Firewalls are effective in preventing attacks initiated from outside of an organization’s network, but they are vulnerable to external threats, e.g. ransomware attacks may expose sensitive firewall data to malicious entities or disable network protection from the firewall. In this paper, we present Obliv-FW: a novel distributed architecture and a suite of protocols to obliviously manage and evaluate firewall rules and policies to prevent external attacks oriented to the firewall data. Obliv-FW alleviates this issue by obfuscating the blacklist or whitelist and distributing the function of evaluating these lists across multiple servers residing in different access control zones of the organization’s internal network. Thus, both accessing and altering the rules are considerably more difficult thereby providing better protection to the local network as well as greater security for the firewall itself. Obliv-FW is developed by leveraging the existing secure multi-party computation techniques. Our empirical results show that the overhead of Obliv-FW is small, and it can be a very valuable tool to mitigate the ever-increasing threats to a private network from external attacks including ransomware attacks.

With the continuous advancement of sensing, networking, controlling, and computing technologies, there is a growing number of IoT (Internet of Things) devices emerging that are expected to integrate into public infrastructure in the near future. However, the deployment of these smart devices in public venues presents new challenges for existing access control mechanisms, particularly in terms of efficiency. To address these challenges, we have developed a highly efficient and scalable access control mechanism that enables automatic and fine-grained access control management while incurring low overhead in large-scale settings. Our mechanism includes a dual-hierarchy access control structure and associated information retrieval algorithms, which we have used to develop a large-scale IoT device access control system called FACT+. FACT+ overcomes the efficiency issues of granting and inquiring access control status over millions of devices in pervasive environments. Additionally, our system offers a pay-and-consume scheme and plug-and-play device management for convenient adoption by service providers. We have conducted extensive experiments to demonstrate the practicality, effectiveness, and efficiency of our access control mechanism.

The widespread use of smart mobile devices has resulted in a massive accumulation of trajectory data by service providers. The analysis of human trajectories, particularly semantic location information, has opened up avenues for discovering common social behavior and enhancing social connections, leading to a range of applications such as friend recommendations and product suggestions. However, the exponential growth of trajectory information generated every day presents significant challenges for existing trajectory analysis algorithms, which are no longer capable of delivering timely analysis results. To address this issue, we propose a highly efficient algorithm that can recommend social communities for new users in real time by leveraging knowledge gained from large-scale semantic trajectories. Specifically, we develop a novel two-branch deep neural network model that extracts semantic meanings at different levels of granularity from human trajectories and uncovers the hidden relationship between trajectories and social communities. We then utilize this model to perform instant social community recommendations. Our experimental results have demonstrated that our approach is not only significantly faster than traditional trajectory analysis algorithms in terms of social community recommendation, but also preserves high prediction accuracy with F1-score above 97%.

Anonymous communication, that is secure end-to-end and unlinkable, plays a critical role in protecting user privacy by preventing service providers from using message metadata to discover communication links between any two users. Techniques, such as Mix-net, DC-net, time delay, cover traffic, Secure Multiparty Computation (SMC) and Private Information Retrieval, can be used to achieve anonymous communication. SMC-based approach generally offers stronger simulation based security guarantee. In this paper, we propose a simple and novel SMC approach to establishing anonymous communication, easily implementable with two non-colluding servers which have only communication and storage related capabilities. Our approach offers stronger security guarantee against malicious adversaries without incurring a great deal of extra computation. To show its practicality, we implemented our solutions using Chameleon Cloud to simulate the interactions among a million users, and extensive simulations were conducted to show message latency with various group sizes. Our approach is efficient for smaller group sizes and sub-group communication while preserving message integrity. Also, it does not have the message collision problem.

