Service-oriented architectures (SOA), and in particular Web services, have quickly become a popular paradigm to develop distributed applications. Nowadays, more and more organizations shift their core business to the Web services platform within which various interactions between the autonomous services occur. One of the widely accepted standards in the Web services platform is Business Process Execution Lan- guage for Web Services (BPEL4WS, or BPEL for short). BPEL defines a language to integrate Web services by creating composite Web services in the form of business processes following the service orchestration paradigm, and it enables organizations to focus on core competence and mission-critical operations while outsource every- thing else to reduce costs and time to market. However BPEL is deficient in privacy issues. The facts are: (1) service requestors?? personal information is fundamental to enable business processes (e.g., the mortgage approval business process); (2) privacy concerns have become one of the most important issues in Information Technology and has received increasing at- tention from organizations, consumers and legislators; (3) most organizations have recognized that dealing correctly and honestly with customers?? privacy concerns can have beneficial returns for their businesses, not only in terms of being compliant with laws and regulations but also in terms of reputation and potential business op- portunities. If not addressed properly, privacy concerns may become an impediment to the widespread adoption of BPEL. Privacy issues have many aspects, the privacy concerns of potential service re- questor (i.e., client) and the privacy concerns of service provider (i.e., organization) are two of them. Service requestor specifies his/her privacy concerns as privacy preference, while service provider defines and publishes its privacy policy to specify its privacy promises. Before requestor accesses certain service, he/she likes to know whether the service provider will respect his/her privacy preference. Otherwise, the requestor may seek the desired service from somewhere else. On the other hand,even though most organizations publish their privacy promises, it will be more convincing if customers are assured that such privacy promises are actually kept within the organizations. In this thesis, we propose a privacy enforcement framework for business processes. In particular, we focus on those that are automated using BPEL. The framework consists of two parts. One focuses on the service requestors?? perspective of privacy, the other concentrates on the privacy concerns of the business process owner (i.e., the service provider). More specifically, the first part of the framework is based on description logic, and allows to represent privacy concepts and perform some rea- soning about these concepts. The reasoning engine will check requestor??s privacy preference against the service provider??s published privacy promises before the re- questor accesses the desired service. The second part of the framework facilitates the service provider to enforce its privacy policy within all its business processes throughout the life cycle of personal data. The privacy enforcement can be achieved step by step: privacy inspection, privacy verification and privacy obligation man- agement. The first step, privacy inspection, aims to identify which activity needs the involvement of what personal data. The second step, privacy verification, is to verify the correctness of designed BPEL business processes in terms of privacy. The third step is to enforce the privacy by managing the fulfillment of the obligation during the execution of business process. The privacy enforcement framework presented in the thesis has been implemented. The first part of the framework is implemented in the Privacy Match Engine prototype. For the second part of the framework, as different parts of the privacy policy need to be enforced at different stages of the life cycle of business processes, the implementation consists of a privacy verification tool and a privacy obligation management system.

