The task of infectious disease contact tracing is crucial yet challenging, especially when meeting strict privacy requirements. Previous attempts in this area have had limitations in terms of applicable scenarios and efficiency. Our paper proposes a highly scalable, practical contact tracing system called PREVENT that can work with a variety of location collection methods to gain a comprehensive overview of a person's trajectory while ensuring the privacy of individuals being tracked, without revealing their plain text locations to any party, including servers. Our system is very efficient and can provide real-time query services for large-scale datasets with millions of locations. This is made possible by a newly designed secret-sharing based architecture that is tightly integrated into unique private space partitioning trees. Notably, our experimental results on both real and synthetic datasets demonstrate that our system introduces negligible performance overhead compared to traditional contact tracing methods. PREVENT could be a game-changer in the fight against infectious diseases and set a new standard for privacy-preserving location tracking.

Recent advances in generative artificial intelligence have enabled the creation of highly realistic synthetic voices which raises a series of new security concerns. These include the spread of fake audio on social media and social engineering attacks using cloned voices of family members in phone calls. State-of-the-art fake voice detectors rely on large-scale deep neural networks such as transformer models, making them resource-intensive and less accessible to everyday users. In this work, we propose TrueEar, the first lightweight fake voice detector of its kind. TrueEar is over 1000 times smaller than latest detectors, yet it achieves up to 99 % accuracy. Built on a newly designed compact architecture, TrueEar is optimized for mobile platforms and can be easily deployed as an app to help users verify the authenticity of incoming calls or online audio. We have conducted extensive experiments on iOS devices to demonstrate the efficiency and effectiveness of our solution.

As voice authentication technology becomes more prevalent, its security flaws and vulnerabilities are garnering increasing scrutiny. State-of-the-art deep neural network (DNN) systems for voice authentication can achieve an accuracy of over 95%. However, DNN-based models are known to be vulnerable to attacks such as adversarial examples and data poisoning. An adversary may also take advantage of the limited generalization of current DNN-based models to circumvent the system, only requiring authentic voices to impersonate others. In this paper, we leverage a data poisoning attack and two voice authentication models to investigate the vulnerability and corresponding impacts on individual user and system security. We introduce a new toolkit, the Voice Authentication Poisoning Impact Evaluator (VAPIE), incorporating conventional machine learning and VGG-based models. VAPIE is designed to predict the potential impacts of various data poisoning scenarios launched by different attack-ers and to evaluate overall system security, achieving an accuracy rate of over 70 %. This facilitates a deeper understanding and mitigation of the risks associated with voice authentication technologies.

Traffic congestion not only wastes valuable time but also exacerbates greenhouse gas emissions. We envision a future city where smart traffic management systems are capable of eliminating traffic jams entirely through coordinated traffic planning, with connected autonomous vehicles interleaving each other without collisions. The state-of-the-art automatic traffic plannings focus on improving traffic throughput of single intersections, however, these approaches may not be optimal for multiple intersections. To the best of our knowledge, there is currently no algorithm addressing large-scale irregular multi-intersection road networks for overall traffic optimization. In this work, we propose UrbanTrafficNet, one of the first AI assisted large-scale traffic management plan generation mechanism. The UrbanTrafficNet employs a unique algorithm to encode dynamic vehicle status and complex road network across multiple intersections. This information is then fed into novel deep learning-based models which generate detailed traffic plans for individual vehicles. The UrbanTrafficNet is universally applicable to any complicated layouts of urban road networks and achieves near-maximum traffic throughput. Compared to traditional traffic light scheduling, UrbanTrafficNet reduces stop-and-go percentages by up to 80%, resulting in smoother traffic flow and decrease in greenhouse gas emissions. Extensive real-world experiments validate the effectiveness and efficiency of our proposed system, showcasing its practicality in addressing traffic congestion and environmental concerns.

Voice authentication is a biometric technique that uses unique vocal characteristics to verify identity, providing an alternative to traditional security methods like passwords and PINs. Despite achieving accuracy rates up to 95%, current authentication systems face challenges due to their complexity and vulnerability to errors caused by similar voice profiles, which can lead to unauthorized access. Unlike static authentication methods, voice attributes vary significantly, making it difficult to accurately differentiate between users. In this paper we introduce VocalTrust, a novel ensemble learning approach to enhance voice authentication. By integrating eight voice authentication models and employing advanced techniques such as score and embedding fusion with SVM and ResNet architectures, VocalTrust reduces impostures by over 87% compared to individual models and achieves a 63% improvement over traditional ensemble methods, all while being more time and resource-efficient.

The widespread use of family tracing apps has highlighted the need for effective location privacy protection. Unfortunately, current solutions fail to provide stringent privacy protection or are computationally expensive, making them unsuitable for real-time services. In this paper, we propose a highly efficient system architecture that supports three common types of location-sharing queries (i.e., point queries, range queries, and k nearest neighbor queries) with strict privacy protection. The proposed design is based on the envisioned future collaborations between two social media platforms. One platform manages location privacy policies, while the other facilitates location collection and sharing requests. Our main contributions involve two new privacy-preserving query protocols. One is a highly efficient, generic secure comparison protocol for range queries. The other is a novel kNN query protocol that eliminates the need for computationally expensive secure sorting in existing solutions, thus offering unparalleled performance without compromising security. The paper provides a formal and rigorous security analysis of the proposed solutions using the Universally Composable framework. We also conduct extensive experiments that demonstrate that our approach is more than an order of magnitude faster than existing solutions.

Firewalls are effective in preventing attacks initiated from outside of an organization’s network, but they are vulnerable to external threats, e.g. ransomware attacks may expose sensitive firewall data to malicious entities or disable network protection from the firewall. In this paper, we present Obliv-FW: a novel distributed architecture and a suite of protocols to obliviously manage and evaluate firewall rules and policies to prevent external attacks oriented to the firewall data. Obliv-FW alleviates this issue by obfuscating the blacklist or whitelist and distributing the function of evaluating these lists across multiple servers residing in different access control zones of the organization’s internal network. Thus, both accessing and altering the rules are considerably more difficult thereby providing better protection to the local network as well as greater security for the firewall itself. Obliv-FW is developed by leveraging the existing secure multi-party computation techniques. Our empirical results show that the overhead of Obliv-FW is small, and it can be a very valuable tool to mitigate the ever-increasing threats to a private network from external attacks including ransomware attacks.

With the continuous advancement of sensing, networking, controlling, and computing technologies, there is a growing number of IoT (Internet of Things) devices emerging that are expected to integrate into public infrastructure in the near future. However, the deployment of these smart devices in public venues presents new challenges for existing access control mechanisms, particularly in terms of efficiency. To address these challenges, we have developed a highly efficient and scalable access control mechanism that enables automatic and fine-grained access control management while incurring low overhead in large-scale settings. Our mechanism includes a dual-hierarchy access control structure and associated information retrieval algorithms, which we have used to develop a large-scale IoT device access control system called FACT+. FACT+ overcomes the efficiency issues of granting and inquiring access control status over millions of devices in pervasive environments. Additionally, our system offers a pay-and-consume scheme and plug-and-play device management for convenient adoption by service providers. We have conducted extensive experiments to demonstrate the practicality, effectiveness, and efficiency of our access control mechanism.

