Leaking Of Private Information Research Articles

동형암호를 활용한 앙상블학습방법의 추론

According to the recent amendment of data-related bills, active efforts are being made to conduct big data analysis for hyper-personalization services. Hyper-personalization services involve several data integration, including external data. However, it also inherently possesses limitations in usage due to concerns about private information leaks, which can lead to damages to individuals and businesses and unnecessary societal losses. One approach to mitigate such security risks is to use homomorphic encryption, which protects private information. In particular, homomorphic encryption fundamentally prevents private information leakage during data integration and analysis processes and retains original data. In this study, we develop an algorithm for performing inference using an ensemble learning method with homomorphic encryption and apply it to real financial complaint data. We demonstrate the equivalence between scores obtained from random forest and XGBoost in plaintext and those derived from the homomorphic ciphertext. Empirical results show that the algorithm achieves inference computation times in approximately 0.4 seconds, confirming the potential utility of the tree-based ensemble learning method.

Blockchain-Based One-Time Authentication for Secure V2X Communication Against Insiders and Authority Compromise Attacks

One significant security challenge in vehicular networks is defending against malicious members’ attacks, including insiders and compromised authorities. Insiders are legitimate vehicles who have passed the registration process. Since they can exploit all the information related to the network and other members’ communication, it is easier to perform various attacks with a high impact. In addition, an authority takes charge of registering and managing legitimate vehicles. Thus, if the authority is compromised, it will cause significant damage to the system, including the leaking of private information, such as identity, location, and membership. Many authentication schemes have been proposed to protect vehicular communication from these security issues. However, most existing schemes still face the vulnerability of malicious members. Furthermore, most conventional schemes require additional interactions between the vehicles and infrastructure for authentication, which can cause communication overheads. To overcome these issues, we propose a novel blockchain-based one-time authentication scheme to protect vehicular communication against malicious members. One-time authentication provides higher security and efficiency as every message is authenticated with different proof at a time. We use publicly verifiable secret sharing with blockchain for this property, which brings two benefits. First, it prevents even an authority from obtaining members’ identities by distributing encrypted shares instead of their real identities. Second, it enables robust vehicular communication against insiders’ attacks by allowing a vehicle to send unique proof generated from its private information with messages. Receivers can authenticate the messages by comparing attached values to the information through the blockchain in a noninteractive manner. Security analysis shows that our scheme assures secure vehicle-to-everything communication against insider attacks, and efficiency analysis shows how both authentication and consensus delay change.

Generating a trading strategy in the financial market from sensitive expert data based on the privacy-preserving generative adversarial imitation network

Applying a deep learning algorithm to real financial trading records can effectively establish a profitable trading strategy, but leaking of private information during the process is a concern. To solve this problem, previous studies have proposed a privatized data “release” mechanism, but this mechanism is unable to truly protect privacy. To preserve privacy while still being able to learn useful information, we proposed a privacy-preserving generative adversarial imitation network (PPGAIN), a novel deep learning algorithm that imitates behaviors of general financial investors while preserving individual privacy. The core concept of PPGAIN is to provide class-ambiguous outputs to preserve privacy while generating sequences of trading behavior that are similar to a real investor’s behavior. We used an auxiliary classifier as an adversary to ensure that the generated results are class ambiguous. We also proposed weakness replay to enforce the training of a discriminator. The PPGAIN model was trained in two stages, in the first stage, the model was trained to be realistic. In the second stage, it was trained against the auxiliary classifier to ensure that the outputs were highly realistic but could not be easily classified as an imitation from any specific individual to preserve privacy. Using real and synthetic trading records in TAIEX, we proved that our proposed method (PPGAIN) can achieve a generation quality similar to that obtained using conditional variational autoencoder models and demonstrated that PPGAIN provides better class ambiguity to preserve individual privacy than privacy-preserving adversarial network.

금융기관 개인정보 자산 분석 자동화 시스템의 설계와 구현

One of the hottest issues of security is information leakage of financial institution. Financial institutions including commercial banks are frequently threatened by attempts of leakage through hacking and vulnerability, and this information is centered on personal information of their clients. Through this study, I found out that security managers of financial institutions are trying to prevent the leaking of private information, but in fact most of them barely know where their personal information is. Even if they know where it is and trace the data, it is often found in unexpected places. Because there is a lot of waste in time and human resources as search is done manually, we have understood that responding to IT Compliance requires a lot of effort. This study is to improve IT Compliance response and protect information leakage through monitoring PC and servers, the main storage of personal information by automated system, periodically.

