Synthesis Lectures on Information Security, Privacy, and Trust – serie

Operating systems provide the fundamental mechanisms for securing computer processing. Since the 1960s, operating systems designers have explored how to build "secure" operating systems - operating systems whose mechanisms protect the system against a motivated adversary. Recently, the importance of ensuring such security has become a mainstream issue for all operating systems. In this book, we examine past research that outlines the requirements for a secure operating system and research that implements example systems that aim for such requirements. For system designs that aimed to satisfy these requirements, we see that the complexity of software systems often results in implementation challenges that we are still exploring to this day. However, if a system design does not aim for achieving the secure operating system requirements, then its security features fail to protect the system in a myriad of ways. We also study systems that have been retrofit with secure operating system features after an initial deployment. In all cases, the conflict between function on one hand and security on the other leads to difficult choices and the potential for unwise compromises. From this book, we hope that systems designers and implementors will learn the requirements for operating systems that effectively enforce security and will better understand how to manage the balance between function and security. Table of Contents: Introduction / Access Control Fundamentals / Multics / Security in Ordinary Operating Systems / Verifiable Security Goals / Security Kernels / Securing Commercial Operating Systems / Case Study: Solaris Trusted Extensions / Case Study: Building a Secure Operating System for Linux / Secure Capability Systems / Secure Virtual Machine Systems / System Assurance

Table of Contents: Introduction / Foundations / Detecting Buffer Overruns Using Static Analysis / Analyzing Security Policies / Analyzing Security Protocols

Table of Contents: Introduction / Cancelable Biometric System / Cryptographic Key Regeneration Using Biometrics / Biometrics-Based Secure Authentication Protocols / Concluding Remarks

Sharing of location data enables numerous exciting applications, such as location-based queries, location-based social recommendations, monitoring of traffic and air pollution levels, etc.

This book deals with Private Information Retrieval (PIR), a technique allowing a user to retrieve an element from a server in possession of a database without revealing to the server which element is retrieved.

This work deals with the ways in which such hidden, non-specified functionality can be introducedinto hardware systems. After briefly outlining the development and production process of hardware systems, we systematically describe a new type of threat, the hardware Trojan.

(ii) controlled information sharing, because in OSNs, where personal information is not only connected to user profiles, but spans across users' social activities and interactions, users must be provided with the possibility to directly control information flows;

At the network level, RFID security means that RFID information should be shared with authorized parties only, while RFID privacy further requires that RFID information should be shared without disclosure of valuable RFID information to any honest-but-curious server which coordinates information sharing.

We present a generic model for mobile platform security architectures: the model illustrates commonly used security mechanisms and techniques in mobile devices and allows a systematic comparison of different platforms.

Digital Watermarking is the art and science of embedding information in existing digital content for Digital Rights Management (DRM) and authentication.

There has been roughly 15 years of research into approaches for aligning research in Human Computer Interaction with computer Security, more colloquially known as ``usable security.'' Although usability and security were once thought to be inherently antagonistic, today there is wide consensus that systems that are not usable will inevitably suffer security failures when they are deployed into the real world. Only by simultaneously addressing both usability and security concerns will we be able to build systems that are truly secure. This book presents the historical context of the work to date on usable security and privacy, creates a taxonomy for organizing that work, outlines current research objectives, presents lessons learned, and makes suggestions for future research.

Table of Contents: Preface / Introduction / Basics of Physically Unclonable Functions / Attacks on PUFs and PUF-based Systems / Advanced PUF Concepts / PUF Implementations and Evaluation / PUF-based Cryptographic Protocols / Security Model for PUF-based Systems / Conclusion / Terms and Abbreviations / Bibliography / Authors' Biographies

Social media greatly enables people to participate in online activities and shatters the barrier for online users to create and share information at any place at any time. However, the explosion of user-generated content poses novel challenges for online users to find relevant information, or, in other words, exacerbates the information overload problem. On the other hand, the quality of user-generated content can vary dramatically from excellence to abuse or spam, resulting in a problem of information credibility. The study and understanding of trust can lead to an effective approach to addressing both information overload and credibility problems. Trust refers to a relationship between a trustor (the subject that trusts a target entity) and a trustee (the entity that is trusted). In the context of social media, trust provides evidence about with whom we can trust to share information and from whom we can accept information without additional verification. With trust, we make the mental shortcut by directly seeking information from trustees or trusted entities, which serves a two-fold purpose: without being overwhelmed by excessive information (i.e., mitigated information overload) and with credible information due to the trust placed on the information provider (i.e., increased information credibility). Therefore, trust is crucial in helping social media users collect relevant and reliable information, and trust in social media is a research topic of increasing importance and of practical significance. This book takes a computational perspective to offer an overview of characteristics and elements of trust and illuminate a wide range of computational tasks of trust. It introduces basic concepts, deliberates challenges and opportunities, reviews state-of-the-art algorithms, and elaborates effective evaluation methods in the trust study. In particular, we illustrate properties and representation models of trust, elucidate trust prediction with representative algorithms, and demonstrate real-world applications where trust is explicitly used. As a new dimension of the trust study, we discuss the concept of distrust and its roles in trust computing.