In light of the growing prevalence of location-based applications, a substantial amount of location data has been accumulated, facilitating various services and research endeavors such as traffic flow analysis, identification of similar movement patterns, and detection of social circles. This surge in data usage has, however, prompted heightened concerns about location privacy among users. Our work aims to fortify users' location privacy without compromising the advantages brought by location-based services. Specifically, we propose an innovative deep learning model called GeoGRCNN which is capable of generating synthetic trajectories indistinguishable from real human trajectories. Such synthetic trajectories can then be mixed with real human trajectories to serve as decoys that prevent users from being profiled by the service provider. Our model seamlessly combines Graph Convolutional Networks(GCN) and Recurrent Neural Networks(RNN) to faithfully replicate authentic movement patterns within urban environments. Our evaluation focuses on measuring the spatial accuracy of these trajectories and their conformity to actual road networks. The experimental results demonstrate that our model effectively replicates actual urban layouts with minimal deviations from road networks. We achieve trajectory generation accuracy of 95.06 % for Beijing and 97.37% for Atlanta.

Users frequently struggle to decipher privacy policies, facing challenges due to the legalese often present in privacy policies, leaving trust and comprehension shrouded in ambiguity. This study dives into the transformative power of language, exploring how different linguistic tones can bridge the gap between legal, technical jargon, and genuine user engagement-through a comparative analysis involving diverse focus groups, immersing them in three distinct policy variations: legalistic, casual, and empathetic. We explored how these tones reshape the user experience and bridge the gap between legal discourse and comprehension. Analysis of the data revealed significant associations between linguistic tone and user trust and comprehension. The adoption of an empathetic tone significantly enhanced user trust, as evidenced by a 40.4% increase compared to alternative language styles. This preference highlights the human desire for genuine connection, even in the intricate domain of data privacy. Furthermore, comprehension indices arise for both empathetic and casual tones, leaving legalistic language lagging far behind. This suggests a clear path towards user-friendly policies, where clarity exceeds complexity. Our exploration goes beyond mere compliance. We illustrate the complex gap between subtle linguistic shifts and user perception. By deciphering the language that resonates with trust and understanding, We plant the seeds for the development of privacy policies that not only meet legal requirements but also enhance user trust and comprehension.

With the advances in deep learning, speaker verification has achieved very high accuracy and is gaining popularity as a type of biometric authentication option in many scenes of our daily life, especially the growing market of web services. Compared to traditional passwords, “vocal passwords” are much more convenient as they relieve people from memorizing different passwords. However, new machine learning attacks are putting these voice authentication systems at risk. Without a strong security guarantee, attackers could access legitimate users' web accounts by fooling the deep neural network (DNN) based voice recognition models. In this paper, we demonstrate an easy-to-implement data poisoning attack to the voice authentication system, which cannot be captured effectively by existing defense mechanisms. Thus, we also propose a more robust defense method called Guardian, a convolutional neural network-based discriminator. The Guardian discriminator integrates a series of novel techniques including bias reduction, input augmentation, and ensemble learning. Our approach is able to distinguish about 95% of attacked accounts from normal accounts, which is much more effective than existing approaches with only 60% accuracy.

Ransomware attacks have become widespread in the last few years and have affected many critical industries and infrastructures. Unfortunately, there are no recovery tools that can effectively defend against all types of ransomware. Approaches, such as frequent data backups, have several drawbacks. They are expensive in terms of resources and trained technical staff. Therefore, it is much more challenging and cost-consuming for average users and small business owners to survive ransomware attacks. To provide an easy-to-use tool for a broader population of users and businesses, we propose a novel ransomware defense mechanism that can be conveniently deployed in modern Windows systems which have over 76% market share as of 2022. The uniqueness of our approach is to fight malware like malware. We leverage Alternate Data Streams, which are sometimes used by malicious applications, to design and implement a data protection method that misleads the ransomware into attacking only file “shells” instead of the actual file content. We have evaluated our approach against different cryptographic ransomware. The results show that our approach is usable, efficient, and effective.

The widespread use of smart mobile devices has resulted in a massive accumulation of trajectory data by service providers. The analysis of human trajectories, particularly semantic location information, has opened up avenues for discovering common social behavior and enhancing social connections, leading to a range of applications such as friend recommendations and product suggestions. However, the exponential growth of trajectory information generated every day presents significant challenges for existing trajectory analysis algorithms, which are no longer capable of delivering timely analysis results. To address this issue, we propose a highly efficient algorithm that can recommend social communities for new users in real time by leveraging knowledge gained from large-scale semantic trajectories. Specifically, we develop a novel two-branch deep neural network model that extracts semantic meanings at different levels of granularity from human trajectories and uncovers the hidden relationship between trajectories and social communities. We then utilize this model to perform instant social community recommendations. Our experimental results have demonstrated that our approach is not only significantly faster than traditional trajectory analysis algorithms in terms of social community recommendation, but also preserves high prediction accuracy with F1-score above 97%.

Most existing image privacy protection works focus mainly on the privacy of photo owners and their friends, but lack the consideration of other people who are in the background of the photos and the related location privacy issues. In fact, when a person is in the background of someone else’s photos, he/she may be unintentionally exposed to the public when the photo owner shares the photo online. Not only a single visited place could be exposed, attackers may also be able to piece together a person’s travel route from images. In this article, we propose a novel image privacy protection system, called LAMP, which aims to light up the location awareness for people during online image sharing. The LAMP system is based on a newly designed location-aware multi-party image access control model. Unlike previous works on small scales, the LAMP system is highly efficient and scalable as it can enforce privacy protection for billions of users on social networks in real time. The LAMP system automatically detects the user’s occurrences on photos regardless the user is the photo owner or not. Once a user is identified and the location of the photo is deemed sensitive according to the user’s privacy policy, the user’s face will be replaced with a synthetic face. A prototype of the system was implemented and evaluated to demonstrate its applicability in the real world.