Intelligent Security Model of Smart Phone Based on Human Behavior in Mobile Cloud Computing

Diverse researches following the advancement of IT technology and emergence of smart devices are common in current research. In particular, the most commercialized smart device, the smart phone, provides convenient communication among users due to easy portability and real-time information sharing within a diverse system. Moreover, spatial and temporal use of smart devices greatly increased because these devices are capable of performing the same functions as a desktop personal computer, making smart phones extremely popular. However, research on smart phones has mainly focused on the convenience of the services offered on these devices, while the issue of security has been neglected. Smart phones are vulnerable to diverse, malicious attacks, which have increased as new functions are developed and commonly used. For this reason, a number of applications were developed to detect a variety of malicious codes in smart phones and prevent private information leakage. However, due to the difficulties of recognizing and responding to attacks, such as advanced persistent threats (APTs), an intelligent security model is urgently required. This paper suggests intelligent security model of smart phone based on human behavior in mobile cloud computing to detect diverse types of malicious code in smart phones and respond to advanced attacks, such as APTs. The suggested intelligent security model of smart phone securely protects users from private information leaks and illegal billing action. Moreover, intelligent response to malicious, difficult-to-detect code is provided by a user behavior-based intelligent analysis, which makes it possible to shut down network, registry, drive, and system accessibility and to notify users to respond to malicious attacks.

Privacy Petri Net and Privacy Leak Software

Private information leak behavior has been widely discovered in malware and suspicious applications. We refer to such software as privacy leak software (PLS). Nowadays, PLS has become a serious and challenging problem to cyber security. Previous methodologies are of two categories: one focuses on the outbound network traffic of the applications; the other dives into the inside information flow of the applications. We present an abstract model called Privacy Petri Net (PPN) which is more applicable to various applications and more intuitive and vivid to users. We apply our approach to both malware and suspicious applications in real world. The experimental result shows that our approach can effectively find categories, content, procedure, destination and severity of the private information leaks for the target software.

A Study of Public Library Patrons' Understanding of Library Records and Data Privacy

As instances of private information leak increase, taking steps to protect such information becomes a necessity. In this study of public library patrons, we strove for a comprehensive understanding of library usage records to suggest viable solutions for private information safety in public libraries. To this end, we investigated the patrons' understanding of library usage records and determined the relationship between different user characteristics and privacy knowledge or leaks. The results show that a high number of patrons perceived these records as their own private information, but that there was no necessity for legal procedures or consent for the use of these records. Also, even though the understanding of these usage records showed that there was a relationship between the frequency of library visits and leaks of personal information, the correlation was not particularly strong.

A rhythm-based authentication scheme for smart media devices.

In recent years, ubiquitous computing has been rapidly emerged in our lives and extensive studies have been conducted in a variety of areas related to smart devices, such as tablets, smartphones, smart TVs, smart refrigerators, and smart media devices, as a measure for realizing the ubiquitous computing. In particular, smartphones have significantly evolved from the traditional feature phones. Increasingly higher-end smartphone models that can perform a range of functions are now available. Smart devices have become widely popular since they provide high efficiency and great convenience for not only private daily activities but also business endeavors. Rapid advancements have been achieved in smart device technologies to improve the end users' convenience. Consequently, many people increasingly rely on smart devices to store their valuable and important data. With this increasing dependence, an important aspect that must be addressed is security issues. Leaking of private information or sensitive business data due to loss or theft of smart devices could result in exorbitant damage. To mitigate these security threats, basic embedded locking features are provided in smart devices. However, these locking features are vulnerable. In this paper, an original security-locking scheme using a rhythm-based locking system (RLS) is proposed to overcome the existing security problems of smart devices. RLS is a user-authenticated system that addresses vulnerability issues in the existing locking features and provides secure confidentiality in addition to convenience.

개인정보 입력 감지를 이용한 사회공학적 공격 대응방안

When you want to be given the on-line service, their homepage requires sign-up with detail personal information. This collected private information lead to mass data spill by hacking. Especially, this makes terrible social problems that the users who sign up their site are persistingly attacked and damaged by hackers using this information. As methods of the social technologic attacks are simple but based upon human psychology, it is easy that people become a victim in the majority of cases. There is a strategy blocking fishing sites by using the black list for defending these attacks. This tactic, however, has some problems that it isn`t possible to handle new fishing sites having a short life-cycle. In this paper, we suggest two solutions to minimize data spill. One marks existing sites with the sign of a reliability measured by a comparison between black list and the white list; therefore, the user check the authenticity about the homepage. The other shut off previously the leaking of private information by sensing a entry of personal information into new sites.

