Open Problems in Network Security: IFIP WG 11.4 International Workshop, iNetSec 2011, Lucerne, Switzerland, June 9, 2011, Revised Selected Papers PDF
Preview Open Problems in Network Security: IFIP WG 11.4 International Workshop, iNetSec 2011, Lucerne, Switzerland, June 9, 2011, Revised Selected Papers
Lecture Notes in Computer Science 7039 CommencedPublicationin1973 FoundingandFormerSeriesEditors: GerhardGoos,JurisHartmanis,andJanvanLeeuwen EditorialBoard DavidHutchison LancasterUniversity,UK TakeoKanade CarnegieMellonUniversity,Pittsburgh,PA,USA JosefKittler UniversityofSurrey,Guildford,UK JonM.Kleinberg CornellUniversity,Ithaca,NY,USA AlfredKobsa UniversityofCalifornia,Irvine,CA,USA FriedemannMattern ETHZurich,Switzerland JohnC.Mitchell StanfordUniversity,CA,USA MoniNaor WeizmannInstituteofScience,Rehovot,Israel OscarNierstrasz UniversityofBern,Switzerland C.PanduRangan IndianInstituteofTechnology,Madras,India BernhardSteffen TUDortmundUniversity,Germany MadhuSudan MicrosoftResearch,Cambridge,MA,USA DemetriTerzopoulos UniversityofCalifornia,LosAngeles,CA,USA DougTygar UniversityofCalifornia,Berkeley,CA,USA GerhardWeikum MaxPlanckInstituteforInformatics,Saarbruecken,Germany Jan Camenisch Dogan Kesdogan (Eds.) Open Problems in Network Security IFIP WG 11.4 International Workshop, iNetSec 2011 Lucerne, Switzerland, June 9, 2011 Revised Selected Papers 1 3 VolumeEditors JanCamenisch IBMResearch-Zurich Säumerstrasse4,8803Rüschlikon,Switzerland E-mail:[email protected] DoganKesdogan UniversitätSiegen InstitutfürWirtschaftsinformatik Hölderlinstr.3,57068Siegen,Germany E-mail:[email protected] ISSN0302-9743 e-ISSN1611-3349 ISBN978-3-642-27584-5 e-ISBN978-3-642-27585-2 DOI10.1007/978-3-642-27585-2 SpringerHeidelbergDordrechtLondonNewYork LibraryofCongressControlNumber:2011944283 CRSubjectClassification(1998):K.6.5,K.4,C.2,E.3,D.4.6,H.3.4-5 LNCSSublibrary:SL4–SecurityandCryptology ©IFIPInternationalFederationforInformationProcessing2012 Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting, reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965, initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violationsareliable toprosecutionundertheGermanCopyrightLaw. Theuseofgeneraldescriptivenames,registerednames,trademarks,etc.inthispublicationdoesnotimply, evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevantprotectivelaws andregulationsandthereforefreeforgeneraluse. Typesetting:Camera-readybyauthor,dataconversionbyScientificPublishingServices,Chennai,India Printedonacid-freepaper SpringerispartofSpringerScience+BusinessMedia(www.springer.com) Preface TheinternationalworkshopiNetSec2011–OpenProblemsinNetworkSecurity— is dedicated to open problem and research directions on all aspects related to network security. It is the main workshop of working group WG 11.4 of the IFIP.Thisyear,iNetSecwasco-locatedwithIFIPSEC2011inLucerneonJune 9 and shared with it the keynote talk by the Kristian Beckman award-winner Ann Cavoukian. Originally, iNetSec was run in the traditional format where research papers get submitted, peer-reviewed, and then presented at the workshop. Since 2009, the format was changed to discuss open research problems and directions in network security. To enable this open workshop style yet remain focused on particular topics, we called for two page abstracts in which the authors were asked to outline an open research problem or direction. This year, we received 28shortsubmissions.Eachofthemwasindependently reviewedby six Program Committeememberswithafocusontherelevanceandsuitabilityfordiscussion. After a round of discussion in the ProgramCommittee, 12 papers were selected for presentation at the workshop. For these presentations almost the same time was given to discussions as for presentations. After the workshop, the authors submitted a full paper that also takesthe discussioninto account.These papers are in the proceedings you are now holding in your hands. We hope that they will serve as a source of inspiration for new research. We thank the authors of all submissions for enabling the workshop and the presenters and all participants for making it a success with their lively con- tributions! We also thank the local organizers Carlos Rieder, Colette Hofer- Schu¨rmann,andFabiaBommes formakingourstayin