Waiting in a long queue at traffic lights not only wastes valuable time but also pollutes the environment. With the advances in autonomous vehicles and 5G networks, the previous jamming scenarios at intersections may be turned into non-stop weaving traffic flows. Toward this vision, we propose a highly efficient traffic planning system, namely DASHX, which enables connected autonomous vehicles to cross multi-way intersections without a stop. Specifically, DASHX has a comprehensive model to represent intersections and vehicle status. It can constantly process large volumes of vehicle information, resolve scheduling conflicts, and generate optimal travel plans for all vehicles coming toward the intersection in real time. Unlike existing works that are limited to certain types of intersections and lack considerations of practicability, DASHX is universal for any type of 3D intersection and yields the near-maximum throughput while still ensuring riding comfort. To better evaluate the effectiveness of traffic scheduling systems in real-world scenarios, we developed a sophisticated open source 3D traffic simulation platform (DASHX-SIM) that can handle complicated 3D road layouts and simulate vehicles’ networking and decision-making processes. We have conducted extensive experiments, and the experimental results demonstrate the practicality, effectiveness, and efficiency of the DASHX system and the simulator.

In today's society, location-based services are widely used which collect a huge amount of human trajectories. Analyzing semantic meanings of these trajectories can benefit numerous real-world applications, such as product advertisement, friend recommendation, and social behavior analysis. However, existing works on semantic trajectories are mostly centralized approaches that are not able to keep up with the rapidly growing trajectory collections. In this paper, we propose a novel large-scale semantic trajectory analysis algorithm in Apache Spark. We design a new hash function along with efficient distributed algorithms that can quickly compute semantic trajectory similarities and identify communities of people with similar behavior across the world. The experimental results show that our approach is more than 30 times faster than centralized approaches without sacrificing any accuracy like other parallel approaches.

Anonymous communication, that is secure end-to-end and unlinkable, plays a critical role in protecting user privacy by preventing service providers from using message metadata to discover communication links between any two users. Techniques, such as Mix-net, DC-net, time delay, cover traffic, Secure Multiparty Computation (SMC) and Private Information Retrieval, can be used to achieve anonymous communication. SMC-based approach generally offers stronger simulation based security guarantee. In this paper, we propose a simple and novel SMC approach to establishing anonymous communication, easily implementable with two non-colluding servers which have only communication and storage related capabilities. Our approach offers stronger security guarantee against malicious adversaries without incurring a great deal of extra computation. To show its practicality, we implemented our solutions using Chameleon Cloud to simulate the interactions among a million users, and extensive simulations were conducted to show message latency with various group sizes. Our approach is efficient for smaller group sizes and sub-group communication while preserving message integrity. Also, it does not have the message collision problem.

With the advances in autonomous vehicles and intelligent intersection management systems, traffic lights may be replaced by optimal travel plans calculated for each passing vehicle in the future. While these technological advancements are envisioned to greatly improve travel efficiency, they are still facing various challenging security hurdles since even a single deviation of a vehicle from its assigned travel plan could cause a serious accident if the surrounding vehicles do not take necessary actions in a timely manner. In this paper, we propose a novel security mechanism namely NWADE which can be integrated into existing autonomous intersection management systems to help detect malicious vehicle behavior and generate evacuation plans. In the NWADE mechanism, we introduce the neighborhood watch concept whereby each vehicle around the intersection will serve as a watcher to report or verify the abnormal behavior of any nearby vehicle and the intersection manager. We propose a blockchain-based verification framework to guarantee the integrity and trustworthiness of the individual travel plans optimized for the entire intersection. We have conducted extensive experimental studies on various traffic scenarios, and the experimental results demonstrate the practicality, effectiveness, and efficiency of our mechanism.

Facial authentication has become more and more popular on personal devices. Due to the ease of use, it has great potential to be widely deployed for web-service authentication in the near future whereby people can easily log on to online accounts from different devices without memorizing lengthy passwords. However, the growing number of attacks on machine learning especially the Deep Neural Networks (DNN) which is commonly used for facial recognition, imposes big challenges on the successful roll-out of such web-service face authentication. Although there have been studies on defending some machine learning attacks, we are not aware of any specific effort devoted to the web-service facial authentication setting. In this article, we first demonstrate a new data poisoning attack that does not require to have any knowledge of the server-side and just needs a handful of malicious photo injections to enable an attacker to easily impersonate the victim in the existing facial authentication systems. We then propose a novel defensive approach called DEFEAT that leverages deep learning techniques to automatically detect such attacks. We have conducted extensive experiments on real datasets and our experimental results show that our defensive approach achieves more than 90 percent detection accuracy.

Risk patterns are crucial in biomedical research and have served as an important factor in precision health and disease prevention. Despite recent development in parallel and high-performance computing, existing risk pattern mining methods still struggle with problems caused by large-scale datasets, such as redundant candidate generation, inability to discover long significant patterns, and prolonged post pattern filtering. In this article, we propose a novel dynamic tree structure, Risk Hierarchical Pattern Tree (RHPTree), and a top-down search method, RHPSearch, which are capable of efficiently analyzing a large volume of data and overcoming the limitations of previous works. The dynamic nature of the RHPTree avoids costly tree reconstruction for the iterative search process and dataset updates. We also introduce two specialized search methods, the extended target search (RHPSearch-TS) and the parallel search approach (RHPSearch-SD), to further speed up the retrieval of certain items of interest. Experiments on both UCI machine learning datasets and sampled datasets of the Simons Foundation Autism Research Initiative (SFARI)—Simon’s Simplex Collection (SSC) datasets demonstrate that our method is not only faster but also more effective in identifying comprehensive long risk patterns than existing works. Moreover, the proposed new tree structure is generic and applicable to other pattern mining problems.

There has been a prolific rise in the popularity of cloud storage in recent years. While cloud storage offers many advantages such as flexibility and convenience, users are typically unable to tell or control the actual locations of their data. This limitation may affect users' confidence and trust in the storage provider, or even render cloud unsuitable for storing data with strict location requirements. To address this issue, we propose a system called LAST-HDFS which integrates Location-Aware Storage Technique (LAST) into the open source Hadoop Distributed File System (HDFS). The LAST-HDFS system enforces location-aware file allocations and continuously monitors file transfers to detect potentially illegal transfers in the cloud. Illegal transfers here refer to attempts to move sensitive data outside the (“legal”) boundaries specified by the file owner and its policies. Our underlying algorithms model file transfers among nodes as a weighted graph, and maximize the probability of storing data items of similar privacy preferences in the same region. We equip each cloud node with a socket monitor that is capable of monitoring the real-time communication among cloud nodes. Based on the real-time data transfer information captured by the socket monitors, our system calculates the probability of a given transfer to be illegal. We have implemented our proposed framework and carried out an extensive experimental evaluation in a large-scale real cloud environment to demonstrate the effectiveness and efficiency of our proposed system.

