Virtual asset service providers (VASPs) currently face a number of challenges, both from the technological and the regulatory perspectives. In the context of virtual asset transfers one key issue is the need for VASPs to securely exchange customer information to comply to the Travel Rule. We discuss a VASP information sharing network as one form of a trust infrastructure for VASP-to-VASP interactions. Related to this is the need for a trusted identity infrastructure for VASPs that would permit other entities to quickly ascertain the legal business status of a VASP. For regulated wallets, an attestation infrastructure may provide VASPs and insurance providers with better visibility into the state of wallets based on trusted hardware. Finally, for customers of VASPs there is a need for seamless integration between the VASP services with the existing consumer identity management infrastructure, providing a user-friendly experience for transferring virtual assets to other users.
The emerging virtual asset service providers (VASP) industry currently faces a number of challenges related to the Travel Rule, notably pertaining to customer personal information, account number and cryptographic key information. VASPs will be handling virtual assets of different forms, where each may be bound to different private-public key pairs on the blockchain. As such, VASPs also face the additional problem of the management of its own keys and the management of customer keys that may reside in a customer wallet. The use of attestation technologies as applied to wallet systems may provi…
We introduce the contract service provider (CSP) model as an analog of the successful Internet ISP model. Our exploration is motivated by the need to seek alternative blockchain service-fee models that departs from the token-for-operations (gas fee) model for smart contracts found on many popular blockchain platforms today. A given CSP community consisting of multiple CSP business entities (VASPs) form a contract domain which implement well-defined contract primitives, policies and contract-ledger. The nodes of the members of CSP community form the blockchain network. We discuss a number of de…
In order for VASPs to fulfill the regulatory requirements from the FATF and the Travel Rule, VASPs need access to truthful information regarding originators, beneficiaries and other VASPs involved in a virtual asset transfer instance. Additionally, in seeking data regarding subjects (individuals or organizations) VASPs are faced with privacy regulations such as the GDPR and CCPA. In this paper we a propose privacy-preserving claims issuance model that carries indicators of the provenance of the data and the algorithms used to derive the claim or assertion. This allows VASPs to obtain originato…
The recent FATF Recommendations defines virtual assets and virtual assets service providers (VASP), and requires under the Travel Rule that originating VASPs obtain and hold required and accurate originator information and required beneficiary information on virtual asset transfers. In this paper we discuss the notion of key ownership evidence as a core part of originator and beneficiary information required by the FATF Recommendation. We discuss approaches to securely communicate the originator and beneficiary information between VASPs, and review existing standards for public key certificate…
Cloud computing is the technology that provides different types of services as a useful resource on the Internet. Resource trust value will help the cloud users to select the services of a cloud provider for processing and storing their essential information. Also, service providers can give access to users based on trust value to secure cloud resources from malicious users. In this paper, trust models are proposed, which comes under the subjective trust model based on the behavior of user and service provider to calculate the trust values. The trust is fuzzy, which motivated us to apply fuzzy…
Authentication and authorization are two key elements of a software application. In modern day, OAuth 2.0 framework and OpenID Connect protocol are widely adopted standards fulfilling these requirements. These protocols are implemented into authorization servers. It is common to call these authorization servers as identity servers or identity providers since they hold user identity information. Applications registered to an identity provider can use OpenID Connect to retrieve ID token for authentication. Access token obtained along with ID token allows the application to consume OAuth 2.0 prot…
Cloud computing is an upcoming technology that has been designed for commercial needs. One of the major issues in cloud computing is the difficulty to manage federated identities and the trust between the user and the service providers. This paper focuses on how security can be provided between the user and the service provider and how the user information can be authenticated. For the purpose of providing privacy and authentication, Security Assertion Markup Language (SAML) based Single Sign-On is used. Security is provided by using Hash based Encryption algorithm (HBE). HBE algorithm works w…
High availability of data is responsible for the current trends in Artificial Intelligence (AI) and Machine Learning (ML). However, high-grade datasets are reluctantly shared between actors because of lacking trust and fear of losing control. Provenance tracing systems are a possible measure to build trust by improving transparency. Especially the tracing of AI assets along complete AI value chains bears various challenges such as trust, privacy, confidentiality, traceability, and fair remuneration. In this paper we design a graph-based provenance model for AI assets and their relations within…