With the advances in autonomous vehicles and intelligent intersection management systems, traffic lights may be replaced by optimal travel plans calculated for each passing vehicle in the future. While these technological advancements are envisioned to greatly improve travel efficiency, they are still facing various challenging security hurdles since even a single deviation of a vehicle from its assigned travel plan could cause a serious accident if the surrounding vehicles do not take necessary actions in a timely manner. In this paper, we propose a novel security mechanism namely NWADE which can be integrated into existing autonomous intersection management systems to help detect malicious vehicle behavior and generate evacuation plans. In the NWADE mechanism, we introduce the neighborhood watch concept whereby each vehicle around the intersection will serve as a watcher to report or verify the abnormal behavior of any nearby vehicle and the intersection manager. We propose a blockchain-based verification framework to guarantee the integrity and trustworthiness of the individual travel plans optimized for the entire intersection. We have conducted extensive experimental studies on various traffic scenarios, and the experimental results demonstrate the practicality, effectiveness, and efficiency of our mechanism.

Summary Online argumentation systems enable stakeholders to post their problems under consideration and solution alternatives and to exchange arguments over the alternatives posted in an argumentation tree. In an argumentation process, stakeholders have their own opinions, which very often contrast and conflict with opinions of others. Some of these opinions may be outliers with respect to the mean group opinion. This paper presents a method for identifying stakeholders with outlier opinions in an argumentation process. It detects outlier opinions on the basis of individual stakeholder's opinions, as well as collective opinions on them from other stakeholders. Decision makers and other participants in an argumentation process therefore have an opportunity to explore the outlier opinions within their groups from both individual and group perspectives. In a large argumentation tree, it is often difficult to identify stakeholders with outlier opinions manually. The system presented in this paper identifies them automatically. Experiments are presented to evaluate the proposed method. Their results show that the method detects outlier opinions in an online argumentation process effectively.

Information retrieval (IR) plays an essential role in daily life. However, currently deployed IR technologies, e.g., Apache Lucene – open-source search software, are insufficient when the information is protected or deemed to be private. For example, submitting a query to a publicly available search engine (e.g., Bing or Google) requires disclosing potentially delicate facts (e.g., thoughts about abortion), as well as the websites the user considers interesting. Similarly, when a private database contains sensitive information needed by the user, it cannot be searched freely. Over the past decade, various approaches, generally referred to as private information retrieval, have been proposed to obfuscate queries and responses, but they are limited in that the retrieved information is inadequate to compute relevancy. To address such limitations, this article introduces the necessary techniques to build Lucene-P$^2$that allows one party to discover whether a second party harbors any relevant textual information without either party disclosing any information.

Many real-time systems are safety-critical, where reliability is crucial. Under traditional scheduling mechanism, the execution patterns of the tasks on such system can be easily derived from side-channel attacks, such that attackers can launch short high-priority tasks at critical instants which may cause deadline miss for high-critical tasks. In order to protect the system from such kind of attacks, this paper proposes the roulette wheel scheduler (RWS) to randomize the task execution pattern. Under RWS, probabilities will be assigned to each task at predefined scheduling points, and the choice for execution is randomized, such that the execution pattern is no longer fixed. We formalize the concept of schedule entropy the additional safety provided by any randomized scheduler. It is used to measure the amount of uncertainty introduced by the new scheduler.

Vehicular Ad-hoc Networks (VANETs) are formed by a huge number of vehicles which act as the network nodes and communicate with one another. This emerging paradigm has opened up new business opportunities and enables numerous applications ranging from road safety enhancement to mobile entertainment. A fundamental issue that impacts the successful deployment of VANET applications is the security and privacy concerns raised by VANET users. However, it is a challenging task to authenticate vehicles while fully preserving their privacy. In this work, we propose a novel privacy-preserving randomized authentication protocol that leverages Homomorphic encryption to allow each individual vehicle to self-generate any number of authenticated identities to achieve full anonymity in VANETs. The proposed protocol prevents vehicles from being tracked by any single party including peer vehicles, service providers, authentication servers, and other infrastructure. Meanwhile, our protocol also provides traceability in case of any dispute. We have conducted both security analysis and experimental study which demonstrates the superiority of our protocol compared to other existing works.