Lucernesucha pleasure. September 2011 Jan Camenisch Dogan Kesdogan iNetSec 2011 Open Research Problems in Network Security Lucerne University of Applied Sciences and Arts June 9, 2011 Lucerne, Switzerland Organized in cooperation with IFIP WG 11.4 Executive Committee Program Chairs Jan Camenisch IBM Research – Zurich, Switzerland Dogan Kesdogan University of Siegen, Germany Organizing Chair Carlos Rieder Lucerne University of Science & Arts, Switzerland Program Committee Endre Bangerter Bern University of Applied Sciences, Switzerland Jan Camenisch IBM Research – Zurich, Switzerland Hannes Federrath University of Regensburg, Germany Simone Fischer-Hu¨bner Karlstad University, Sweden Virgil Gligor Carnegie Mellon University, USA Thomas Gross IBM Research – Zurich, Switzerland Dogan Kesdogan University of Siegen, Germany Engin Kirda Northeastern University, Boston, USA Albert Levi Sabanci University, Turkey Javier Lopez University of Malaga, Spain Ulrike Meyer RWTH Aachen University, Germany Refik Molva Eurecom Local Organizing Committee Carlos Rieder Lucerne University of Science and Arts Colette Hofer-Schu¨rmann Lucerne University of Science and Arts Fabia Bommes Lucerne University of Science and Arts Table of Contents I Assisting Users Evoking Comprehensive Mental Models of Anonymous Credentials ..... 1 Erik W¨astlund, Julio Angulo, and Simone Fischer-Hu¨bner Towards Usable Interfaces for Proof Based Access Rights on Mobile Devices ......................................................... 15 Marcel Heupel and Dogan Kesdogan Commercial Home Assistance (eHealth) Services ..................... 28 Milica Milutinovic, Koen Decroix, Vincent Naessens, and Bart De Decker II Malware Detection Detecting Computer Worms in the Cloud ........................... 43 Sebastian Biedermann and Stefan Katzenbeisser Efficient and Stealthy Instruction Tracing and Its Applications in Automated Malware Analysis: Open Problems and Challenges......... 55 Endre Bangerter, Stefan Bu¨hlmann, and Engin Kirda Challenges for Dynamic Analysis of iOS Applications................. 65 Martin Szydlowski, Manuel Egele, Christopher Kruegel, and Giovanni Vigna III Saving Energy Energy-EfficientCryptographic Engineering Paradigm ................ 78 Marine Minier and Raphael C.-W. Phan VIII Table of Contents IV Policies Towards a Similarity Metric for Comparing Machine-Readable Privacy Policies ......................................................... 89 Inger Anne Tøndel and ˚Asmund Ahlmann Nyre Abstract Privacy Policy Framework: Addressing Privacy Problems in SOA ......................................................... 104 Laurent Bussard and Ulrich Pinsdorf Flexible and Dynamic Consent-Capturing ........................... 119 Muhammad Rizwan Asghar and Giovanni Russello V Problems in the Cloud Towards User Centric Data Governance and Control in the Cloud...... 132 Stephan Groß and Alexander Schill Securing Data Provenance in the Cloud............................. 145 Muhammad Rizwan Asghar, Mihaela Ion, Giovanni Russello, and Bruno Crispo Author Index.................................................. 161 Evoking Comprehensive Mental Models of Anonymous Credentials Erik W¨astlund, Julio Angulo, and Simone Fischer-Hu¨bner Karlstad University, Universitetsgatan 2, 651 88 Karlstad, Sweden {erik.wastlund,julio.angulo,simone.fischer-huebner}@kau.se http://www.kau.se Abstract. Anonymous credentials are a fundamental technology for preserving end users’ privacy by enforcing data minimization for online applications. However,thedesign of user-friendly interfaces that convey their privacy benefits to users is still a major challenge. Users are still unfamiliar with thenew and rathercomplex concept of anonymous cre- dentials,sincenoobviousreal-world analogies existsthatcanhelpthem createthecorrectmentalmodels.Inthispaperweexploredifferentways in which suitable mental models of the data minimization property of anonymous credentials can be evoked on end users. To achieve this, we investigatethreedifferentapproachesinthecontextofane-shoppingsce- nario:acard-based approach,anattribute-based approachandanadapted card-based approach.Resultsshowthattheadaptedcard-basedapproach is a good approach towards evoking the right mental models for anony- mouscredentialapplications. However,betterdesign paradigms arestill needed to make users understand that attributes can be used to satisfy conditions without revealing thevalueof theattributes themselves. Keywords: Credential Selection, Anonymous Credentials, Mental Models, Usability. 