1 \documentclass[dvipsnames,14pt,t]{beamer} |
1 \documentclass[dvipsnames,14pt,t]{beamer} |
2 \usepackage{proof} |
2 \usepackage{../slides} |
3 \usepackage{beamerthemeplaincu} |
|
4 %\usepackage[T1]{fontenc} |
|
5 %\usepackage[latin1]{inputenc} |
|
6 \usepackage{mathpartir} |
|
7 \usepackage{isabelle} |
|
8 \usepackage{isabellesym} |
|
9 \usepackage[absolute,overlay]{textpos} |
|
10 \usepackage{ifthen} |
|
11 \usepackage{tikz} |
|
12 \usepackage{courier} |
|
13 \usepackage{listings} |
|
14 \usetikzlibrary{arrows} |
|
15 \usetikzlibrary{positioning} |
|
16 \usetikzlibrary{calc} |
|
17 \usepackage{graphicx} |
|
18 \usetikzlibrary{shapes} |
|
19 \usetikzlibrary{shadows} |
|
20 \usetikzlibrary{plotmarks} |
|
21 |
|
22 |
|
23 \isabellestyle{rm} |
|
24 \renewcommand{\isastyle}{\rm}% |
|
25 \renewcommand{\isastyleminor}{\rm}% |
|
26 \renewcommand{\isastylescript}{\footnotesize\rm\slshape}% |
|
27 \renewcommand{\isatagproof}{} |
|
28 \renewcommand{\endisatagproof}{} |
|
29 \renewcommand{\isamarkupcmt}[1]{#1} |
|
30 \newcommand{\isaliteral}[1]{} |
|
31 \newcommand{\isactrlisub}[1]{\emph{\isascriptstyle${}\sb{#1}$}} |
|
32 |
|
33 |
|
34 % Isabelle characters |
|
35 \renewcommand{\isacharunderscore}{\_} |
|
36 \renewcommand{\isacharbar}{\isamath{\mid}} |
|
37 \renewcommand{\isasymiota}{} |
|
38 \renewcommand{\isacharbraceleft}{\{} |
|
39 \renewcommand{\isacharbraceright}{\}} |
|
40 \renewcommand{\isacharless}{$\langle$} |
|
41 \renewcommand{\isachargreater}{$\rangle$} |
|
42 \renewcommand{\isasymsharp}{\isamath{\#}} |
|
43 \renewcommand{\isasymdots}{\isamath{...}} |
|
44 \renewcommand{\isasymbullet}{\act} |
|
45 |
|
46 |
|
47 |
|
48 \definecolor{javared}{rgb}{0.6,0,0} % for strings |
|
49 \definecolor{javagreen}{rgb}{0.25,0.5,0.35} % comments |
|
50 \definecolor{javapurple}{rgb}{0.5,0,0.35} % keywords |
|
51 \definecolor{javadocblue}{rgb}{0.25,0.35,0.75} % javadoc |
|
52 |
|
53 \lstset{language=Java, |
|
54 basicstyle=\ttfamily, |
|
55 keywordstyle=\color{javapurple}\bfseries, |
|
56 stringstyle=\color{javagreen}, |
|
57 commentstyle=\color{javagreen}, |
|
58 morecomment=[s][\color{javadocblue}]{/**}{*/}, |
|
59 numbers=left, |
|
60 numberstyle=\tiny\color{black}, |
|
61 stepnumber=1, |
|
62 numbersep=10pt, |
|
63 tabsize=2, |
|
64 showspaces=false, |
|
65 showstringspaces=false} |
|
66 |
|
67 \lstdefinelanguage{scala}{ |
|
68 morekeywords={abstract,case,catch,class,def,% |
|
69 do,else,extends,false,final,finally,% |
|
70 for,if,implicit,import,match,mixin,% |
|
71 new,null,object,override,package,% |
|
72 private,protected,requires,return,sealed,% |
|
73 super,this,throw,trait,true,try,% |
|
74 type,val,var,while,with,yield}, |
|
75 otherkeywords={=>,<-,<\%,<:,>:,\#,@}, |
|
76 sensitive=true, |
|
77 morecomment=[l]{//}, |
|
78 morecomment=[n]{/*}{*/}, |
|
79 morestring=[b]", |
|
80 morestring=[b]', |
|
81 morestring=[b]""" |
|
82 } |
|
83 |
|
84 \lstset{language=Scala, |
|
85 basicstyle=\ttfamily, |
|
86 keywordstyle=\color{javapurple}\bfseries, |
|
87 stringstyle=\color{javagreen}, |
|
88 commentstyle=\color{javagreen}, |
|
89 morecomment=[s][\color{javadocblue}]{/**}{*/}, |
|
90 numbers=left, |
|
91 numberstyle=\tiny\color{black}, |
|
92 stepnumber=1, |
|
93 numbersep=10pt, |
|
94 tabsize=2, |
|
95 showspaces=false, |
|
96 showstringspaces=false} |
|
97 |
3 |
98 % beamer stuff |
4 % beamer stuff |
99 \renewcommand{\slidecaption}{APP 07, King's College London, 19 November 2013} |
5 \renewcommand{\slidecaption}{APP 07, King's College London} |
100 \newcommand{\dn}{\stackrel{\mbox{\scriptsize def}}{=}}% for definitions |
|
101 \newcommand{\bl}[1]{\textcolor{blue}{#1}} |
6 \newcommand{\bl}[1]{\textcolor{blue}{#1}} |
102 |
7 |
103 |
|
104 |
|
105 \begin{document} |
8 \begin{document} |
106 |
9 |
107 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
10 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
108 \mode<presentation>{ |
11 \begin{frame}[t] |
109 \begin{frame}<1>[t] |
|
110 \frametitle{% |
12 \frametitle{% |
111 \begin{tabular}{@ {}c@ {}} |
13 \begin{tabular}{@ {}c@ {}} |
112 \\ |
14 \\ |
113 \LARGE Access Control and \\[-3mm] |
15 \LARGE Access Control and \\[-3mm] |
114 \LARGE Privacy Policies (7)\\[-6mm] |
16 \LARGE Privacy Policies (7)\\[-6mm] |
115 \end{tabular}}\bigskip\bigskip\bigskip |
17 \end{tabular}}\bigskip\bigskip\bigskip |
116 |
18 |
117 %\begin{center} |
19 |
118 %\includegraphics[scale=1.3]{pics/barrier.jpg} |
20 \normalsize |
119 %\end{center} |
|
120 |
|
121 \normalsize |
|
122 \begin{center} |
21 \begin{center} |
123 \begin{tabular}{ll} |
22 \begin{tabular}{ll} |
124 Email: & christian.urban at kcl.ac.uk\\ |
23 Email: & christian.urban at kcl.ac.uk\\ |
125 Office: & S1.27 (1st floor Strand Building)\\ |
24 Office: & S1.27 (1st floor Strand Building)\\ |
126 Slides: & KEATS (also homework is there)\\ |
25 Slides: & KEATS (also homework is there)\\ |
127 \end{tabular} |
26 \end{tabular} |
128 \end{center} |
27 \end{center} |
129 |
28 |
130 |
29 \end{frame} |
131 \end{frame}} |
30 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
132 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
31 |
133 |
32 |
134 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
33 |
135 \mode<presentation>{ |
34 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
136 \begin{frame}[c] |
35 \mode<presentation>{ |
137 \frametitle{} |
36 \begin{frame}[c] |
138 |
37 \frametitle{Man-in-the-Middle} |
139 Recall the following scenario: |
38 |
140 |
39 \begin{itemize} |
141 \begin{itemize} |
40 \item Border Gateway Protocol (BGP) --- routers believe their neighbours |
142 \item If \textcolor{blue}{Admin} says that \textcolor{blue}{\isa{file}} |
41 \item it is possible to advertise bad routes |
143 should be deleted, then this file must be deleted. |
42 \item can be done over continents\bigskip |
144 \item \textcolor{blue}{Admin} trusts \textcolor{blue}{Bob} to decide whether |
43 \end{itemize} |
145 \textcolor{blue}{\isa{file}} should be deleted (delegation). |
44 |
146 \item \textcolor{blue}{Bob} wants to delete \textcolor{blue}{\isa{file}}. |
