Dr. Gergely Biczók
Associate Professor
biczok (at) crysys.hu
office: I.E. 430
tel: +36 1 463 2080
fax: +36 1 463 3263
Current courses | Student projects | Publications
Short Bio
Gergely is a freshly-minted associate professor at the CrySyS Lab. He received the PhD (2010) and MSc (2003) degrees in
Computer Science from the Budapest University of Technology and Economics. He was a postdoctoral fellow at the
Norwegian University of Science and Technology from 2011 to 2014. He was a Fulbright Visiting Researcher to
Northwestern University between 2007 and 2008. He also held a researcher position at Ericsson Research Hungary
from 2003 to 2007.
His research interests are in the economics of networked systems focusing on data privacy, information security and incentives.
His Google Scholar profile is here.
Current Courses
IT Security (VIHIAC01)
This BSc course gives an overview of the different areas of IT security with the aim of increasing the security awareness of computer science students and shaping their attitude towards designing and using secure computing systems. The course prepares BSc students for security challenges that they may encounter during their professional career, and at the same time, it provides a basis for those students who want to continue their studies at MSc level (taking, for instance, our IT Security minor specialization). We put special emphasis on software security and the practical aspects of developing secure programs.
IT Security (in English) (VIHIAC01)
This BSc course gives an overview of the different areas of IT security with the aim of increasing the security awareness of computer science students and shaping their attitude towards designing and using secure computing systems. The course prepares BSc students for security challenges that they may encounter during their professional career, and at the same time, it provides a basis for those students who want to continue their studies at MSc level (taking, for instance, our IT Security minor specialization). We put special emphasis on software security and the practical aspects of developing secure programs.
Security and Privacy: an Economic Approach (in English) (VIHIAV34)
Information security is as much an economic problem as it is technical. Even given flawless cryptographic protocols and the availability of perfectly secure software, the misaligned economic incentives of different stakeholders in a system often result in a (very) sub-optimal security level. By guiding you through the jungle of asymmetric information, interdependent security, correlated risk and other concepts characteristic for system security, this elective course will enable you to make better decisions in risk management, security investment and policy design on a system level. Furthermore, the course touches upon the economic aspects of data privacy, an emerging area of interest for users and companies in the big data era.
Privacy-Preserving Technologies (VIHIAV35)
The sharing and explotation of the ever-growing data about individuals raise serious privacy concerns these
days. Is it possible to derive (socially or individually) useful information about people from this Big Data
without revealing personal information?
This course provides a detailed overview of data privacy. It focuses on different privacy problems of web
tracking, data sharing, and machine learning, as well as their mitigation techniques. The aim is to give the
essential (technical) background knowledge needed to identify and protect personal data. These skills are
becoming a must of every data/software engineer and data protection officer dealing with personal and sensitive
data, and are also required by the European General Data Protection Regulation (GDPR).
Student Project Proposals
Economics of cybersecurity and data privacy
As evidenced in the last 10-15 years, cybersecurity is not a purely technical discipline. Decision-makers, whether sitting at security providers (IT companies), security demanders (everyone using IT) or the security industry, are mostly driven by economic incentives. Understanding these incentives are vital for designing systems that are secure in real-life scenarios. Parallel to this, data privacy has also shown the same characteristics: proper economic incentives and controls are needed to design systems where sharing data is beneficial to both data subject and data controller. An extreme example to a flawed attempt at such a design is the Cambridge Analytica case.
The prospective student will identify a cybersecurity or data privacy economics problem, and use elements of game theory and other domain-specific techniques and software tools to transform the problem into a model and propose a solution. Potential topics include:
- Ghostbusting in ML: eliminating free-riders in federated learning schemes
- CPSFlipIt: attacker-defender dynamics in cyber-physical systems
- Risk management for cyber-physical/OT systems
- Incentives in secure software development: why should programmers have proper security training?
- Interdependent privacy: modeling inference with probabilistic graphical models
- Additional Related Topics
- BYOT: Bring Your Own Topic!
Required skills: model thinking, good command of English
Preferred skills: basic knowledge of game theory, basic programming skills (e.g., python, matlab, NetLogo)
Publications
2021
Detecting Message Modification Attacks on the CAN Bus with Temporal Convolutional Networks
I. Chiscop, A. Gazdag, J. Bosman, G. Biczók
Proceedings of the 7th International Conference on Vehicle Technology and Intelligent Transport Systems, 2021.