With the prevalence of smartphones, mobile apps have become more and more popular. However, many mobile apps request location information of the user. If there is nothing in place for location privacy, these mobile app users are in great risk of being tracked by malicious parties. Although the location privacy problem has been studied extensively by resorting to a third-party location anonymizer, there is very little work that allows the users to fully control the disclosure of their data using their smartphones alone. In this paper, we propose a novel Android App called MoveWithMe which automatically generates mocking locations. Most importantly, these mocking locations are not random like those generated by original Android location mocking function. The proposed MoveWithMe app generates k traces of mocking locations and ensures that each trace looks like a trace of a real human and each trace is semantically different from the real user's trace.

The Jaccard Coefficient, as an information similarity measure, has wide variety of applications, such as cluster analysis and image segmentation. Due to the concerns of personal privacy, the Jaccard Coefficient cannot be computed directly between two independently owned datasets. The problem, secure computation of the Jaccard Coefficient for multisets (SJCM), considers the situation where two parties want to securely compute the random shares of the Jaccard Coefficient between their multisets. During the process, the content of each party's multiset is not disclosed to the other party and also the value of Jaccard Coefficient should be hidden from both parties. Secure computation of multiset intersection cardinality is an important sub-problem of SJCM. Existing methods when applied to solve such a problem can lead to either insecure or inefficient solutions. Our work addresses this gap. We first present a basic SJCM protocol constructed using the existing secure dot product method as a sub-routine. Then, as a major contribution, we propose an approximated version of our basic protocol to improve efficiency without compromising accuracy much. We provide various experimental results to show that the proposed protocols are significantly more efficient than the existing techniques when the domain size is small using both simulated and real datasets.

Data Mining has wide applications in many areas such as banking, medicine, scientific research and among government agencies. Classification is one of the commonly used tasks in data mining applications. For the past decade, due to the rise of various privacy issues, many theoretical and practical solutions to the classification problem have been proposed under different security models. However, with the recent popularity of cloud computing, users now have the opportunity to outsource their data, in encrypted form, as well as the data mining tasks to the cloud. Since the data on the cloud is in encrypted form, existing privacy-preserving classification techniques are not applicable. In this paper, we focus on solving the classification problem over encrypted data. In particular, we propose a secure k-NN classifier over encrypted data in the cloud. The proposed protocol protects the confidentiality of data, privacy of user's input query, and hides the data access patterns. To the best of our knowledge, our work is the first to develop a secure k-NN classifier over encrypted data under the semi-honest model. Also, we empirically analyze the efficiency of our proposed protocol using a real-world dataset under different parameter settings.

Biometric authentication, a key component for many secure protocols and applications, is a process of authenticating a user by matching her biometric data against a biometric database stored at a server managed by an entity. If there is a match, the user can log into her account or obtain the services provided by the entity. Privacy-preserving biometric authentication (PPBA) considers a situation where the biometric data are kept private during the authentication process. That is the user's biometric data record is never disclosed to the entity, and the data stored in the entity's biometric database are never disclosed to the user. Due to the reduction in operational costs and high computing power, it is beneficial for an entity to outsource not only its data but also computations such as biometric authentication process to a cloud. However, due to well-documented security risks faced by a cloud, sensitive data like biometrics should be encrypted first and then outsourced to the cloud. When the biometric data are encrypted and cannot be decrypted by the cloud, the existing PPBA protocols are not applicable. Therefore, in this paper, we propose a two-party PPBA protocol when the biometric data in consideration are fully encrypted and outsourced to a cloud. In the proposed protocol, the security of the biometric data is completely protected since the encrypted biometric data are never decrypted during the authentication process. In addition, we formally analyze the security of the proposed protocol and provide extensive empirical results to show its runtime complexity.