Service-oriented architectures (SOA), and in particular Web services, have quickly become a popular paradigm to develop distributed applications. Nowadays, more and more organizations shift their core business to the Web services platform within which various interactions between the autonomous services occur. One of the widely accepted standards in the Web services platform is Business Process Execution Lan- guage for Web Services (BPEL4WS, or BPEL for short). BPEL defines a language to integrate Web services by creating composite Web services in the form of business processes following the service orchestration paradigm, and it enables organizations to focus on core competence and mission-critical operations while outsource every- thing else to reduce costs and time to market. However BPEL is deficient in privacy issues. The facts are: (1) service requestors?? personal information is fundamental to enable business processes (e.g., the mortgage approval business process); (2) privacy concerns have become one of the most important issues in Information Technology and has received increasing at- tention from organizations, consumers and legislators; (3) most organizations have recognized that dealing correctly and honestly with customers?? privacy concerns can have beneficial returns for their businesses, not only in terms of being compliant with laws and regulations but also in terms of reputation and potential business op- portunities. If not addressed properly, privacy concerns may become an impediment to the widespread adoption of BPEL. Privacy issues have many aspects, the privacy concerns of potential service re- questor (i.e., client) and the privacy concerns of service provider (i.e., organization) are two of them. Service requestor specifies his/her privacy concerns as privacy preference, while service provider defines and publishes its privacy policy to specify its privacy promises. Before requestor accesses certain service, he/she likes to know whether the service provider will respect his/her privacy preference. Otherwise, the requestor may seek the desired service from somewhere else. On the other hand,even though most organizations publish their privacy promises, it will be more convincing if customers are assured that such privacy promises are actually kept within the organizations. In this thesis, we propose a privacy enforcement framework for business processes. In particular, we focus on those that are automated using BPEL. The framework consists of two parts. One focuses on the service requestors?? perspective of privacy, the other concentrates on the privacy concerns of the business process owner (i.e., the service provider). More specifically, the first part of the framework is based on description logic, and allows to represent privacy concepts and perform some rea- soning about these concepts. The reasoning engine will check requestor??s privacy preference against the service provider??s published privacy promises before the re- questor accesses the desired service. The second part of the framework facilitates the service provider to enforce its privacy policy within all its business processes throughout the life cycle of personal data. The privacy enforcement can be achieved step by step: privacy inspection, privacy verification and privacy obligation man- agement. The first step, privacy inspection, aims to identify which activity needs the involvement of what personal data. The second step, privacy verification, is to verify the correctness of designed BPEL business processes in terms of privacy. The third step is to enforce the privacy by managing the fulfillment of the obligation during the execution of business process. The privacy enforcement framework presented in the thesis has been implemented. The first part of the framework is implemented in the Privacy Match Engine prototype. For the second part of the framework, as different parts of the privacy policy need to be enforced at different stages of the life cycle of business processes, the implementation consists of a privacy verification tool and a privacy obligation management system.

Users share a large amount of information with modern platforms such as web platforms and social platforms for various services. However, they face the risk of information leakage because modern platforms still lack proper security policies. Existing security policies, such as permission systems and isolation, can help regulate information sharing. However, these policies have problems, such as coarse granularity, bad usability, and incompleteness, especially when new features are introduced. I investigate the security impacts of new features in web and mobile platforms and find design problems that lead to user information leakage. Based on these analyses, I propose design principles for permission systems that mediate how information should be shared in modern and emerging platforms, such as web and social platforms, to provide functionality with privacy preserved. I aim to design permission systems that only allow least-privilege information access. Specifically, I utilize program analysis and natural language processing to understand how applications use sensitive data and correlate these data with their functionality. With this understanding, I design schemes that ask for user consent about unexpected information access and automatically reduce overprivileged access. I provide guidelines for platform designers to build their permission systems according to respective adversary models and resources. In particular, I implement the new permission system for social platforms and Internet of Things (IoT) platforms that enable least-privilege information sharing. For the social platforms, I incorporate the primitives of Opaque handle, Opaque display, and User-driven access control (OOU) to design a least-privilege, user-friendly, developer-friendly, and feature-rich permission system. According to my study on Facebook, OOU can be applied to remove or replace 81.2% of sensitive permission instances without affecting functionality. For IoT platforms, I present a new authorization framework, SmartAuth, that supports user-centric, semantic-based authorization. SmartAuth automatically collects security-relevant information from an IoT application’s description, code, and annotations, and generates an authorization user interface to bridge the gap between the functionalities explained to the user and the operations the application actually performs.