45 \hfill\footnotesize\url{http://www.renesys.com/2013/11/mitm-internet-hijacking/} |
147 \end{itemize}\bigskip |
46 \end{frame}} |
148 |
47 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
149 \small |
48 |
150 \textcolor{blue}{\isa{{\isaliteral{5C3C47616D6D613E}{\isasymGamma}}\ {\isaliteral{3D}{\isacharequal}}}\small\begin{tabular}{l} |
49 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
151 \isa{{\isaliteral{28}{\isacharparenleft}}Admin\ says\ del{\isaliteral{5F}{\isacharunderscore}}file\isaliteral{5C3C5E697375623E}{}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ del{\isaliteral{5F}{\isacharunderscore}}file\isaliteral{5C3C5E697375623E}{}},\\ |
50 \begin{frame}[t] |
152 \isa{{\isaliteral{28}{\isacharparenleft}}Admin\ says\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{28}{\isacharparenleft}}Bob\ says\ del{\isaliteral{5F}{\isacharunderscore}}file\isaliteral{5C3C5E697375623E}{}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ del{\isaliteral{5F}{\isacharunderscore}}file\isaliteral{5C3C5E697375623E}{}{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}},\\ |
51 \frametitle{Facebook Privacy} |
153 \isa{Bob\ says\ del{\isaliteral{5F}{\isacharunderscore}}file\isaliteral{5C3C5E697375623E}{}}\\ |
52 |
154 \end{tabular}}\medskip |
53 \begin{itemize} |
155 |
54 \item \large Who has a Facebook account?\pause\medskip |
156 \textcolor{blue}{\isa{{\isaliteral{5C3C47616D6D613E}{\isasymGamma}}\ {\isaliteral{5C3C7475726E7374696C653E}{\isasymturnstile}}\ del{\isaliteral{5F}{\isacharunderscore}}file\isaliteral{5C3C5E697375623E}{}}} |
55 |
157 \end{frame}} |
56 \item \large Who keeps the list of friends private?\pause\medskip |
158 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
57 |
159 |
58 \item \large Who knows that this is completely pointless? |
160 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
59 {\small (at least at the end of 2013)}\pause\medskip |
161 \mode<presentation>{ |
60 \end{itemize} |
162 \begin{frame}[c] |
61 |
163 \frametitle{\begin{tabular}{@ {\hspace{-2mm}}c@ {}}The Access Control Problem\end{tabular}} |
62 \only<4>{ Create a fake account. Send a friend request. |
164 |
63 Facebook answers with ``People you may know'' feature. |
|
64 Conveniently it has also a ``see all'' button. } |
|
65 |
|
66 \only<5>{\small\it ``Our policies explain that changing the |
|
67 visibility of people on your friend list controls how they |
|
68 appear on your Timeline, and that your friends may be visible |
|
69 on other parts of the site, such as in News Feed, Search and |
|
70 on other people's Timelines. This behavior is something we'll |
|
71 continue to evaluate to make sure we're providing clarity.'' } |
|
72 |
|
73 \end{frame} |
|
74 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
75 |
|
76 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
77 \mode<presentation>{ |
|
78 \begin{frame}[c] |
|
79 \frametitle{Privacy, Anonymity et al} |
|
80 |
|
81 Some terminology: |
|
82 |
|
83 \begin{itemize} |
|
84 \item \alert{secrecy} is the mechanism used to limit the number of |
|
85 principals with access to information (e.g., cryptography or access controls) |
|
86 |
|
87 \item \alert{confidentiality} is the obligation to protect the secrets of other people |
|
88 or organizations (secrecy for the benefit of an organisation) |
|
89 |
|
90 \item \alert{anonymity} is the ability to leave no evidence of an activity (e.g., sharing a secret) |
|
91 |
|
92 \item \alert{privacy} is the ability or right to protect your personal secrets |
|
93 (secrecy for the benefit of an individual) |
|
94 |
|
95 \end{itemize} |
|
96 |
|
97 \end{frame}} |
|
98 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
99 |
|
100 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
101 \mode<presentation>{ |
|
102 \begin{frame}[t] |
|
103 \frametitle{Privacy vs Anonymity} |
|
104 |
|
105 \begin{itemize} |
|
106 \item everybody agrees that anonymity has its uses (e.g., voting, whistleblowers, peer-review, exams) |
|
107 \end{itemize}\bigskip\bigskip\pause |
|
108 |
|
109 |
|
110 But privacy?\bigskip\bigskip |
|
111 |
|
112 ``You have zero privacy anyway. Get over it.''\\ |
|
113 \hfill{}Scott Mcnealy (CEO of Sun)\bigskip\\ |
|
114 |
|
115 |
|
116 If you have nothing to hide, you have nothing to fear. |
|
117 |
|
118 \end{frame}} |
|
119 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
120 |
|
121 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
122 \mode<presentation>{ |
|
123 \begin{frame}[t] |
|
124 \frametitle{Privacy} |
|
125 |
|
126 private data can be often used against me |
|
127 |
|
128 \begin{itemize} |
|
129 \item if my location data becomes public, thieves will switch off their phones and help themselves in my home |
|
130 \item if supermarkets can build a profile of what I buy, they can use it to their advantage (banks - mortgages) |
|
131 \item my employer might not like my opinions\bigskip\pause |
|
132 |
|
133 \item one the other hand, Freedom-of-Information Act |
|
134 \item medical data should be private, but medical research needs data |
|
135 \end{itemize} |
|
136 |
|
137 \end{frame}} |
|
138 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
139 |
|
140 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
141 \mode<presentation>{ |
|
142 \begin{frame}[t] |
|
143 \frametitle{Privacy Problems} |
|
144 |
|
145 \begin{itemize} |
|
146 \item Apple takes note of every dictation (send over the Internet to Apple) |
|
147 \item markets often only work, if data is restricted (to build trust) |
|
148 \item Social network can reveal data about you |
|
149 \item have you tried the collusion (lightbeam?) extension for FireFox? |
|
150 \item I do use Dropbox, store cards |
|
151 \end{itemize} |
|
152 |
|
153 \begin{textblock}{5}(12,9.9) |
|
154 \includegraphics[scale=0.2]{../pics/gattaca.jpg}\\ |
|
155 \small Gattaca (1997) |
|
156 \end{textblock} |
|
157 |
|
158 \end{frame}} |
|
159 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
160 |
|
161 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
162 \mode<presentation>{ |
|
163 \begin{frame}[t] |
|