@inproceedings {
author = {Irina Chiscop, András Gazdag, Joost Bosman, Gergely Biczók},
title = {Detecting Message Modification Attacks on the CAN Bus with Temporal Convolutional Networks},
booktitle = {Proceedings of the
7th International Conference on
Vehicle Technology and Intelligent Transport Systems},
year = {2021}
}
Keywords
Vehicle Security, Intrusion Detection, Controller Area Network, Machine Learning, Temporal Convolutional Networks.Abstract
Multiple attacks have shown that in-vehicle networks have vulnerabilities which can be exploited. Securing the Controller Area Network (CAN) for modern vehicles has become a necessary task for car manufacturers. Some attacks inject potentially large amount of fake messages into the CAN network; however, such attacks are relatively easy to detect. In more sophisticated attacks, the original messages are modified, making the de- tection a more complex problem. In this paper, we present a novel machine learning based intrusion detection method for CAN networks. We focus on detecting message modification attacks, which do not change the timing patterns of communications. Our proposed temporal convolutional network-based solution can learn the normal behavior of CAN signals and differentiate them from malicious ones. The method is evaluated on multiple CAN-bus message IDs from two public datasets including different types of attacks. Performance results show that our lightweight approach compares favorably to the state-of-the-art unsupervised learning approach, achieving similar or better accuracy for a wide range of scenarios with a significantly lower false positive rate.Impact Assessment of IT Security Breaches in Cyber-Physical Systems
A. Földvári, G. Biczók, I. Kocsis, L. Gönczy, A. Pataricza
2nd Workshop on vAlidation and verification in FuturE cybeR-physical Systems (WAFERS, co-located with LADC 2021), 2021.
@inproceedings {
author = {, Gergely Biczók, , , },
title = {Impact Assessment of IT Security Breaches in Cyber-Physical Systems},
booktitle = {2nd Workshop on vAlidation and verification in FuturE cybeR-physical Systems (WAFERS, co-located with LADC 2021)},
year = {2021}
}
Keywords
cyber-physical systems, impact analysis, error propagation analysisAbstract
Interdependent privacy issues are pervasive among third-party applications
S. Liu, B. Herendi, G. Biczók
16th International Workshop on Data Privacy Management (DPM, co-located with ESORICS 2021), 2021.
@inproceedings {
author = {Shuaishuai Liu, , Gergely Biczók},
title = {Interdependent privacy issues are pervasive among third-party applications},
booktitle = {16th International Workshop on Data Privacy Management (DPM, co-located with ESORICS 2021)},
year = {2021}
}
Keywords
interdependent privacy, third-party apps, permissions, Android, browser extensions, Google Workspace, risk signalAbstract
Third-party applications are popular: they improve and ex- tend the features offered by their respective platforms, whether being mobile OS, browsers or cloud-based tools. Although some privacy con- cerns regarding these apps have been studied in detail, the phenomenon of interdependent privacy, when a user shares others’ data with an app without their knowledge and consent. Through careful analysis of per- mission models and multiple platform-specific datasets, we show that interdependent privacy risks are enabled by certain permissions in all platforms studied, and actual apps request these permissions instantiat- ing these risks. We also identify potential risk signals, and discuss solu- tions which could improve transparency and control for users, developers and platform owners.Measuring Contributions in Privacy-Preserving Federated Learning
G. Ács, G. Biczók, B. Pejo
ERCIM NEWS, vol. 126, 2021, pp. 35-36.
@article {
author = {Gergely Ács, Gergely Biczók, Balazs Pejo},
title = {Measuring Contributions in Privacy-Preserving Federated Learning},
journal = {ERCIM NEWS},
volume = {126},
year = {2021},
pages = {35-36},
howpublished = "\url{https://ercim-news.ercim.eu/en126/special/measuring-contributions-in-privacy-preserving-federated-learning}"
}
Abstract
How vital is each participant’s contribution to a collaboratively trained machine learning model? This is a challenging question to answer, especially if the learning is carried out in a privacy-preserving manner with the aim of concealing individual actions.Privacy of Aggregated Mobility Data
G. Ács, Sz. Lestyán, G. Biczók
Jajodia S., Samarati P., Yung M. (eds) Encyclopedia of Cryptography, Security and Privacy. Springer, Berlin, Heidelberg., Springer, 2021.