Waiting in a long queue at a traffic light has been a common and frustrating experience of the majority of daily commuters, which not only wastes valuable time but also pollutes our environments. With the advances in autonomous vehicles and their collaboration capabilities, the previous jamming intersection has a great potential to be turned into weaving traffic flows that no longer need to stop. Towards this envision, we propose a novel autonomous vehicle traffic coordination system called DASH. Specifically, DASH has a comprehensive model to represent intersections and vehicle status. It can constantly process a large volume of vehicle information of various kinds, resolve scheduling conflicts of all vehicles coming towards the intersection, and generate the optimal travel plan for each individual vehicle in real time to guide vehicles passing intersections in a safe and highly efficient way. Unlike existing works on the autonomous traffic control which are limited to certain types of intersections and lack considerations of practicability, our proposed DASH algorithm is universal for any kind of intersections yields the near-maximum throughput while still ensuring riding comfort that prevents sudden stop and acceleration. We have conducted extensive experiments to evaluate the DASH system in the scenarios of different types of intersections and different traffic flows. Our experimental results demonstrate its practicality, effectiveness, and efficiency.

People constantly share their photographs with others through various social media sites. With the aid of the privacy settings provided by social media sites, image owners can designate scope of sharing, e.g., close friends and acquaintances. However, even if the owner of a photograph carefully sets the privacy setting to exclude a given individual who is not supposed to see the photograph, the photograph may still eventually reach a wider audience, including those clearly undesired through unanticipated channels of disclosure, causing a privacy breach. Moreover, it is often the case that a given image involves multiple stakeholders who are also depicted in the photograph. Due to various personalities, it is even more challenging to reach agreement on the privacy settings for these multi-owner photographs. In this paper, we propose a privacy risk reminder system, called REMIND, which estimates the probability that a shared photograph may be seen by unwanted people-through the social graph-who are not included in the original sharing list. We tackle this problem from a novel angle by digging into the big data regarding image sharing history. Specifically, the social media providers possess a huge amount of image sharing information (e.g., what photographs are shared with whom) of their users. By analyzing and modeling such rich information, we build a sophisticated probability model that efficiently aggregates the image disclosure probabilities along different possible image propagation chains and loops. If the computed disclosure probability indicates high risks of privacy breach, a reminder is issued to the image owner to help revise the privacy settings (or, at least, inform the user about this accidental disclosure risk). The proposed REMIND system also has a nice feature of policy harmonization that helps resolve privacy differences in multi-owner photographs. We have carried out a user study to validate the rationale of our proposed solutions and also conducted experimental studies to evaluate the efficiency of the proposed REMIND system.

With the prevalence of smartphones, mobile websites have been more and more popular. However, many mobile websites collect the location information which greatly increases users' risks of being tracked unexpectedly. The current location access control setting is not sufficient since it cannot prevent the service providers which have been granted location-access permissions from tracking the users. In this paper, we propose a novel location privacy preservation mobile app, called MoveWithMe, which automatically generates decoy queries to hide the real users' locations and intentions when they are using location-based mobile services. Unlike the existing works on dummy trajectories which may be easily discovered by attackers through data analysis, the uniqueness of the MoveWithMe app is that our generated decoys closely behave like real humans. Each decoy in our system has its own moving patterns, daily schedules, and social behaviors, which ensures its movements to be semantically different from the real user's trace and satisfying geographic constraints. Thus, our decoys can hardly be distinguished even by advanced data mining techniques. Another advantage of the MoveWithMe app is that it guarantees the same level of user experience without affecting the response time or introducing extra control burdens. Decoys move independently in the back end and automatically submit queries to the same service provider whenever the user does so. Our proposed MoveWithMe app has both iOS and Android versions and has been tested on different brands of smartphones against various location-based services, such as Yelp and TripAdvisor. Experimental results demonstrate its practicality, effectiveness, and efficiency.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

Autonomous vehicles have the potential to enhance road safety, reduce traffic pressure and improve the driving experience. With the on-board sensors, compute units, storage devices, and communication modules, autonomous vehicles are becoming integrated information systems. Compared to conventional centralized approaches and traditional clouds, the emerging vehicular clouds (v-clouds) technology is a more promising solution for utilizing such rich resources. In v-clouds, vehicles can communicate with one another, form self-organized vehicular ad-hoc networks (VANETs), collect real-time sensing data, conduct intensive computation, and disseminate information. However, the highly dynamic and heterogeneous nature of autonomous vehicles raises many issues when designing v-cloud systems. In this paper, we focus on the challenges in designing v-cloud computing architectures, providing effective routing protocols, securing v-cloud environments and enhancing the dependability of v-clouds. We review the state of the art and discuss open research issues.

With the prevalence of online social networking, a large amount of studies have focused on online users' privacy. Existing work has heavily focused on preventing unauthorized access of one's personal information (e.g. locations, posts and photos). Very little research has been devoted into protecting the friend search engine, a service that allows people to explore others' friend lists. Although most friend search engines only disclose a partial view of one's friend list (e.g., k friends) or offer the ability to show all or no friends, attackers may leverage the combined knowledge from views obtained from different queries to gain a much larger social network of a targeted victim, potentially revealing sensitive information of a victim. In this paper, we propose a new friend search engine, namely FriendGuard, which guarantees the degree of friend exposure as set by users. If a user only allows k of his/her friends to be disclosed, our search engine will ensure that any attempts of discovering more friends of this user through querying the user's other friends will be a failure. The key idea underlying our search engine is the construction of a unique sub social network that is capable of satisfying query needs as well as controlling the degree of friend exposure. We have carried out an extensive experimental study and the results demonstrate both efficiency and effectiveness in our approach.

The expanding cloud computing services offer great opportunities for consumers to find the best service and best pricing. Meanwhile, it also raises new challenges for consumers who need to select the best service out of such a huge pool since it will be time-consuming for consumers to collect the necessary information and analyze all service providers to make the decision. Therefore, in this paper, we propose a novel brokerage-based architecture in the cloud, where the cloud brokers is responsible for the service selection. We also design an efficient indexing structure, called B$^{cloud}$-tree, for managing the information of a large number of cloud service providers. We then develop the service selection algorithm that recommends most suitable cloud services to the cloud consumers. We carry out extensive experimental studies on real and synthetic cloud data, and demonstrate a significant performance improvement over previous approaches.

To configure successful privacy settings for social image sharing, two issues are inseparable: 1) content sensitiveness of the images being shared; and 2) trustworthiness of the users being granted to see the images. This paper aims to consider these two inseparable issues simultaneously to recommend fine-grained privacy settings for social image sharing. For achieving more compact representation of image content sensitiveness (privacy), two approaches are developed: 1) a deep network is adapted to extract 1024-D discriminative deep features; and 2) a deep multiple instance learning algorithm is adopted to identify 280 privacy-sensitive object classes and events. Second, users on the social network are clustered into a set of representative social groups to generate a discriminative dictionary for user trustworthiness characterization. Finally, both the image content sensitiveness and the user trustworthiness are integrated to train a tree classifier to recommend fine-grained privacy settings for social image sharing. Our experimental studies have demonstrated both the efficiency and the effectiveness of our proposed algorithms.

