Lecture Notes in Computer Science 4258

Transcription

1 Lecture Notes in Computer Science 4258 Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen University of Dortmund, Germany Madhu Sudan Massachusetts Institute of Technology, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Moshe Y. Vardi Rice University, Houston, TX, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany

2 George Danezis Philippe Golle (Eds.) Privacy Enhancing Technologies 6th International Workshop, PET 2006 Cambridge, UK, June 28-30, 2006 Revised Selected Papers 13

3 Volume Editors George Danezis Katholieke Universiteit Leuven Kasteelpark Arenberg 10 B-3001 Leuven-Heverlee, Belgium Philippe Golle Palo Alto Research Center 3333 Coyote Hill Rd Palo Alto, CA 94304, USA Library of Congress Control Number: CR Subject Classification (1998): E.3, C.2, D.4.6, K.6.5, K.4, H.3, H.4 LNCS Sublibrary: SL 4 Security and Cryptology ISSN ISBN Springer Berlin Heidelberg New York ISBN Springer Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. Springer is a part of Springer Science+Business Media springer.com Springer-Verlag Berlin Heidelberg 2006 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: /

4 Foreword The 6th Workshop on Privacy Enhancing Technologies, PET 2006, was held at Robinson College, Cambridge (UK), on June 28 30, The workshop received 91 full paper submissions out of which 24 were selected for presentation. As a rule, papers were reviewed by 3 independent members of the Program Committee, and often also by external reviewers. A further two-week long online discussion took place amongst the PC to reach consensus on all submissions. The ultimate responsibility for the final selection of papers rests on the program chairs. The ratio of acceptance puts PET in league with other premiere computer security venues, and guarantees a high quality scientific program. Yet PET also retains its character as a workshop, by providing a venue where promising new ideas can be presented and discussed by the privacy community. Identifying high quality, as well as high potential, submissions was a difficult balancing act. The program chairs would like to thank the Program Committee of PET 2006 for their invaluable work in helping select the best submissions: - Alessandro Acquisti, Heinz School, Carnegie Mellon University, USA - Mikhail Atallah, Purdue University, USA - Michael Backes, Saarland University, Germany - Alastair Beresford, University of Cambridge, UK - Nikita Borisov, University of Illinois at Urbana-Champaign, USA - Jan Camenisch, IBM Zurich Research Laboratory, Switzerland - Kim Cameron, Microsoft, USA - Fred Cate, Indiana University at Bloomington, USA - Roger Dingledine, The Free Haven Project, USA - Hannes Federrath, University of Regensburg, Germany - Simone Fischer-Hübner, Karlstad University, Sweden - Ian Goldberg, Zero Knowledge Systems, Canada - Markus Jakobsson, Indiana University at Bloomington, USA - Dennis Kügler, Federal Office for Information Security, Germany - Brian Levine, University of Massachusetts at Amherst, USA - David Molnar, University of California at Berkeley, USA - Andreas Pfitzmann, Dresden University of Technology, Germany - Mike Reiter, Carnegie Mellon University, USA - Andrei Serjantov, The Free Haven Project, UK - Paul Syverson, Naval Research Lab, USA - Matthew Wright, University of Texas at Arlington, USA Additional reviewers included Christer Andersson, Marina Blanton, Katrin Borcea-Pfitzmann, Sebastian Clauß, Richard Clayton, Hatim Daginawala,

