As technology develops,the amount of information being used has increased a lot.Every company learns big data to provide customized services with its customers.Accordingly,collecting and analyzing data of the data sub...As technology develops,the amount of information being used has increased a lot.Every company learns big data to provide customized services with its customers.Accordingly,collecting and analyzing data of the data subject has become one of the core competencies of the companies.However,when collecting and using it,the authority of the data subject may be violated.The data often identifies its subject by itself,and even if it is not a personal information that infringes on an individual’s authority,the moment it is connected,it becomes important and sensitive personal information that we have never thought of.Therefore,recent privacy regulations such as GDPR(GeneralData ProtectionRegulation)are changing to guarantee more rights of the data subjects.To use data effectively without infringing on the rights of the data subject,the concept of de-identification has been created.Researchers and companies can make personal information less identifiable through appropriate de-identification/pseudonymization and use the data for the purpose of statistical research.De-identification/pseudonymization techniques have been studied a lot,but it is difficult for companies and researchers to know how to de-identify/pseudonymize data.It is difficult to clearly understand how and to what extent each organization should take deidentification measures.Currently,each organization does not systematically analyze and conduct the situation but only takes minimal action while looking at the guidelines distributed by each country.We solved this problem from the perspective of risk management.Several steps are required to secure the dataset starting from pre-processing to releasing the dataset.We can analyze the dataset,analyze the risk,evaluate the risk,and treat the risk appropriately.The outcomes of each step can then be used to take appropriate action on the dataset to eliminate or reduce its risk.Then,we can release the dataset under its own purpose.These series of processes were reconstructed to fit the current situation by analyzing various standards such as ISO/IEC(International Organization for Standardization/International Electrotechnical Commission)20889,NIST IR(National Institute of Standards and Technology Interagency Reports)8053,NIST SP(National Institute of Standards and Technology Special Publications)800-188,and ITU-T(International Telecommunications Union-Telecommunication)X.1148.We propose an integrated framework based on situational awareness model and risk management model.We found that this framework can be specialized for multiple domains,and it is useful because it is based on a variety of case and utility-based ROI calculations.展开更多
As Vehicular ad hoc networks (VANETs) become more sophisticated, the importance of integrating data protection and cybersecurity is increasingly evident. This paper offers a comprehensive investigation into the challe...As Vehicular ad hoc networks (VANETs) become more sophisticated, the importance of integrating data protection and cybersecurity is increasingly evident. This paper offers a comprehensive investigation into the challenges and solutions associated with the privacy implications within VANETs, rooted in an intricate landscape of cross-jurisdictional data protection regulations. Our examination underscores the unique nature of VANETs, which, unlike other ad-hoc networks, demand heightened security and privacy considerations due to their exposure to sensitive data such as vehicle identifiers, routes, and more. Through a rigorous exploration of pseudonymization schemes, with a notable emphasis on the Density-based Location Privacy (DLP) method, we elucidate the potential to mitigate and sometimes sidestep the heavy compliance burdens associated with data protection laws. Furthermore, this paper illuminates the cybersecurity vulnerabilities inherent to VANETs, proposing robust countermeasures, including secure data transmission protocols. In synthesizing our findings, we advocate for the proactive adoption of protective mechanisms to facilitate the broader acceptance of VANET technology while concurrently addressing regulatory and cybersecurity hurdles.展开更多
Security problem is an important issue for Wireless Sensor Network.The paper focuses on the privacy protection of WSN applications.An anonymity enhancement tactic based on pseudonym mechanism is presented for clustere...Security problem is an important issue for Wireless Sensor Network.The paper focuses on the privacy protection of WSN applications.An anonymity enhancement tactic based on pseudonym mechanism is presented for clustered Wireless Sensor Network,which provides anonymity for both the sensors within a cluster and the cluster head nodes.Simulation experiments are launched through NS2 platform to validate the anonymity performance.The theoretical analysis and empirical study imply that the proposed scheme based on pseudonym can protect the privacies of both the sensor nodes and the cluster head nodes.The work is valuable and the experimental results are convincible.展开更多
Trust is one of the most important security requirements in the design and implementation of peer-to-peer （P2P） systems. In an environment where peers＇ identity privacy is important, it may conflict with trustworth...Trust is one of the most important security requirements in the design and implementation of peer-to-peer （P2P） systems. In an environment where peers＇ identity privacy is important, it may conflict with trustworthiness that is based on the knowledge related to the peer＇s identity, while identity privacy is usually achieved by hiding such knowledge. A trust model based on trusted computing （TC） technology was proposed to enhance the identity privacy of peers during the trustworthiness evaluation process between peers from different groups. The simulation results show that, the model can be implemented in an efficient way, and when the degree of anonymity within group （DAWG） is up to 0.6 and the percentage of malicious peers is up to 70%7 the service selection failure rate is less than 0.15.展开更多