Learning urban community structures refers to the efforts of quantifying, summarizing, and representing an urban community’s (i) static structures, e.g., Point-Of-Interests (POIs) buildings and corresponding geographic allocations, and (ii) dynamic structures, e.g., human mobility patterns among POIs. By learning the community structures, we can better quantitatively represent urban communities and understand their evolutions in the development of cities. This can help us boost commercial activities, enhance public security, foster social interactions, and, ultimately, yield livable, sustainable, and viable environments. However, due to the complex nature of urban systems, it is traditionally challenging to learn the structures of urban communities. To address this problem, in this article, we propose a collective embedding framework to learn the community structure from multiple periodic spatial-temporal graphs of human mobility. Specifically, we first exploit a probabilistic propagation-based approach to create a set of mobility graphs from periodic human mobility records. In these mobility graphs, the static POIs are regarded as vertexes, the dynamic mobility connectivities between POI pairs are regarded as edges, and the edge weights periodically evolve over time. A collective deep auto-encoder method is then developed to collaboratively learn the embeddings of POIs from multiple spatial-temporal mobility graphs. In addition, we develop a Unsupervised Graph based Weighted Aggregation method to align and aggregate the POI embeddings into the representation of the community structures. We apply the proposed embedding framework to two applications (i.e., spotting vibrant communities and predicting housing price return rates) to evaluate the performance of our proposed method. Extensive experimental results on real-world urban communities and human mobility data demonstrate the effectiveness of the proposed collective embedding framework.

There has been a prolific rise in the popularityof cloud storage in recent years. While cloud storage offersmany advantages such as flexibility and convenience, users arenow unable to tell or control the actual locations of their data. This limitation may affect users' confidence and trust in thestorage provider, or even be unsuitable for storing data withstrict location requirements. To address this issue, we proposean illegal file transfer detection framework that constantlymonitors the real-time file transfers in the cloud and is capableof detecting potential illegal transfers which moves sensitivedata outside the ("legal") boundaries specified by the fileowner. The main idea is to classifying multiple users' location preferences when making the data storage arrangement inthe cloud nodes. We model the legal file transfers amongnodes as a weighted graph and then maximize the probabilityof storing data items of similar privacy preferences in thesame region. Then we leverage the socket monitoring functionsprovided by LAST-HDFS (a recent location-aware Hadoop filestorage system) to monitor the real-time communication amongcloud nodes. Based on our legal file transfer graph and thedetected communication, we propose an approach to calculatethe probability of the detected transfer to be illegal.

This paper aims to simultaneously consider two inseparable issues for privacy setting recommendation: (1) sensitiveness of visual content of the images being shared; and (2) trustworthiness of users being granted. First, an object-based approach is developed for image content sensitiveness (privacy) representation. Secondly, the users on a social network are clustered into a set of representative social groups to generate a discriminative dictionary for user trustworthiness characterization. Finally, a tree classifier is trained hierarchically to recommend appropriate privacy settings for image sharing.

Vehicular Ad-hoc Networks (VANETs) are formed by a huge number of vehicles which act as the network nodes and communicate with one another. This emerging paradigm has opened up new business opportunities and enables numerous applications ranging from road safety enhancement to mobile entertainment. A fundamental issue that impacts the successful deployment of VANET applications is the security and privacy concerns raised by VANET users. However, it is a challenging task to authenticate vehicles while fully preserving their privacy. In this work, we propose a novel privacy-preserving randomized authentication protocol that leverages Homomorphic encryption to allow each individual vehicle to self-generate any number of authenticated identities to achieve full anonymity in VANETs. The proposed protocol prevents vehicles from being tracked by any single party including peer vehicles, service providers, authentication servers, and other infrastructure. Meanwhile, our protocol also provides traceability in case of any dispute. We have conducted both security analysis and experimental study which demonstrates the superiority of our protocol compared to other existing works.

Sharing images on social network sites has become a part of daily routine for more and more online users. However, in face of the considerable amount of images shared online, it is not a trivial task for a person to manually configure proper privacy settings for each of the images that he/she uploaded. The lack of proper privacy protection during image sharing could raise many potential privacy breaches of people's private lives that they are not aware of. In this work, we propose a privacy setting recommender system to help people effortlessly set up the privacy settings for their online images. The key idea is developed based on our finding that there are certain correlations between a number of generic patterns of image privacy settings and image tags, regardless of the image owners' individual privacy bias and levels of awareness. We propose a multi-pronged mechanism that carefully analyzes tags' semantics and co-presence to derive a set of suitable privacy settings for a newly uploaded image. Our system is also capable of dealing with cold-start problem when there are very few image tags available. We have conducted extensive experimental studies and the results demonstrate the effectiveness of our approach in terms of the policy recommendation accuracy.

With the prevalence of smartphones, mobile apps have become more and more popular. However, many mobile apps request location information of the user. If there is nothing in place for location privacy, these mobile app users are in great risk of being tracked by malicious parties. Although the location privacy problem has been studied extensively by resorting to a third-party location anonymizer, there is very little work that allows the users to fully control the disclosure of their data using their smartphones alone. In this paper, we propose a novel Android App called MoveWithMe which automatically generates mocking locations. Most importantly, these mocking locations are not random like those generated by original Android location mocking function. The proposed MoveWithMe app generates k traces of mocking locations and ensures that each trace looks like a trace of a real human and each trace is semantically different from the real user's trace.

With the proliferation of location-based services enabled by a large number of mobile devices and applications, the quantity of location data, such as trajectories collected by service providers, is gigantic. If these datasets could be published, they will be valuable assets to various service providers to explore business opportunities, to governments to research commuter behavior for better transport management, and could also greatly benefit the general public for day to day commute. However, there are two major concerns that considerably limit the availability and the usage of these trajectory datasets. The first is the threat to individual privacy as users' trajectories may be tracked by an adversary to discover sensitive information, such as home locations, their children's school locations, or social information like habits or relationships. The other concern is the ability to analyze the exabytes of location data in a timely manner. Although there have been trajectory anonymization approaches proposed in the past to mitigate privacy concerns, none of these prior works address the scalability issue since it is a newly occurring problem. In this paper, we conquer these two challenges by designing a novel trajectory anonymization algorithm using the MapReduce programming paradigm to provide scalability, strong privacy protection and high utility rate of the anonymized trajectory datasets. We have conducted extensive experiments using real maps with different topologies, and our results prove both effectiveness and efficiency when compared with the latest centralized approaches.

Cloud computing is growing exponentially, whereby there are now hundreds of cloud service providers (CSPs) of various sizes. While the cloud consumers may enjoy cheaper data storage and computation offered in this multi-cloud environment, they are also in face of more complicated reliability issues and privacy preservation problems of their outsourced data. Though searchable encryption allows users to encrypt their stored data while preserving some search capabilities, few efforts have sought to consider the reliability of the searchable encrypted data outsourced to the clouds. In this paper, we propose a privacy-preserving STorage and REtrieval (STRE) mechanism that not only ensures security and privacy but also provides reliability guarantees for the outsourced searchable encrypted data. The STRE mechanism enables the cloud users to distribute and search their encrypted data across multiple independent clouds managed by different CSPs, and is robust even when a certain number of CSPs crash. Besides the reliability, STRE also offers the benefit of partially hidden search pattern. We evaluate the STRE mechanism on Amazon EC2 using a real world dataset and the results demonstrate both effectiveness and efficiency of our approach.