Whereas user-facing applications are often written in modern languages, the firmware, operating system, support libraries, and virtual machines that underpin just about any modern computer system are still written in low-level languages that value flexibility and performance over convenience and safety.

we also explore the links between anonymization methods and privacy models (how anonymization methods can be used to enforce privacy models and thereby offer ex ante privacy guarantees).

With the rapid development of cloud computing, the enterprises and individuals can outsource their sensitive data into the cloud server where they can enjoy high quality data storage and computing services in a ubiquitous manner.

Privacy Risk Analysis fills a gap in the existing literature by providing an introduction to the basic notions, requirements, and main steps of conducting a privacy risk analysis.The deployment of new information technologies can lead to significant privacy risks and a privacy impact assessment should be conducted before designing a product or system that processes personal data. However, if existing privacy impact assessment frameworks and guidelines provide a good deal of details on organizational aspects (including budget allocation, resource allocation, stakeholder consultation, etc.), they are much vaguer on the technical part, in particular on the actual risk assessment task. For privacy impact assessments to keep up their promises and really play a decisive role in enhancing privacy protection, they should be more precise with regard to these technical aspects.This book is an excellent resource for anyone developing and/or currently running a risk analysis as it defines the notions of personal data, stakeholders, risk sources, feared events, and privacy harms all while showing how these notions are used in the risk analysis process. It includes a running smart grids example to illustrate all the notions discussed in the book.

Over the last decade, differential privacy (DP) has emerged as the de facto standard privacy notion for research in privacy-preserving data analysis and publishing.

Digital forensic science, or digital forensics, is the application of scientific tools and methods to identify, collect, and analyze digital (data) artifacts in support of legal proceedings.

The new field of cryptographic currencies and consensus ledgers, commonly referred to as blockchains, is receiving increasing interest from various different communities.

This book focuses on the combined cyber and physical security issues in advanced electric smart grids. Future defenses are proposed that include information flow analysis and attestation systems that rely on fundamental physical properties of the smart grid system.

Anomaly detection has been a long-standing security approach with versatile applications, ranging from securing server programs in critical environments, to detecting insider threats in enterprises, to anti-abuse detection for online social networks.

The social benefit derived from Online Social Networks (OSNs) can lure users to reveal unprecedented volumes of personal data to an online audience that is much less trustworthy than their offline social circle. Even if a user hides his personal data from some users and shares with others, privacy settings of OSNs may be bypassed, thus leading to various privacy harms such as identity theft, stalking, or discrimination. Therefore, users need to be assisted in understanding the privacy risks of their OSN profiles as well as managing their privacy settings so as to keep such risks in check, while still deriving the benefits of social network participation.This book presents to its readers how privacy risk analysis concepts such as privacy harms and risk sources can be used to develop mechanisms for privacy scoring of user profiles and for supporting users in privacy settings management in the context of OSNs. Privacy scoring helps detect and minimize the risks due to the dissemination and use of personal data. The book also discusses many open problems in this area to encourage further research.

Since the use of ML entails understanding which techniques can be best used for specific tasks to ensure comprehensive security, the book provides an overview of the current state of the art of ML techniques for security and a detailed taxonomy of security tasks and corresponding ML techniques that can be used for each task.

Since the use of ML entails understanding which techniques can be best used for specific tasks to ensure comprehensive security, the book provides an overview of the current state of the art of ML techniques for security and a detailed taxonomy of security tasks and corresponding ML techniques that can be used for each task.

This book journeys through the labyrinth of usable privacy, a place where the interplay of privacy and Human-Computer Interaction (HCI) reveals a myriad of challenges, solutions, and new possibilities.

This book journeys through the labyrinth of usable privacy, a place where the interplay of privacy and Human-Computer Interaction (HCI) reveals a myriad of challenges, solutions, and new possibilities.

This book, authored by some of the pioneers in the security certification domain, provides a foundational knowledge base for designing and deploying effective security certification schemes for cloud-edge distributed systems.