The objective of this paper is to give a comprehensive introduction to applied cryptography with an engineer or computer scientist in mind. The emphasis is on the knowledge needed to create practical systems which supports integrity, confidentiality, or authenticity. Topics covered includes an introduction to the concepts in cryptography, attacks against cryptographic systems, key use and handling, random bit generation, encryption modes, and message authentication codes. Recommendations on algorithms and further reading is given in the end of the paper. This paper should make the reader able to build, understand and evaluate system descriptions and designs based on the cryptographic components described in the paper.

[서평]「Applied Cryptography」

Normal accidents. Living with high-risk technologies

To deal with the increasing complexity of software systems and uncertainty of their environments, software engineers have turned to self-adaptivity. Self-adaptive systems are capable of dealing with a continuously changing environment and emerging requirements that may be unknown at design-time. However, building such systems cost-effectively and in a predictable manner is a major engineering challenge. In this paper, we explore the state-of-the-art in engineering self-adaptive systems and identify potential improvements in the design process.

Our most important finding is that in designing self-adaptive systems, the feedback loops that control self-adaptation must become first-class entities. We explore feedback loops from the perspective of control engineering and within existing self-adaptive systems in nature and biology. Finally, we identify the critical challenges our community must address to enable systematic and well-organized engineering of self-adaptive and self-managing software systems.

/pdf/engineering-self-adaptive-systems-through-feedback-loops-2emar8k20k.pdf

Engineering Self-Adaptive Systems through Feedback Loops

Social-networking sites (SNS) such as Facebook and Twitter are growing in both popularity and number of users For advertisers and the sites themselves, it is crucial that users accept advertising as a component of the SNS Anecdotal evidence indicates that social-networking advertising (SNA) can be effective when users accept it, but the perception of excessive commercialization may lead to user abandonment Empirical support for these propositions, however, is lacking Based on media uses and gratification theory, the authors propose and empirically test a model of content-related, structural, and socialization factors that affect users9 attitudes toward SNA

Friends, Fans, and Followers: Do Ads Work on Social Networks?

The Health Insurance Portability and Accountability Act, also known as HIPAA, was first delivered to congress in 1996 and consisted of just two Titles. It was designed to protect health insurance coverage for workers and their families while between jobs. It establishes standards for electronic health care transactions and addresses the issues of privacy and security when dealing with Protected Health Information (PHI). HIPAA is applicable only in the United States of America.

The Health Insurance Portability and Accountability Act.

Enabling novel ways to personalize the relationship with customers without sacrificing their privacy.

Personalization in privacy-aware highly dynamic systems

Process mining stands for a set of techniques to analyze business process models and logs. However, the extent to which it can be used for security auditing has not been investigated. Focusing on conformance checking and its support in ProM, this paper reports on a case-study in the financial sector applying this technology for the auditing of relevant security requirements. Although the vast majority of requirements could be verified, we notice a large manual effort to carry out the analysis. Moreover, we identify a class of security requirements that demands process discovery for analysis, and elaborate on ways in which process mining could be extended to better suit security analyses.

http://files.telematik.uni-freiburg.de/publications/sac12.pdf

On the exploitation of process mining for security audits: the conformance checking case

A key problem in the deployment of large-scale, reliable cloud computing concerns the difficulty to certify the compliance of business processes operating in the cloud. Standard audit procedures such as SAS-70 and SAS-117 are hard to conduct for cloud-based processes. The paper proposes a novel approach to certify the compliance of business processes with regulatory requirements. The approach translates process models into their corresponding Petri net representations and checks them against requirements also expressed in this formalism. Being based on Petri nets, the approach provides well-founded evidence on adherence and, in case of noncompliance, indicates the possible vulnerabilities.

/pdf/automated-certification-for-compliant-cloud-based-business-54t36hhc6r.pdf

Automated Certification for Compliant Cloud-based Business Processes

The advent of cloud computing allows the provision of several commodities "as-a-service". For enterprise systems, a particularly interesting business model is the offer of configurable business processes for different consumers, which can then outsource their execution onto the cloud. Although such an outsourcing harbors a vast economic potential, both external and internal auditing pose a general challenge for their acceptance. This paper reviews the role of remote auditing as a means to address this issue and indicates research directions for automated tool support.

Business Process as a Service: Chances for Remote Auditing

Since location information is considered as personal information, location privacy has been emerged as one of the most important security concerns. In this paper, we enhance the ‘Share The Secret’ (STS) scheme, a privacy mechanism that segments location information into pieces (shares), distributes the shares to multiple untrustworthy location servers, and reconstructs the original location on authorized entities. We introduce certain policies based on the theory of optimal stopping in order to achieve time-optimized decisions for different levels of privacy. Moreover, we evaluate the performance of STS in terms of communication and computation load, and energy consumption. Experimental results quantify the benefits stemming for STS adoption.

Rafael Accorsi

Papers

Personalization in privacy-aware highly dynamic systems

On the exploitation of process mining for security audits: the conformance checking case

Automated Certification for Compliant Cloud-based Business Processes

Business Process as a Service: Chances for Remote Auditing

Security and Trust Management