Cloud brokers have been recently introduced as an additional computational layer to facilitate cloud selection and service management tasks for cloud consumers. However, existing brokerage schemes on cloud service selection typically assume that brokers are completely trusted, and do not provide any guarantee over the correctness of the service recommendations. It is then possible for a compromised or dishonest broker to easily take advantage of the limited capabilities of the clients and provide incorrect or incomplete responses. To address this problem, we propose an innovative cloud service selection verification (CSSV) scheme and index structures (MMBcloud-tree) to enable cloud clients to detect misbehavior of the cloud brokers during the service selection process. We demonstrate correctness and efficiency of our approaches both theoretically and empirically.

To achieve automatic recommendation of privacy settings for image sharing, a new tool called iPrivacy (image privacy) is developed for releasing the burden from users on setting the privacy preferences when they share their images for special moments. Specifically, this paper consists of the following contributions: 1) massive social images and their privacy settings are leveraged to learn the object-privacy relatedness effectively and identify a set of privacy-sensitive object classes automatically; 2) a deep multi-task learning algorithm is developed to jointly learn more representative deep convolutional neural networks and more discriminative tree classifier, so that we can achieve fast and accurate detection of large numbers of privacy-sensitive object classes; 3) automatic recommendation of privacy settings for image sharing can be achieved by detecting the underlying privacy-sensitive objects from the images being shared, recognizing their classes, and identifying their privacy settings according to the object-privacy relatedness; and 4) one simple solution for image privacy protection is provided by blurring the privacy-sensitive objects automatically. We have conducted extensive experimental studies on real-world images and the results have demonstrated both the efficiency and effectiveness of our proposed approach.

Vehicular Ad-hoc Networks (VANETs) are an emerging field, whereby vehicle-to-vehicle communications can enable many new applications such as safety and entertainment services. Most VANET applications are enabled by different routing protocols. The design of such routing protocols, however, is quite challenging due to the dynamic nature of nodes (vehicles) in VANETs. To exploit the unique characteristics of VANET nodes, we design a moving-zone based architecture in which vehicles collaborate with one another to form dynamic moving zones so as to facilitate information dissemination. We propose a novel approach that introduces moving object modeling and indexing techniques from the theory of large moving object databases into the design of VANET routing protocols. The results of extensive simulation studies carried out on real road maps demonstrate the superiority of our approach compared with both clustering and non-clustering based routing protocols.

Enabled by the state-of-the-art cloud computing technologies, cloud storage has gained increasing popularity in recent years. Despite of the benefit of flexible and reliable data access offered by such services, users have to bear with the fact of not actually knowing the whereabouts of their data. The lack of knowledge and control of the physical locations of data could raise legal and regulatory issues, especially for certain sensitive data that are governed by laws to remain within certain geographic boundaries and borders. In this paper, we study the problem of data placement control within distributed file systems supporting cloud storage. Particularly, we consider the open source Hadoop file system (HDFS) as the underlying architecture, and propose a location-aware cloud storage system, named LAST-HDFS, to support and enforce location-aware storage in HDFS-based clusters. In addition, it also includes a monitoring system deployed at individual hosts to oversee and detect potential data placement violations due to the existence of malicious datanodes. We carried out an extensive experimental evaluation in a real cloud environment that demonstrates the effectiveness and efficiency of our proposed system.

The ubiquitous adoption of portable smart devices has enabled a new way of communication via Pocket Switched Networks (PSN), whereby messages are routed by personal devices inside the pockets of ever-moving people. PSNs provide opportunities for various interesting applications such as location based social networking, geolocal advertising, and military missions in active battlefields where the central communication tower is unavailable. One key challenge of the successful roll-out of PSN applications is the difficulty of achieving high message delivery ratio due to the dynamic nature of moving people and spatial-temporal sparsity in such networks. In this paper, we propose a novel message routing approach, called ChitChat, which exploits users' direct and transient social interests via discriminatory gossiping to penetrate messages deeper into the network. Our approach enables message carriers to make opportunistic and distributed routing decisions based on the likelihood a potential message receiver will meet individuals that have a high chance to forward the message to the destination. Our experimental results have demonstrated that our approach achieves higher delivery ratios against the two more recent state-of-the-art algorithms, while maintaining a lower communication overhead against flooding and reducing the amount of time messages remain idlein buffers.

Cloud computing offers a wide array of storage services. While enjoying the benefits of flexibility, scalability and reliability brought by the cloud storage, cloud users also face the risk of losing control of their own data, in partly because they do not know where their data is actually stored. This raises a number of security and privacy concerns regarding one's sensitive data such as health records. For example, according to Canadian laws, data related to personal identifiable information must be stored within Canada. Nevertheless, in contrast to the urgent demands, privacy requirements regarding to cloud storage locations have not been well investigated in the current cloud computing market, fostering security and privacy concerns among potential adopters. Aiming at addressing this emerging critical issue, we propose a novel secure location-sensitive storage framework, called SecLoc, which offers protection for cloud users' data following the storage location restrictions, with minimum management overhead to existing cloud storage services. We conduct security analysis, complexity analysis and experimental evaluation on the proposed SecLoc system. Our results demonstrate both effectiveness and efficiency of our mechanism.

With the increasing volume of images users share through social sites, maintaining privacy has become a major problem, as demonstrated by a recent wave of publicized incidents where users inadvertently shared personal information. In light of these incidents, the need of tools to help users control access to their shared content is apparent. Toward addressing this need, we propose an Adaptive Privacy Policy Prediction (A3P) system to help users compose privacy settings for their images. We examine the role of social context, image content, and metadata as possible indicators of users' privacy preferences. We propose a two-level framework which according to the user's available history on the site, determines the best available privacy policy for the user's images being uploaded. Our solution relies on an image classification framework for image categories which may be associated with similar policies, and on a policy prediction algorithm to automatically generate a policy for each newly uploaded image, also according to users' social features. Overtime, the generated policies will follow the evolution of users' privacy attitude. We provide the results of our extensive evaluation over 5,000 policies, which demonstrate the effectiveness of our system, with prediction accuracies over 90 percent.