원격 저장소 환경에서 다중 키워드를 이용한 효율적인 검색 가능한 대칭키 암호 시스템

매우 가벼운 무게와 손안에 들어가는 작은 크기로 휴대성을 제공하는 휴대용 저장매체는 사용자들로부터 많은 호응을 받고 있다. 하지만 휴대용 저장매체의 휴대성으로 인하여 USB 메모리의 분실 및 도난이 잦아졌고 그로 인하여 저장매체 내부에 저장되어 있는 개인정보가 유출되는 사고가 발생하는 문제점이 발생되었다. 따라서 분실위험이 없고 네트워크를 통하여 언제든 자료를 저장하고 접근할 수 있는 원격 저장소 서비스가 등장하게 되었다. 정보통신산업이 발달함에 따라 여러 종류의 정보 기기를 통하여 언제 어디서든 빠른 네트워크에 접근할 수 있게 되었고, 이는 원격 저장소를 이용하는 사용자들을 더욱 증가하게 하였다. 하지만 여러 사용자의 주요 자료가 저장됨에 따라 비윤리적인 관리자 및 공격자로 인하여 서버에 저장된 여러 사용자의 주요자료가 동시에 유출될 수 있는 위험이 존재한다. 이를 해결하기 위해 서버에 저장되는 자료의 암호화가 필요해졌으며, 이와 동시에 암호화한 자료의 효율적인 검색 및 이용을 위하여 검색 가능 암호 시스템이 필요하다. 하지만, 기존의 대칭키 검색 가능 암호 시스템은 문서의 삽입/삭제 효율성 및 다중 키워드 검색 시 연산의 효율성이 떨어지는 문제점이 존재한다. 따라서 본 논문은 기존 대칭키 검색 가능 암호의 문제점을 해결할 수 있는 효율적인 대칭키 검색 가능 암호 시스템을 제안한다. Removable Storage provides the excellent portability with light weight and small size which fits in one's hand, many users have recently turned attention to the high-capacity products. However, due to the easy of portability for Removable Storage, Removable Storage are frequently lost and stolen and then many problems have been occurred such as the leaking of private information to the public. The advent of remote storage services where data is stored throughout the network, has allowed an increasing number of users to access data. The main data of many users is stored together on remote storage, but this has the problem of disclosure by an unethical administrator or attacker. To solve this problem, the encryption of data stored on the server has become necessary, and a searchable encryption system is needed for efficient retrieval of encrypted data. However, the existing searchable encryption system has the problem of low efficiency of document insert/delete operations and multi-keyword search. In this paper, an efficient searchable encryption system is proposed.

Personal Information Protection in Digital Era -Reviewing Personal information protection Act-

Companies using internet as a kind of marketing means are increasing rapidly according to the expansion trend of e-commerce through internet and consumers also use internet as the common means of purchasing necessary articles. E-commerce using internet has advantages without limitation to temporal and spatial accessibility and general consumers and unspecified individuals also use internet to purchase their goods as well as general transactions such as advertisement, contract, payment and claim settlement. 'In the age of information, invasion of personal information resulted from the development of information and communication technology is one of the greatest problems all the countries in the world face. Therefore, Personal information protection Act is one of basic laws to protect personal information and rights and it is also an essential law in the age of information. In that sense, new Personal information protection Act is the advanced act containing various items to minimize the national damages from the leaking of private information and protect right to informational self-determination in the information society. It is expected that this legislation contributes to reduce the leaking of private information, enhance the level of privacy protection and develop privacy related industries. However, active participation of all members of our society and improvement of their recognition should be preceded for the rational and legal use of private information and the settlement of its protection culture. While the purpose of Personal information protection Act can protect privacy from collection, leaking, misuse and abuse of private information and enhance national interests and protect personal dignity and value, it also must perform the roles of balancing privacy protection with liberal information flow.

Information Intensity, Informative Equilibrium, and the Value of Information: An Analysis of Competitive Stock Market

Abstract: The traditional theory in the stock market holds that the information quality affects the market equilibrium. Recently empirical research tends to support a positive association between Information quantity (disclosure level) and the stock price. In contrast to previous literature we present a model analyzing the effect when information observed to explore the relationship between the information intensity (defined as quality × quantity in this paper) and the market equilibrium. In this paper, we analyze the operation of the price system in a competitive market where there are I kinds of information x1, x2,...x1, which is to be observed and used f1, f2,...,f1 times respectively by risk-averse traders. Rational investor get informed to infer the intrinsic value of risky asset (such as stock), and invest (using the information) to maximize his own utility, and hence determine the equilibrium. There are four main results as follows. First, The equilibrium price in the above framework serves as an aggregator of different kinds of information (may be private) accord to their relative intensity and even an private information leaks out .it's said to be an efficient market defined as Fama 1970. Second, the random price can not serve as an efficiency estimator of intrinsic value of risky asset; traders still have incentive for collecting other information. The competitive markets will tend to be efficient but will not break down as described by Grossman 1976. Third, if investors become better informed by an increase in alternative sources of information, but financial reports remain conveying a smaller portion of the total information, then the value relevance of financial reports decline. Finally, the more difference between the signals observed, the investors adopt more active trading behavior, thus the quantity demanded and the utility gained from observing information (i.e. the value of information) for risky assets rise. Policies that reduce asymmetry of information will decrease the liquidity of the market for a firm's securities and the information value.