Secure Processor Consistent with Both Foreign Software Protection and User Privacy Protection (Transcript of Discussion)

We developed a secure processor that protects foreign software running on an open source operating system (OS). The implementation of such a processor has not been reported yet. The processor is called L-MSP (License-controlling Multi-vendor Secure Processor). In this paper, the relationship between software protection and user privacy is discussed. In general, software protection enables secure distributed computing and copyright protection, but the software might violate user privacy. In the L-MSP system, user privacy is able to be protected by security sandbox and related OS mechanisms which is implemented in an open source. Thus transparency of user privacy protection can be assured on the system.

With the increasing use of information technology in various fields, including e-commerce, ensuring user data and privacy protection is crucial for companies like Tokopedia, one of the largest e-commerce companies in Indonesia. This research aims to identify Tokopedia's security management system and its challenges in protecting user data and privacy. The study utilizes a literature review methodology, analyzing various documents, books, and journals related to Tokopedia's security management system. The research objectives are to understand the system's effectiveness, challenges, and Tokopedia's efforts to improve data and privacy protection. Tokopedia has prioritized information security since its establishment, implementing tight security measures, and continuously improving them. Tokopedia Shield, a security feature introduced in 2015, has significantly reduced fraud risk in the platform. Additionally, the company has taken several steps to secure user data, such as data encryption, access restriction, and password quality enhancement. Tokopedia continuously develops its security system, incorporating the latest technologies such as Artificial Intelligence (AI) and Big Data Analytics to detect potential threats early and improve the security system's responsiveness.

Recently proposed trusted processor model is a promising model for building secure applications. While effective designs have been proposed for protecting data confidentiality and data integrity in such environments, an important security criterion -- user privacy is usually neglected in current designs. Due to the increasing concern of privacy protection in the Internet era, such deficiency can hinder the adoption of the new model.In this paper, we identify the threat model to user privacy and propose a new scheme for user privacy protection. In addition to providing the same ability in protecting data confidentiality and data integrity, the new scheme effectively protects user privacy and only introduces very low overhead.

The increasing presence of renewable sources requires power grid operators to continuously monitor electricity generation and demand in order to maintain the grid's stability. To this end, smart meters have been deployed to collect realtime information about the current grid load and forward it to the utility in a timely manner. High resolution smart meter data can however reveal the nature of appliances and their mode of operation with high accuracy, and thus endanger user privacy. In this paper, we investigate the impact on user privacy when the consumption data collected by distributed smart metering devices are preprocessed prior to their usage. We therefore assess the impact on the successful classification of appliances when sensor readings are (1) quantized, (2) down-sampled at a lower sampling rate, and (3) averaged by means of an FIR filter. Our evaluation shows that a combination of these preprocessing steps can provide a balanced trade-off that is in the interests of both users (privacy protection) and utilities (near real-time information).

With the rise of digital images in our daily lives, there is a growing need to provide an image trading market where people can monetize their images and get desired images at prices that fit their budget. Those images are usually uploaded and stored onto centralized image trading service providers’ servers and the transactions for image trading are processed by these providers. Unfortunately, transaction unfairness and users’ privacy breaches have become major concerns since the service providers might be untrusted and able to manipulate image trading prices and infer users’ private information. Recently, several approaches have been proposed to address the unfairness issue by using the decentralized ledger technique and smart contract, but users’ privacy protection is not considered. In this paper, we propose a fair and privacy-preserving protocol that supports image fair exchange and protect user privacy. In particular, we exploit blockchain and Merkle tree to construct a fair image trading protocol with low communication overhead based on smart contract, which serves as an external judge that resolves disputes between buyers and sellers in image transactions. Moreover, we extend a popular short group signature scheme to protect users’ identity privacy, prevent linkability of transactions from being inferred, and ensure traceability of malicious users who may sell fake images and/or refuse to pay. Finally, we design and build a practical and open-source image trading system to evaluate the performance of our proposed protocol. Experimental results demonstrate its effectiveness and efficiency in real-world applications.