We are experiencing the expanding use of location-based services such as AT&T’s TeleNav GPS Navigator and Intel’s Thing Finder. Existing location-based services have collected a large amount of location data, which has great potential for statistical usage in applications like traffic flow analysis, infrastructure planning, and advertisement dissemination. The key challenge is how to wisely use the data without violating each user’s location privacy concerns. In this article, we first identify a new privacy problem, namely, the inference-route problem, and then present our anonymization algorithms for privacy-preserving trajectory publishing. The experimental results have demonstrated that our approach outperforms the latest related work in terms of both efficiency and effectiveness.

Assessing similarity of policies is crucial in a variety of scenarios, such as finding the cloud service providers which satisfy users' privacy concerns, or finding collaborators which have matching security and privacy settings. Existing approaches to policy similarity analysis are mainly based on logical reasoning and Boolean function comparison. Such approaches are computationally expensive and do not scale well for large heterogeneous distributed environments (like the cloud). In this paper, we propose a policy similarity measure as a lightweight ranking approach to help one party quickly locate parties with potentially similar policies. In particular, given a policy P, the similarity measure assigns a ranking (similarity score) to each policy compared with P. We formally define the measure by taking into account various factors and prove several important properties of the measure. Our extensive experimental study demonstrates the efficiency and practical value of our approach.

The expanding Cloud computing services offer great opportunities for consumers to find the best service and best pricing, which however raises new challenges on how to select the best service out of the huge pool. It is time-consuming for consumers to collect the necessary information and analyze all service providers to make the decision. This is also a highly demanding task from a computational perspective, because the same computations may be conducted repeatedly by multiple consumers who have similar requirements. Therefore, in this paper, we propose a novel brokerage-based architecture in the Cloud, where the Cloud brokers is responsible for the service selection. In particular, we design a unique indexing technique for managing the information of a large number of Cloud service providers. We then develop efficient service selection algorithms that rank potential service providers and aggregate them if necessary. We prove the efficiency and effectiveness of our approach through an experimental study with the real and synthetic Cloud data.

With the dramatic increase of users on social network websites, the needs to assist users to manage their large number of contacts as well as providing privacy protection become more and more evident. Unfortunately, limited tools are available to address such needs and reduce users' workload on mana

We propose and study a new type of location optimization problem: given a set of clients and a set of existing facilities, we select a location from a given set of potential locations for establishing a new facility so that the average distance between a client and her nearest facility is minimized. We call this problem the min-dist location selection problem, which has a wide range of applications in urban development simulation, massively multiplayer online games, and decision support systems. We explore two common approaches to location optimization problems and propose methods based on those approaches for solving this new problem. However, those methods either need to maintain an extra index or fall short in efficiency. To address their drawbacks, we propose a novel method (named MND), which has very close performance to the fastest method but does not need an extra index. We provide a detailed comparative cost analysis on the various algorithms. We also perform extensive experiments to evaluate their empirical performance and validate the efficiency of the MND method.

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. A major feature of the cloud services is that users' data are usually processed remotely in unknown machines that users do not own or operate. While enjoying the convenience brought by this new emerging technology, users' fears of losing control of their own data (particularly, financial and health data) can become a significant barrier to the wide adoption of cloud services. To address this problem, in this paper, we propose a novel highly decentralized information accountability framework to keep track of the actual usage of the users' data in the cloud. In particular, we propose an object-centered approach that enables enclosing our logging mechanism together with users' data and policies. We leverage the JAR programmable capabilities to both create a dynamic and traveling object, and to ensure that any access to users' data will trigger authentication and automated logging local to the JARs. To strengthen user's control, we also provide distributed auditing mechanisms. We provide extensive experimental studies that demonstrate the efficiency and effectiveness of the proposed approaches.

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. A major feature of the cloud services is that users' data is usually processed remotely in unknown machines that users do not own or operate. While enjoying the convenience brought by this new emerging technology, users' fears of losing control of their own data(particularly financial and health data) can become a significant barrier to the wide adoption of cloud services. To address this problem, in this paper, we propose a novel highly decentralized information accountability framework to keep track of the actual usage of the users' data in the cloud. In particular, we leverage the programmable capability of Java JAR files to enclose our logging mechanism together with users' data and policies. Our approach ensures that any access to users' data will trigger authentication and automated logging local to the JARs. To strengthen user's control, we also provide distributed auditing mechanisms. Our experimental study demonstrates the efficiency and effectiveness of the proposed approaches.

The emerging Vehicular Ad-hoc Network (VANET) technology will enable many exciting applications such as vehicular safety assistance and mobile entertainment. One of the key challenges toward successful roll-out of VANET applications is to provide security and privacy preserving mechanisms for users. Existing efforts on this topic rely heavily on infrastructure like road-side units which however are not available everywhere. To minimize the dependence on infrastructure, we propose a novel Peer-based Automobile Identity Management (PAIM) Framework which is mainly based on vehicle-to-vehicle communication. PAIM supports dynamic event-based moving zones formed by vehicles sharing common interest. PAIM achieves the level of privacy desired by vehicles and traceability required by law enforcement authorities, in addition to satisfying fundamental security requirements including authentication, non-repudiation, message integrity and confidentiality. A prototype of PAIM is built and tested and the results demonstrate the efficiency and feasibility of our approach.

With the growing use of location-based services, location privacy attracts increasing attention from users, industry, and the research community. While considerable effort has been devoted to inventing techniques that prevent service providers from knowing a user's exact location, relatively little attention has been paid to enabling so-called peer-wise privacy---the protection of a user's location from unauthorized peer users. This paper identifies an important efficiency problem in existing peer-privacy approaches that simply apply a filtering step to identify users that are located in a query range, but that do not want to disclose their location to the querying peer. To solve this problem, we propose a novel, privacy-policy enabled index called the PEB-tree that seamlessly integrates location proximity and policy compatibility. We propose efficient algorithms that use the PEB-tree for processing privacy-aware range and k NN queries. Extensive experiments suggest that the PEB-tree enables efficient query processing.

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. While cloud computing is expanding rapidly and used by many individuals and organizations internationally, data protection issues in the cloud have not been carefully addressed at current stage. Users' fear of confidential data (particularly financial and health data) leakage and loss of privacy in the cloud may become a significant barrier to the wide adoption of cloud services. In this paper, we explore a newly emerging problem of information leakage caused by indexing in the cloud. We design a three-tier data protection architecture to accommodate various levels of privacy concerns by users. According to the architecture, we develop a novel portable data binding technique to ensure strong enforcement of users' privacy requirements at server side.

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. While cloud computing is expanding rapidly and used by many individuals and organizations internationally, data protection issues in the cloud have not been carefully addressed at current stage. In the cloud, users' data is usually processed remotely in unknown machines that users do not own or operate. Hence, users' fear of confidential data (particularly financial and health data) leakage and loss of privacy in the cloud becomes a significant barrier to the wide adoption of cloud services. To allay users' concerns of their data privacy, in this paper, we propose a novel data protection framework which addresses challenges during the life cycle of a cloud service. The framework consists of three key components: policy ranking, policy integration and policy enforcement. For each component, we present various models and analyze their properties. Our goal is to provide a new vision toward addressing the issues of the data protection in the cloud rather than detailed techniques of each component. To this extent, the paper includes a discussion of a set of general guidelines for evaluating systems designed based on such a framework.

