Search

Transparency of data processing is often a requirement for compliance to legislation and/or business requirements. Furthermore, it has recognised as a key privacy principle, for example in the European Data Protection Directive. At the same time, transparency of the data processing should be limited to the users involved in order to minimise the leakage of sensitive business information and privacy of the employees (if any) performing the data processing.

In the online world, service providers allow users to upload data to be stored or processed. In some cases, privacy will become an essential feature. Sensitive content can be the data provided to or the services used at the service provider. Logging of the actions of the service providers can therefore also generate privacy-sensitive content. However, to enhance transparency towards users, logging can be a very useful tool. In this paper, we build upon the concept of distributed privacy-preserving log trails. The trust in such a system lies in the storage of a vector in a certain register stored in software. With a piece of malicious software, a hacker or curious user could misuse this register to learn about a certain process or to learn for whom a service is performed, although the scheme ensures forward-unlinkability and forward-integrity. In this paper, we strengthen the conventional software approach by implementing the vector in external hardware. This hardens the scheme further, and reduces the level to which the log server has to be trusted, at the cost of additional but solvable security threats.

This paper presents the implementation of a home banking solution for mobile phones, using a secure micro-SD card. This card is used to implement a strong online authentication with the bank server, based on a public key infrastructure, providing a flexible way to add entities --- users as well as banks --- to the ecosystem. The implemented system is running on Android mobile phones, taking into account the possible weaknesses at operating system level. The microSD card is running Java Card 2.2.1. Different security features are discussed that considerably improve upon existing mobile banking systems and allow for seamless integration of our system in the current smart phone context.

Social network sites (SNS) allow users to share information with friends, family, and other contacts. However, current SNS sites such as Facebook or Twitter assume that users trust SNS providers with the access control of their data. In this paper we propose Scramble, the implementation of a SNS-independent Firefox extension that allows users to enforce access control over their data. Scramble lets users define access control lists (ACL) of authorised users for each piece of data, based on their preferences. The definition of ACL is facilitated through the possibility of dynamically defining contact groups. In turn, the confidentiality and integrity of one data item is enforced using cryptographic techniques. When accessing a SNS that contains data encrypted using Scramble, the plugin transparently decrypts and checks integrity of the encrypted content.

Privacy protection tools can be characterised by the number of parties that have to cooperate so that the tools work and achieve the desired effect [Pfi01]: Some privacy protection tools can be used stand-alone, without the need for the cooperation of other parties. Others require that the communication partners use the same tools. Some tools only function when being supported by an appropriate infrastructure that quite often is currently not in place.

In 2008, Wan et al. presented an anonymous ID-based group key agreement scheme for wireless networks, for which they claim that it ensures anonymity and unlinkability of the group members, as well as forward and backward secrecy of the group session key. In this paper, we show that forward and backward secrecy do not hold for the protocol. We propose a correction that introduces a shielding factor that protects each member's input to the group key. we also introduce a new feature that assures the correctness of the key as computed by all group members. This results in an increased computation cost, due to extra public key operations, and a similar communication cost. We also show in which practical setting the protocol can be deployed. © 2011 Springer-Verlag Berlin Heidelberg. ispartof: pages:214-222 ispartof: Lecture Notes in Computer Science vol:6543 pages:214-222 ispartof: SOFSEM 2011 location:SLOVAKIA, Novy Smokovec date:22 Jan - 28 Jan 2011 status: published

In this paper a practical offline payment system based on digital vouchers using Near Field Communication (NFC) in mobile phones is presented. This work was performed within the scope of the IBBT NFC-Voucher project. The goal of the project is to assess the feasibility of such a system, from a technical and security perspective, using tangible NFC devices such as the Nokia 6131 NFC mobile phone. This involved an in-depth technical and security analysis of all actors in the system and a rigorous elaboration of the practical security requirements and assumptions. In the architecture implementing and connecting all the different actors of this voucher payment system, no compromises regarding security were made. At device level all sensitive data is stored in a Secure Element (SE) with limited access for non-authorised users. The backbone and voucher transfer system uses a classical Public Key Infrastructure (PKI), such that only trusted and registered parties can handle and transfer vouchers. After having implemented this system, we conclude that it is possible to build an off-line payment system for mobile phones without compromising security, but that it remains quite challenging, given the current limitations on speed, available memory and security functionality.

The technique of electronic time-stamping allows a client to get an electronic proof of the existence of a document at a speci.c point in time. A simple way to achieve this is to produce a digital signature over the pair (document,time). Linked time-stamps have an advantage over these simple time-stamps because they construct a veri.able link between time-stamps. In this paper, we discuss how to include linked time-stamps in the OASIS Digital Signature Services standard. We highlight the problem points when introducing a sub-pro.le of this standard, and we describe some additional structures that are needed to accommodate a broad range of linked time-stamping schemes.

In the last couple of years, several European countries have started projects which intend to provide their citizens with electronic identity cards, driven by the European Directive on Electronic Signatures. One can expect that within a few years, these smart cards will be used in a wide variety of applications. In this paper, we describe the common threats that can be identified when using security tokens such as smart cards in web applications. We illustrate each of these threats with a few attack scenarios. This paper is part of a series of papers, written by several academic teams. Each paper focuses on one particular technological building block for web applications.

This article gives a brief introduction to the Belgian EID card project commonly referred to as “Belpic.” This introduction includes an overview of the history of the project, details on the visual and cryptographic aspects of the EID cards, a discussion of the different sub-CAs involved, together with the card issuing process.