Data and Applications Security and Privacy XXXIV

Anoop Singhal, Jaideep Vaidya

► To cite this version:

Anoop Singhal, Jaideep Vaidya. Data and Applications Security and Privacy XXXIV: 34th Annual IFIP WG 11.3 Conference, DBSec 2020, Regensburg, Germany, June 25-26, 2020, Proceedings. Springer International Publishing, LNCS-12122, 2020, Lecture Notes in Computer Science, 978-3-030-49668-5. 10.1007/978-3-030-49669-2 . hal-03243621

HAL Id: hal-03243621

https://inria.hal.science/hal-03243621

Submitted on 31 May 2021

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Founding Editors

Gerhard Goos

Karlsruhe Institute of Technology, Karlsruhe, Germany

Juris Hartmanis

Cornell University, Ithaca, NY, USA

Editorial Board Members

Elisa Bertino

Purdue University, West Lafayette, IN, USA

Wen Gao

Peking University, Beijing, China

Bernhard Steffen

TU Dortmund University, Dortmund, Germany

Gerhard Woeginger

RWTH Aachen, Aachen, Germany

Moti Yung

Columbia University, New York, NY, USA
More information about this series at http://www.springer.com/series/7409
Anoop Singhal · Jaideep Vaidya (Eds.)

Data and Applications
Security and Privacy XXXIV

34th Annual IFIP WG 11.3 Conference, DBSec 2020
Regensburg, Germany, June 25–26, 2020
Proceedings

<figure><img src="image_2.png" /></figure>

Springer
Editors

Anoop Singhal
National Institute of Standards
and Technology
Gaithersburg, MD, USA

Jaideep Vaidya
Rutgers University
Newark, NJ, USA

ISSN 0302-9743
Lecture Notes in Computer Science

ISBN 978-3-030-49668-5

https://doi.org/10.1007/978-3-030-49669-2

ISSN 1611-3349 (electronic)

ISBN 978-3-030-49669-2 (eBook)

LNCS Sublibrary: SL3 – Information Systems and Applications, incl. Internet/Web, and HCI

© IFIP International Federation for Information Processing 2020

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, express or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface

This volume contains the papers selected for presentation at the 34th Annual IFIP WG11.3 Conference on Data and Applications Security and Privacy (DBSec 2020), that was supposed to be during June 25–26, 2020, in Regensburg. While the conference was held on the dates as scheduled, due to the COVID-19 situation it was held virtually (for the first time in the history of DBSec), instead of physically in Regensburg.

In response to the call for papers of this edition, 41 submissions were received, and all submissions were evaluated on the basis of their significance, novelty, and technical quality. The Program Committee, comprising 40 members, performed an excellent job, with the help of additional reviewers, of reviewing all submissions through a careful anonymous process (three or more reviews per submission). The Program Committee's work was carried out electronically, yielding intensive discussions. Of the submitted papers, 14 full papers and 8 short papers were selected for presentation at the conference.

The success of DBSec 2020 depended on the volunteering effort of many individuals, and there is a long list of people who deserve special thanks. We would like to thank all the members of the Program Committee and all the external reviewers, for all their hard work in evaluating the papers and for their active participation in the discussion and selection process. We are very grateful to all people who readily assisted and ensured a smooth organization process, in particular Günther Pernul for his efforts as DBSec 2020 general chair; Sara Foresti (IFIP WG11.3 chair) for her guidance and support; Yuan Hong and Benedikt Putz (publicity chairs) for helping with publicity; and Petra Sauer for helping with other arrangements for the conference. EasyChair made the conference review and proceedings process run very smoothly.

Last but certainly not least, thanks to all the authors who submitted papers and all the conference attendees. We hope you find the proceedings of DBSec 2020 interesting, stimulating, and inspiring for your future research.

