No description available.

No description available.

No description available.

<p>Secure multi-party computation (MPC) enables mutually distrusting parties to compute securely over their private data. It is a natural approach for building distributed applications with strong privacy guarantees, and it has been used in more and more real-world privacy-preserving solutions such as privacy-preserving machine learning, secure financial analysis, and secure auctions.</p> <p><br></p> <p>The typical method of MPC is to represent the function with arithmetic circuits or binary circuits, then MPC can be applied to compute each gate privately. The practicality of secure multi-party computation (MPC) has been extensively analyzed and improved over the past decade, however, we are hitting the limits of efficiency with the traditional approaches as the circuits become more complicated. Therefore, we follow the design principle of identifying and constructing fast and provably-secure MPC protocols to evaluate useful high-level algebraic abstractions; thus, improving the efficiency of all applications relying on them. </p> <p><br></p> <p>To begin with, we construct an MPC protocol to efficiently evaluate the powers of a secret value. Then we use it as a building block to form a secure mixing protocol, which can be directly used for anonymous broadcast communication. We propose two different protocols to achieve secure mixing offering different tradeoffs between local computation and communication. Meanwhile, we study the necessity of robustness and fairness in many use cases, and provide these properties to general MPC protocols. As a follow-up work in this direction, we design more efficient MPC protocols for anonymous communication through the use of permutation matrices. We provide three variants targeting different MPC frameworks and input volumes. Besides, as the core of our protocols is a secure random permutation, our protocol is of independent interest to more applications such as secure sorting and secure two-way communication.</p> <p><br></p> <p>Meanwhile, we propose the solution and analysis for another useful arithmetic operation: secure multi-variable high-degree polynomial evaluation over both scalar and matrices. Secure polynomial evaluation is a basic operation in many applications including (but not limited to) privacy-preserving machine learning, secure Markov process evaluation, and non-linear function approximation. In this work, we illustrate how our protocol can be used to efficiently evaluate decision tree models, with both the client input and the tree models being private. We implement the prototypes of this idea and the benchmark shows that the polynomial evaluation becomes significantly faster and this makes the secure comparison the only bottleneck. Therefore, as a follow-up work, we design novel protocols to evaluate secure comparison efficiently with the help of pre-computed function tables. We implement and test this idea using Falcon, a state-of-the-art privacy-preserving machine learning framework and the benchmark results illustrate that we get significant performance improvement by simply replacing their secure comparison protocol with ours.</p> <p><br></p>

Denna studie syftar till att utveckla kunskapen kring de hot som finns på internet, samt att förstå privatpersoners säkerhetsmedvetande vid internettransaktioner. För att uppfylla detta syfte besvarar studien följande tre frågor: hur hanteras privatpersoners kreditkort på internet? hur ser privatpersoners säkerhetsmedvetande ut? och vad gör e-handelsföretag för att skydda privatpersoners data och kreditupplysningar? Datainsamlingen har genomförts med hjälp av en enkätundersökning, två telefonintervjuer samt en litteraturstudie. Enkätundersökningen genomfördes digitalt och riktade sig till studenter på Högskolan Dalarna i åldersgruppen 18–42+. Telefonintervjuerna genomfördes med två dagligvaruhandlare som även bedriver e-handel och intervjuerna var semistrukturerade till sin karaktär. Litteraturstudien genomfördes i syfte att skapa en teoretisk bakgrund till ämnet, som sedan applicerades på resultatet i analysen. Resultatet av denna studie visar att de undersökta företagen som bedriver e-handel gör sitt främsta för att upprätthålla säkerhet gällande e-handel. Studien visar även att den undersökta målgruppen har ett starkt säkerhetsmedvetande.

<p><strong>OBJECTIVE: </strong>The aim of this study was to explore an alternative method of secure data exchange of patient information among physicians using their existing email.<strong></strong></p> <p><strong>METHODS: </strong>A four-step framework was designed to effectively conduct the research. It involved designing a prototype of a web-based system called ST-SecRx to simulate secure communication between physicians while exchanging sensitive patient data through email. The simulation achieved through the system was meant to determine and measure response of physicians to the use of secure email or similar communication tools for exchanging patient data. Physicians were invited to use ST-SecRx and subsequently participate in a survey to determine its acceptability and their perceptions about the usefulness of the software. Finally, the data collected from the survey were analyzed.</p> <p><strong>RESULTS:</strong> Data were collected from 22 physicians from various healthcare facilities in the province of Ontario, Canada. Eliminating questionnaires with no response resulted in 19 valid responses. Results revealed that 57.9% used email support provided by their organization for exchanging patient data. Over 70% acknowledged that factors such as: ease of use, not having to use an email different from the one provided by their employer, not having to create and remember new password every three to six months, and data transfer complying with privacy regulations would facilitate their use of ST-SecRx. More than 50% of the physicians felt that the simulated system as demonstrated to them was more secure and easier to use when compared to previously used methods of patient data exchange through email. The majority of the physicians (from 57.9% to 73.7%) agreed with all the six questions on behavioral intention to use ST-SecRx. Overall 42% were willing to pay between $5 and $20 per month for ST-SecRx. Additional analysis of data by age, sex and discipline did not reveal any substantial differences in their enthusiasm to use the system.</p> <p><strong>CONCLUSION: </strong>The current research was successful providing data on what is important to clinicians who want to exchange data on patients with other clinicians. Use of systems similar to the prototype ST-SecRx could be an improvement over conventional email, provided that they would ensure security using encrypted technology under public key infrastructure methods and systems. Overall the physicians were satisfied with ST-SexRx and found it simple, fast, easy to use, and secure, and they indicated that they intended to use it if it were made available and it conformed to privacy and security standards. Also, such a secure system would have the potential to reduce the overall cost of healthcare by reducing duplication of diagnostic tests and making patient- specific information exchange faster. More research needs to be conducted with a larger sample size to validate the findings of this study. The limitations, dissatisfaction, and concerns expressed by the physicians who used ST-SecRx could direct future research. Future studies could include other healthcare professionals in the exchange of sensitive clinical data.</p> / Master of Science (MSc)