One of the most important security threats in Content Centric Networking (CCN) is cache privacy disclosure, where an adversary can obtain the privacy information of a legitimate user through timing attack. In view of this security problem, we propose a cache privacy protection strategy based on content privacy and user security classification (CPUSC). While protecting user privacy, CPUSC also takes into account the efficiency of content distribution. Firstly, CPUSC starting from user's subjective point of view to determine content privacy level. Secondly, the router in the system assigns a credit value to each user according to the user's behavior and sets a security level for each of them. Then, in the light of the credit value, the user's security level can be defined. Finally, a latency is set for each content response based on the content privacy level and the user's security level. Performance analysis show that the proposed scheme can effectively protect the user's privacy while ensuring the content distribution efficiency of the network.

Since the development of location-based services, privacy-preserving has gained special attention and many algorithms aiming at protecting user's privacy have been created such as obfuscation or k-anonymity. However, all of these researches separate the algorithms from the database level. Thus, the querying process has two phases, querying the database to retrieve the accurate positions of users and then modifying them to decrease the quality of location information. This two-phase process is time-consuming due to the number of disk accesses required to retrieve the user's exact position. We address this problem by proposing OST-tree, a structure that embeds the user's privacy policy in its node and obfuscates the spatio-temporal data. Experiments show that OST-tree provides an improvement over the algorithm separated from the database level for both querying costs and user's privacy protection.

Secure processor architecture enables tamper-proof protection on software that addresses many difficult security problems such as reverse-engineering prevention, trusted computing, secure mobile agents by providing a secure computing environment that is resistant to both physical tampering and software exploits. Two essential features offered by a secure processor are software encryption for protecting software privacy and integrity verification for preventing tampering of the protected software. Despite a number of secure processor designs have been proposed, the delicate relationship between privacy and integrity protection in the context of modern out-of-order processor design is not well understood. This paper aims to remedy this research deficiency by evaluating different designs that integrate software decryption and integrity verification into an out-of-order pipeline. Our paper provides an in-depth analysis of the security and performance trade-offs, implications of several designs in the context of memory fetch side-channel exploits. Among the evaluated spectrum of design alternatives are: (1) authentication-then-issue, (2) authentication-then-commit, (3) authentication-then-write, (4) authentication-then-fetch, and (5) authentication-then-commit + address obfuscation. Performance of various designs was evaluated using a cycle based processor model and SPEC 2000 benchmark suite

Copyright law continues to provide the favored protection for software, including programs of all kinds, microcode and the screen imagery of video games and computer interfaces. However, patent protection for nonobvious software inventions is increasingly available as additional or alternative protection in many industrial countries. In countries other than the US, patent protection for computer programs requires a statement of combination with implementing hardware, but the hardware itself must be novel in only a very few countries. The US imposes the most stringent disclosure requirements, requiring an inventor to describe the best mode for carrying out his invention, in effect calling for source code or, at a minimum, a detailed flow diagram. Copyright law, although protecting only 'expression' and not any concept or idea in itself, has thus far been implemented in US court decisions so as to provide a reasonable degree of protection, providing an incentive for innovative work without preventing the creation of new works to perform required computer functions. Recent proposals for specially tailored laws to permit 'reverse engineering' or copying of programs that are deemed industry standards are unnecessary and counterproductive. >

Patient can obtain sorts of health-care delivery services via Telecare Medical Information Systems (TMIS). Authentication, security, patient's privacy protection and data confidentiality are important for patient or doctor accessing to Electronic Medical Records (EMR). In 2012, Chen et al. showed that Khan et al.'s dynamic ID-based authentication scheme has some weaknesses and proposed an improved scheme, and they claimed that their scheme is more suitable for TMIS. However, we show that Chen et al.'s scheme also has some weaknesses. In particular, Chen et al.'s scheme does not provide user's privacy protection and perfect forward secrecy, is vulnerable to off-line password guessing attack and impersonation attack once user's smart card is compromised. Further, we propose a secure anonymity authentication scheme to overcome their weaknesses even an adversary can know all information stored in smart card.

