This paper focuses on fine-grained,secure access to FAIR data,for which we propose ontology-based data access policies.These policies take into account both the FAIR aspects of the data relevant to access(such as prov...This paper focuses on fine-grained,secure access to FAIR data,for which we propose ontology-based data access policies.These policies take into account both the FAIR aspects of the data relevant to access(such as provenance and licence),expressed as metadata,and additional metadata describing users.With this tripartite approach(data,associated metadata expressing FAIR information,and additional metadata about users),secure and controlled access to object data can be obtained.This yields a security dimension to the“A”(accessible)in FAIR,which is clearly needed in domains like security and intelligence.These domains need data to be shared under tight controls,with widely varying individual access rights.In this paper,we propose an approach called Ontology-Based Access Control(OBAC),which utilizes concepts and relations from a data set's domain ontology.We argue that ontology-based access policies contribute to data reusability and can be reconciled with privacy-aware data access policies.We illustrate our OBAC approach through a proof-of-concept and propose that OBAC to be adopted as a best practice for access management of FAIR data.展开更多
分布式计算有很多应用需要参与各方协同执行集合的一些计算但不泄露各自数据集的信息.保密集合交集(private set intersection,PSI)计算已经成为数据匹配、数据挖掘、推荐系统等应用中保护用户隐私的一个重要工具.本文的主要工作是构造...分布式计算有很多应用需要参与各方协同执行集合的一些计算但不泄露各自数据集的信息.保密集合交集(private set intersection,PSI)计算已经成为数据匹配、数据挖掘、推荐系统等应用中保护用户隐私的一个重要工具.本文的主要工作是构造无匹配差错的安全两方保密集合交集运算协议.着重探讨三个问题:(1)开发构造无匹配差错的两方保密集合交集计算所需要的工具(①面向有理数且具有语义安全性的加密方案,②便于集合匹配计算的称之为集合的定长向量编码方法);(2)无匹配差错的两方保密集合交集计算问题;(3)元素为有理数的保密集合交集计算问题.首先在标准模型下设计了一个能够加密有理数的方案,并证明了该方案能抗自适应性地选择明文攻击;而后又提出了一种便于集合匹配计算的,称之为集合的定长向量编码方法;最后基于有理数加密方案和集合的定长向量编码方法构造了两个面向有理数的、无匹配差错的两方保密集合交集协议.与先前的两方保密集合交集协议相较之,这两个协议不仅解决了无匹配差错的两方保密集合交集计算,还拓展了保密集合交集问题中隐私保护的范畴:除了可以保护各参与方的隐私数据外,还可以保护各参与方隐私数据的数量.展开更多
Mining penetration testing semantic knowledge hidden in vast amounts of raw penetration testing data is of vital importance for automated penetration testing.Associative rule mining,a data mining technique,has been st...Mining penetration testing semantic knowledge hidden in vast amounts of raw penetration testing data is of vital importance for automated penetration testing.Associative rule mining,a data mining technique,has been studied and explored for a long time.However,few studies have focused on knowledge discovery in the penetration testing area.The experimental result reveals that the long-tail distribution of penetration testing data nullifies the effectiveness of associative rule mining algorithms that are based on frequent pattern.To address this problem,a Bayesian inference based penetration semantic knowledge mining algorithm is proposed.First,a directed bipartite graph model,a kind of Bayesian network,is constructed to formalize penetration testing data.Then,we adopt the maximum likelihood estimate method to optimize the model parameters and decompose a large Bayesian network into smaller networks based on conditional independence of variables for improved solution efficiency.Finally,irrelevant variable elimination is adopted to extract penetration semantic knowledge from the conditional probability distribution of the model.The experimental results show that the proposed method can discover penetration semantic knowledge from raw penetration testing data effectively and efficiently.展开更多
Within the framework of UC （universally composable） security, a general method is presented to construct a secure channel protocol with using IND-CVA （indistinguishability of encryption scheme under ciphertext veri...Within the framework of UC （universally composable） security, a general method is presented to construct a secure channel protocol with using IND-CVA （indistinguishability of encryption scheme under ciphertext verification attacks）. A channel protocol with using the method first invokes an ideal keyexchange protocol to get a session key, and then computes the messages with an authenticated encryption scheme. The paper shows that a channel protocol is UC secure if and only if the underlying authenticated encryption scheme is both IND-CVA secure and INT-PTXT secure. The condition about secure channel protocol in this paper is much weaker than IND-CCA secure and INT-CTXT secure. The IND-CVA can be presented for describing the privacy requirements of secure channels in detail. Moreover, the method for designing secure channel protocol in the paper reduces the UC security of secure channels, which are measured by action-simulation in the UC security framework, to the security of authenticated encryption schemes, which are measured semantically.展开更多
To solve the shortage problem of the semantic descrip- tion scope and verification capability existed in the security policy, a semantic description method for the security policy based on ontology is presented. By de...To solve the shortage problem of the semantic descrip- tion scope and verification capability existed in the security policy, a semantic description method for the security policy based on ontology is presented. By defining the basic elements of the security policy, the relationship model between the ontology and the concept of security policy based on the Web ontology language （OWL） is established, so as to construct the semantic description framework of the security policy. Through modeling and reasoning in the Protege, the ontology model of authorization policy is proposed, and the first-order predicate description logic is introduced to the analysis and verification of the model. Results show that the ontology-based semantic description of security policy has better flexibility and practicality.展开更多
基金Part of this work was supported by the Titanium Project(funded by the European Comission under grant agreement 740558)The work was also supported by TNO’s internal research project“ERP AI”.