April 2020

Anoop Singhal

Jaideep Vaidya
## Organization

### Program Committee

Ayesha Afzal

Vijay Atluri

Frédéric Cuppens

Nora Cuppens-Boulahia

Sabrina De Capitani di
Vimercati

Giovanni Di Crescenzo

Csilla Farkas

Barbara Fila

Sara Foresti

Steven Furnell

Ehud Gudes

Yuan Hong

Sokratis Katsikas

Costas Lambrinoudakis

Adam J. Lee

Yingjiu Li

Giovanni Livraga

Javier Lopez

Brad Malin

Fabio Martinelli

Sjouke Mauw

Catherine Meadows

Charles Morisset

Martin Olivier

Stefano Paraboschi

Günther Pernul

Silvio Ranise

Indrajit Ray

Indrakshi Ray

Kui Ren

Pierangela Samarati

Andreas Schaad

Anoop Singhal

Scott Stoller

Shamik Sural

Jaideep Vaidya

Vijay Varadharajan

Air University, USA

Rutgers University, USA

Télécom Bretagne, France

IMT Atlantique, France

Università degli Studi di Milano, Italy

Perspecta Labs, USA

USC, USA

INSA Rennes, IRISA, France

Università degli Studi di Milano, Italy

Plymouth University, UK

Ben-Gurion University, Israel

Illinois Institute of Technology, USA

Open University of Cyprus, Cyprus

University of Piraeus, Greece

University of Pittsburgh, USA

University of Oregon, USA

University of Milan, Italy

UMA, Spain

Vanderbilt University, USA

IIT-CNR, Italy

University of Luxembourg, Luxembourg

NRL, USA

Newcastle University, UK

University of Pretoria, South Africa

Università di Bergamo, Italy

Universität Regensburg, Germany

FBK-Irst, Italy

Colorado State University, USA

Colorado State University, USA

State University of New York at Buffalo, USA

Università degli Studi di Milano, Italy

WIBU-Systems, Germany

NIST, USA

Stony Brook University, USA

IIT Kharagpur, India

Rutgers University, Australia

The University of Newcastle, Australia
Additional Reviewers
# Contents

## Network and Cyber-Physical Systems Security

Modeling and Mitigating Security Threats in Network Functions
Virtualization (NFV)
Nawaf Alhebaishi, Lingyu Wang, and Sushil Jajodia
3

Managing Secure Inter-slice Communication in 5G Network Slice Chains
Luis Suárez, David Espes, Frédéric Cuppens, Cao-Thanh Phan,
Philippe Bertin, and Philippe Le Parc
24

Proactively Extracting IoT Device Capabilities: An Application
to Smart Homes
Andy Dolan, Indrakshi Ray, and Suryadipta Majumdar
42

Security Enumerations for Cyber-Physical Systems
Daniel Schlette, Florian Menges, Thomas Baumer, and Günther Pernul
64

## Information Flow and Access Control

Inference-Proof Monotonic Query Evaluation
and View Generation Reconsidered
Joachim Biskup
79

Network Functions Virtualization Access Control as a Service
Manel Smine, David Espes, Nora Cuppens-Boulahia,
and Frédéric Cuppens
100

Effective Access Control in Shared-Operator Multi-tenant Data Stream
Management Systems
Marian Zaki, Adam J. Lee, and Panos K. Chrysanthis
118

Information Flow Security Certification for SPARK Programs
Sandip Ghosal and R. K. Shyamasundar
137

## Privacy-Preserving Computation

Provably Privacy-Preserving Distributed Data Aggregation in Smart Grids
Marius Stübs, Tobias Mueller, Kai Bavendiek, Manuel Loesch,
Sibylle Schupp, and Hannes Federrath
153

Non-interactive Private Decision Tree Evaluation
Anselme Tueno, Yordan Boev, and Florian Kerschbaum
174
Privacy-Preserving Anomaly Detection Using Synthetic Data
Rudolf Mayer, Markus Hittmeir, and Andreas Ekelhart
195

Local Differentially Private Matrix Factorization
with MoG for Recommendations
Jeyamohan Neera, Xiaomin Chen, Nauman Aslam, and Zhan Shu
208

Visualization and Analytics for Security

Designing a Decision-Support Visualization for Live Digital
Forensic Investigations
Fabian Böhm, Ludwig Englbrecht, and Günther Pernul
223

Predictive Analytics to Prevent Voice over IP International
Revenue Sharing Fraud
Yoram J. Meijaard, Bram C. M. Cappers, Josh G. M. Mengerink,
and Nicola Zannone
241

PUA Detection Based on Bundle Installer Characteristics
Amir Lukach, Ehud Gudes, and Asaf Shabtai
261

ML-Supported Identification and Prioritization of Threats
in the OVVL Threat Modelling Tool
Andreas Schaad and Dominik Binder
274

Spatial Systems and Crowdsourcing Security

Enhancing the Performance of Spatial Queries on Encrypted
Data Through Graph Embedding
Sina Shaham, Gabriel Ghinita, and Cyrus Shahabi
289

Crowdsourcing Under Data Poisoning Attacks: A Comparative Study
Farnaz Tahmasebian, Li Xiong, Mani Sotoodeh, and Vaidy Sunderam
310

Self-enhancing GPS-Based Authentication Using Corresponding Address
Tran Phuong Thao, Mhd Irvan, Ryosuke Kobayashi,
Rie Shigetomi Yamaguchi, and Toshiyuki Nakata
333

Secure Outsourcing and Privacy

GOOSE: A Secure Framework for Graph Outsourcing
and SPARQL Evaluation
Radu Ciucanu and Pascal Lafourcade
347

SGX-IR: Secure Information Retrieval with Trusted Processors
Fahad Shaon and Murat Kantarcioglu
367
<table><tr><td></td><td>Contents</td><td>xi</td></tr><tr><td>Readability of Privacy Policies</td><td></td><td>388</td></tr><tr><td colspan="2">Barbara Krumay and Jennifer Klar</td><td></td></tr><tr><td>Author Index</td><td></td><td>401</td></tr></table>