@inproceedings {
author = {Gergely Ács, Szilvia Lestyan, Gergely Biczók},
title = {Privacy of Aggregated Mobility Data},
booktitle = {Jajodia S., Samarati P., Yung M. (eds) Encyclopedia of Cryptography, Security and Privacy. Springer, Berlin, Heidelberg.},
publisher = {Springer},
year = {2021},
howpublished = "\url{https://doi.org/10.1007/978-3-642-27739-9_1575-1}"
}
Abstract
SafeLib: a practical library for outsourcing stateful network functions securely
E. Marku, G. Biczók, C. Boyd
2021 IEEE 7th International Conference on Network Softwarization (NetSoft 2021), 2021.
@inproceedings {
author = {Enio Marku, Gergely Biczók, Colin Boyd},
title = {SafeLib: a practical library for outsourcing stateful network functions securely},
booktitle = {2021 IEEE 7th International Conference on Network Softwarization (NetSoft 2021)},
year = {2021}
}
Keywords
virtualization; outsourcing; stateful network function; cloud; securityAbstract
A recent trend is to outsource virtual network functions (VNFs) to a third-party service provider, such as a public cloud. Since the cloud is usually not trusted, redirecting enterprise traffic to such an entity introduces security concerns. In addition to protecting enterprise traffic, it is also desirable to protect VNF code, policies and states. Existing outsourcing solutions fall short in either supporting stateful VNFs, catering for all security requirements, or providing adequate performance. In this paper we present SafeLib, a trusted hardware based outsourcing solution built on Intel SGX. SafeLib provides i) support for stateful VNFs, ii) support for illegal SGX instructions by integrating Graphene-SGX, iii) protection of both packet headers and payload for enterprise user traffic, VNF policies and VNF code, and iv) integration of libVNF for streamlined VNF development. Our performance evaluation shows that SafeLib scales properly for multiple cores, and introduces a reasonable performance overhead. We also outline plans to further improve SafeLib to satisfy even more stringent functional, security and performance requirements.2020
Corona Games: Masks, Social Distancing and Mechanism Design
B. Pejo, G. Biczók
Proc. of ACM SIGSPATIAL Workshop on COVID, ACM, 2020.
@inproceedings {
author = {Balazs Pejo, Gergely Biczók},
title = {Corona Games: Masks, Social Distancing and Mechanism Design},
booktitle = {Proc. of ACM SIGSPATIAL Workshop on COVID},
publisher = {ACM},
year = {2020}
}
Abstract
Pandemic response is a complex affair. Most governments employ a set of quasi-standard measures to fight COVID-19 including wearing masks, social distancing, virus testing and contact tracing. We argue that some non-trivial factors behind the varying effectiveness of these measures are selfish decision-making and the differing national implementations of the response mechanism. In this paper, through simple games, we show the effect of individual incentives on the decisions made with respect to wearing masks and social distancing, and how these may result in a sub-optimal outcome. We also demonstrate the responsibility of national authorities in designing these games properly regarding the chosen policies and their influence on the preferred outcome. We promote a mechanism design approach: it is in the best interest of every government to carefully balance social good and response costs when implementing their respective pandemic response mechanism.Securing Outsourced VNFs: Challenges, State of the Art, and Future Directions
E. Marku, G. Biczók, C. Boyd
IEEE Communications Magazine, vol. 58, no. 7, vol. 58, 2020, pp. 1-8.
