With the remarkable progress in microelectronics and low-power semiconductor technologies, Radio Frequency IDentification technology (RFID) has moved from obscurity into mainstream applications, which essentially provides an indispensable foundation to realize ubiquitous computing and machine perception. However, the catching and exclusive characteristics of RFID systems introduce growing security and privacy concerns. To address these issues are particularly challenging for low-cost RFID systems, where tags are extremely constrained in resources, power and cost. The primary reasons are: (1) the security requirements of low-cost RFID systems are even more rigorous due to large operation range and mass deployment; and (2) the passive tags' modest capabilities and the necessity to keep their prices low present a novel problem that goes beyond the well-studied problems of traditional cryptography. This thesis presents our research results on the design and the analysis of security schemes for low-cost RFID systems. Motivated by the recent attention on exploiting physical layer resources in the design of security schemes, we investigate how to solve the eavesdropping, modification and one particular type of relay attacks toward the tag-to-reader communication in passive RFID systems without requiring lightweight ciphers. To this end, we propose a novel physical layer scheme, called Backscatter modulation- and Uncoordinated frequency hopping-assisted Physical Layer Enhancement (BUPLE). The idea behind it is to use the amplitude of the carrier to transmit messages as normal, while to utilize its periodically varied frequency to hide the transmission from the eavesdropper/relayer and to exploit a random sequence modulated to the carrier's phase to defeat malicious modifications. We further improve its eavesdropping resistance through the coding in the physical layer, since BUPLE ensures that the tag-to-eavesdropper channel is strictly noisier than the tag-to-reader channel. Three practical Wiretap Channel Codes (WCCs) for passive tags are then proposed: two of them are constructed from linear error correcting codes, and the other one is constructed from a resilient vector Boolean function. The security and usability of BUPLE in conjunction with WCCs are further confirmed by our proof-of-concept implementation and testing. Eavesdropping the communication between a legitimate reader and a victim tag to obtain raw data is a basic tool for the adversary. However, given the fundamentality of eavesdropping attacks, there are limited prior work investigating its intension and extension for passive RFID systems. To this end, we firstly identified a brand-new attack, working at physical layer, against backscattered RFID communications, called unidirectional active eavesdropping, which defeats the customary impression that eavesdropping is a ``passive" attack. To launch this attack, the adversary transmits an un-modulated carrier (called blank carrier) at a certain frequency while a valid reader and a tag interacts at another frequency channel. Once the tag modulates the amplitude of reader's signal, it causes fluctuations on the blank carrier as well. By carefully examining the amplitude of the backscattered versions of the blank carrier and the reader's carrier, the adversary could intercept the ongoing reader-tag communication with either significantly lower bit error rate or from a significantly greater distance away. Our concept is demonstrated and empirically analyzed towards a popular low-cost RFID system, i.e., EPC Gen2. Although active eavesdropping in general is not trivial to be prohibited, for a particular type of active eavesdropper, namely a greedy proactive eavesdropper, we propose a simple countermeasure without introducing extra cost to current RFID systems. The needs of cryptographic primitives on constraint devices keep increasing with the growing pervasiveness of these devices. One recent design of the lightweight block cipher is Hummingbird-2. We study its cryptographic strength under a novel technique we developed, called Differential Sequence Attack (DSA), and present the first cryptanalytic result on this cipher. In particular, our full attack can be divided into two phases: preparation phase and key recovery phase. During the key recovery phase, we exploit the fact that the differential sequence for the last round of Hummingbird-2 can be retrieved by querying the full cipher, due to which, the search space of the secret key can be significantly reduced. Thus, by attacking the encryption (decryption resp.) of Hummingbird-2, our algorithm recovers 36-bit (another 28-bit resp.) out of 128-bit key with $2^{68}$ ($2^{60}$ resp.) time complexity if particular differential conditions of the internal states and of the keys at one round can be imposed. Additionally, the rest 64-bit of the key can be exhaustively searched and the overall time complexity is dominated by $2^{68}$. During the preparation phase, by investing $2^{81}$ effort in time, the adversary is able to create the differential conditions required in the key recovery phase with at least 0.5 probability. As an additional effort, we examine the cryptanalytic strength of another lightweight candidate known as A2U2, which is the most lightweight cryptographic primitive proposed so far for low-cost tags. Our chosen-plaintext-attack fully breaks this cipher by recovering its secret key with only querying the encryption twice on the victim tag and solving 32 sparse systems of linear equations (where each system has 56 unknowns and around 28 unknowns can be directly obtained without computation) in the worst case, which takes around 0.16 second on a Thinkpad T410 laptop.

