将使我们的隐私处于危险之中,并且需要可信的第三方来维护我们的位置信息。
{"title":"Privacy-preserving alibi systems","authors":"Benjamin Davis, Hao Chen, M. Franklin","doi":"10.1145/2414456.2414475","DOIUrl":"https://doi.org/10.1145/2414456.2414475","url":null,"abstract":"An alibi provides evidence of a person's past location and can be critical in proving ones innocence. An alibi involves two parties: the owner, who benefits from the alibi, and the corroborator, who testifies for the owner. As mobile devices become ubiquitous, they can determine where we are and what we are doing, and help us to establish evidence of our location as they accompany us on our daily activities. Existing location-based services like Google Latitude can already track and record our every move, but these systems require us to reveal our identity when recording our location. This leaves our privacy at risk, and requires a trusted third party to maintain our location information.","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"27 1","pages":"34-35"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74436203","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 41
CL-PRE: a certificateless proxy re-encryption scheme for secure data sharing with public cloud CL-PRE:一种无证书代理重加密方案,用于与公共云安全共享数据
Lei Xu, Xiaoxin Wu, Xinwen Zhang
We propose CL-PRE, a certificateless proxy re-encryption scheme for secure data sharing with public cloud, which leverages maximal cloud resources to reduce the computing and communication cost for data owner. Towards running proxy in public cloud environment, we further propose multi-proxy CL-PRE and randomized CL-PRE, which enhance the security and robustness of CL-PRE. We implement all CL-PRE schemes and evaluate their security and performance.
我们提出了一种无证书代理重加密方案CL-PRE,用于与公共云的安全数据共享,最大限度地利用云资源,降低数据所有者的计算和通信成本。针对在公共云环境下运行代理,我们进一步提出了多代理的CL-PRE和随机化的CL-PRE,增强了CL-PRE的安全性和鲁棒性。我们实现了所有CL-PRE方案,并评估了它们的安全性和性能。
{"title":"CL-PRE: a certificateless proxy re-encryption scheme for secure data sharing with public cloud","authors":"Lei Xu, Xiaoxin Wu, Xinwen Zhang","doi":"10.1145/2414456.2414507","DOIUrl":"https://doi.org/10.1145/2414456.2414507","url":null,"abstract":"We propose CL-PRE, a certificateless proxy re-encryption scheme for secure data sharing with public cloud, which leverages maximal cloud resources to reduce the computing and communication cost for data owner. Towards running proxy in public cloud environment, we further propose multi-proxy CL-PRE and randomized CL-PRE, which enhance the security and robustness of CL-PRE. We implement all CL-PRE schemes and evaluate their security and performance.","PeriodicalId":72308,"journal":{"name":"Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...","volume":"49 1","pages":"87-88"},"PeriodicalIF":0.0,"publicationDate":"2012-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"72894945","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 157
期刊
Asia CCS '22 : proceedings of the 2022 ACM Asia Conference on Computer and Communications Security : May 30-June 3, 2022, Nagasaki, Japan. ACM Asia Conference on Computer and Communications Security (17th : 2022 : Nagasaki-shi, Japan ; ...
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1