Managing and accessing data in the cloud: Privacy risks and approaches

7th International Conference on Risks and Security of Internet and Systems, CRiSIS 2012

Volumn , Issue , 2012, Pages

  De Capitani Di Vimercati, Sabrina ^a   Foresti, Sara ^a   Samarati, Pierangela ^a  

^a UNIVERSITY OF MILAN   (Italy)

Author keywords

cloud; data protection; outsourced data; Privacy risks; private access

Indexed keywords

ACCESSING DATA; DATA OUTSOURCING; DATA PROTECTION; GRAND CHALLENGE; HIGH QUALITY; INFORMATION DISCLOSURE; OUTSOURCED DATA; PRIVACY PROBLEMS; PRIVACY RISKS; PRIVATE ACCESS; SENSITIVE INFORMATIONS;

CLOUDS; INFORMATION TECHNOLOGY; INTERNET;

DATA PRIVACY;

EID: 84872068962     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CRISIS.2012.6378956     Document Type: Conference Paper

References (50)

1. B. Fung, K. Wang, R. Chen, and P. Yu, "Privacy-preserving data publishing: A survey of recent developments," ACM CSUR, vol. 42, no. 4, pp. 14:1-14:53, Jun. 2010.
2. P. Samarati and S. De Capitani di Vimercati, "Data protection in outsourcing scenarios: Issues and directions," in Proc. of ASIACCS, China, Apr. 2010.
3. S. De Capitani di Vimercati, S. Foresti, S. Paraboschi, G. Pelosi, and P. Samarati, "Efficient and private access to outsourced data," in Proc. of ICDCS, Minneapolis, MN, USA, Jun. 2011.
4. P. Williams, R. Sion, and B. Carbunar, "Building castles out of mud: Practical access pattern privacy and correctness on untrusted storage," in Proc of CCS, Alexandria, VA, USA, Oct. 2008.
5. C. Ardagna, S. De Capitani di Vimercati, S. Foresti, S. Paraboschi, and P. Samarati, "Minimizing disclosure of private information in credential-based interactions: A graph-based approach," in Proc. of PASSAT, Minneapolis, MN, USA, Aug. 2010.
6. -, "Minimising disclosure of client information in credential-based interactions," IJIPSI, vol. 1, no. 2/3, pp. 205-233, 2012.
7. -, "Supporting privacy preferences in credential-based interactions," in Proc. of WPES, Chicago, IL, USA, Oct. 2010.
8. W. Chen, L. Clarke, J. Kurose, and D. Towsley, "Optimizing cost-sensitive trust-negotiation protocols," in Proc. of INFOCOM, Miami, FL, USA, Mar. 2005.
9. P. Kärger, D. Olmedilla, and W.-T. Balke, "Exploiting preferences for minimal credential disclosure in policy-driven trust negotiations," in Proc. of SDM, Auckland, New Zealand, Aug. 2008.
10. D. Yao, K. Frikken, M. Atallah, and R. Tamassia, "Private information: To reveal or not to reveal," ACM TISSEC, vol. 12, no. 1, pp. 1-27, Oct. 2008.
11. V. Ciriani, S. De Capitani di Vimercati, S. Foresti, and P. Samarati, "k-Anonymity," in Secure Data Management in Decentralized Systems, T. Yu and S. Jajodia, Eds. Springer-Verlag, 2007.
12. P. Samarati, "Protecting respondents' identities in microdata release," IEEE TKDE, vol. 13, no. 6, pp. 1010-1027, Nov. 2001.
13. C. Dwork, "Differential privacy," in Proc. of ICALP, Venice, Italy, Jul. 2006.
14. C. Ardagna, S. Jajodia, P. Samarati, and A. Stavrou, "Providing mobile users' anonymity in hybrid networks," in Proc. of ESORICS, Athens, Greece, Sep. 2010.
15. N. Jones, M. Arye, J. Cesareo, and M. Freedman, "Hiding amongst the clouds: A proposal for cloud-based onion routing," in Proc. of FOCI, San Francisco, CA, USA, Aug. 2011.
16. M. Benedikt, P. Bourhis, and C. Ley, "Querying schemas with access restrictions," Proc. of VLDB Endowment, vol. 5, no. 7, pp. 634-645, Mar. 2012.
17. A. Calì and D. Martinenghi, "Querying data under access limitations," in Proc. of ICDE, Cancun, Mexico, Apr. 2008.
18. S. De Capitani di Vimercati, S. Foresti, S. Jajodia, S. Paraboschi, and P. Samarati, "Assessing query privileges via safe and efficient permission composition," in Proc. of CCS, Alexandria, VA, USA, Oct. 2008.
19. -, "Controlled information sharing in collaborative distributed query processing," in Proc. of ICDCS, Beijing, China, Jun. 2008.
20. C. Li, "Computing complete answers to queries in the presence of limited access patterns," VLDB Journal, vol. 12, no. 3, pp. 211-227, Oct. 2003.
21. S. Cimato, M. Gamassi, V. Piuri, R. Sassi, and F. Scotti, "Privacy-aware biometrics: Design and implementation of a multimodal verification system," in Proc. of ACSAC, Anaheim, CA, USA, Dec. 2008.
22. -, "Privacy in biometrics," in Biometrics: theory, methods, and applications, N. Boulgouris, K. Plataniotis, and E. Micheli-Tzanakou, Eds. Wiley-IEEE Press, 2009.
23. M. Gamassi, V. Piuri, D. Sana, and F. Scotti, "Robust fingerprint detection for access control," in Proc. of RoboCare, Rome, Italy, May 2005.