Vu que les tags RFID sont actuellement en phase de large déploiement dans le cadre de plusieurs applications (comme les paiements automatiques, le contrôle d'accès à distance, et la gestion des chaînes d’approvisionnement), il est important de concevoir des protocoles de sécurité garantissant la protection de la vie privée des détenteurs de tags RFID. Or, la conception de ces protocoles est régie par les limitations en termes de puissance et de calcul de la technologie RFID, et par les modèles de sécurité qui sont à notre avis trop forts pour des systèmes aussi contraints que les tags RFID. De ce fait, on limite dans cette thèse le modèle de sécurité; en particulier, un adversaire ne peut pas observer toutes les interactions entre tags et lecteurs. Cette restriction est réaliste notamment dans le contexte de la gestion des chaînes d’approvisionnement qui est l’application cible de ce travail. Sous cette hypothèse, on présente quatre protocoles cryptographiques assurant une meilleure collaboration entre les différents partenaires de la chaîne d’approvisionnement. D’abord, on propose un protocole de transfert de propriété des tags RFID, qui garantit l’authentification des tags en temps constant alors que les tags implémentent uniquement des algorithmes symétriques, et qui permet de vérifier l'authenticité de l’origine des tags. Ensuite, on aborde le problème d'authenticité des produits en introduisant deux protocoles de sécurité qui permettent à un ensemble de vérificateurs de vérifier que des tags “sans capacité de calcul” ont emprunté des chemins valides dans la chaîne d’approvisionnement. Le dernier résultat présenté dans cette thèse est un protocole d’appariement d’objets utilisant des tags “sans capacité de calcul”, qui vise l’automatisation des inspections de sécurité dans la chaîne d’approvisionnement lors du transport des produits dangereux. Les protocoles introduits dans cette thèse utilisent les courbes elliptiques et les couplages bilinéaires qui permettent la construction des algorithmes de signature et de chiffrement efficaces, et qui minimisent donc le stockage et le calcul dans les systèmes RFID. De plus, la sécurité de ces protocoles est démontrée sous des modèles formels bien définis qui prennent en compte les limitations et les contraintes des tags RFID, et les exigences strictes en termes de sécurité et de la protection de la vie privée des chaines d’approvisionnement. / While RFID systems are one of the key enablers helping the prototype of pervasive computer applications, the deployment of RFID technologies also comes with new privacy and security concerns ranging from people tracking and industrial espionage to produ ct cloning and denial of service. Cryptographic solutions to tackle these issues were in general challenged by the limited resources of RFID tags, and by the formalizations of RFID privacy that are believed to be too strong for such constrained devices. It follows that most of the existing RFID-based cryptographic schemes failed at ensuring tag privacy without sacrificing RFID scalability or RFID cost effectiveness. In this thesis, we therefore relax the existing definitions of tag privacy to bridge the gap between RFID privacy in theory and RFID privacy in practice, by assuming that an adversary cannot continuously monitor tags. Under this assumption, we are able to design sec ure and privacy preserving multi-party protocols for RFID-enabled supply chains. Namely, we propose a protocol for tag ownership transfer that features constant-time authentication while tags are only required to compute hash functions. Then, we tackle the problem of product genuineness verification by introducing two protocols for product tracking in the supply chain that rely on storage only tags. Finally, we present a solution for item matching that uses storage only tags and aims at the automation of safety inspections in the supply chain.The protocols presented in this manuscript rely on operations performed in subgroups of elliptic curves that allow for the construction of short encryptions and signatures, resulting in minimal storage requirements for RFID tags. Moreover, the privacy and the security of these protocols are proven under well defined formal models that take into account the computational limitations of RFID technology and the stringent privacy and security requirements of each targeted supply chain application.

Visual surveillance systems are increasingly common in our society today. There is a conflict between the demands for security of the public and the demands to preserve the personal integrity. This thesis suggests a solution in which parts of the surveillance images are covered in order to conceal the identities of persons appearing in video, but not their actions or activities. The covered parts could be encrypted and unlocked only by the police or another legal authority in case of a crime. This thesis implements a proof-of-concept demonstrator using a combination of image processing techniques such as foreground segmentation, mathematical morphology, geometric camera calibration and region tracking. The demonstrator is capable of tracking a moderate number of moving objects and conceal their identity by replacing them with a mask or a blurred image. Functionality for replaying recorded data and unlocking individual persons are included. The concept demonstrator shows the chain from concealing the identities of persons to unlocking only a single person on recorded data. Evaluation on a publicly available dataset shows overall good performance.

The advances in recording, editing and broadcasting multimedia content in digital form motivate the protection of digital information against illegal use, manipulation and distribution. This thesis work focuses on one aspect of digital rights management (DRM), namely digital watermarking. Specifically, we study its use in copy protection, tamper detection and information hiding. We introduce three application-specific digital watermarking techniques. The first two algorithms, based on embedding film grain like noise and signal dependent watermarks, respectively, are designed for authentication applications. The advantage is that they are able to detect malicious tampering while being robust against content-preserving processes such as compression, filtering and additive noise. The third method, a reversible watermarking technique, is designed so that sensitive personal information can be embedded in medical images. Simulation results show that our proposed method outperforms other approaches in the available literature in terms of image quality and computational complexity.