@article {
author = {Enio Marku, Gergely Biczók, Colin Boyd},
title = {Securing Outsourced VNFs: Challenges, State of the Art, and Future Directions},
journal = {IEEE Communications Magazine, vol. 58, no. 7},
volume = {58},
year = {2020},
pages = {1-8}
}
Keywords
virtualization, security, confidentiality, middlebox, cloud, outsourcing, VNF, SGX, 5G, RAP, LAPAbstract
It is becoming increasingly common for en- terprises to outsource network functions to a third party provider such as a public cloud. Besides its well- documented benefits in cost and flexibility, outsourcing also introduces security issues. Peeking into or modifying traffic destined to the cloud are not the only threats we have to deal with; it can also be desirable to protect VNF code, input policies and states from a malicious cloud provider. In recent years several solutions have been proposed towards mitigating the threats of outsourcing VNFs, using either cryptographic or trusted hardware- based mechanisms (the latter typically applying SGX). In this paper, we provide an overview of methods for protecting the security of outsourced network functions. We introduce the challenges and emerging requirements, analyze the state-of-the-art, and identify the gaps between the requirements and existing solutions. Furthermore, we outline a potential way to fill these gaps in order to devise a more complete solution.The cost of having been pwned: a security service provider's perspective
G. Biczók, M. Horváth, Sz. Szebeni, I. Lam, L. Buttyán
3rd International Workshop on Emerging Technologies for Authorization and Authentication (Co-Located with ESORICS 2020) - ETAA 2020, 2020.
@inproceedings {
author = {Gergely Biczók, Máté Horváth, Szilveszter Szebeni, Istvan Lam, Levente Buttyán},
title = {The cost of having been pwned: a security service provider's perspective},
booktitle = {3rd International Workshop on Emerging Technologies for Authorization and Authentication (Co-Located with ESORICS 2020) - ETAA 2020},
year = {2020}
}
Abstract
Account information from major online providers are getting exposed regularly; this gives rise to PWND services, providing a smart means to check whether a password or username/password tuple has already been leaked, rendering them ``pwned'' and therefore risky to use. However, state-of-the-art PWND mechanisms leak some information themselves. In this paper, we investigate how this minimal leaked information can speed up password cracking attacks of a powerful adversary, when the PWND mechanism is implemented on-premise by a service provider as an additional security measure during registration or password change. We analyze the costs and practicality of these attacks, and investigate simple mitigation techniques. We show that implementing a PWND mechanism can be beneficial, especially for security-focused service providers, but proper care needs to be taken. We also discuss behavioral factors to consider when deploying PWND services.2019
Automatic Driver Identification from In-Vehicle Network Logs
M. Remeli, Sz. Lestyán, G. Ács, G. Biczók
22th IEEE Intelligent Transportation Systems Conference (ITSC), IEEE, 2019.
@inproceedings {
author = {Mina Remeli, Szilvia Lestyan, Gergely Ács, Gergely Biczók},
title = {Automatic Driver Identification from In-Vehicle Network Logs},
booktitle = {22th IEEE Intelligent Transportation Systems Conference (ITSC)},
publisher = {IEEE},
year = {2019},
howpublished = "\url{https://arxiv.org/pdf/1911.09508.pdf}"
}
Abstract
Extracting vehicle sensor signals from CAN logs for driver re-identification
Sz. Lestyán, G. Ács, G. Biczók, Zs. Szalay
5th International Conference on Information Security and Privacy (ICISSP 2019), SCITEPRESS, 2019, shortlisted for Best Student Paper Award.
@inproceedings {
author = {Szilvia Lestyan, Gergely Ács, Gergely Biczók, Zsolt Szalay},
title = {Extracting vehicle sensor signals from CAN logs for driver re-identification},
booktitle = {5th International Conference on Information Security and Privacy (ICISSP 2019)},
publisher = {SCITEPRESS},
year = {2019},
note = {shortlisted for Best Student Paper Award}
}
Abstract
Data is the new oil for the car industry. Cars generate data about how they are used and who’s behind the wheel which gives rise to a novel way of profiling individuals. Several prior works have successfully demonstrated the feasibility of driver re-identification using the in-vehicle network data captured on the vehicle’s CAN bus. However, all of them used signals (e.g., velocity, brake pedal or accelerator position) that have already been extracted from the CAN log which is itself not a straightforward process. Indeed, car manufacturers intentionally do not reveal the exact signal location within CAN logs. Nevertheless, we show that signals can be efficiently extracted from CAN logs using machine learning techniques. We exploit that signals have several distinguishing statistical features which can be learnt and effectively used to identify them across different vehicles, that is, to quasi ”reverse-engineer” the CAN protocol. We also demonstrate that the extracted signals can be successfully used to re-identify individuals in a dataset of 33 drivers. Therefore, hiding signal locations in CAN logs per se does not prevent them to be regarded as personal data of drivers.Together or Alone: The Price of Privacy in Collaborative Learning
B. Pejó, Q. Tang, G. Biczók
Proceedings on Privacy Enhancing Technologies (PETS 2019), De Gruyter, 2019.
