Attack Trees for Security and Privacy in Social Virtual Reality Learning Environments
Attack Trees for Security and Privacy in Social Virtual Reality Learning Environments
复制标题
DOI：
10.1109/ccnc46108.2020.9045724
复制
发表时间：
2019-11
期刊：
影响因子：
--
通讯作者：
Samaikya Valluripally;Aniket Gulhane;Reshmi Mitra;K. A. Hoque;P. Calyam
中科院分区：
文献类型：
--
作者：
Samaikya Valluripally;Aniket Gulhane;Reshmi Mitra;K. A. Hoque;P. Calyam
社会虚拟现实学习环境（VRLE）是一种新型的边缘计算平台，用于分布式用户之间的协作。考虑到VRLE用于关键应用（例如，特殊教育、公共安全培训），重要的是要确保安全和隐私问题。在本文中，我们提出了一种新的框架，以获得定量评估的威胁和脆弱性VRLEs。基于实际社交VRLE的用例，即，在vSocial中，我们首先使用攻击树对安全和隐私进行建模。随后，这些攻击树被转换成随机时间自动机表示，允许严格的统计模型检查。这样的分析有助于我们采取相关的设计原则，如硬化，多样性和最小特权原则，以提高社会VRLE的弹性。通过vSocial案例研究中的实验，我们证明了我们的攻击树建模的有效性，在与采用设计原则有关的前后场景中，完整性（安全性）损失的概率减少了26%，隐私泄露（隐私）减少了80%。
Social Virtual Reality Learning Environment (VRLE) is a novel edge computing platform for collaboration amongst distributed users. Given that VRLEs are used for critical applications (e.g., special education, public safety training), it is important to ensure security and privacy issues. In this paper, we present a novel framework to obtain quantitative assessments of threats and vulnerabilities for VRLEs. Based on the use cases from an actual social VRLE viz., vSocial, we first model the security and privacy using the attack trees. Subsequently, these attack trees are converted into stochastic timed automata representations that allow for rigorous statistical model checking. Such an analysis helps us adopt pertinent design principles such as hardening, diversity and principle of least privilege to enhance the resilience of social VRLEs. Through experiments in a vSocial case study, we demonstrate the effectiveness of our attack tree modeling with a reduction of 26% in probability of loss of integrity (security) and 80% in privacy leakage (privacy) in before and after scenarios pertaining to the adoption of the design principles.