Improving road safety and traffic efficiency has been a long-term endeavor for the government, automobile industry and academia. Recently, the U.S. Federal Communication Commission (FCC) has allocated a 75 MHz spectrum at 5.9 GHz for vehicular communications, opening a new door to combat the road fatalities by letting vehicles communicate to each other on the roads. Those communicating vehicles form a huge Ad Hoc Network, namely Vehicular Ad Hoc Network (VANET). In VANETs, a variety of applications ranging from the safety related (e.g. emergence report, collision warning) to the non-safety related (e.g., delay tolerant network, infortainment sharing) are enabled by vehicle-to-vehicle (V-2-V) and vehicle-to-roadside (V-2-I) communications. However, the flourish of VANETs still hinges on fully understanding and managing the challenging issues over which the public show concern, particularly, security and privacy preservation issues. If the traffic related messages are not authenticated and integrity-protected in VANETs, a single bogus and/or malicious message can potentially incur a terrible traffic accident. In addition, considering VANET is usually implemented in civilian scenarios where locations of vehicles are closely related to drivers, VANET cannot be widely accepted by the public if VANET discloses the privacy information of the drivers, i.e., identity privacy and location privacy. Therefore, security and privacy preservation must be well addressed prior to its wide acceptance. Over the past years, much research has been done on considering VANET's unique characteristics and addressed some security and privacy issues in VANETs; however, little of it has taken the social characteristics of VANET into consideration. In VANETs, vehicles are usually driven in a city environment, and thus we can envision that the mobility of vehicles directly reflects drivers' social preferences and daily tasks, for example, the places where they usually go for shopping or work. Due to these human factors in VANETs, not only the safety related applications but also the non-safety related applications will have some social characteristics. In this thesis, we emphasize VANET's social characteristics and introduce the concept of vehicular social network (VSN), where both the safety and non-safety related applications in VANETs are influenced by human factors including human mobility, human self-interest status, and human preferences. In particular, we carry on research on vehicular delay tolerant networks and infotainment sharing --- two important non-safety related applications of VSN, and address the challenging security and privacy issues related to them. The main contributions are, i) taking the human mobility into consideration, we first propose a novel social based privacy-preserving packet forwarding protocol, called SPRING, for vehicular delay tolerant network, which is characterized by deploying roadside units (RSUs) at high social intersections to assist in packet forwarding. With the help of high-social RSUs, the probability of packet drop is dramatically reduced and as a result high reliability of packet forwarding in vehicular delay tolerant network can be achieved. In addition, the SPRING protocol also achieves conditional privacy preservation and resist most attacks facing vehicular delay tolerant network, such as packet analysis attack, packet tracing attack, and black (grey) hole attacks. Furthermore, based on the ``Sacrificing the Plum Tree for the Peach Tree" --- one of the Thirty-Six Strategies of Ancient China, we also propose a socialspot-based packet forwarding (SPF) protocol for protecting receiver-location privacy, and present an effective pseudonyms changing at social spots strategy, called PCS, to facilitate vehicles to achieve high-level location privacy in vehicular social network; ii) to protect the human factor --- interest preference privacy in vehicular social networks, we propose an efficient privacy-preserving protocol, called FLIP, for vehicles to find like-mined ones on the road, which allows two vehicles sharing the common interest to identify each other and establish a shared session key, and at the same time, protects their interest privacy (IP) from other vehicles who do not share the same interest on the road. To generalize the FLIP protocol, we also propose a lightweight privacy-preserving scalar product computation (PPSPC) protocol, which, compared with the previously reported PPSPC protocols, is more efficient in terms of computation and communication overheads; and iii) to deal with the human factor -- self-interest issue in vehicular delay tolerant network, we propose a practical incentive protocol, called Pi, to stimulate self-interest vehicles to cooperate in forwarding bundle packets. Through the adoption of the proper incentive policies, the proposed Pi protocol can not only improve the whole vehicle delay tolerant network's performance in terms of high delivery ratio and low average delay, but also achieve the fairness among vehicles. The research results of the thesis should be useful to the implementation of secure and privacy-preserving vehicular social networks.