164 \frametitle{Privacy} |
|
165 |
|
166 \begin{minipage}{1.05\textwidth} |
|
167 \begin{itemize} |
|
168 \item we \alert{do} want that government data is made public (free maps for example) |
|
169 \item we \alert{do not} want that medical data becomes public (similarly tax data, school |
|
170 records, job offers)\bigskip |
|
171 \item personal information can potentially lead to fraud |
|
172 (identity theft) |
|
173 \end{itemize}\pause |
|
174 |
|
175 {\bf ``The reality'':} |
|
176 \only<2>{\begin{itemize} |
|
177 \item London Health Programmes lost in June two years unencrypted details of more than 8 million people |
|
178 (no names, but postcodes and details such as gender, age and ethnic origin) |
|
179 \end{itemize}} |
|
180 \only<3>{\begin{itemize} |
|
181 \item also in June two years ago, Sony got hacked: over 1M users' personal information, including passwords, email addresses, home addresses, dates of birth, and all Sony opt-in data associated with their accounts. |
|
182 \end{itemize}} |
|
183 \end{minipage} |
|
184 |
|
185 \end{frame}} |
|
186 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
187 |
|
188 |
|
189 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
190 \mode<presentation>{ |
|
191 \begin{frame}[c] |
|
192 \frametitle{Privacy and Big Data} |
|
193 \mbox{}\\[-16mm]\mbox{} |
|
194 |
|
195 Selected sources of ``Big Data'':\smallskip{} |
|
196 |
|
197 \begin{itemize} |
|
198 \item Facebook |
|
199 \begin{itemize} |
|
200 \item 40+ Billion photos (100 PB) |
|
201 \item 6 Billion messages daily (5 - 10 TB) |
|
202 \item 900 Million users |
|
203 \end{itemize} |
|
204 \item Common Crawl |
|
205 \begin{itemize} |
|
206 \item covers 3.8 Billion webpages (2012 dataset) |
|
207 \item 50 TB of data |
|
208 \end{itemize} |
|
209 \item Google |
|
210 \begin{itemize} |
|
211 \item 20 PB daily (2008) |
|
212 \end{itemize} |
|
213 \item Twitter |
|
214 \begin{itemize} |
|
215 \item 7 Million users in the UK |
|
216 \item a company called Datasift is allowed to mine all tweets since 2010 |
|
217 \item they charge 10k per month for other companies to target advertisement |
|
218 \end{itemize} |
|
219 \end{itemize}\pause |
|
220 |
|
221 |
|
222 \end{frame}} |
|
223 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
224 |
|
225 |
|
226 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
227 \mode<presentation>{ |
|
228 \begin{frame}[c] |
|
229 \frametitle{Cookies\ldots} |
|
230 |
|
231 ``We have published a new cookie policy. It explains what cookies are |
|
232 and how we use them on our site. To learn more about cookies and |
|
233 their benefits, please view our cookie policy.\medskip |
|
234 |
|
235 If you'd like to disable cookies on this device, please view our information |
|
236 pages on 'How to manage cookies'. Please be aware that parts of the |
|
237 site will not function correctly if you disable cookies. \medskip |
|
238 |
|
239 By closing this |
|
240 message, you consent to our use of cookies on this device in accordance |
|
241 with our cookie policy unless you have disabled them.'' |
|
242 |
|
243 |
|
244 \end{frame}} |
|
245 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
246 |
|
247 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
248 \mode<presentation>{ |
|
249 \begin{frame}[c] |
|
250 \frametitle{Scare Tactics} |
|
251 |
|
252 The actual policy reads:\bigskip |
|
253 |
|
254 ``As we explain in our Cookie Policy, cookies help you to get the most |
|
255 out of our websites.\medskip |
|
256 |
|
257 If you do disable our cookies you may find that certain sections of our |
|
258 website do not work. For example, you may have difficulties logging in |
|
259 or viewing articles.'' |
|
260 |
|
261 |
|
262 |
|
263 |
|
264 \end{frame}} |
|
265 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
266 |
|
267 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
268 \mode<presentation>{ |
|
269 \begin{frame}[c] |
|
270 \frametitle{Netflix Prize} |
|
271 |
|
272 Anonymity is \alert{necessary} for privacy, but \alert{not} enough!\bigskip |
|
273 |
|
274 \begin{itemize} |
|
275 \item Netflix offered in 2006 (and every year until 2010) a 1 Mio \$ prize for improving their movie rating algorithm |
|
276 \item dataset contained 10\% of all Netflix users (appr.~500K) |
|
277 \item names were removed, but included numerical ratings as well as times of rating |
|
278 \item some information was \alert{perturbed} (i.e., slightly modified) |
|
279 \end{itemize} |
|
280 |
|
281 \hfill{\bf\alert{All OK?}} |
|
282 |
|
283 \end{frame}} |
|
284 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
285 |
|
286 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
287 \mode<presentation>{ |
|
288 \begin{frame}[c] |
|
289 \frametitle{Re-identification Attacks} |
|
290 |
|
291 Two researchers analysed the data: |
|
292 |
|
293 \begin{itemize} |
|
294 \item with 8 ratings (2 of them can be wrong) and corresponding dates that can have a margin 14-day error, 98\% of the |
|
295 records can be identified |
|
296 \item for 68\% only two ratings and dates are sufficient (for movie ratings outside the top 500)\bigskip\pause |
|
297 \item they took 50 samples from IMDb (where people can reveal their identity) |
|
298 \item 2 of them uniquely identified entries in the Netflix database (either by movie rating or by dates) |
|
299 \end{itemize} |
|
300 |
|
301 \end{frame}} |
|
302 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
303 |
|
304 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
305 \mode<presentation>{ |
|
306 \begin{frame}[c] |
|
307 \frametitle{Re-identification Attacks} |
|
308 |
|
309 |
|
310 \begin{itemize} |
|
311 \item in 1990 insurance databases were made public with names removed, but birth dates, |
|
312 gender, ZIP-code were retained\medskip |
|
313 \item could be cross referenced with public voter registration data in order to find out what the |
|
314 medical record of the governor of Massachusetts was |
|
315 \end{itemize} |
|
316 |
|
317 \end{frame}} |
|
318 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
319 |
|
320 |
|