ABSTRACTSmart grid is a new type of power grid that integrates advanced information communication technology and measurement technology into conventional power grids. It provides an efficient and intelligent energy service. However, the entities in the smart grid are easily hacked and sometimes even collapsed; then the whole grid system could be jeopardized. Therefore, the security of user privacy and communication in smart grids is still facing great challenges. In this paper, we propose a robust, distributed, and privacy-preserving aggregation scheme, RDPA for short, which uses the homomorphic Paillier cryptosystem technique combined with signature technique to ensure the confidentiality and integrality of users’ electricity consumption. In addition, we employ the threshold secret sharing technology and secret factors injection method to improve the robustness of smart grid systems. For example, RDPA can still run well even when a gateway is hacked. The experimental results and analysis demonstrate that RDPA can resist various attacks and protect user privacy, and its security and performance are better than other related schemes.

FedCDR: Privacy-preserving federated cross-domain recommendation

In recent years, due to the emergence of COVID-19(Corona Virus Disease 2019), how to have a higher quality medical environment has become a troubling problem. The proposal of the Office of the State Council on promoting the development of “Internet plus medical and health” has brought a lot of convenience to the public, but also brought about the problem of data leakage and other user privacy protection. In view of the problems of user's personal information storage and user's health data processing in the medical and health context, how to ensure that these data are not stolen, leaked or tampered with has become a major challenge faced by current researchers. Based on the privacy protection of users in the context of health care, this paper classifies the current privacy protection mechanisms, and introduces the latest progress of related technologies. Finally, according to the integrated information, the research direction of privacy protection technologies in the field of health care is prospected.

Digital Currency for Central Bank is becoming an important policy for country. CBDC (Central Bank Digital Currency) model should take advantages in the supervision, payment and consumption. Blockchain possesses the feature of de-centrality, tamper-resistant, and traceability. So this paper attempts to use the blockchain as the fundamental technology of CBDC. However, the challenges such as the protection for users privacy, supervision and transaction speed should be overcome. This paper proposes a CBDC model called MBDC which is based on the permission blockchain technology. The model makes use of the multi-blockchain architecture and ChainID to improve the models scalability and process payments more quickly. In this model, central bank and commercial banks and other agencies build and maintain the blockchain. On one hand, central bank could master the issuance of currency. On the other hand, relying on the user account address protocol, central bank could separate the users identity and transaction information. In this way, central bank could avoid double-spending issues and protect users privacy. In addition, the establishment of DC (Data Center) and layers of supervision provide strong supervision for the model. Finally, we also demonstrate, both theoretically and experimentally, the performance of model on the scalability and the speed of transaction execution etc.

In the ever-evolving digital era, the importance of cyber law in safeguarding user privacy cannot be overstated. As a distinct legal discipline, cyber law examines regulations that oversee activities in cyberspace, offering legal protection regarding personal data and user privacy. Referring to various credible sources, this article evaluates the role of cyber law in protecting user privacy in the Indonesian context. The article discusses regulations such as the Electronic Information and Transactions Law (UU ITE), the Government Regulation on Electronic Systems, and the Personal Data Protection Bill. The main elements analyzed include supervision, regulation, resolution, and protection of user rights when facing digital security challenges. The examination shows that cyber law plays a significant role in protecting individuals' personal information, thereby encouraging safer and more trustworthy digital services. Furthermore, the article points out the various challenges faced in enforcing cyber law, such as administrative constraints, inadequate digital literacy, and limited access to justice, especially for those without legal knowledge or support. Consequently, to improve the effectiveness of cyber law, continued efforts are needed to strengthen the digital regulatory framework and provide more comprehensive user privacy protection. This perspective seeks to enhance understanding of the significance of cyber law in safeguarding privacy and proposes recommendations for governments and relevant organizations in addressing privacy issues in the digital age.