文摘This paper focuses on fine-grained,secure access to FAIR data,for which we propose ontology-based data access policies.These policies take into account both the FAIR aspects of the data relevant to access(such as provenance and licence),expressed as metadata,and additional metadata describing users.With this tripartite approach(data,associated metadata expressing FAIR information,and additional metadata about users),secure and controlled access to object data can be obtained.This yields a security dimension to the“A”(accessible)in FAIR,which is clearly needed in domains like security and intelligence.These domains need data to be shared under tight controls,with widely varying individual access rights.In this paper,we propose an approach called Ontology-Based Access Control(OBAC),which utilizes concepts and relations from a data set's domain ontology.We argue that ontology-based access policies contribute to data reusability and can be reconciled with privacy-aware data access policies.We illustrate our OBAC approach through a proof-of-concept and propose that OBAC to be adopted as a best practice for access management of FAIR data.
文摘分布式计算有很多应用需要参与各方协同执行集合的一些计算但不泄露各自数据集的信息.保密集合交集(private set intersection,PSI)计算已经成为数据匹配、数据挖掘、推荐系统等应用中保护用户隐私的一个重要工具.本文的主要工作是构造无匹配差错的安全两方保密集合交集运算协议.着重探讨三个问题:(1)开发构造无匹配差错的两方保密集合交集计算所需要的工具(①面向有理数且具有语义安全性的加密方案,②便于集合匹配计算的称之为集合的定长向量编码方法);(2)无匹配差错的两方保密集合交集计算问题;(3)元素为有理数的保密集合交集计算问题.首先在标准模型下设计了一个能够加密有理数的方案,并证明了该方案能抗自适应性地选择明文攻击;而后又提出了一种便于集合匹配计算的,称之为集合的定长向量编码方法;最后基于有理数加密方案和集合的定长向量编码方法构造了两个面向有理数的、无匹配差错的两方保密集合交集协议.与先前的两方保密集合交集协议相较之,这两个协议不仅解决了无匹配差错的两方保密集合交集计算,还拓展了保密集合交集问题中隐私保护的范畴:除了可以保护各参与方的隐私数据外,还可以保护各参与方隐私数据的数量.
基金the National Natural Science Foundation of China No.61502528.
文摘Mining penetration testing semantic knowledge hidden in vast amounts of raw penetration testing data is of vital importance for automated penetration testing.Associative rule mining,a data mining technique,has been studied and explored for a long time.However,few studies have focused on knowledge discovery in the penetration testing area.The experimental result reveals that the long-tail distribution of penetration testing data nullifies the effectiveness of associative rule mining algorithms that are based on frequent pattern.To address this problem,a Bayesian inference based penetration semantic knowledge mining algorithm is proposed.First,a directed bipartite graph model,a kind of Bayesian network,is constructed to formalize penetration testing data.Then,we adopt the maximum likelihood estimate method to optimize the model parameters and decompose a large Bayesian network into smaller networks based on conditional independence of variables for improved solution efficiency.Finally,irrelevant variable elimination is adopted to extract penetration semantic knowledge from the conditional probability distribution of the model.The experimental results show that the proposed method can discover penetration semantic knowledge from raw penetration testing data effectively and efficiently.
基金Supported by the National Basic Research Program of China (Grant No. G2002cb312205)
文摘Within the framework of UC （universally composable） security, a general method is presented to construct a secure channel protocol with using IND-CVA （indistinguishability of encryption scheme under ciphertext verification attacks）. A channel protocol with using the method first invokes an ideal keyexchange protocol to get a session key, and then computes the messages with an authenticated encryption scheme. The paper shows that a channel protocol is UC secure if and only if the underlying authenticated encryption scheme is both IND-CVA secure and INT-PTXT secure. The condition about secure channel protocol in this paper is much weaker than IND-CCA secure and INT-CTXT secure. The IND-CVA can be presented for describing the privacy requirements of secure channels in detail. Moreover, the method for designing secure channel protocol in the paper reduces the UC security of secure channels, which are measured by action-simulation in the UC security framework, to the security of authenticated encryption schemes, which are measured semantically.
基金Supported by the National Natural Science Foundation of China(61462020,61363006,61163057)the Guangxi Experiment Center of Information Science Foundation(20130329)the Guangxi Natural Science Foundation(2014GXNSFAA118375)
文摘To solve the shortage problem of the semantic descrip- tion scope and verification capability existed in the security policy, a semantic description method for the security policy based on ontology is presented. By defining the basic elements of the security policy, the relationship model between the ontology and the concept of security policy based on the Web ontology language （OWL） is established, so as to construct the semantic description framework of the security policy. Through modeling and reasoning in the Protege, the ontology model of authorization policy is proposed, and the first-order predicate description logic is introduced to the analysis and verification of the model. Results show that the ontology-based semantic description of security policy has better flexibility and practicality.