The mobile ad-hoc network consists of energy constraint devices called nodes communicating through radio signals forming a temporary network i.e. nodes are continuously switching from one network to another. To minimize the power consumption, we form the clusters with an elected cluster head (Service Provider) based on any cluster head selection strategy.To establish a trusted link amongst newly entered node and CH we have adopted an indirect trust computation technique based on recommendations, which form an important component in trust-based access control models for pervasive environment.In…
5G networks intend to cover user demands through multi-party collaborations in a secure and trustworthy manner. To this end, marketplaces play a pivotal role as enablers for network service consumers and infrastructure providers to offer, negotiate, and purchase 5G resources and services. Nevertheless, marketplaces often do not ensure trustworthy networking by analyzing the security and trust of their members and offers. This paper presents a security and trust framework to enable the selection of reliable third-party providers based on their history and reputation. In addition, it also introd…
As more users adopt VPNs for a variety of reasons, it is important to develop empirical knowledge of their needs and mental models of what a VPN offers. Moreover, studying VPN users alone is not enough because, by using a VPN, a user essentially transfers trust, say from their network provider, onto the VPN provider. To that end, we are the first to study the VPN ecosystem from both the users' and the providers' perspectives. In this paper, we conduct a quantitative survey of 1,252 VPN users in the U.S. and qualitative interviews of nine providers to answer several research questions regarding…
Online elections make a natural target for distributed denial of service attacks. Election agencies wary of disruptions to voting may procure DDoS protection services from a cloud provider. However, current DDoS detection and mitigation methods come at the cost of significantly increased trust in the cloud provider. In this paper we examine the security implications of denial-of-service prevention in the context of the 2017 state election in Western Australia, revealing a complex interaction between actors and infrastructure extending far beyond its borders. Based on the publicly observable pr…
Duke University（杜克大学）；The Ohio State University（俄亥俄州立大学）
Byzantine-robust federated learning aims to enable a service provider to learn an accurate global model when a bounded number of clients are malicious. The key idea of existing Byzantine-robust federated learning methods is that the service provider performs statistical analysis among the clients' local model updates and removes suspicious ones, before aggregating them to update the global model. However, malicious clients can still corrupt the global models in these methods via sending carefully crafted local model updates to the service provider. The fundamental reason is that there is no ro…
Bolted is a new architecture for a bare metal cloud with the goal of providing security-sensitive customers of a cloud the same level of security and control that they can obtain in their own private data centers. It allows tenants to elastically allocate secure resources within a cloud while being protected from other previous, current, and future tenants of the cloud. The provisioning of a new server to a tenant isolates a bare metal server, only allowing it to communicate with other tenant's servers once its critical firmware and software have been attested to the tenant. Tenants, rather th…
Function-as-a-Service (FaaS) is a recent and already very popular paradigm in cloud computing. The function provider need only specify the function to be run, usually in a high-level language like JavaScript, and the service provider orchestrates all the necessary infrastructure and software stacks. The function provider is only billed for the actual computational resources used by the function invocation. Compared to previous cloud paradigms, FaaS requires significantly more fine-grained resource measurement mechanisms, e.g. to measure compute time and memory usage of a single function invoca…
There has been tremendous interest in the development of formal trust models and metrics through the use of analytics (e.g., Belief Theory and Bayesian models), logics (e.g., Epistemic and Subjective Logic) and other mathematical models. The choice of trust metric will depend on context, circumstance and user requirements and there is no single best metric for use in all circumstances. Where different users require different trust metrics to be employed the trust score calculations should still be based on all available trust evidence. Trust is normally computed using past experiences but, in …
Health App Reviews for Privacy & Trust (HARPT): A Corpus for Analyzing Patient Privacy Concerns, Trust in Providers and Trust in Applications
Institute for Data Science & Informatics, University of Missouri（密苏里大学数据科学与信息学研究所）；Dept. Electrical Engineering & Computer Science, University of Missouri（密苏里大学电气工程与计算机科学系）；Dept. of Computer Science, Yale University（耶鲁大学计算机科学系）
In this paper we focus on one part of the trust infrastructures needed for the future virtual assets industry, namely the attestation infrastructure related to key management in private wallet systems. Our focus is on regulated private wallets utilizing trusted hardware, and the capability of the wallet to yield attestation evidence suitable to address requirements in several use-cases, such as asset insurance and regulatory compliance. We argue that attestation services will be needed as a core part of the key management lifecycle for private wallets in true decentralized systems.
