Security and Privacy of High Impact Computer Applications

高影响力计算机应用程序的安全和隐私

• 批准号: 418648-2012
• 负责人: Mannan, Mohammad
• 金额: $ 1.6万
• 依托单位: Concordia University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2014
• 资助国家: 加拿大
• 起止时间: 2014-01-01 至 2015-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=551528
• 关键词: Security; Privacy; Impact; Computer; Applications

This research explores security and privacy problems in several high-impact, widely-used computer applications and cloud-based services. The use of any security-sensitive applications currently requires a leap of faith as users have no easy way of verifying that a computer system is malware-free, and that users are not being fooled by a phishing/spoofing attack. Most security tools are implicitly designed for expert users, require user diligence, and at best can provide only limited protection against even common malware threats, let alone advanced, state-sponsored attacks. On the other hand, participation of everyday users on the Internet in recent years has seen phenomenal growth, mostly facilitated by 'free' web services from for-profit corporations -- with the expectation that businesses can generate money from their unrestrained access to user data. What has been sharply lost in this process is, users' privacy, or even the expectation of privacy. CEOs of Sun Micorsystems, Google and Facebook remarked at various time to the effect that "privacy is dead." From a research perspective, designing privacy-preserving techniques for web services is complicated by the requirement of balancing security and ease-of-use needs of everyday users.

这项研究探讨了几种高影响力、广泛使用的计算机应用程序和基于云的服务中的安全和隐私问题。 目前，使用任何安全敏感应用程序都需要信心的飞跃，因为用户没有简单的方法来验证计算机系统是否没有恶意软件，并且用户没有被网络钓鱼/欺骗攻击所愚弄。 大多数安全工具都是为专家用户隐式设计的，需要用户勤奋，并且最多只能提供有限的保护，即使是常见的恶意软件威胁，更不用说高级的、国家支持的攻击了。 另一方面，近年来，日常用户对互联网的参与度出现了惊人的增长，这主要是由营利性公司的“免费”网络服务推动的——人们期望企业可以通过不受限制地访问用户数据来赚钱。 在这个过程中急剧丧失的是用户的隐私，甚至是对隐私的期望。 Sun Microsystems、谷歌和Facebook的首席执行官曾多次表示“隐私已死”。从研究的角度来看，由于平衡日常用户的安全性和易用性需求，设计 Web 服务的隐私保护技术变得很复杂。