@inproceedings {
author = {Balázs Pejó, , Gergely Biczók},
title = {Together or Alone: The Price of Privacy in Collaborative Learning},
booktitle = {Proceedings on Privacy Enhancing Technologies (PETS 2019)},
publisher = {De Gruyter},
year = {2019}
}
Abstract
Machine learning algorithms have reached mainstream status and are widely deployed in many applications. The accuracy of such algorithms depends significantly on the size of the underlying training dataset; in reality a small or medium sized organization often does not have the necessary data to train a reasonably accurate model. For such organizations, a realistic solution is to train their machine learning models based on their joint dataset (which is a union of the individual ones). Unfortunately, privacy concerns prevent them from straightforwardly doing so. While a number of privacy-preserving solutions exist for collaborating organizations to securely aggregate the parameters in the process of training the models, we are not aware of any work that provides a rational framework for the participants to precisely balance the privacy loss and accuracy gain in their collaboration. In this paper, by focusing on a two-player setting, we model the collaborative training process as a two-player game where each player aims to achieve higher accuracy while preserving the privacy of its own dataset. We introduce the notion of Price of Privacy, a novel approach for measuring the impact of privacy protection on the accuracy in the proposed framework. Furthermore, we develop a game-theoretical model for different player types, and then either find or prove the existence of a Nash Equilibrium with regard to the strength of privacy protection for each player. Using recommendation systems as our main use case, we demonstrate how two players can make practical use of the proposed theoretical framework, including setting up the parameters and approximating the non-trivial Nash Equilibrium.Towards protected VNFs for multi-operator service delivery
E. Marku, G. Biczók, C. Boyd
1st International Workshop on Cyber-Security Threats, Trust and Privacy Management in Software-defined and Virtualized Infrastructures (SecSoft), IEEE, 2019, co-located with IEEE NetSoft 2019.
@inproceedings {
author = {Enio Marku, Gergely Biczók, Colin Boyd},
title = {Towards protected VNFs for multi-operator service delivery},
booktitle = {1st International Workshop on Cyber-Security Threats, Trust and Privacy Management in Software-defined and Virtualized Infrastructures (SecSoft)},
publisher = {IEEE},
year = {2019},
note = {co-located with IEEE NetSoft 2019}
}
Abstract
Towards Systematic Specification of Non-Functional Requirements for Sharing Economy Services
I. Symeonidis, J. Schroers, M. A. Mustafa, G. Biczók
1st International Workshop on Smart Circular Economy (co-located with IEEE DCOSS), IEEE, 2019.
@inproceedings {
author = {Iraklis Symeonidis, , , Gergely Biczók},
title = {Towards Systematic Specification of Non-Functional Requirements for Sharing Economy Services},
booktitle = {1st International Workshop on Smart Circular Economy (co-located with IEEE DCOSS)},
publisher = {IEEE},
year = {2019}
}
Abstract
2018
Collateral damage of Facebook third-party applications: a comprehensive study
I. Symeonidis, G. Biczók, F. Shirazi, C. Perez-Sola, J. Schroers, B. Preneel
Computers & Security, vol. 77, 2018, pp. 179-208.
@article {
author = {Iraklis Symeonidis, Gergely Biczók, Fatemeh Shirazi, Cristina Perez-Sola, , Bart Preneel},
title = {Collateral damage of Facebook third-party applications: a comprehensive study},
journal = {Computers & Security},
volume = {77},
year = {2018},
pages = {179-208}
}
Abstract
Third-party applications on Facebook can collect personal data of the users who install them, but also of their friends. This raises serious privacy issues as these friends are not notified by the applications nor by Facebook and they have not given consent. This paper presents a detailed multi-faceted study on the collateral information collection of the applications on Facebook. To investigate the views of the users, we designed a questionnaire and collected the responses of 114 participants. The results show that participants are concerned about the collateral information collection and in particular about the lack of notification and of mechanisms to control the data collection. Based on real data, we compute the likelihood of collateral information collection affecting users: we show that the probability is significant and greater than 80% for popular applications such as TripAdvisor. We also demonstrate that a substantial amount of profile data can be collected by applications, which enables application providers to profile users. To investigate whether collateral information collection is an issue to users’ privacy we analysed the legal framework in light of the General Data Protection Regulation. We provide a detailed analysis of the entities involved and investigate which entity is accountable for the collateral information collection. To provide countermeasures, we propose a privacy dashboard extension that implements privacy scoring computations to enhance transparency toward collateral information collection. Furthermore, we discuss alternative solutions highlighting other countermeasures such as notification and access control mechanisms, cryptographic solutions and application auditing. To the best of our knowledge this is the first work that provides a detailed multi-faceted study of this problem and that analyses the threat of user profiling by application providers.POSTER: The Price of Privacy in Collaborative Learning
B. Pejó, Q. Tang, G. Biczók
CCS 2018 Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, ACM, 2018.
