Professor Tzong-Chen Wu Security and Privacy for Mobile Applications and Cloud Services in Distributed Mobile Cloud Environments Leading Investigator: Professor Tzong-Chen Wu Researchers: Nai-Wei Lo Chuan-Kai Yang Shi-Cho Cha Raylin Tso Kuo-Hui Yeh

Agenda Research picture Four focused areas Deliverables Privacy-Preserving Video Retrieval Privacy-Preserving Data Analysis Transparent Authentication Privacy Policy Notification Framework Deliverables

Research Picture Cloud Sensor Data Center Gateway IoT Environment Internet Gateway Transparent Authentication Sensor Sensor Encrypted Data Access Mobile Device Encrypted Data/Video Access Privacy Policy Notification Mobile Device

Four Focused Areas Privacy-Preserving Video Retrieval Privacy-Preserving Data Analysis Transparent Authentication Privacy Policy Notification Framework

Privacy-Preserving Video Retrieval State of the Art As videos are huge and stored on the cloud in an encrypted form, how do we retrieve them? Li et al.’s work: the encryption is through permutation of pixels Suffer from known-plaintext attack Unless the permutation can be changed dynamically Lu et al.’s work: Separate the content and index Use traditional encryption for content Build secure search indices

Privacy-Preserving Video Retrieval Research Goals (1/2) Naïve way: Download Decode  Compare Time consuming Better way (our goal): Compare in the encryption domain on the cloud and return only the matched videos

Privacy-Preserving Video Retrieval Research Goals (2/2)

Privacy-Preserving Data Analysis State of the Art To keep the secrecy of the data stored in cloud servers, data should be encrypted Need some privacy-preserving statistical analysis protocols allow users to perform statistical analysis on the encrypted data without compromising the data privacy Most of the existing schemes based on homomorphic encryption or PKC are inefficient and not applicable to the IoT devices as well as sensor networks

Privacy-Preserving Data Analysis Research Goals (1/2) Introduce a new practical technique to support data retrieval from cloud environment for statistical data analysis and prevent data disclosure from resource-limited client devices at the same time Utilize the concept and techniques of secure multi-party computation to defend against security threats from insider attacks

Privacy-Preserving Data Analysis Research Goals (2/2)

Transparent Authentication State of the Art Few studies focus on the transparent authentication with biometric features in Body Area Networks The evolution of wearable IoT device has led the design of authentication into a new era Personal bio-data, such as heartbeat, brain-weaves and body-temperature can be analyzed to support the transparent authentication

Transparent Authentication Research Goals An authentication scheme using adaptive biometric features, such as heart rate, body temperature, and personal preference pattern, for IoT-based cloud environments Use transparent token concept to construct continuous authenticated sessions for IoT-like client devices

Privacy Policy Notification Framework State of the Art While current smartphones usually equip with different kinds of sensors, using mobile applications may pose new risks to user privacy Although several governmental agencies start to request mobile application developers to provide privacy policies with their applications, current marketplace providers usually do not force mobile applications developers to provide privacy policies about their applications Even application developers provide privacy policies in application marketplaces, current marketplaces usually do not address the issues of privacy policies updates There is no standard way to enable users to know privacy policies of the application is updated

Privacy Policy Notification Framework Research Goals (1/2) To design and implement a Privacy Policy Notification Framework for Android applications to achieve the following requirements: To provide a standard way for Android application developers to express their privacy policies and to embed the privacy policies in Android applications To enable third-party to inspect whether privacy policies of an application comply with practices of the application To provide a standard means for application users to obtain privacy policies of Android applications and know whether privacy policies of the applications are verified by third parties To enable application users know application privacy policies updates of applications If application marketplace providers find that the privacy policy of an application is mismatched with the practices of the application, the marketplace providers can notify application users to stop using the application

Privacy Policy Notification Framework Research Goals (2/2)

Deliverables Privacy-Preserving Video Retrieval A privacy-preserving video retrieval system Privacy-Preserving Data Analysis A lightweight encryption algorithm for resource-limited devices A scheme supports statistic analysis on stored data without compromising the data privacy Transparent Authentication A transparent authentication scheme using adaptive biometric features Privacy Policy Notification Framework A privacy policy notification framework and its prototype for Android applications Multiple conference papers (published or accepted) and journal papers (submitted)