In the era of big data, it is essential to implement practical security and privacy measures to ensure the lawful use of data and provide users with trust and assurance. In the dissertation, I address this issue through several key steps. Firstly, I delve into the problem of conditional secret disclosure, representing it using graphs to determine the most efficient approach for storing and disclosing secrets. Secondly, I extend the conditional disclosure of secrets problem from a single secret to multiple secrets and from a bipartite graph to an arbitrary graph. Thirdly, I remove security constraints to observe how they affect the efficiency of storage and recovery. In our final paper, I explore the secure summation problem, aiming to determine the capacity of total noise. Throughout the dissertation, I leverage information-theoretic tools to address security and privacy concerns.

A cyber-physical controller (CPC) uses computing to control a physical process. Example CPCs can be found in self-driving automobiles, unmanned aerial vehicles, and other autonomous systems. They are also used in large-scale industrial control systems (ICSs) manufacturing and utility infrastructure. CPC operations rely on embedded systems having real-time, high-assurance interactions with physical processes. However, recent attacks like Stuxnet have demonstrated that CPC malware is not restricted to networks and general-purpose computers, rather embedded components are targeted as well. General-purpose computing and network approaches to security are failing to protect embedded controllers, which can have the direct effect of process disturbance or destruction. Moreover, as embedded systems increasingly grow in capability and find application in CPCs, embedded leaf node security is gaining priority. This work develops a root-of-trust design architecture, which provides process resilience to cyber attacks on, or from, embedded controllers: the Trustworthy Autonomic Interface Guardian Architecture (TAIGA). We define five trust requirements for building a fine-grained trusted computing component. TAIGA satisfies all requirements and addresses all classes of CPC attacks using an approach distinguished by adding resilience to the embedded controller, rather than seeking to prevent attacks from ever reaching the controller. TAIGA provides an on-chip, digital, security version of classic mechanical interlocks. This last line of defense monitors all of the communications of a controller using configurable or external hardware that is inaccessible to the controller processor. The interface controller is synthesized from C code, formally analyzed, and permits run-time checked, authenticated updates to certain system parameters but not code. TAIGA overrides any controller actions that are inconsistent with system specifications, including prediction and preemption of latent malwares attempts to disrupt system stability and safety. This material is based upon work supported by the National Science Foundation under Grant Number CNS-1222656. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the National Science Foundation. We are grateful for donations from Xilinx, Inc. and support from the Georgia Tech Research Institute. / Ph. D.

Nowadays, we use embedded electronic devices in almost every aspect of our daily lives. They represent our electronic identity; they store private information; they monitor health status; they do confidential communications, and so on. All these applications rely on cryptography and, therefore, present us a research objective: how to implement cryptography on embedded systems in a trustworthy and efficient manner. Implementing embedded cryptography faces two challenges - constrained resources and physical attacks. Due to low cost constraints and power budget constraints, embedded devices are not able to use high-end processors. They cannot run at extremely high frequencies either. Since most embedded devices are portable and deployed in the field, attackers are able to get physical access and to mount attacks as they want. For example, the power dissipation, electromagnetic radiation, and execution time of embedded cryptography enable Side-Channel Attacks (SCAs), which can break cryptographic implementations in a very short time with a quite low cost. In this dissertation, we propose solutions to efficient implementation of SCA-resistant and high-performance cryptographic software on embedded systems. These solutions make use of two state-of-the-art architectures of embedded processors: instruction set extensions and multi-core architectures. We show that, with proper processor micro-architecture design and suitable software programming, we are able to deliver SCA-resistant software which performs well in security, performance, and cost. In comparison, related solutions have either high hardware cost or poor performance or low attack resistance. Therefore, our solutions are more practical and see a promising future in commercial products. Another contribution of our research is the proper partitioning of the Montgomery multiplication over multi-core processors. Our solution is scalable over multiple cores, achieving almost linear speedup with a high tolerance to inter-core communication delays. We expect our contributions to serve as solid building blocks that support secure and high-performance embedded systems. / Ph. D.

Denna studie vill undersöka hur svenska och finska pedagoger beskriver anknytning och inskolning samt hur de förbereder och arbetar med inskolning av nya familjer till förskolan och vad pedagogerna anser som hinder i ämnet. Syftet fokuserade på att få kunskap om hur inskolningspraktiker genomfördes, hur pedagogerna resonerade om detta, deras val av pedagogiska metoder vid arbetet kring anknytning. Studien använde sig av fenomenografi för att studera människors uppfattningar om ämnet. Jag ville undersöka ”vad de vet” om ämnet och hur de förstår det. För att besvara frågeställningen genomfördes en kvalitativ metod med semistrukturerade intervjuer för att ta reda på pedagogernas uppfattningar i ämnet dessa intervjuer genomfördes i ett öppet samtal där de fick plats att styra samtalet till vad de menar som viktigt. Intervjuerna genomfördes med totalt sju pedagoger från Sverige och Finland. Resultaten visade att pedagogerna beskriver anknytning på ett liknande sätt men det skiljer sig i hur de arbetar med inskolning och vilka förutsättningar de har beroende på olika faktorer ex lagar och samhällsnormer. De arbetade även olika med hur man bjuder in föräldrarna i verksamheten, men alla pedagogerna såg föräldrarna som en tillgång vid inskolningsmomentet. Slutsatserna kan användas som inspiration till att genomföra nya studier kring ämnet då mer vetenskap behövs kring detta forskningsfält.