1 Introduction Data minimization is a fundamental privacy principle which requires that ap- plications and services should use only the minimal amount of personal data necessaryto carry outan online transaction. A key technologyfor enforcingthe principle of data minimization for online applications are anonymous creden- tials [1], [2], [5]. In contrast to traditional electronic credentials, which require the disclosure of all attributes of the credential to a service provider when per- forming an online transaction, anonymous credentials let users reveal any pos- sible subset of attributes of the credential, characteristicsof these attributes, or prove possession of the credential without revealing the credential itself, thus providing users with the right of anonymity and the protection of their privacy. Even though Microsoft’s U-Prove and IBM’s Idemix anonymous credential technologies are currently introduced into commercial and open source systems andproducts,thedesignofeasilyunderstandableinterfacesforintroducingthese J.CamenischandD.Kesdogan(Eds.): iNetSec2011,LNCS7039,pp. 1–14,2012. (cid:2)c IFIPInternationalFederationforInformationProcessing2012 2 E. W¨astlund, J. Angulo, and S.Fischer-Hu¨bner concepts to end users is a major challenge, since end users are not yet familiar with this rather new and complex technology and no obvious real-world analo- gies exist. Besides, users have grown accustomed to believe that their identity cannotremainanonymouswhenactingonlineandhavelearnedfromexperience orwordofmouth thatunwantedconsequencescancome fromdistributing their information to some services providers on the Internet. In other words, people do not yet posses the right mental models regarding how anonymous credentials work and how anonymous credentials can be used to, for example, protect their personal information. Inordertotacklethe challengeofdesigninginterfacesthatconveythe princi- pleofdataminimizationwiththeuseofanonymouscredentials,wehave,within the scope of the EU FP7 project PrimeLife1 and the Swedish U-PrIM project2, investigatedthewaymentalmodelsofaverageusersworkwithregardstoanony- mouscredentialsandhavetriedtoevoketheircorrectmentalmodelswithvarious experiments [10]. In this article, we first provide background information on the concepts of anonymous credentials and mental models and then present previous related work. Then, we describe the experiments that were carried out using three dif- ferent approaches, and present the analyses and interpretations of the collected data. Finally, we provide conclusions in the last section. 2 Background In this sectionwe presenta descriptionof the conceptof anonymouscredentials and the definition of mental models. 2.1 Anonymous Credentials A traditional credential (also called a certificate or attribute certificate) is a set ofpersonalidentifiableattributeswhichissignedbyacertifyingtrustpartyand is bound to its owner by cryptographic means (e.g., by requiring the owner’s secret key to use the credential). With a credential system, users can obtain a credentialfromthe certifyingpartyanddemonstratepossessionofthese creden- tials at the moment of carryingout online transactions.In terms of privacy, the useof(traditionaloranonymous)credentialsisbetterthanthedirectrequestto the certifyingparty,asthis preventsthe certifyingpartyfromprofilingthe user. Whenusingtraditionalcredentials,alloftheattributescontainedinthe creden- tial are disclosedto the service provider when proving certain properties during online transactions. This contradicts the privacy principle of data minimization and can also lead to unwanted user profiling by the service provider. 1 EU FP7 integrated project PrimeLife (Privacy and IdentityManagement for Life), http://www.primelife.eu/ 2 U-PrIM(UsablePrivacy-enhancingIdentityManagement for smart applications) is funded bythe Swedish Knowledge Foundation, KK-Styftelsen, http://www.kau.se/en/computer-science/research/research-projects/u-prim
The list of books you might like