For the past decade, query processing on relational data has been studied extensively, and many theoretical and practical solutions to query processing have been proposed under various scenarios. With the recent popularity of cloud computing, users now have the opportunity to outsource their data as well as the data management tasks to the cloud. However, due to the rise of various privacy issues, sensitive data (e.g., medical records) need to be encrypted before outsourcing to the cloud. In addition, query processing tasks should be handled by the cloud; otherwise, there would be no point to outsource the data at the first place. To process queries over encrypted data without the cloud ever decrypting the data is a very challenging task. In this paper, we focus on solving the k-nearest neighbor (kNN) query problem over encrypted database outsourced to a cloud: a user issues an encrypted query record to the cloud, and the cloud returns the k closest records to the user. We first present a basic scheme and demonstrate that such a naive solution is not secure. To provide better security, we propose a secure kNN protocol that protects the confidentiality of the data, user's input query, and data access patterns. Also, we empirically analyze the efficiency of our protocols through various experiments. These results indicate that our secure protocol is very efficient on the user end, and this lightweight scheme allows a user to use any mobile device to perform the kNN query.

We are experiencing the expanding use of location-based services such as AT&T’s TeleNav GPS Navigator and Intel’s Thing Finder. Existing location-based services have collected a large amount of location data, which has great potential for statistical usage in applications like traffic flow analysis, infrastructure planning, and advertisement dissemination. The key challenge is how to wisely use the data without violating each user’s location privacy concerns. In this article, we first identify a new privacy problem, namely, the inference-route problem, and then present our anonymization algorithms for privacy-preserving trajectory publishing. The experimental results have demonstrated that our approach outperforms the latest related work in terms of both efficiency and effectiveness.

With the growing popularity of data and service outsourcing, where the data resides on remote servers in encrypted form, there remain open questions about what kind of query operations can be performed on the encrypted data. In this paper, we focus on one such important query operation, namely range query. One of the basic security primitive that can be used to evaluate range queries is secure comparison of encrypted integers. However, the existing secure comparison protocols strongly rely on the encrypted bit-wise representations rather than on pure encrypted integers. Therefore, in this paper, we first propose an efficient method for converting an encrypted integer z into encryptions of the individual bits of z. We then utilize the proposed security primitive to construct a new protocol for secure evaluation of range queries in the cloud computing environment. Furthermore, we empirically show the efficiency gains of using our security primitive over existing method under the range query application.

Many secure data analysis tasks, such as secure clustering and classification, require efficient mechanisms to convert the intermediate encrypted integers into the corresponding encryptions of bits. The existing bit-decomposition algorithms either do not offer sufficient security or are computationally inefficient. In order to provide better security as well as to improve efficiency, we propose a novel probabilistic-based secure bit-decomposition protocol for values encrypted using public key additive homomorphic encryption schemes. The proposed protocol guarantees security as per the semi-honest security definition of secure multi-party computation (MPC) and is also very efficient compared to the existing method. Our protocol always returns the correct result, however, it is probabilistic in the sense that the correct result can be generated in the first run itself with very high probability. The computation time of the proposed protocol grows linearly with the input domain size in bits. We theoretically analyze the complexity of the proposed protocol with the existing method in detail.

Wireless sensor networks (WSNs) have wide range of applications in military, health-monitoring, smart-home applications, and in other commercial environments. The computation of data aggregation functions like MIN/MAX is one of the commonly used tasks in many such WSN applications. However, due to privacy issues in some of these applications, the individual sensor readings should be kept secret from others. That is, the base station should be the only entity who should receive the output of MIN/MAX function and the individual sensor readings should not be revealed either to other sensor nodes or to the root node for confidentiality reasons. Existing Secure Data Aggregation (SDA) techniques for computing MIN/MAX are based on either order preserving or privacy homomorphic encryption schemes which are either inefficient or insecure. Along this direction, this paper proposes two novel solutions for securely computing MIN/MAX functions in WSNs using probabilistic encryption scheme. The first solution works for WSNs with no duplicate sensor readings whereas the second solution acts as a generic method and works even for duplicate readings but is less efficient compared to the first method. However, the second solution is much more secure compared to the existing protocols. The security of the proposed protocols is justified based on the well known quadratic residuosity assumption. We empirically analyze the efficiency of our schemes and demonstrate the advantages of the proposed protocols over existing approaches.