321 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
322 \mode<presentation>{ |
|
323 \begin{frame}[c] |
|
324 \frametitle{} |
|
325 |
|
326 \begin{itemize} |
|
327 \item Birth data, postcode and gender (unique for\\ 87\% of the US population) |
|
328 \item Preferences in movies (99\% of 500K for 8 ratings) |
|
329 \end{itemize}\bigskip |
|
330 |
|
331 Therefore best practices / or even law (HIPAA, EU): |
|
332 |
|
333 \begin{itemize} |
|
334 \item only year dates (age group for 90 years or over), |
|
335 \item no postcodes (sector data is OK, similarly in the US)\\ |
|
336 \textcolor{gray}{no names, addresses, account numbers, licence plates} |
|
337 \item disclosure information needs to be retained for 5 years |
|
338 \end{itemize} |
|
339 |
|
340 \end{frame}} |
|
341 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
342 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
343 \mode<presentation>{ |
|
344 \begin{frame}<2>[c] |
|
345 \frametitle{\large How to Safely Disclose Information?} |
|
346 |
|
347 \only<1>{ |
|
348 \begin{itemize} |
|
349 \item Assume you make a survey of 100 randomly chosen people. |
|
350 \item Say 99\% of the surveyed people in the 10 - 40 age group have seen the |
|
351 Gangnam video on youtube.\bigskip |
|
352 |
|
353 \item What can you infer about the rest of the population? |
|
354 \end{itemize}} |
|
355 \only<2>{ |
|
356 \begin{itemize} |
|
357 \item Is it possible to re-identify data later, if more data is released? \bigskip\bigskip\pause |
|
358 |
|
359 \item Not even releasing only aggregate information prevents re-identification attacks. |
|
360 (GWAS was a public database of gene-frequency studies linked to diseases; |
|
361 you only needed partial DNA information in order |
|
362 to identify whether an individual was part of the study --- DB closed in 2008) |
|
363 \end{itemize}} |
|
364 |
|
365 \end{frame}} |
|
366 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
367 |
|
368 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
369 \mode<presentation>{ |
|
370 \begin{frame}<2>[c] |
|
371 \frametitle{\Large We cannot exclude all Harm} |
|
372 |
|
373 \begin{itemize} |
|
374 \item Analysis of a given data set teaches us that smoking causes cancer. |
|
375 Mary, a smoker, is harmed by this analysis: her insurance premiums rise. |
|
376 Mary’s premiums rise whether or not her data are in the data set. In other words, |
|
377 Mary is harmed by the finding smoking causes cancer.\bigskip |
|
378 |
|
379 \item \ldots of course she is also helped; she might quit smoking |
|
380 \end{itemize} |
|
381 |
|
382 \end{frame}} |
|
383 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
384 |
|
385 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
386 \mode<presentation>{ |
|
387 \begin{frame}<2>[c] |
|
388 \frametitle{Differential Privacy} |
|
389 |
|
390 \begin{itemize} |
|
391 \item Goal: Nothing about an individual should be learnable from the database that |
|
392 cannot be learned without access to the database.\pause\bigskip |
|
393 |
|
394 \item Differential privacy is a ``protocol'' which you run on some dataset \bl{$X$} producing |
|
395 some output \bl{$O(X)$}.\bigskip |
|
396 |
|
397 \item You want to achieve \alert{forward privacy} |
|
398 \end{itemize} |
|
399 |
|
400 \end{frame}} |
|
401 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
402 |
|
403 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
404 \mode<presentation>{ |
|
405 \begin{frame}[c] |
|
406 \frametitle{Differential Privacy} |
165 |
407 |
166 \begin{center} |
408 \begin{center} |
167 \begin{tikzpicture}[scale=1] |
409 User\;\;\;\; |
168 |
410 \begin{tabular}{c} |
169 \draw[line width=1mm] (-.3, -0.5) rectangle (1.5,2); |
411 tell me \bl{$f(x)$} $\Rightarrow$\\ |
170 \draw (-2.7,1) node {\begin{tabular}{l}access\\request\\ (\bl{$F$})\end{tabular}}; |
412 $\Leftarrow$ \bl{$f(x) + \text{noise}$} |
171 \draw (4.2,1) node {\begin{tabular}{l}provable/\\not provable\end{tabular}}; |
413 \end{tabular} |
172 \draw (0.6,0.8) node {\footnotesize \begin{tabular}{l}AC-\\ Checker:\\ applies\\ inference\\ rules\end{tabular}}; |
414 \;\;\;\;\begin{tabular}{@{}c} |
173 |
415 Database\\ |
174 \draw[red, ->, line width = 2mm] (1.7,1) -- (2.7,1); |
416 \bl{$x_1, \ldots, x_n$} |
175 \draw[red,<-, line width = 2mm] (-0.6,1) -- (-1.6,1); |
|
176 \draw[red, <-, line width = 3mm] (0.6,2.2) -- (0.6,3.2); |
|
177 |
|
178 \draw (0.6,4) node {\begin{tabular}{l}\large Access Policy (\boldmath\bl{$\Gamma$})\end{tabular}}; |
|
179 |
|
180 \end{tikzpicture} |
|
181 \end{center} |
|
182 |
|
183 \end{frame}} |
|
184 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
185 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
186 \mode<presentation>{ |
|
187 \begin{frame}[c] |
|
188 |
|
189 \begin{itemize} |
|
190 \item \bl{$P \,\text{says}\, F$} means \bl{$P$} can send a ``signal'' \bl{$F$} through a wire, or |
|
191 can make a ``statement'' \bl{$F$}\bigskip\pause |
|
192 |
|
193 \item \bl{$P$} is entitled to do \bl{$F$}\smallskip\\ |
|
194 \bl{$P \,\text{controls}\, F \,\dn\, (P\,\text{says}\, F) \Rightarrow F$}\medskip |
|
195 |
|
196 \begin{center} |
|
197 \bl{\infer{\Gamma \vdash F}{\Gamma \vdash P\,\text{controls}\, F & \Gamma \vdash P\,\text{says}\,F}} |
|
198 \end{center} |
|
199 |
|
200 |
|
201 \end{itemize} |
|
202 |
|
203 \end{frame}} |
|
204 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
205 |
|
206 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
207 \mode<presentation>{ |
|
208 \begin{frame}[c] |
|
209 \frametitle{Security Levels} |
|
210 \small |
|
211 |
|
212 \begin{itemize} |
|
213 \item Top secret (\bl{$T\!S$}) |
|
214 \item Secret (\bl{$S$}) |
|
215 \item Public (\bl{$P$}) |
|
216 \end{itemize} |
|
217 |
|
218 \begin{center} |
|
219 \bl{$slev(P) < slev(S) < slev(T\!S)$}\pause |
|
220 \end{center} |
|
221 |
|
222 \begin{itemize} |
|
223 \item Bob has a clearance for ``secret'' |
|
224 \item Bob can read documents that are public or sectret, but not top secret |
|
225 \end{itemize} |
|
226 |
|
227 \end{frame}} |
|