The resources and localization abilities available in modern smartphones have provided a huge boost to the popularity of location-based applications. In these applications, users send their current locations to a central service provider and can receive content or an enhanced experience predicated on their provided location. Privacy issues with location- based applications can arise from a central entity being able to store large amounts of information about users (e.g., contact information, attributes) and locations (e.g., available businesses, users present). We propose an architecture for a privacy-friendly location hub to encourage the development of mobile location-based social applications with privacy- preserving features. Our primary goal is to store information such that no entity in our architecture can link a user’s identity to her location. We also aim to decouple storing data from manipulating data for social networking purposes. Other goals include designing an architecture flexible enough to support a wide range of use cases and avoiding considerable client-side computation. Our architecture consists of separate server components for storing information about users and storing information about locations, as well as client devices and optional com- ponents in the cloud for supporting applications. We describe the design of API functions exposed by the server components and demonstrate how they can be used to build some sample mobile location-based social applications. A proof-of-concept implementation is provided with in-depth descriptions of how each function was realized, as well as experi- ments examining the practicality of our architecture. Finally, we present two real-world applications developed on the Android platform to demonstrate how these applications work from a user’s perspective.

While advances to the Internet have enabled users to easily interact and exchange information online, they have also created several opportunities for adversaries to prey on users’ private information. Whether the motivation for data collection is commercial, where service providers sell data for marketers, or political, where a government censors, blocks and tracks its people, or even personal, for cyberstalking purposes, there is no doubt that the consequences of personal information leaks can be severe. Low-latency anonymity networks have thus emerged as a solution to allow people to surf the Internet without the fear of revealing their identities or locations. In order to provide anonymity to users, anonymity networks route users’ traffic through several intermediate relays, which causes unavoidable extra delays. However, although these networks have been originally designed to support interactive applications, due to a variety of design weaknesses, these networks offer anonymity at the expense of further intolerable performance costs, which disincentivize users from adopting these systems. In this thesis, we seek to improve the network performance of low-latency anonymity networks while maintaining the anonymity guarantees they provide to users today. As an experimentation platform, we use Tor, the most widely used privacy-preserving network that empowers people with low-latency anonymous online access. Since its introduction in 2003, Tor has successfully evolved to support hundreds of thousands of users using thousands of volunteer-operated routers run all around the world. Incidents of sudden increases in Tor’s usage, coinciding with global political events, confirm the importance of the Tor network for Internet users today. We identify four key contributors to the performance problems in low-latency anonymity networks, exemplified by Tor, that significantly impact the experience of low-latency application users. We first consider the lack of resources problem due to the resource-constrained routers, and propose multipath routing and traffic splitting to increase throughput and improve load balancing. Second, we explore the poor quality of service problem, which is exacerbated by the existence of bandwidth-consuming greedy applications in the network. We propose online traffic classification as a means of enabling quality of service for every traffic class. Next, we investigate the poor transport design problem and propose a new transport layer design for anonymous communication networks which addresses the drawbacks of previous proposals. Finally, we address the problem of the lack of congestion control by proposing an ATM-style credit-based hop-by-hop flow control algorithm which caps the queue sizes and allows all relays to react to congestion in the network. Our experimental results confirm the significant performance benefits that can be obtained using our privacy-preserving approaches.