@inproceedings {
author = {Balázs Pejó, , Gergely Biczók},
title = {POSTER: The Price of Privacy in Collaborative Learning},
booktitle = {CCS 2018 Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security},
publisher = {ACM},
year = {2018}
}
Abstract
Machine learning algorithms have reached mainstream status and are widely deployed in many applications. The accuracy of such algorithms depends significantly on the size of the underlying training dataset; in reality a small or medium sized organization often does not have enough data to train a reasonably accurate model. For such organizations, a realistic solution is to train machine learning models based on a joint dataset (which is a union of the individual ones). Unfortunately, privacy concerns prevent them from straightforwardly doing so. While a number of privacy-preserving solutions exist for collaborating organizations to securely aggregate the parameters in the process of training the models, we are not aware of any work that provides a rational framework for the participants to precisely balance the privacy loss and accuracy gain in their collaboration. In this paper, we model the collaborative training process as a two-player game where each player aims to achieve higher accuracy while preserving the privacy of its own dataset. We introduce the notion of Price of Privacy, a novel approach for measuring the impact of privacy protection on the accuracy in the proposed framework. Furthermore, we develop a game-theoretical model for different player types, and then either find or prove the existence of a Nash Equilibrium with regard to the strength of privacy protection for each player.Privacy-Preserving Release of Spatio-Temporal Density
G. Ács, G. Biczók, C. Castelluccia
A. Gkoulalas-Divanis and Claudio Bettini (Eds.), Handbook of Mobile Data Privacy, pp. 307-335, Springer, 2018.
@inbook {
author = {Gergely Ács, Gergely Biczók, Claude Castelluccia},
editor = {A. Gkoulalas-Divanis and Claudio Bettini (Eds.)},
title = {Privacy-Preserving Release of Spatio-Temporal Density},
chapter = {Handbook of Mobile Data Privacy},
pages = {307-335},
publisher = {Springer},
year = {2018}
}
Abstract
In today’s digital society, increasing amounts of contextually rich spatio-temporal information are collected and used, e.g., for knowledge-based decision making, research purposes, optimizing operational phases of city management, planning infrastructure networks, or developing timetables for public transportation with an increasingly autonomous vehicle fleet. At the same time, however, publishing or sharing spatio-temporal data, even in aggregated form, is not always viable owing to the danger of violating individuals’ privacy, along with the related legal and ethical repercussions. In this chapter, we review some fundamental approaches for anonymizing and releasing spatio-temporal density, i.e., the number of individuals visiting a given set of locations as a function of time. These approaches follow different privacy models providing different privacy guarantees as well as accuracy of the released anonymized data. We demonstrate some sanitization (anonymization) techniques with provable privacy guarantees by releasing the spatio-temporal density of Paris, in France. We conclude that, in order to achieve meaningful accuracy, the sanitization process has to be carefully customized to the application and public characteristics of the spatio-temporal data.2017
Manufactured by software: SDN-enabled multi-operator composite services with the 5G Exchange
H Lønsethagen, P Heegaard, L. Toka, M Dramitinos, G. Biczók
IEEE Communications Magazine, vol. 55, no. 4, 2017.