The advances in recording, editing and broadcasting multimedia content in digital form motivate the protection of digital information against illegal use, manipulation and distribution. This thesis work focuses on one aspect of digital rights management (DRM), namely digital watermarking. Specifically, we study its use in copy protection, tamper detection and information hiding. We introduce three application-specific digital watermarking techniques. The first two algorithms, based on embedding film grain like noise and signal dependent watermarks, respectively, are designed for authentication applications. The advantage is that they are able to detect malicious tampering while being robust against content-preserving processes such as compression, filtering and additive noise. The third method, a reversible watermarking technique, is designed so that sensitive personal information can be embedded in medical images. Simulation results show that our proposed method outperforms other approaches in the available literature in terms of image quality and computational complexity.

>Magister Scientiae - MSc / With the development of information and network technologies, Electronic Health Records (EHRs) management system has gained wide spread application in managing medical records. One of the major challenges of EHRs is the independent nature of medical institutions. This non-collaborative nature puts a significant barrier between patients, doctors, medical researchers and medical data. Moreover, unlike the unique and strong anti-tampering nature of traditional paper-based records, electronic health records stored in centralization database are vulnerable to risks from network attacks, forgery and tampering. In view of the data sharing difficulties and information security problems commonly found in existing EHRs, this dissertation designs and develops a credible Blockchain-based electronic health records (CB-EHRs) management system.

Indiana University-Purdue University Indianapolis (IUPUI) / The Internet has substantially embraced mobility since last decade. Cellular data network carries majority of Internet mobile access traffic and become the de facto solution of accessing Internet in mobile fashion, while many clean-slate Internet mobility solutions were proposed but none of them has been largely deployed. Internet mobile users increasingly concern more about their privacy as both researches and real-world incidents show leaking of communication and location privacy could lead to serious consequences. Just the communication itself between mobile user and their peer users or websites could leak considerable privacy of mobile user, such as location history, to other parties. Additionally, comparing to ordinary Internet access, connecting through cellular network yet provides equivalent connection stability or longevity. In this research we proposed a novelty paradigm that leverages concurrent far-side proxies to maximize network location privacy protection and minimize interruption and performance penalty brought by mobility.To avoid the deployment feasibility hurdle we also investigated the root causes impeding popularity of existing Internet mobility proposals and proposed guidelines on how to create an economical feasible solution for this goal. Based on these findings we designed a mobility support system offered as a value-added service by mobility service providers and built on elastic infrastructure that leverages various cloud aided designs, to satisfy economic feasibility and explore the architectural trade-offs among service QoS, economic viability, security and privacy.

Indiana University-Purdue University Indianapolis (IUPUI) / Following the trend of online data sharing and publishing, researchers raise their concerns about the privacy problem. Online Social Networks (OSNs), for example, often contain sensitive information about individuals. Therefore, anonymizing network data before releasing it becomes an important issue. This dissertation studies the privacy preservation problem from the perspectives of both attackers and defenders. To defenders, preserving the private information while keeping the utility of the published OSN is essential in data anonymization. At one extreme, the final data equals the original one, which contains all the useful information but has no privacy protection. At the other extreme, the final data is random, which has the best privacy protection but is useless to the third parties. Hence, the defenders aim to explore multiple potential methods to strike a desirable tradeoff between privacy and utility in the published data. This dissertation draws on the very fundamental problem, the definition of utility and privacy. It draws on the design of the privacy criterion, the graph abstraction model, the utility method, and the anonymization method to further address the balance between utility and privacy. To attackers, extracting meaningful information from the collected data is essential in data de-anonymization. De-anonymization mechanisms utilize the similarities between attackers’ prior knowledge and published data to catch the targets. This dissertation focuses on the problems that the published data is periodic, anonymized, and does not cover the target persons. There are two thrusts in studying the de-anonymization attacks: the design of seed mapping method and the innovation of generating-based attack method. To conclude, this dissertation studies the online data privacy problem from both defenders’ and attackers’ point of view and introduces privacy and utility enhancement mechanisms in different novel angles.