In this paper, we proposed an anonymity scheme based on pseudonym where peers are motivated not to share their identity. Compared with precious scheme such as RuP （Reputation using Pseudonyms）, our scheme can reduce...In this paper, we proposed an anonymity scheme based on pseudonym where peers are motivated not to share their identity. Compared with precious scheme such as RuP （Reputation using Pseudonyms）, our scheme can reduce its overhead and minimize the trusted center＇s involvement.展开更多
In peer-to-peer (P2P) reputation systems,each peer's trustworthiness is evaluated based on its pseudonym's rating values given by other peers. Since it is assumed that each peer has a long lived pseudonym,all ...In peer-to-peer (P2P) reputation systems,each peer's trustworthiness is evaluated based on its pseudonym's rating values given by other peers. Since it is assumed that each peer has a long lived pseudonym,all the transactions conducted by the same peer may be linked by its pseudonym. Therefore,one of the fundamental challenges in P2P reputation systems is to protect peers' identity privacy. In this paper,we present two independent anonymity protocols to achieve all the peers' anonymity by changing pseudonym with the help of a trusted third party (TTP) server. Compared with RuP (Reputation using Pseudonym),an existing representative scheme,our protocols reduce the server's cost in two different ways. First,we propose a protocol using blind signature scheme as in RuP. The protocol improves the blind signature scheme and assessment of macro-node values,and reduces the server's cost by half in terms of encryption and decryption operations and message overhead. Second,we propose another protocol,group-confusion protocol,to further reduce the server's cost.展开更多
When initializing cryptographic systems or running cryptographic protocols, the randomness of critical parameters, like keys or key components, is one of the most crucial aspects. But, randomly chosen parameters come ...When initializing cryptographic systems or running cryptographic protocols, the randomness of critical parameters, like keys or key components, is one of the most crucial aspects. But, randomly chosen parameters come with the intrinsic chance of duplicates, which finally may cause cryptographic systems including RSA, ElGamal and Zero-Knowledge proofs to become insecure. When concerning digital identifiers, we need uniqueness in order to correctly identify a specific action or object. Unfortunately we also need randomness here. Without randomness, actions become linkable to each other or to their initiator’s digital identity. So ideally the employed (cryptographic) parameters should fulfill two potentially conflicting requirements simultaneously: randomness and uniqueness. This article proposes an efficient mechanism to provide both attributes at the same time without highly constraining the first one and never violating the second one. After defining five requirements on random number generators and discussing related work, we will describe the core concept of the generation mechanism. Subsequently we will prove the postulated properties (security, randomness, uniqueness, efficiency and privacy protection) and present some application scenarios including system-wide unique parameters, cryptographic keys and components, identifiers and digital pseudonyms.展开更多
文摘As technology develops,the amount of information being used has increased a lot.Every company learns big data to provide customized services with its customers.Accordingly,collecting and analyzing data of the data subject has become one of the core competencies of the companies.However,when collecting and using it,the authority of the data subject may be violated.The data often identifies its subject by itself,and even if it is not a personal information that infringes on an individual’s authority,the moment it is connected,it becomes important and sensitive personal information that we have never thought of.Therefore,recent privacy regulations such as GDPR(GeneralData ProtectionRegulation)are changing to guarantee more rights of the data subjects.To use data effectively without infringing on the rights of the data subject,the concept of de-identification has been created.Researchers and companies can make personal information less identifiable through appropriate de-identification/pseudonymization and use the data for the purpose of statistical research.De-identification/pseudonymization techniques have been studied a lot,but it is difficult for companies and researchers to know how to de-identify/pseudonymize data.It is difficult to clearly understand how and to what extent each organization should take deidentification measures.Currently,each organization does not systematically analyze and conduct the situation but only takes minimal action while looking at the guidelines distributed by each country.We solved this problem from the perspective of risk management.Several steps are required to secure the dataset starting from pre-processing to releasing the dataset.We can analyze the dataset,analyze the risk,evaluate the risk,and treat the risk appropriately.The outcomes of each step can then be used to take appropriate action on the dataset to eliminate or reduce its risk.Then,we can release the dataset under its own purpose.These series of processes were reconstructed to fit the current situation by analyzing various standards such as ISO/IEC(International Organization for Standardization/International Electrotechnical Commission)20889,NIST IR(National Institute of Standards and Technology Interagency Reports)8053,NIST SP(National Institute of Standards and Technology Special Publications)800-188,and ITU-T(International Telecommunications Union-Telecommunication)X.1148.We propose an integrated framework based on situational awareness model and risk management model.We found that this framework can be specialized for multiple domains,and it is useful because it is based on a variety of case and utility-based ROI calculations.