24. R. Sandhu and P. Samarati, "Authentication, access control and intrusion detection," in CRC Handbook of Computer Science and Engineering, A. Tucker, Ed. CRC Press Inc., 1997, pp. 1929-1948.
25. C. Ardagna, S. De Capitani di Vimercati, S. Paraboschi, E. Pedrini, P. Samarati, and M. Verdicchio, "Expressive and deployable access control in open web service applications," IEEE TSC, vol. 4, no. 2, pp. 96-109, Apr-Jun. 2011.
26. P. Bonatti and P. Samarati, "A uniform framework for regulating service access and information release on the Web," JCS, vol. 10, no. 3, pp. 241-272, 2002.
27. A. Lee, M. Winslett, J. Basney, and V. Welch, "The Traust authorization service," ACM TISSEC, vol. 11, no. 1, pp. 1-3, Feb. 2008.
28. J. Camenisch and A. Lysyanskaya, "An efficient system for nontransferable anonymous credentials with optional anonymity revocation," in Proc. of EUROCRYPT, Innsbruck, Austria, May 2001.
29. H. Hacigümüs, B. Iyer, S. Mehrotra, and C. Li, "Executing SQL over encrypted data in the database-service-provider model." in Proc. of SIGMOD, Madison, WI, USA, Jun. 2002.
30. E. Damiani, S. De Capitani di Vimercati, S. Jajodia, S. Paraboschi, and P. Samarati, "Balancing confidentiality and efficiency in untrusted relational DBMSs," in Proc. of CCS, Washington, DC, USA, Oct. 2003.
31. H. Wang and L. Lakshmanan, "Efficient secure query evaluation over encrypted XML databases," in Proc. of VLDB, Seoul, Korea, Sep. 2006.
32. G. Aggarwal, M. Bawa, P. Ganesan, H. Garcia-Molina, K. Kenthapadi, R. Motwani, U. Srivastava, D. Thomas, and Y. Xu, "Two can keep a secret: A distributed architecture for secure database services," in Proc. of CIDR, Asilomar, CA, USA, Jan. 2005.
33. V. Ciriani, S. De Capitani di Vimercati, S. Foresti, S. Jajodia, S. Paraboschi, and P. Samarati, "Fragmentation and encryption to enforce privacy in data storage," in Proc. of ESORICS, Germany, Sep. 2007.
34. -, "Keep a few: Outsourcing data while maintaining confidentiality," in Proc. of ESORICS, Saint Malo, France, Sep. 2009.
35. -, "Fragmentation design for efficient query execution over sensitive distributed databases," in Proc. of ICDCS, Montreal, Quebec, Canada, Jun. 2009.
36. D. Boneh, C. Gentry, B. Lynn, and H. Shacham, "Aggregate and verifiably encrypted signatures from bilinear maps," in Proc. of EUROCRYPT 2003, Warsaw, Poland, May 2003.
37. E. Mykletun, M. Narasimha, and G. Tsudik, "Authentication and integrity in outsourced databases," ACM TOS, vol. 2, no. 2, pp. 107-138, May 2006.
38. S. De Capitani di Vimercati, S. Foresti, S. Jajodia, S. Paraboschi, and P. Samarati, "Over-encryption: Management of access control evolution on outsourced data," in Proc. of VLDB, Vienna, Austria, Sep. 2007.
39. -, "A data outsourcing architecture combining cryptography and access control," in Proc. of CSAW, Fairfax, VA, USA, Nov. 2007.
40. -, "Encryption policies for regulating access to outsourced data," ACM TODS, vol. 35, no. 2, pp. 12:1-12:46, Apr. 2010.
41. -, "Support for write privileges on outsourced data," in Proc. of SEC, Heraklion, Crete, Greece, Jun. 2012.
42. M. Atallah, M. Blanton, N. Fazio, and K. Frikken, "Dynamic and efficient key management for access hierarchies," ACM TISSEC, vol. 12, no. 3, pp. 18:1-18:43, Jan. 2009.
43. M. Narasimha and G. Tsudik, "DSAC: Integrity for outsourced databases with signature aggregation and chaining," in Proc. of CIKM, Bremen, Germany, Oct.-Nov. 2005.
44. H. Pang, A. Jain, K. Ramamritham, and K. Tan, "Verifying completeness of relational query results in data publishing," in Proc. of SIGMOD, Baltimore, MA, USA, Jun. 2005.
45. Y. Yang, D. Papadias, S. Papadopoulos, and P. Kalnis, "Authenticated join processing in outsourced databases," in Proc. of SIGMOD, Providence, RI, USA, Jun.-Jul. 2009.
46. H. Wang, J. Yin, C. Perng, and P. Yu, "Dual encryption for query integrity assurance," in Proc. of CIKM, Napa Valley, CA, USA, Oct. 2008.
47. M. Xie, H. Wang, J. Yin, and X. Meng, "Integrity auditing of outsourced data," in Proc. of VLDB, Vienna, Austria, Sep. 2007.
48. -, "Providing freshness guarantees for outsourced databases," in Proc. of EDBT, Nantes, France, Mar. 2008.
49. W. Gasarch, "A survey on private information retrieval," Bulletin of the EATCS, vol. 82, pp. 72-107, 2004.
50. S. De Capitani di Vimercati, S. Foresti, S. Paraboschi, G. Pelosi, and P. Samarati, "Supporting concurrency in private data outsourcing," in Proc. of ESORICS, Leuven, Belgium, Sep. 2011.