In many cases, competing parties who have private data may collaboratively conduct privacy-preserving distributed data analysis (PPDA) tasks to learn beneficial data models or analysis results. Most often, the competing parties have different incentives. Although certain PPDA techniques guarantee that nothing other than the final analysis result is revealed, it is impossible to verify whether participating parties are truthful about their private input data. Unless proper incentives are set, current PPDA techniques cannot prevent participating parties from modifying their private inputs.incentive compatible privacy-preserving data analysis techniques This raises the question of how to design incentive compatible privacy-preserving data analysis techniques that motivate participating parties to provide truthful inputs. In this paper, we first develop key theorems, then base on these theorems, we analyze certain important privacy-preserving data analysis tasks that could be conducted in a way that telling the truth is the best choice for any participating party.

The emerging growth of online social networks have opened new doors for various business applications such as promoting a new product across its customers. Besides this, friend recommendation is an important tool for recommending potential candidates as friends to users in order to enhance the development of the entire network structure. Existing friend recommendation methods utilize social network structure and/or user profile information. However, these techniques can no longer be applicable if the privacy of users is taken into consideration. In this paper, we propose a two-phase private friend recommendation protocol for recommending friends to a given target user based on the network structure as well as utilizing the real message interaction between users. Our protocol computes the recommendation scores of all users who are within a radius of h from the target user in a privacy preserving manner. In addition, we show the practical applicability of our approach through empirical analysis.

Oblivious Transfer (OT) is an important cryptographic tool, which has found its usage in many crypto protocols, such as Secure Multiparty Computations, Certified E-mail and Simultaneous Contract Signing . In this paper, we propose three k-out-of-n OT (OT_k^n) protocols based on additive homomorphic encryption. Two of these protocols prohibit malicious behaviors from a receiver. We also achieve efficient communication complexity bounded by O(l* n) in bits, where l is the size of the encryption key. The computational complexity is comparable to the most efficient existing protocols. Due to the semantic security property, the sender cannot get receiver's selection. When the receiver tries to retrieve more than k values, the receiver is caught cheating with 1-(1/m) probability (Protocol II) or the receiver is unable to get any value at all (Protocol III). We introduce a novel technique based on the solvability of linear equations, which could find its way into other applications. We also provide an experimental analysis to compare the efficiency of the protocols.

Suppose Alice owns a k-anonymous database and needs to determine whether her database, when inserted with a tuple owned by Bob, is still k-anonymous. Also, suppose that access to the database is strictly controlled, because for example data are used for certain experiments that need to be maintained confidential. Clearly, allowing Alice to directly read the contents of the tuple breaks the privacy of Bob (e.g., a patient's medical record); on the other hand, the confidentiality of the database managed by Alice is violated once Bob has access to the contents of the database. Thus, the problem is to check whether the database inserted with the tuple is still k-anonymous, without letting Alice and Bob know the contents of the tuple and the database, respectively. In this paper, we propose two protocols solving this problem on suppression-based and generalization-based k-anonymous and confidential databases. The protocols rely on well-known cryptographic assumptions, and we provide theoretical analyses to proof their soundness and experimental results to illustrate their efficiency.

Similar document detection plays important roles in many applications, such as file management, copyright protection, and plagiarism prevention. Existing protocols assume that the contents of files stored on a server (or multiple servers) are directly accessible. This assumption limits more practical applications, e.g., detecting plagiarized documents between two conferences, where submissions are confidential. We propose novel protocols to detect similar documents between two entities where documents cannot be openly shared with each other. We also conduct experiments to show the practical value of the proposed protocols.