文摘As Vehicular ad hoc networks (VANETs) become more sophisticated, the importance of integrating data protection and cybersecurity is increasingly evident. This paper offers a comprehensive investigation into the challenges and solutions associated with the privacy implications within VANETs, rooted in an intricate landscape of cross-jurisdictional data protection regulations. Our examination underscores the unique nature of VANETs, which, unlike other ad-hoc networks, demand heightened security and privacy considerations due to their exposure to sensitive data such as vehicle identifiers, routes, and more. Through a rigorous exploration of pseudonymization schemes, with a notable emphasis on the Density-based Location Privacy (DLP) method, we elucidate the potential to mitigate and sometimes sidestep the heavy compliance burdens associated with data protection laws. Furthermore, this paper illuminates the cybersecurity vulnerabilities inherent to VANETs, proposing robust countermeasures, including secure data transmission protocols. In synthesizing our findings, we advocate for the proactive adoption of protective mechanisms to facilitate the broader acceptance of VANET technology while concurrently addressing regulatory and cybersecurity hurdles.
基金the National Natural Science Foundation of China (NSFC) under grant No.61309024,the National Key Basic Research Program of China (973) under Grant No.2013CB834204,the Fundamental Research Funds for the Central Universities under grant No.14CX06009A at China University of Petroleum
文摘Security problem is an important issue for Wireless Sensor Network.The paper focuses on the privacy protection of WSN applications.An anonymity enhancement tactic based on pseudonym mechanism is presented for clustered Wireless Sensor Network,which provides anonymity for both the sensors within a cluster and the cluster head nodes.Simulation experiments are launched through NS2 platform to validate the anonymity performance.The theoretical analysis and empirical study imply that the proposed scheme based on pseudonym can protect the privacies of both the sensor nodes and the cluster head nodes.The work is valuable and the experimental results are convincible.
基金The National High-Tech Research and Development (863) Program of China (No. 2005AA145110, No. 2006AA01Z436) The Natural Science Foundation of Shanghai (No. 05ZR14083) The Pudong New Area Technology Innovation Public Service Platform of China (No. PDPT2005-04)
文摘Trust is one of the most important security requirements in the design and implementation of peer-to-peer （P2P） systems. In an environment where peers＇ identity privacy is important, it may conflict with trustworthiness that is based on the knowledge related to the peer＇s identity, while identity privacy is usually achieved by hiding such knowledge. A trust model based on trusted computing （TC） technology was proposed to enhance the identity privacy of peers during the trustworthiness evaluation process between peers from different groups. The simulation results show that, the model can be implemented in an efficient way, and when the degree of anonymity within group （DAWG） is up to 0.6 and the percentage of malicious peers is up to 70%7 the service selection failure rate is less than 0.15.
文摘In this paper, we proposed an anonymity scheme based on pseudonym where peers are motivated not to share their identity. Compared with precious scheme such as RuP （Reputation using Pseudonyms）, our scheme can reduce its overhead and minimize the trusted center＇s involvement.
基金the National High Technology Research and Development Program (863) of China(No. 07QA14033)the National Natural Science Foundation of China(No.60702047)
文摘In peer-to-peer (P2P) reputation systems,each peer's trustworthiness is evaluated based on its pseudonym's rating values given by other peers. Since it is assumed that each peer has a long lived pseudonym,all the transactions conducted by the same peer may be linked by its pseudonym. Therefore,one of the fundamental challenges in P2P reputation systems is to protect peers' identity privacy. In this paper,we present two independent anonymity protocols to achieve all the peers' anonymity by changing pseudonym with the help of a trusted third party (TTP) server. Compared with RuP (Reputation using Pseudonym),an existing representative scheme,our protocols reduce the server's cost in two different ways. First,we propose a protocol using blind signature scheme as in RuP. The protocol improves the blind signature scheme and assessment of macro-node values,and reduces the server's cost by half in terms of encryption and decryption operations and message overhead. Second,we propose another protocol,group-confusion protocol,to further reduce the server's cost.
文摘When initializing cryptographic systems or running cryptographic protocols, the randomness of critical parameters, like keys or key components, is one of the most crucial aspects. But, randomly chosen parameters come with the intrinsic chance of duplicates, which finally may cause cryptographic systems including RSA, ElGamal and Zero-Knowledge proofs to become insecure. When concerning digital identifiers, we need uniqueness in order to correctly identify a specific action or object. Unfortunately we also need randomness here. Without randomness, actions become linkable to each other or to their initiator’s digital identity. So ideally the employed (cryptographic) parameters should fulfill two potentially conflicting requirements simultaneously: randomness and uniqueness. This article proposes an efficient mechanism to provide both attributes at the same time without highly constraining the first one and never violating the second one. After defining five requirements on random number generators and discussing related work, we will describe the core concept of the generation mechanism. Subsequently we will prove the postulated properties (security, randomness, uniqueness, efficiency and privacy protection) and present some application scenarios including system-wide unique parameters, cryptographic keys and components, identifiers and digital pseudonyms.