228 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
229 % |
|
230 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
231 \mode<presentation>{ |
|
232 \begin{frame}[c] |
|
233 \frametitle{Reading a File} |
|
234 |
|
235 \bl{\begin{center} |
|
236 \begin{tabular}{c} |
|
237 \begin{tabular}{@ {}l@ {}} |
|
238 \only<2->{\textcolor{red}{$slev($File$)$ $<$ $slev($Bob$)$ $\Rightarrow$}}\\ |
|
239 \only<2->{\hspace{3cm}}Bob controls Permitted $($File, read$)$\\ |
|
240 Bob says Permitted $($File, read$)$\only<2->{\\} |
|
241 \only<2>{\textcolor{red}{$slev($File$)$ $<$ $slev($Bob$)$}}% |
|
242 \only<3>{\textcolor{red}{$slev($File$)$ $=$ $P$}\\}% |
|
243 \only<3>{\textcolor{red}{$slev($Bob$)$ $=$ $S$}\\}% |
|
244 \only<3>{\textcolor{red}{$slev(P)$ $<$ $slev(S)$}\\}% |
|
245 \end{tabular}\\ |
|
246 \hline |
|
247 Permitted $($File, read$)$ |
|
248 \end{tabular} |
|
249 \end{center}} |
|
250 |
|
251 \end{frame}} |
|
252 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
253 % |
|
254 |
|
255 |
|
256 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
257 \mode<presentation>{ |
|
258 \begin{frame}[c] |
|
259 \frametitle{Substitution Rule} |
|
260 \small |
|
261 |
|
262 \bl{\begin{center} |
|
263 \begin{tabular}{c} |
|
264 $\Gamma \vdash slev(P) = l_1$ \hspace{4mm} $\Gamma \vdash slev(Q) = l_2$ |
|
265 \hspace{4mm} $\Gamma \vdash l_1 < l_2$\\\hline |
|
266 $\Gamma \vdash slev(P) < slev(Q)$ |
|
267 \end{tabular} |
|
268 \end{center}}\bigskip\pause |
|
269 |
|
270 \begin{itemize} |
|
271 \item \bl{$slev($Bob$)$ $=$ $S$} |
|
272 \item \bl{$slev($File$)$ $=$ $P$} |
|
273 \item \bl{$slev(P) < slev(S)$} |
|
274 \end{itemize} |
|
275 |
|
276 \end{frame}} |
|
277 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
278 % |
|
279 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
280 \mode<presentation>{ |
|
281 \begin{frame}[c] |
|
282 \frametitle{Reading a File} |
|
283 |
|
284 \bl{\begin{center} |
|
285 \begin{tabular}{c} |
|
286 \begin{tabular}{@ {}l@ {}} |
|
287 $slev($File$)$ $<$ $slev($Bob$)$ $\Rightarrow$\\ |
|
288 \hspace{3cm}Bob controls Permitted $($File, read$)$\\ |
|
289 Bob says Permitted $($File, read$)$\\ |
|
290 $slev($File$)$ $=$ $P$\\ |
|
291 $slev($Bob$)$ $=$ $T\!S$\\ |
|
292 \only<1>{\textcolor{red}{$?$}}% |
|
293 \only<2>{\textcolor{red}{$slev(P) < slev(S)$}\\}% |
|
294 \only<2>{\textcolor{red}{$slev(S) < slev(T\!S)$}}% |
|
295 \end{tabular}\\ |
|
296 \hline |
|
297 Permitted $($File, read$)$ |
|
298 \end{tabular} |
|
299 \end{center}} |
|
300 |
|
301 \end{frame}} |
|
302 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
303 % |
|
304 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
305 \mode<presentation>{ |
|
306 \begin{frame}[c] |
|
307 \frametitle{Transitivity Rule} |
|
308 \small |
|
309 |
|
310 \bl{\begin{center} |
|
311 \begin{tabular}{c} |
|
312 $\Gamma \vdash l_1 < l_2$ |
|
313 \hspace{4mm} $\Gamma \vdash l_2 < l_3$\\\hline |
|
314 $\Gamma \vdash l_1 < l_3$ |
|
315 \end{tabular} |
|
316 \end{center}}\bigskip |
|
317 |
|
318 \begin{itemize} |
|
319 \item \bl{$slev(P) < slev (S)$} |
|
320 \item \bl{$slev(S) < slev (T\!S)$} |
|
321 \item[] \bl{$slev(P) < slev (T\!S)$} |
|
322 \end{itemize} |
|
323 |
|
324 \end{frame}} |
|
325 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
326 % |
|
327 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
328 \mode<presentation>{ |
|
329 \begin{frame}[c] |
|
330 \frametitle{Reading Files} |
|
331 |
|
332 \begin{itemize} |
|
333 \item Access policy for Bob for reading |
|
334 \end{itemize} |
|
335 |
|
336 \bl{\begin{center} |
|
337 \begin{tabular}{c} |
|
338 \begin{tabular}{@ {}l@ {}} |
|
339 $\forall f.\;slev(f)$ \only<1>{$<$}\only<2>{\textcolor{red}{$\le$}} $slev($Bob$)$ $\Rightarrow$\\ |
|
340 \hspace{3cm}Bob controls Permitted $(f$, read$)$\\ |
|
341 Bob says Permitted $($File, read$)$\\ |
|
342 $slev($File$)$ $=$ \only<1>{$P$}\only<2>{\textcolor{red}{$T\!S$}}\\ |
|
343 $slev($Bob$)$ $=$ $T\!S$\\ |
|
344 $slev(P) < slev(S)$\\ |
|
345 $slev(S) < slev(T\!S)$ |
|
346 \end{tabular}\\ |
|
347 \hline |
|
348 Permitted $($File, read$)$ |
|
349 \end{tabular} |
|
350 \end{center}} |
|
351 |
|
352 \end{frame}} |
|
353 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
354 % |
|
355 |
|
356 |
|
357 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
358 \mode<presentation>{ |
|
359 \begin{frame}[c] |
|
360 \frametitle{Writing Files} |
|
361 |
|
362 \begin{itemize} |
|
363 \item Access policy for Bob for {\bf writing} |
|
364 \end{itemize} |
|
365 |
|
366 \bl{\begin{center} |
|
367 \begin{tabular}{c} |
|
368 \begin{tabular}{@ {}l@ {}} |
|
369 $\forall f.\;slev($Bob$)$ $\le$ $slev(f)$ $\Rightarrow$\\ |
|
370 \hspace{3cm}Bob controls Permitted $(f$, write$)$\\ |
|
371 Bob says Permitted $($File, write$)$\\ |
|
372 $slev($File$)$ $=$ $T\!S$\\ |
|
373 $slev($Bob$)$ $=$ $S$\\ |
|
374 $slev(P) < slev(S)$\\ |
|
375 $slev(S) < slev(T\!S)$ |
|
376 \end{tabular}\\ |
|
377 \hline |
|
378 Permitted $($File, write$)$ |
|
379 \end{tabular} |
|
380 \end{center}} |
|
381 |
|
382 \end{frame}} |
|
383 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
384 % |
|
385 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
386 \mode<presentation>{ |
|
387 \begin{frame}[c] |
|
388 \frametitle{Encrypted Messages} |
|
389 |
|
390 \begin{itemize} |
|
391 \item Alice sends a message \bl{$m$} |
|
392 \begin{center} |
|
393 \bl{Alice says $m$} |
|
394 \end{center}\medskip\pause |
|
395 |
|
396 \item Alice sends an encrypted message \bl{$m$}\\ (with key \bl{$K$}) |
|
397 \begin{center} |
|
398 \bl{Alice says $\{m\}_K$} |
|
399 \end{center}\medskip\pause |
|
400 |
|
401 \item Decryption of Alice's message\smallskip |
|
402 \begin{center} |
|
403 \bl{\mbox{\infer{\Gamma \vdash \text{Alice}\;\text{says}\;m} |
|
404 {\Gamma \vdash \text{Alice}\;\text{says}\;\{m\}_K & \Gamma \vdash \text{Alice}\,\text{says}\,K}}} |
|
405 \end{center} |
|
406 \end{itemize} |
|
407 |
|
408 \end{frame}} |
|
409 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
410 |
|
411 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
412 \mode<presentation>{ |
|
413 \begin{frame}[c] |
