More Like this

1. Towards an Effective Method of ReDoS Detection for Non-backtracking Engines

   Su, Weihao ; Huang, Hong ; Li, Rongchen ; Chen, Haiming ; Ge, Tingjian ( August 2024 , USENIX Association)

   33rd USENIX Security Symposium (USENIX Security 24) 

   more » « less
2. Understanding How to Inform Blind and Low-Vision Users about Data Privacy through Privacy Question Answering Assistants

   https://doi.org/10.17605/OSF.IO/K9FV6  

   Feng, Yuanyuan ; Ravichander, Abhilasha ; Yao, Yaxing ; Zhang, Shikun ; Chen, Rex ; Wilson, Shomir ; Sadeh, Norman ( January 2023 , OSF)

   This repository archives the supplemental materials for the USENIX Security '24 paper of the same title. 

   more » « less
3. Scalable Private Set Union, with Stronger Security

   Jia, Yanxue ; Sun, Shi-Feng ; Zhou, Hong-Sheng ; Gu, Dawu ( August 2024 , USENIX Association)

   Private Set Union (PSU) protocol allows parties, each hold- ing an input set, to jointly compute the union of the sets without revealing anything else. In the literature, scalable PSU protocols follow the “split-execute-assemble” paradigm (Kolesnikov et al., ASIACRYPT 2019); in addition, those fast protocols often use Oblivious Transfer as building blocks. Kolesnikov et al. (ASIACRYPT 2019) and Jia et al. (USENIX Security 2022), pointed out that certain security issues can be introduced in the “split-execute-assemble” paradigm. In this work, surprisingly, we observe that the typical way of invoking Oblivious Transfer also causes unnecessary leakage, and only the PSU protocols based on additively homomor- phic encryption (AHE) can avoid the leakage. However, the AHE-based PSU protocols are far from being practical. To bridge the gap, we also design a new PSU protocol that can avoid the unnecessary leakage. Unlike the AHE- based PSU protocols, our new construction only relies on symmetric-key operations other than base OTs, thereby being much more scalable. The experimental results demonstrate that our protocol can obtain at least 873.74× speedup over the best-performing AHE-based scheme. Moreover, our per- formance is comparable to that of the state-of-the-art PSU protocol (Chen et al., USENIX Security 2023), which also suffers from the unnecessary leakage. 

   more » « less
4. Organizing Records for Retrieval in Multi-Dimensional Range Searchable Encryption

   Heidaripour, Mahdieh ; Kian, Ladan ; Rezapour, Maryam ; Holcomb, Mark ; Fuller, Benjamin ; Agrawal, Gagan ; Maleki, Hoda ( July 2024 , International Conference on Security and Cryptography)

   Storage of sensitive multi-dimensional arrays must be secure and efficient in storage and processing time. Searchable encryption allows one to trade between security and efficiency. Searchable encryption design focuses on building indexes, overlooking the crucial aspect of record retrieval. Gui et al. (PoPETS 2023) showed that understanding the security and efficiency of record retrieval is critical to understand the overall system. A common technique for improving security is partitioning data tuples into parts. When a tuple is requested, the entire relevant part is retrieved, hiding the tuple of interest. This work assesses tuple partitioning strategies in the dense data setting, considering parts that are random, 1-dimensional, and multi-dimensional. We consider synthetic datasets of 2,3 and 4 dimensions, with sizes extending up to 2M tuples. We compare security and efficiency across a variety of record retrieval methods. Our findings are: 1. For most configurations, multi-dimensional partitioning yields better efficiency and less leakage. 2. 1-dimensional partitioning outperforms multi-dimensional partitioning when the first (indexed) dimension is any size as long as the query is large in all other dimensions. 3. The leakage of 1-dimensional partitioning is reduced the most when using a bucketed ORAM (Demertiz et al., USENIX Security 2020). 

   more » « less
5. Exploring Connections Between Active Learning and Model Extraction

   Chandrasekaran, V ; Chaudhari, K ; Giacomelli, I ; Jha, S ; Yan, S ( August 2020 , Usenxix security (submitted))

   Machine learning is being increasingly used by individuals, research institutions, and corporations. This has resulted in the surge of Machine Learning-as-a-Service (MLaaS) - cloud services that provide (a) tools and resources to learn the model, and (b) a user-friendly query interface to access the model. However, such MLaaS systems raise privacy concerns such as model extraction. In model extraction attacks, adversaries mali- ciously exploit the query interface to steal the model. More precisely, in a model extraction attack, a good approximation of a sensitive or propri- etary model held by the server is extracted (i.e. learned) by a dishonest user who interacts with the server only via the query interface. This attack was introduced by Tramèr et al. at the 2016 USENIX Security Symposium, where practical attacks for various models were shown. We believe that better understanding the efficacy of model extraction attacks is paramount to designing secure MLaaS systems. To that end, we take the first step by (a) formalizing model extraction and discussing possible defense strategies, and (b) drawing parallels between model extraction and established area of active learning. In particular, we show that re- cent advancements in the active learning domain can be used to imple- ment powerful model extraction attacks, and investigate possible defense strategies. 

   more » « less