Alice, owner of a k-anonymous database, needs to determine whether her database, when inserted with a tuple owned by Bob, is still k-anonymous. Suppose that Bob is not allowed to access to the database because of data confidentiality and that Alice is not allowed to read Bob's tuple due to Bob's privacy concern. Under these assumptions, this paper proposes two protocols to check whether the database inserted with a tuple is still k-anonymous, without letting Alice and Bob know the contents of the tuple and the database respectively.

To support large-scale biomedical research projects, organizations need to share person-specific genomic sequences without violating the privacy of their data subjects. In the past, organizations protected subjects' identities by removing identifiers, such as name and social security number; however, recent investigations illustrate that deidentified genomic data can be "reidentified" to named individuals using simple automated methods. In this paper, we present a novel cryptographic framework that enables organizations to support genomic data mining without disclosing the raw genomic sequences. Organizations contribute encrypted genomic sequence records into a centralized repository, where the administrator can perform queries, such as frequency counts, without decrypting the data. We evaluate the efficiency of our framework with existing databases of single nucleotide polymorphism (SNP) sequences and demonstrate that the time needed to complete count queries is feasible for real world applications. For example, our experiments indicate that a count query over 40 SNPs in a database of 5000 records can be completed in approximately 30 min with off-the-shelf technology. We further show that approximation strategies can be applied to significantly speed up query execution times with minimal loss in accuracy. The framework can be implemented on top of existing information and network technologies in biomedical environments.

The secure multi-party computation (SMC) model provides means for balancing the use and confidentiality of distributed data. Increasing security concerns have led to a surge in work on practical secure multi-party computation protocols. However, most are only proven secure under the semi-honest model, and security under this adversary model is insufficient for most applications in the field of privacy-preserving data mining. In this paper, we present the full spectrum of the accountable computing (AC) framework, which is sufficient or practical for many applications without the complexity and cost of an SMC-protocol under the malicious model. Furthermore, to show the applicability of the AC-framework, we present an application under this framework regarding privacy-preserving mining frequent itemsets.

Many information sources contain information that can only be accessed through search-specific search engines. Federated search provides search solutions of this type of hidden information that cannot be searched by conventional search engines. In many scenarios of federated search, such as the search among health care providers or among intelligence agencies, an individual information source does not want to disclose the source of the search results to users or other sources. Therefore, this paper proposes a two-step federated search protocol that protects the privacy of information sources. As far as we know, this is the first attempt to address the research problem of protecting source privacy in federated text search.

Privacy-preserving data mining is an important area that studies privacy issues of data mining. When the goal is to share data mining results, two privacy-related problems may arise. The first one is how to compute the data-mining results among several parties without sharing the data. Cryptography-based primitives are the basic tool used to develop ad-hoc secure multi-party computation protocols that share information as less as possible during the computation under different adversary models. The second one is how to produce data mining results that provably do not contain threats to the anonymity of individuals. The concept of k-anonymity has been used to discover anonymity-preserving frequent patterns, and centralized algorithms have been developed. In this paper and for the first time, we study how to produce anonymity-preserving data mining results in a distributed environment. We present two privacy-preserving strategies and show their feasibility through experimental analysis.

Transportation and logistics are a major sector of the economy, however data analysis in this domain has remained largely in the province of optimization. The potential of data mining and knowledge discovery techniques is largely untapped. Transportation networks are naturally represented as graphs. This paper explores the problems in mining of transportation network graphs: we hope to find how current techniques both succeed and fail on this problem, and from the failures, we hope to present new challenges for data mining. Experimental results from applying both existing graph mining and conventional data mining techniques to real transportation network data are provided, including new approaches to making these techniques applicable to the problems. Reasons why these techniques are not appropriate are discussed. We also suggest several challenging problems to precipitate research and galvanize future work in this area.