Sharif University of Technology（谢里夫理工大学）；Boston University（波士顿大学）；McMaster University（麦克马斯特大学）
The Social Internet of Things (SIoT), integration of the Internet of Things and Social Networks paradigms, has been introduced to build a network of smart nodes that are capable of establishing social links. In order to deal with misbehaving service provider nodes, service requestor nodes must evaluate their trustworthiness levels. In this paper, we propose a novel trust management mechanism in the SIoT to predict the most reliable service providers for each service requestor, which leads to reduce the risk of being exposed to malicious nodes. We model the SIoT with a flexible bipartite graph …
We introduce the concept of adaptive trust in crowdsourced IoT services. It is a customized fine-grained trust tailored for specific IoT consumers. Usage patterns of IoT consumers are exploited to provide an accurate trust value for service providers. A novel adaptive trust management framework is proposed to assess the dynamic trust of IoT services. The framework leverages a novel detection algorithm to obtain trust indicators that are likely to influence the trust level of a specific IoT service type. Detected trust indicators are then used to build service-to-indicator model to evaluate a s…
Identity federations operating in a business or consumer context need to prevent the collection of user data across trust service providers for legal and business case reasons. Legal reasons are given by data protection legislation. Other reasons include business owners becoming increasingly aware of confidentiality risks that go beyond traditional information security, e.g., the numbers of authentications to an EDI service might provide insights into the volume of invoices, from which one could derive insider information. This paper proposes extended technical controls supporting three privac…
Software as a service or (SaaS) is a new software development and deployment paradigm over the cloud and offers Information Technology services dynamically as "on-demand" basis over the internet. Trust is one of the fundamental security concepts on storing and delivering such services. In general, trust factors are integrated into such existent security frameworks in order to add a security level to entities collaborations through the trust relationship. However, deploying trust factor in the secured cloud environment are more complex engineering task due to the existence of heterogeneous type…
Cloud computing as a potential paradigm offers tremendous advantages to enterprises. With the cloud computing, the market's entrance time is reduced, computing capabilities is augmented and computing power is really limitless. Usually, to use the full power of cloud computing, cloud users has to rely on external cloud service provider for managing their data. Nevertheless, the management of data and services are probably not fully trustworthy. Hence, data owners are uncomfortable to place their sensitive data outside their own system .i.e., in the cloud. Bringing transparency, trustworthiness …
Assessing the security level of IoT applications to be deployed to heterogeneous Cloud-Edge infrastructures operated by different providers is a non-trivial task. In this article, we present a methodology that permits to express security requirements for IoT applications, as well as infrastructure security capabilities, in a simple and declarative manner, and to automatically obtain an explainable assessment of the security level of the possible application deployments. The methodology also considers the impact of trust relations among different stakeholders using or managing Cloud-Edge infras…
Internet of Things (IoT) and B3G/4G communication are promoting the pervasive mobile services with its advanced features. However, security problems are also baffled the development. This paper proposes a trust model to protect the user's security. The billing or trust operator works as an agent to provide a trust authentication for all the service providers. The services are classified by sensitive value calculation. With the value, the user's trustiness for corresponding service can be obtained. For decision, three trust regions are divided, which is referred to three ranks: high, medium and…
This paper proposes a QoS-based trust evaluation model for black box data services. Under the black-box model, data services neither export (meta)-data about conditions in which they are deployed and collect and process data nor the quality of data they deliver. Therefore, the black-box model creates blind spots about the extent to which data providers can be trusted to be used to build target applications. The trust evaluation model for black box data services introduced in this paper originally combines QoS indicators, like service performance and data quality, to determine services trustwor…
Future communication networks such as 5G are expected to support end-to-end delivery of services for several vertical markets with diverging requirements. Network slicing is a key construct that is used to provide end to end logical virtual networks running on a common virtualised infrastructure, which are mutually isolated. Having different network slices operating over the same 5G infrastructure creates several challenges in security and trust. This paper addresses the fundamental issue of trust of a network slice. It presents a trust model and property-based trust attestation mechanisms whi…
A major feature of the emerging geo-social networks is the ability to notify a user when one of his friends (also called buddies) happens to be geographically in proximity with the user. This proximity service is usually offered by the network itself or by a third party service provider (SP) using location data acquired from the users. This paper provides a rigorous theoretical and experimental analysis of the existing solutions for the location privacy problem in proximity services. This is a serious problem for users who do not trust the SP to handle their location data, and would only like …