This thesis analyzes the rationale, appropriateness and value of the available legal and regulatory means to deal with genetic discrimination in the context of insurance. Insurance is used as a paradigm case for discussing the legal means to address the concerns related to the impact of new medical technologies. A new framework is proposed for evaluating the potential impact of such new technologies on people's ability to participate fully in social life and to have access to important social goods without unfair discrimination based on certain inherited traits. / A "thick" contextual method is used, which involves a detailed description of the medical, social, and legal context of the debate. The approach is based on Michael Walzer's theory of justice, which posits that in assessing the fairness of the distribution of a particular good, one must take into account the nature of the good as determined by the specific socio-historical context in which it obtains its shared meaning. Walzer's theory is used in the thesis to critically analyze the regulatory and legislative means introduced in several countries to curb genetic discrimination. It is further argued that Walzer's contextual analysis resembles the approach taken by the Canadian Supreme Court in the context of anti-discrimination law. Canadian human rights law is analyzed in detail to describe how genetic discrimination could be dealt with under the current provisions and how human rights law can be used to create conditions of substantive equality. The thesis concludes with an analysis of various legal and regulatory options to deal with genetic discrimination and its impact on human rights in the Canadian context. The establishment of a regulatory body is proposed, with the mandate to review the appropriateness of the use of new tests in the context of insurance. I argue that this review process, and the contextual analysis that should be involved in this process, would constitute a useful step towards creating conditions for substantive equality, not only for those who are genetically disabled, but for all those who are affected by real or perceived disabling conditions and stigmatizing traits.

The resources and localization abilities available in modern smartphones have provided a huge boost to the popularity of location-based applications. In these applications, users send their current locations to a central service provider and can receive content or an enhanced experience predicated on their provided location. Privacy issues with location- based applications can arise from a central entity being able to store large amounts of information about users (e.g., contact information, attributes) and locations (e.g., available businesses, users present). We propose an architecture for a privacy-friendly location hub to encourage the development of mobile location-based social applications with privacy- preserving features. Our primary goal is to store information such that no entity in our architecture can link a user’s identity to her location. We also aim to decouple storing data from manipulating data for social networking purposes. Other goals include designing an architecture flexible enough to support a wide range of use cases and avoiding considerable client-side computation. Our architecture consists of separate server components for storing information about users and storing information about locations, as well as client devices and optional com- ponents in the cloud for supporting applications. We describe the design of API functions exposed by the server components and demonstrate how they can be used to build some sample mobile location-based social applications. A proof-of-concept implementation is provided with in-depth descriptions of how each function was realized, as well as experi- ments examining the practicality of our architecture. Finally, we present two real-world applications developed on the Android platform to demonstrate how these applications work from a user’s perspective.

This dissertation addresses research questions related to defining user's trust and risk perceptions associated with social networking usage behavior in relation to the repeated privacy and security breaches. The general research question is explored in the dissertation via the conduct of three related studies. The finding from these three investigations are presented in the results section as 3 essays that collectively examine the social networking sites usage behavior. Essay 1 proposes a conceptual model based on the review of multiple breaches. The review provides a conceptual model which is further analyzed using a quantitative survey in the second essay. Essay 2 measures the trust and risk perceptions associated with different sources of information when presented with multiple breaches. This portion of the research used a quantitative method that included surveying of college students from University of North Texas (UNT) to understand the relation between user's trust and risk perceptions. Essay 3 examines the social networking usage behavior on account of repeated privacy and security breaches. This essay uses the insights from the other two essays to identify the usage behavior and how it is affected. The proposed model was tested using a survey questionnaire method. Results show a significant relationship between the positives, negatives, technology usage, repeated breaches that impacts usage behavior. The dissertation concludes with a summary of how the three essays make a cumulative contribution to the literature as well as providing practical guidance that identifies social networking usage behavior.

This study explores teenager perceptions towards advertising in the online social networking environment. The future of online social networking sites is dependant upon the continued support of advertisers in this new medium, which is linked to the acceptance of advertising on these sites by their targeted audience. This exploratory study used the qualitative research methods of focus groups and in-depth personal interviews to gain insights from the teenager participants. The literature review in Chapter Two examined the previous research into advertising theories, consumer attitudes and issues such as advertising avoidance, advertising as a service and trust and privacy in the online social networking environment. The teenage consumer was also examined as were the influences of social identity theory. From this literature review eleven propositions were formed which provided a structure to the analysis of the research. Chapter Three outlined the multi-method research approach of using focus groups and in-depth interviews. The key findings were outlined in Chapter Four and Chapter Five provides discussion regarding these findings and the implications for theory and advertising practice. The main findings from this study suggest that teenagers have very high levels of advertising avoidance and are sceptical towards advertising on their online social networking sites. They have an inherent distrust of commercial messages in the online social networking environment; however they are extremely trusting with the information that they disclose online. They believe that if their site is classified as private, then the information disclosed on this site is not accessible to anyone. The study explores the reasons behind these views. This research has resulted in the identification of seven motivations behind online social networking use. A new model of advertising avoidance in the online social networking environment is also presented and discussed. This model makes a contribution towards filling the gap in available research on online social networking sites and advertising perception. The findings of this study have also resulted in the identification of the characteristics of online social networking sites as an advertising medium. The newness of online social networking sites coupled with the enthusiastic adoption of online social networking by the teenage demographic means that this exploratory study will be of interest to both academics and practitioners alike.