|
414 \frametitle{Encryption} |
|
415 |
|
416 \begin{itemize} |
|
417 \item Encryption of a message\smallskip |
|
418 \begin{center} |
|
419 \bl{\mbox{\infer{\Gamma \vdash \text{Alice}\;\text{says}\;\{m\}_K} |
|
420 {\Gamma \vdash \text{Alice}\;\text{says}\;m & \Gamma \vdash \text{Alice}\,\text{says}\,K}}} |
|
421 \end{center} |
|
422 \end{itemize} |
|
423 |
|
424 \end{frame}} |
|
425 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
426 |
|
427 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
428 \mode<presentation>{ |
|
429 \begin{frame}[c] |
|
430 \frametitle{Trusted Third Party} |
|
431 |
|
432 Simple protocol for establishing a secure connection via a mutually |
|
433 trusted 3rd party (server): |
|
434 |
|
435 \begin{center} |
|
436 \begin{tabular}{@ {\hspace{-7mm}}l@{\hspace{2mm}}r@ {\hspace{1mm}}l} |
|
437 Message 1 & \bl{$A \rightarrow S :$} & \bl{$A, B$}\\ |
|
438 Message 2 & \bl{$S \rightarrow A :$} & \bl{$\{K_{AB}\}_{K_{AS}}$} and \bl{$\{\{K_{AB}\}_{K_{BS}} \}_{K_{AS}}$}\\ |
|
439 Message 3 & \bl{$A \rightarrow B :$} & \bl{$\{K_{AB}\}_{K_{BS}} $}\\ |
|
440 Message 4 & \bl{$A \rightarrow B :$} & \bl{$\{m\}_{K_{AB}}$}\\ |
|
441 \end{tabular} |
417 \end{tabular} |
442 \end{center} |
418 \end{center} |
443 |
419 |
444 \end{frame}} |
420 |
445 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
421 \begin{itemize} |
446 |
422 \item \bl{$f(x)$} can be released, if \bl{$f$} is insensitive to |
447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
423 individual entries \bl{$x_1, \ldots, x_n$}\\ |
448 \mode<presentation>{ |
424 \item Intuition: whatever is learned from the dataset would be learned regardless of whether |
449 \begin{frame}[c] |
425 \bl{$x_i$} participates\bigskip\pause |
450 \frametitle{Sending Rule} |
426 |
451 |
427 \item Noised needed in order to prevent queries:\\ Christian's salary $=$ |
452 \bl{\begin{center} |
428 \begin{center} |
453 \mbox{$\infer{\Gamma \vdash Q \;\text{says}\; F} |
429 \bl{\large$\Sigma$} all staff $-$ \bl{\large$\Sigma$} all staff $\backslash$ Christian |
454 {\Gamma \vdash P \;\text{says}\; F & \Gamma \vdash P \;\text{sends}\; Q : F}$} |
430 \end{center} |
455 \end{center}}\bigskip\pause |
431 \end{itemize} |
456 |
432 |
457 \bl{$P \,\text{sends}\, Q : F \dn$}\\ |
433 \end{frame}} |
458 \hspace{6mm}\bl{$(P \,\text{says}\, F) \Rightarrow (Q \,\text{says}\, F)$} |
434 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
459 |
435 |
460 \end{frame}} |
436 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
461 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
437 \mode<presentation>{ |
462 |
438 \begin{frame}[c] |
463 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
439 \frametitle{Example} |
464 \mode<presentation>{ |
440 |
465 \begin{frame}[c] |
441 \begin{center} |
466 \frametitle{Trusted Third Party} |
442 \begin{tabular}{l|l} |
467 |
443 Name & Has the disease?\\\hline |
468 \begin{center} |
444 Alice & yes\\ |
469 \bl{\begin{tabular}{l} |
445 Bob & no\\ |
470 $A$ sends $S$ : $\text{Connect}(A,B)$\\ |
446 Charlie & yes\\ |
471 \bl{$S \,\text{says}\, (\text{Connect}(A,B) \Rightarrow$}\\ |
447 Eve & no\\ |
472 \hspace{2.5cm}\bl{$\{K_{AB}\}_{K_{AS}} \wedge |
448 Chandler & yes\\ |
473 \{\{K_{AB}\}_{K_{BS}}\}_{K_{AS}})$}\\ |
449 \end{tabular} |
474 $S$ sends $A$ : $\{K_{AB}\}_{K_{AS}}$ \bl{$\wedge$} $\{\{K_{AB}\}_{K_{BS}}\}_{K_{AS}}$\\ |
450 \end{center} |
475 $A$ sends $B$ : $\{K_{AB}\}_{K_{BS}}$\\ |
451 |
476 $A$ sends $B$ : $\{m\}_{K_{AB}}$ |
452 How many people have a disease? |
477 \end{tabular}} |
453 |
478 \end{center}\bigskip\pause |
454 \end{frame}} |
479 |
455 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
480 |
456 |
481 \bl{$\Gamma \vdash B \,\text{says} \, m$}? |
457 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
482 \end{frame}} |
458 \mode<presentation>{ |
483 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
459 \begin{frame}[c] |
484 |
460 \frametitle{Adding Noise} |
485 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
461 |
486 \mode<presentation>{ |
462 Adding noise is not as trivial as one would wish: |
487 \begin{frame}[c] |
463 |
488 \frametitle{Public/Private Keys} |
464 \begin{itemize} |
489 |
465 \item If I ask how many of three have a disease and get a result |
490 \begin{itemize} |
466 as follows |
491 \item Bob has a private and public key: \bl{$K_{Bob}^{pub}$}, \bl{$K_{Bob}^{priv}$}\bigskip |
467 |
492 \begin{center} |
468 \begin{center} |
493 \bl{\mbox{\infer{\Gamma \vdash \text{Alice}\;\text{says}\;m} |
469 \begin{tabular}{l|c} |
494 {\Gamma \vdash \text{Alice}\;\text{says}\;\{m\}_{K_{Bob}^{pub}} & |
470 Alice & yes\\ |
495 \Gamma \vdash K_{Bob}^{priv}}}} |
471 Bob & no\\ |
496 \end{center}\bigskip\pause |
472 Charlie & yes\\ |
497 |
473 \end{tabular} |
498 \item this is {\bf not} a derived rule! |
474 \end{center} |
499 \end{itemize} |
475 |
500 |
476 then I have to add a noise of \bl{$1$}. So answers would be in the |
501 \end{frame}} |
477 range of \bl{$1$} to \bl{$3$} |
502 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
478 |
503 |
479 \bigskip |
504 |
480 \item But if I ask five questions for all the dataset (has the disease, is male, below 30, \ldots), |
505 % \begin{itemize} |
481 then one individual can change the dataset by \bl{$5$} |
506 % \item Alice calls Sam for a key to communicate with Bob |
482 \end{itemize} |
507 % \item Sam responds with a key that Alice can read and a key Bob can read (pre-shared) |
483 |
508 % \item Alice sends the message encrypted with the key and the second key it recieved |
484 \end{frame}} |
509 % \end{itemize}\bigskip |
485 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
510 |
486 |
511 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
487 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
512 \mode<presentation>{ |
488 \mode<presentation>{ |
513 \begin{frame}[c] |
489 \begin{frame}[t] |
514 \frametitle{Sending Rule} |
490 \frametitle{\begin{tabular}{@{}c@{}}Tor (private web browsing)\end{tabular}} |
515 |
491 |
516 |
492 \begin{itemize} |
517 \bl{\begin{center} |