@article {
author = {Håkon Lønsethagen, Poul E. Heegaard, Laszlo Toka, Manos Dramitinos, Gergely Biczók},
title = {Manufactured by software: SDN-enabled multi-operator composite services with the 5G Exchange},
journal = {IEEE Communications Magazine},
volume = {55},
number = {4},
year = {2017}
}
Abstract
Bla2016
Collateral Damage of Facebook Apps: Friends, Providers, and Privacy Interdependence
B. Preneel, C. Perez-Sola, G. Biczók, F. Shirazi, I. Symeonidis
IFIP International Conference on ICT Systems Security and Privacy Protection (IFIP SEC), Springer, 2016.
@inproceedings {
author = {Bart Preneel, Cristina Perez-Sola, Gergely Biczók, Fatemeh Shirazi, Iraklis Symeonidis},
title = {Collateral Damage of Facebook Apps: Friends, Providers, and Privacy Interdependence},
booktitle = {IFIP International Conference on ICT Systems Security and Privacy Protection (IFIP SEC)},
publisher = {Springer},
year = {2016}
}
Abstract
Third-party apps enable a personalized experience on social networking platforms; however, they give rise to privacy interdependence issues. Apps installed by a user’s friends can collect and potentially misuse her personal data inflicting collateral damage on the user while leaving her without proper means of control. In this paper, we present a multi-faceted study on the collateral information collection of apps in social networks. We conduct a user survey and show that Facebook users are concerned about this issue and the lack of mechanisms to control it. Based on real data, we compute the likelihood of collateral information collection affecting users; we show that the probability is significant and depends on both the friendship network and the popularity of the app. We also show its significance by computing the proportion of exposed user attributes including the case of profiling, when several apps are offered by the same provider. Finally, we propose a privacy dashboard concept enabling users to control the collateral damage.Private VNFs for collaborative multi-operator service delivery: An architectural case
C. Boyd, N. Bereczky, B. Sonkoly, G. Biczók
IEEE/IFIP Network Operations and Management Symposium (NOMS), IEEE, 2016.
@inproceedings {
author = {Colin Boyd, Nikolett Bereczky, Balázs Sonkoly, Gergely Biczók},
title = {Private VNFs for collaborative multi-operator service delivery: An architectural case},
booktitle = {IEEE/IFIP Network Operations and Management Symposium (NOMS)},
publisher = {IEEE},
year = {2016}
}
Abstract
Flexible service delivery is a key requirement for 5G network architectures. This includes the support for collaborative service delivery by multiple operators, when an individual operator lacks the geographical footprint or the available network, compute or storage resources to provide the requested service to its customer. Network Function Virtualisation is a key enabler of such service delivery, as network functions (VNFs) can be outsourced to other operators. Owing to the (partial lack of) contractual relationships and co-opetition in the ecosystem, the privacy of user data, operator policy and even VNF code could be compromised. In this paper, we present a case for privacy in a VNF-enabled collaborative service delivery architecture. Specifically, we show the promise of homomorphic encryption (HE) in this context and its performance limitations through a proof of concept implementation of an image transcoder network function. Furthermore, inspired by application-specific encryption techniques, we propose a way forward for private, payload-intensive VNFs.Sharing is Power: Incentives for Information Exchange in Multi-Operator Service Delivery
L. Toka, G. Biczók, P Heegaard
IEEE Global Communications Conference (GLOBECOM), IEEE, 2016.
@inproceedings {
author = {Laszlo Toka, Gergely Biczók, Poul E. Heegaard},
title = {Sharing is Power: Incentives for Information Exchange in Multi-Operator Service Delivery},
booktitle = {IEEE Global Communications Conference (GLOBECOM)},
publisher = {IEEE},
year = {2016}
}
Abstract
2015
On pricing online data backup
G. Biczók, L. Toka
IEEE INFOCOM Smart Data Pricing WS, IEEE, 2015.
@inproceedings {
author = {Gergely Biczók, Laszlo Toka},
title = {On pricing online data backup},
booktitle = {IEEE INFOCOM Smart Data Pricing WS},
publisher = {IEEE},
year = {2015}
}
Abstract
2013
Interdependent Privacy: Let Me Share Your Data
P. Chia, G. Biczók
Financial Cryptography & Data Security, Springer, 2013.
@inproceedings {
author = {Pern Hui Chia, Gergely Biczók},
title = {Interdependent Privacy: Let Me Share Your Data},
booktitle = {Financial Cryptography & Data Security},
publisher = {Springer},
year = {2013}
}