Research Doctorate - Doctor of Philosophy (PhD) / Due to advances in information processing technology and storage capacity, nowadays huge amount of data is being collected for various data analyses. Data mining techniques, such as classification, are often applied on these data to extract hidden information. During the whole process of data mining the data get exposed to several parties and such an exposure potentially leads to breaches of individual privacy. This thesis presents a comprehensive noise addition technique for protecting individual privacy in a data set used for classification, while maintaining the data quality. We add noise to all attributes, both numerical and categorical, and both to class and non-class, in such a way so that the original patterns are preserved in a perturbed data set. Our technique is also capable of incorporating previously proposed noise addition techniques that maintain the statistical parameters of the data set, including correlations among attributes. Thus the perturbed data set may be used not only for classification but also for statistical analysis. Our proposal has two main advantages. Firstly, as also suggested by our experimental results the perturbed data set maintains the same or very similar patterns as the original data set, as well as the correlations among attributes. While there are some noise addition techniques that maintain the statistical parameters of the data set, to the best of our knowledge this is the first comprehensive technique that preserves the patterns and thus removes the so called Data Mining Bias from the perturbed data set. Secondly, re-identification of the original records directly depends on the amount of noise added, and in general can be made arbitrarily hard, while still preserving the original patterns in the data set. The only exception to this is the case when an intruder knows enough about the record to learn the confidential class value by applying the classifier. However, this is always possible, even when the original record has not been used in the training data set. In other words, providing that enough noise is added, our technique makes the records from the training set as safe as any other previously unseen records of the same kind. In addition to the above contribution, this thesis also explores the suitability of pre-diction accuracy as a sole indicator of data quality, and proposes technique for clustering both categorical values and records containing such values.

Research Doctorate - Doctor of Philosophy (PhD) / The rapid pace of growth in the field of human genetics has left researchers with many new challenges in the area of security and privacy. To encourage participation and foster trust towards research, it is important to ensure that genetic databases are adequately protected. This task is a particularly challenging one for statistical agencies due to the high prevalence of categorical data contained within statistical genetic databases. The absence of natural ordering makes the application of traditional Statistical Disclosure Control (SDC) methods less straightforward, which is why we have proposed a new noise addition technique for categorical values. The main contributions of the thesis are as follows. We provide a comprehensive analysis of the trust relationships that occur between the different stakeholders in a genetic data warehouse system. We also provide a quantifiable model of trust that allows the database manager to granulate the level of protection based on the amount of trust that exists between the stakeholders. To the best of our knowledge, this is the first time that trust has been applied in the SDC context. We propose a privacy protection framework for genetic databases which is designed to deal with the fact that genetic data warehouses typically contain a high proportion of categorical data. The framework includes the use of a clustering technique which allows for the easier application of traditional noise addition techniques for categorical values. Another important contribution of this thesis is a new similarity measure for categorical values, which aims to capture not only the direct similarity between values, but also some sense of transitive similarity. This novel measure also has possible applications in providing a way of ordering categorical values, so that more traditional SDC methods can be more easily applied to them. Our analysis of experimental results also points to a numerical attribute phenomenon, whereby we typically have high similarity between numerical values that are close together, and where the similarity decreases as the absolute value of the difference between numerical values increases. However, some numerical attributes appear to not behave in a strictly `numerical' way. That is, values which are close together numerically do not always appear very similar. We also provide a novel noise addition technique for categorical values, which employs our similarity measure to partition the values in the data set. Our method - VICUS - then perturbs the original microdata file so that each value is more likely to be changed to another value in the same partition than one from a different partition. The technique helps to ensure that the perturbed microdata file retains data quality while also preserving the privacy of individual records.