493 \item initially developed by US Navy Labs, but then opened up to the world |
518 \mbox{\infer{\Gamma \vdash Q \;\textit{says}\; F} |
494 \item network of proxy nodes |
519 {\Gamma \vdash P \;\textit{says}\; F & \Gamma \vdash P \;\textit{sends}\; Q : F}} |
495 \item a Tor client establishes a ``random'' path to the destination server (you cannot trace back where the information came from)\bigskip\pause |
520 \end{center}}\bigskip\pause |
496 \end{itemize} |
521 |
497 |
522 \bl{$P \,\text{sends}\, Q : F \dn$}\\ |
498 \only<2>{ |
523 \hspace{6mm}\bl{$(P \,\text{says}\, F) \Rightarrow (Q \,\text{says}\, F)$} |
499 \begin{itemize} |
524 |
500 \item malicious exit node attack: someone set up 5 Tor exit nodes and monitored the traffic: |
525 \end{frame}} |
501 \begin{itemize} |
526 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
502 \item a number of logons and passwords used by embassies (Usbekistan `s1e7u0l7c', while |
527 |
503 Tunesia `Tunesia' and India `1234') |
528 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
504 \end{itemize} |
529 \mode<presentation>{ |
505 \end{itemize}} |
530 \begin{frame}[c] |
506 \only<3>{ |
531 \frametitle{Trusted Third Party} |
507 \begin{itemize} |
532 |
508 \item bad apple attack: if you have one insecure application, your IP can be tracked through Tor |
533 \begin{center} |
509 \begin{itemize} |
534 \bl{\begin{tabular}{l} |
510 \item background: 40\% of traffic on Tor is generated by BitTorrent |
535 $A$ sends $S$ : $\textit{Connect}(A,B)$\\ |
511 \end{itemize} |
536 \bl{$S \,\text{says}\, (\textit{Connect}(A,B) \Rightarrow$}\\ |
512 \end{itemize}} |
537 \hspace{2.5cm}\bl{$\{K_{AB}\}_{K_{AS}} \wedge |
513 |
538 \{\{K_{AB}\}_{K_{BS}}\}_{K_{AS}})$}\\ |
514 |
539 $S$ sends $A$ : $\{K_{AB}\}_{K_{AS}}$ \bl{$\wedge$} $\{\{K_{AB}\}_{K_{BS}}\}_{K_{AS}}$\\ |
515 \end{frame}} |
540 $A$ sends $B$ : $\{K_{AB}\}_{K_{BS}}$\\ |
516 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
541 $A$ sends $B$ : $\{m\}_{K_{AB}}$ |
517 |
542 \end{tabular}} |
518 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
543 \end{center}\bigskip\pause |
519 \mode<presentation>{ |
544 |
520 \begin{frame}[c] |
545 |
521 \frametitle{Tor Nodes} |
546 \bl{$\Gamma \vdash B \,\text{says} \, m$}? |
522 |
547 \end{frame}} |
523 Dan Egerstad wrote:\bigskip |
548 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
524 |
549 |
525 \it ``If you actually look in to where these Tor nodes are hosted and how big they are, some of these nodes cost thousands of dollars each month just to host because they're using lots of bandwidth, they're heavy-duty servers and so on. Who would pay for this and be anonymous?" |
550 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
526 |
551 \mode<presentation>{ |
527 |
552 \begin{frame}[c] |
528 \end{frame}} |
553 \frametitle{Challenge-Response Protocol} |
529 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
554 |
530 |
555 \begin{itemize} |
531 |
556 \item an engine \bl{$E$} and a transponder \bl{$T$} share a key \bl{$K$}\bigskip |
532 |
557 \item \bl{$E$} sends out a \alert{nonce} \bl{$N$} (random number) to \bl{$T$}\bigskip |
533 |
558 \item \bl{$T$} responds with \bl{$\{N\}_K$}\bigskip |
534 |
559 \item if \bl{$E$} receives \bl{$\{N\}_K$} from \bl{$T$}, it starts engine |
535 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
560 \end{itemize} |
536 \mode<presentation>{ |
561 |
537 \begin{frame}[t] |
562 \end{frame}} |
538 \frametitle{\begin{tabular}{@{}c@{}}Skype\end{tabular}} |
563 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
539 |
564 |
540 \begin{itemize} |
565 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
541 \item Skype used to be known as a secure online communication (encryption cannot be disabled), |
566 \mode<presentation>{ |
542 but \ldots\medskip |
567 \begin{frame}[c] |
543 |
568 \frametitle{Challenge-Response Protocol} |
544 \item it is impossible to verify whether crypto algorithms are correctly used, or whether there are backdoors.\bigskip |
569 |
545 |
570 \begin{center} |
546 \item recently someone found out that you can reset the password of somebody else's |
571 \bl{\begin{tabular}{l} |
547 account, only knowing their email address (needed to suspended the password reset feature temporarily) |
572 $E \;\text{says}\; N$\hfill(start)\\ |
548 \end{itemize} |
573 $E \;\text{sends}\; T : N$\hfill(challenge)\\ |
549 |
574 $(T \;\text{says}\; N) \Rightarrow (T \;\text{sends}\; E : \{N\}_K \wedge$\\ |
550 |
575 \hspace{3.5cm} $T \;\text{sends}\; E : \text{Id}(T))$\;\;\;\hfill(response)\\ |
551 \end{frame}} |
576 $T \;\text{says}\; K$\hfill(key)\\ |
552 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
577 $T \;\text{says}\; \text{Id}(T)$\hfill(identity)\\ |
553 |
578 $(E \;\text{says}\; \{N\}_K \wedge E \;\text{says}\; \text{Id}(T)) \Rightarrow$\\ |
554 |
579 \hspace{5cm}$ \text{start\_engine}(T)$\hfill(engine)\\ |
|
580 \end{tabular}} |
|
581 \end{center}\bigskip |
|
582 |
|
583 \bl{$\Gamma \vdash \text{start\_engine}(T)$}? |
|
584 \end{frame}} |
|
585 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
586 |
555 |
587 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
556 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
588 \mode<presentation>{ |
557 \mode<presentation>{ |
589 \begin{frame}[c] |
558 \begin{frame}[c] |
590 \frametitle{Exchange of a Fresh Key} |
559 \frametitle{\begin{tabular}{@{}c@{}}Take Home Point\end{tabular}} |
591 |
560 |
592 \bl{$A$} and \bl{$B$} share a (``super-secret'') key \bl{$K_{AB}$} and want to share another key |
561 According to Ross Anderson: \bigskip |
593 |
562 \begin{itemize} |
594 \begin{itemize} |
563 \item Creating large databases of sensitive personal information is intrinsically |
595 \item assumption \bl{$K_{AB}$} is only known to \bl{$A$} and \bl{$B$}\bigskip |
564 hazardous (NHS)\bigskip |
596 \item \bl{$A \,\text{sends}\, B : A, \{N_A\}_{K_{AB}}$} |
565 |
597 \item \bl{$B\,\text{sends}\, A : \{N_A + 1, N_B\}_{K_{AB}}$} |
566 |
598 \item \bl{$A \,\text{sends}\, B : \{N_B + 1\}_{K_{AB}}$} |
567 \item Privacy in a big hospital is just about doable.\medskip |