Many access control policy languages, e.g., XACML, allow a policy to contain multiple sub-policies, and the result of the policy on a request is determined by combining the results of the sub-policies according to some policy combining algorithms (PCAs). Existing access control policy languages, however, do not provide a formal language for specifying PCAs. As a result, it is difficult to extend them with new PCAs. While several formal policy combining algebras have been proposed, they did not address important practical issues such as policy evaluation errors and obligations; furthermore, they cannot express PCAs that consider all sub-policies as a whole (e.g., weak majority or strong majority). We propose a policy combining language PCL, which can succinctly and precisely express a variety of PCAs. PCL represents an advancement both in terms of theory and practice. It is based on automata theory and linear constraints, and is more expressive than existing approaches. We have implemented PCL and integrated it with SUN's XACML implementation. With PCL, a policy evaluation engine only needs to understand PCL to evaluate any PCA specified in it.

Collaborative and distributed applications, such as dynamic coalitions and virtualized grid computing, often require integrating access control policies of collaborating parties. Such an integration must be able to support complex authorization specifications and the fine-grained integration requirements that the various parties may have. In this paper, we introduce an algebra for fine-grained integration of sophisticated policies. The algebra, which consists of three binary and two unary operations, is able to support the specification of a large variety of integration constraints. To assess the expressive power of our algebra, we introduce a notion of completeness and prove that our algebra is complete with respect to this notion. We then propose a framework that uses the algebra for the fine-grained integration of policies expressed in XACML. We also present a methodology for generating the actual integrated XACML policy, based on the notion of Multi-Terminal Binary Decision Diagrams.

The continuous intersection join query is computationally expensive yet important for various applications on moving objects. No previous study has specifically addressed this query type. We can adopt a naive algorithm or extend an existing technique (TP-Join) to process the query. However, they compute the answer for either too long or too short a time interval, which results in either a very large computation cost per object update or too frequent answer updates, respectively. This motivates us to optimize the query processing in the time dimension. In this study, we achieve this optimization by introducing the new concept of time-constrained (TC) processing. Further, TC processing enables a set of effective improvement techniques on traditional intersection join algorithms. With a thorough experimental study, we show that our algorithm outperforms the best adapted existing solution by several orders of magnitude.

With the advances in web service techniques, new collaborative applications have emerged like supply chain arrangements and coalition in government agencies. In such applications, the collaborating parties are responsible for managing and protecting resources entrusted to them. Access control decisions thus become a collaborative activity in which a global policy must be enforced by a set of collaborating parties without compromising the autonomy or confidentiality requirements of these parties. Unfortunately, none of the conventional access control systems meets these new requirements. To support collaborative access control, in this paper, we propose a novel policy-based access control model. Our main idea is based on the notion of policy decomposition and we propose an extension to the reference architecture for XACML. We present algorithms for decomposing a global policy and efficiently evaluating requests.

Progress in science and engineering relies on the ability to measure, reliably and in detail, pertinent properties of artifacts under design. Progress in the area of database-index design thus relies on empirical studies based on prototype implementations of indexes. This paper proposes a benchmark that targets techniques for the indexing of the current and near-future positions of moving objects. This benchmark enables the comparison of existing and future indexing techniques. It covers important aspects of such indexes that have not previously been covered by any benchmark. Notable aspects covered include update efficiency, query efficiency, concurrency control, and storage requirements. Next, the paper applies the benchmark to half a dozen notable moving-object indexes, thus demonstrating the viability of the benchmark and offering new insight into the performance properties of the indexes.

In this work, we present our implementation for managing moving objects on top of a popular relational database system MySQL, namely SpADE (spatio-temporal autonomic database engine for managing moving objects). In our SpADE system, non-static entities like vehicles and pedestrians are abstracted as moving objects. They obtain positioning information with GPS (Global Positioning System) receivers installed, and are able to communicate via wireless network with the server, sending queries to and receiving results from it. The server is responsible for managing moving object information and processing queries from mobile users. By employing the industry standard JDBC for the data access, our server can also support providing services for other application interfaces such as the Web.

Recent collaborative applications and enterprises very often need to efficiently integrate their access control policies. An important step in policy integration is to analyze the similarity of policies. Existing approaches to policy similarity analysis are mainly based on logical reasoning and boolean function comparison. Such approaches are computationally expensive and do not scale well for large heterogeneous distributed environments (like Grid computing systems). In this paper, we propose a policy similarity measure as a filter phase for policy similarity analysis. This measure provides a lightweight approach to pre-compile a large amount of policies and only return the most similar policies for further evaluation. In the paper we formally define the measure, by taking into account both the case of categorical attributes and numeric attributes. Detailed algorithms are presented for the similarly computation. Results of our case study demonstrates the efficiency and practical value of our approach.

This paper considers the problem of efficiently maintaining a clustering of a dynamic set of data points that move continuously in two-dimensional Euclidean space. This problem has received little attention and introduces new challenges to clustering. The paper proposes a new scheme that is capable of incrementally clustering moving objects. This proposal employs a notion of object dissimilarity that considers object movement across a period of time, and it employs clustering features that can be maintained efficiently in incremental fashion. In the proposed scheme, a quality measure for incremental clusters is used for identifying clusters that are not compact enough after certain insertions and deletions. An extensive experimental study shows that the new scheme performs significantly faster than traditional ones that frequently rebuild clusters. The study also shows that the new scheme is effective in preserving the quality of moving-object clusters.

This paper assumes a setting where a population of objects move continuously in the Euclidean plane. The position of each object, modeled as a linear function from time to points, is assumed known. In this setting, the paper studies the querying for dense regions. In particular, the paper defines a particular type of density query with desirable properties and then proceeds to propose an algorithm for the efficient computation of density queries. While the algorithm may exploit any existing index for the current and near-future positions of moving objects, the Bx-tree is used. The paper reports on an extensive empirical study, which elicits the performance properties of the algorithm.

Although significant effort has been put into the development of efficient spatio-temporal indexing techniques for moving objects, little attention has been given to the development of techniques that efficiently support queries about the past, present, and future positions of objects. The provisioning of such techniques is challenging, both because of the nature of the data, which reflects continuous movement, and because of the types of queries to be supported. This paper proposes the BBx -index structure, which indexes the positions of moving objects, given as linear functions of time, at any time. The index stores linearized moving-object locations in a forest of B+ -trees. The index supports queries that select objects based on temporal and spatial constraints, such as queries that retrieve all objects whose positions fall within a spatial range during a set of time intervals. Empirical experiments are reported that offer insight into the query and update performance of the proposed technique.

No abstract available.