5 VI Preface Markus Duermuth, Nick Feamster, Keith Frikken, Rachel Greenstadt, Thomas Heydt-Benjamin, Ari Juels, Lea Kissner, Stefan Köpsell, Klaus K. Kursawe, Pil Joong Lee, Jiangtao Li, Katja Liesebach, Leonardo A. Martucci, Nick Mathewson, Steven J. Murdoch, Gregory Neuven, Amit Sahai, Antje Schneidewind, Dagmar Schufeld, Sid Stamm, Sandra Steinbrecher, Madhu Venkateshaiah, and Lasse Øverlier. Their help was very much appreciated. We are especially grateful to our General Chair, Richard Clayton, from the University of Cambridge Computer Laboratory, for taking care of all local arrangements. Thomas Herlea, from the K.U. Leuven, was kind enough to help us with the online submission and reviewing system. PET 2006 was collocated with two events. WEIS 2006, the Workshop on the Economics of Information Security, shared a session with PET on the economics of privacy and surveillance. We are very grateful to Ross Anderson, WEIS Chair, and Tyler Moore, WEIS General Chair, who took care of local arrangements, for their help in coordinating the two events. Secondly, WOTE 2006, the Workshop on Trustworthy Elections, coordinated by Peter Ryan, shared the last two days of the workshop. Participants of both workshops were free to circulate between all sessions, and social activities during the day were shared to maximize the synergy between the two communities. PET 2006 was made possible, and more affordable, thanks to the continuing generous sponsorship of Microsoft. We are particularly indebted to Caspar Bowden and JC Cannon, who actively contributed to the success of the workshop by providing this sponsorship and support. Roger Dingledine was kind enough to manage and distribute the stipends to those participants who needed them. The PET prize, sponsored by Microsoft and the Office of the Information and Privacy Commissioner of Ontario, was this year awarded through an independent prize committee headed by Alessandro Acquisti, to whom we are thankful. The 2006 prize was awarded to Daniel Solove for his paper entitled A Taxonomy of Privacy. The award ceremony took place at Microsoft Research Cambridge, along with live demonstrations of privacy technology. October 2006 George Danezis and Philippe Golle Program Chairs PET 2006

6 Table of Contents 6 th Workshop on Privacy Enhancing Technologies Privacy for Public Transportation... 1 Thomas S. Heydt-Benjamin, Hee-Jin Chae, Benessa Defend, and Kevin Fu Ignoring the Great Firewall of China Richard Clayton, Steven J. Murdoch, and Robert N.M. Watson Imagined Communities: Awareness, Information Sharing, and Privacy on the Facebook Alessandro Acquisti and Ralph Gross Enhancing Consumer Privacy in the Liberty Alliance Identity Federation and Web Services Frameworks Mansour Alsaleh and Carlisle Adams Traceable and Automatic Compliance of Privacy Policies in Federated Digital Identity Management Anna Squicciarini, Abhilasha Bhargav-Spantzel, Alexei Czeskis, and Elisa Bertino Privacy Injector Automated Privacy Enforcement Through Aspects Chris Vanden Berghe and Matthias Schunter A Systemic Approach to Automate Privacy Policy Enforcement in Enterprises Marco Casassa Mont and Robert Thyne One Big File Is Not Enough: A Critical Evaluation of the Dominant Free-Space Sanitization Technique Simson L. Garfinkel and David J. Malan Protecting Privacy with the MPEG-21 IPMP Framework Nicholas Paul Sheppard and Reihaneh Safavi-Naini Personal Rights Management Taming Camera-Phones for Individual Privacy Enforcement Mina Deng, Lothar Fritsch, and Klaus Kursawe Improving Sender Anonymity in a Structured Overlay with Imprecise Routing Giuseppe Ciaccio

7 VIII Table of Contents Selectively Traceable Anonymity Luis von Ahn, Andrew Bortz, Nicholas J. Hopper, and Kevin O Neill Valet Services: Improving Hidden Servers with a Personal Touch Lasse Øverlier and Paul Syverson Blending Different Latency Traffic with Alpha-mixing Roger Dingledine, Andrei Serjantov, and Paul Syverson Private Resource Pairing Joseph A. Calandrino and Alfred C. Weaver Honest-Verifier Private Disjointness Testing Without Random Oracles Susan Hohenberger and Stephen A. Weis A Flexible Framework for Secret Handshakes (Multi-party Anonymous and Un-observable Authentication) Gene Tsudik and Shouhuai Xu On the Security of the Tor Authentication Protocol Ian Goldberg Optimal Key-Trees for Tree-Based Private Authentication Levente Buttyán, Tamás Holczer, and István Vajda Simple and Flexible Revocation Checking with Privacy John Solis and Gene Tsudik Breaking the Collusion Detection Mechanism of MorphMix Parisa Tabriz and Nikita Borisov Linking Anonymous Transactions: The Consistent View Attack Andreas Pashalidis and Bernd Meyer Preserving User Location Privacy in Mobile Data Management Infrastructures Reynold Cheng, Yu Zhang, Elisa Bertino, and Sunil Prabhakar The Effects of Location Access Behavior on Re-identification Risk in a Distributed Environment Bradley Malin and Edoardo Airoldi Author Index