599 \item \bl{$B \,\text{sends}\, A : \{K^{new}_{AB}, N^{new}_B\}_{K_{AB}}$} |
568 \item How do you enforce privacy in something as big as Google |
600 \item<2> \bl{$A \,\text{sends}\, B : \{msg\}_{K^{new}_{AB}}$} |
569 or complex as Facebook? No body knows.\bigskip |
601 \end{itemize}\bigskip |
570 |
602 |
571 Similarly, big databases imposed by government |
603 Assume \bl{$K^{new}_{AB}$} is compromised by \bl{$I$} |
572 \end{itemize} |
604 \end{frame}} |
573 |
605 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
574 |
606 |
575 \end{frame}} |
607 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
576 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
608 \mode<presentation>{ |
577 |
609 \begin{frame}[c] |
578 |
610 \frametitle{The Attack} |
|
611 |
|
612 An intruder \bl{$I$} convinces \bl{$A$} to accept the compromised key \bl{$K^{new}_{AB}$}\medskip |
|
613 |
|
614 \begin{minipage}{1.1\textwidth} |
|
615 \begin{itemize} |
|
616 \item \bl{$A \,\text{sends}\, B : A, \{N_A\}_{K_{AB}}$} |
|
617 \item \bl{$B\,\text{sends}\, A : \{N_A + 1, N_B\}_{K_{AB}}$} |
|
618 \item \bl{$A \,\text{sends}\, B : \{N_B + 1\}_{K_{AB}}$} |
|
619 \item \bl{$B \,\text{sends}\, A : \{K^{new}_{AB}, N^{new}_B\}_{K_{AB}}$}\;\;recorded by \bl{$I$}\pause |
|
620 \item \bl{$A \,\text{sends}\, B : A, \{M_A\}_{K_{AB}}$} |
|
621 \item \bl{$B\,\text{sends}\, A : \{M_A + 1, M_B\}_{K_{AB}}$} |
|
622 \item \bl{$A \,\text{sends}\, B : \{M_B + 1\}_{K_{AB}}$} |
|
623 \item \bl{$B \,\text{sends}\, I : \{K^{newer}_{AB}, N^{newer}_B\}_{K_{AB}}$}\;intercepted by \bl{$I$} |
|
624 \item \bl{$I \,\text{sends}\, A : \{K^{new}_{AB}, N^{new}_B\}_{K_{AB}}$}\pause |
|
625 \item \bl{$A \,\text{sends}\, B : \{msg\}_{K^{new}_{AB}}$}\;\;\;\;\bl{$I$} can read it also |
|
626 \end{itemize} |
|
627 \end{minipage} |
|
628 |
|
629 \end{frame}} |
|
630 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
631 |
|
632 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
633 \mode<presentation>{ |
|
634 \begin{frame}[c] |
|
635 |
|
636 A Man-in-the-middle attack in real life: |
|
637 |
|
638 \begin{itemize} |
|
639 \item the card only says yes or no to the terminal if the PIN is correct |
|
640 \item trick the card in thinking transaction is verified by signature |
|
641 \item trick the terminal in thinking the transaction was verified by PIN |
|
642 \end{itemize} |
|
643 |
|
644 \begin{minipage}{1.1\textwidth} |
|
645 \begin{center} |
|
646 \mbox{}\hspace{-6mm}\includegraphics[scale=0.5]{pics/chip-attack.png} |
|
647 \includegraphics[scale=0.3]{pics/chipnpinflaw.png} |
|
648 \end{center} |
|
649 \end{minipage} |
|
650 |
|
651 \end{frame}} |
|
652 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
653 |
|
654 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
655 \mode<presentation>{ |
|
656 \begin{frame}[c] |
|
657 \frametitle{Problems with EMV} |
|
658 |
|
659 \begin{itemize} |
|
660 \item it is a wrapper for many protocols |
|
661 \item specification by consensus (resulted unmanageable complexity) |
|
662 \item its specification is 700 pages in English plus 2000+ pages for testing, additionally some |
|
663 further parts are secret |
|
664 \item other attacks have been found |
|
665 |
|
666 \item one solution might be to require always online verification of the PIN with the bank |
|
667 \end{itemize} |
|
668 |
|
669 \end{frame}} |
|
670 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
671 |
|
672 |
|
673 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
674 \mode<presentation>{ |
|
675 \begin{frame}[c] |
|
676 \frametitle{\begin{tabular}{c}Problems with WEP (Wifi)\end{tabular}} |
|
677 |
|
678 \begin{itemize} |
|
679 \item a standard ratified in 1999 |
|
680 \item the protocol was designed by a committee not including cryptographers |
|
681 \item it used the RC4 encryption algorithm which is a stream cipher requiring a unique nonce |
|
682 \item WEP did not allocate enough bits for the nonce |
|
683 \item for authenticating packets it used CRC checksum which can be easily broken |
|
684 \item the network password was used to directly encrypt packages (instead of a key negotiation protocol)\bigskip |
|
685 \item encryption was turned off by default |
|
686 \end{itemize} |
|
687 |
|
688 \end{frame}} |
|
689 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
690 |
|
691 |
|
692 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
693 \mode<presentation>{ |
|
694 \begin{frame}[c] |
|
695 \frametitle{Protocols are Difficult} |
|
696 |
|
697 \begin{itemize} |
|
698 \item even the systems designed by experts regularly fail\medskip |
|
699 \item try to make everything explicit (you need to authenticate all data you might rely on)\medskip |
|
700 \item the one who can fix a system should also be liable for the losses\medskip |
|
701 \item cryptography is often not {\bf the} answer\bigskip\bigskip |
|
702 \end{itemize} |
|
703 |
|
704 logic is one way protocols are studied in academia |
|
705 (you can use computers to search for attacks) |
|
706 |
|
707 \end{frame}} |
|
708 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
709 |
|
710 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
711 \mode<presentation>{ |
|
712 \begin{frame}[c] |
|
713 \frametitle{Public-Key Infrastructure} |
|
714 |
|
715 \begin{itemize} |
|
716 \item the idea is to have a certificate authority (CA) |
|
717 \item you go to the CA to identify yourself |
|
718 \item CA: ``I, the CA, have verified that public key \bl{$P^{pub}_{Bob}$} belongs to Bob''\bigskip |
|
719 \item CA must be trusted by everybody |
|
720 \item What happens if CA issues a false certificate? Who pays in case of loss? (VeriSign |
|
721 explicitly limits liability to \$100.) |
|
722 \end{itemize} |
|
723 |
|
724 \end{frame}} |
|
725 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
726 |
|
727 |
|
728 |
|
729 |
|
730 |
|
731 |
|
732 |
|
733 \end{document} |
579 \end{document} |
734 |
580 |
735 %%% Local Variables: |
581 %%% Local Variables: |
736 %%% mode: latex |
582 %%% mode: latex |
737 %%% TeX-master: t |
583 %%% TeX-master: t |