Today’s software systems have become increasingly connected and complex, requiring comprehensive analysis to ensure quality properties like confidentiality. Architecture-based confidentiality analysis enables the early identification of confidentiality violations to counter data breaches effectively. However, uncertainty within the software system and its environment hinders the precise and comprehensive analysis of software architectures. Furthermore, the complexity of both architectural models and uncertainties and their outcomes impede automated model repair due to combinatorial explosion. Ultimately, software architects must manually address all confidentiality violations, which is both bothersome and error-prone. Although existing approaches can identify confidentiality violations due to uncertainty, they fall short of mitigating their effects. In this paper, we address this by utilizing machine learning in the confidentiality analysis both to evaluate the criticality of identified violations and to automatically repair them. This bridges the gap between analysis and mitigation, thereby effectively supporting software architects. Evaluation results show that logistic regression provides the best ranking of the importance of uncertainty sources. Combined with incremental testing, our approach outperforms the state of the art and achieves up to a 60-fold reduction in runtime.
Zur Publikation
The adoption of Homomorphic Encryption (HE) and Secure Function Evaluation (SFE) applications in the real world remains limited, even nearly 50 years after the introduction of HE. This is particularly unfortunate given the strong privacy and confidentiality guarantees these tools can offer to modern digital life. While attempting to incorporate a simple straw-man PSI protocol into a web service for matching individuals based on their profiles, we encountered several shortcomings in current outsourcing frameworks. Existing outsourced protocols either require clients to perform tasks beyond merely contributing their inputs or rely on a non-collusion assumption between a server and a client, which appears implausible in standard web service scenarios. To address these issues, we present, to the best of our knowledge, the first general construction for non-interactive outsourced computation based on black-box homomorphic encryption. This approach relies on a non-collusion assumption between two dedicated servers, which we consider more realistic in a web-service setting. Furthermore, we provide a proof of our construction within the Universal Composability (UC) framework, assuming semi-honest (i.e., passive) adversaries. Unlike general one-sided two-party SFE protocols, our construction addi-tionally requires sender privacy. Specifically, the sender must contribute its inputs solely in encrypted form. This ensures stronger privacy guar-antees and broadens the applicability of the protocol. Overall, the range of applications for our construction includes all one-sided two-party sender-private SFE protocols as well as server-based arithmetic computations on encrypted inputs. Finally, we demonstrate the practical applicability of our general outsourced computation frame-work by applying it to the specific use case of Outsourced Private Set Intersection (OPSI) in a real-world scenario, accompanied by a detailed evaluation of its efficiency.
Zur Publikation
Anonymization plays a key role in protecting sensible information of individuals in real world datasets. Self-driving cars for example need high resolution facial features to track people and their viewing direction to predict future behaviour and react accordingly. In order to protect people’s privacy whilst keeping important features in the dataset, it is important to replace the full body of a person with a highly detailed anonymized one. In contrast to doing face anonymization, full body replacement decreases the ability of recognizing people by their hairstyle or clothes. In this paper, we propose a workflow for full body person anonymization utilizing Stable Diffusion as a generative backend. Text-to-image diffusion models, like Stable Diffusion, OpenAI’s DALL-E or Midjourney, have become very popular in recent time, being able to create photorealistic images from a single text prompt. We show that our method outperforms state-of-the art anonymization pipelines with respect to image quality, resolution, Inception Score (IS) and Frechet Inception Distance (FID). Additionally, our method is invariant with respect to the image generator and thus able to be used with the latest models available.
Zur Publikation
Zum Code auf GitHub
Achieving and maintaining certain quality attributes of software-intensive systems is challenging, especially when these systems undergo change. In particular, information security is more difficult to maintain and degrades more rapidly than other non-functional attributes, often with catastrophic consequences. Security patterns are a well-established method for preventing and mitigating malicious attacks or unintentional failures. However, these patterns depend on contextual factors such as attacker behaviour and run-time configurations that are not explicitly addressed at design time, but evolve along with other software components or change dynamically in production. Security issues can arise after the initial development phases if software architects do not adequately document such contextual information in their designs. Existing approaches handle security-related information during the software design phase, but fail to consider the effects of evolving system architecture and environment due to implicit assumptions. Security pattern analysis needs to incorporate such contextual information to provide accurate security predictions. In this paper, we propose a novel approach for modelling security patterns and related contextual information within software architectures. This model-based documentation facilitates the analysis of the expected functionality of applied security patterns at an architectural abstraction level. We demonstrate how these architectural improvements support the maintenance of security by enabling architects to anticipate, track, and act upon the impact of evolutionary changes on the system. To validate our modelling approach, we apply it to a common case study.
Zur Publikation
Market entrants have brought a variety of new urban mobility services over the past years, which are rooted in the sharing economy and have their origin in digitalization. Digital data serve as key resource of a business model and, accordingly, digital technologies are the basis of key activities. Building our analysis on the resource-based view and on the business model debate, we ask: what degrees of digitalization do urban mobility service business models exhibit? We perform a systematic literature review and a qualitative content analysis. As a result, we identify a continuum of highly and lowly digitalized business models. We derive a threefold business model framework, substantiated in conventional mobility, hybrid, and data-driven business models. (1) Conventional mobility business models are dominated by mobility as a key resource, digitalization is low and performed by key partners, (2) hybrid models contain both conventional mobility and data-driven key resources, and (3) data-driven models take digital data as key resources, while conventional mobility is carried out by key partners. As a first main contribution, we conceptualize conventional versus purely data-driven business models along the continuum of data-driven business model components. New urban mobility services are the group of both hybrid and data-driven business models, while conventional urban mobility stands on its own. As a second contribution, we clarify the Mobility-as-a-Service (MaaS) concept by corroborating it as a purely data-driven business model with key partners provisioning mobility.
Zur Publikation
Sharing urban mobility and public transportation data is critical to use the mobility infrastructure of cities to its fullest potential. For data protection reasons, however, the disclosure of data to the public is restricted and only permitted if the anonymity of each individual associated with the dataset can be guaranteed. To achieve anonymity in a given dataset, numerous approaches can be applied, while each ap- proach follows a dierent denition of anonymity. One of the most used denitions is k-anonymity, which builds on the building of equivalence classes so that each row in a dataset belongs to an equivalence class that contains at least k rows that cannot be distinguished. Naturally, this can be achieved by multiple realizations. However, the question is which realization will provide the highest utility for future real-world applications. Currently, abstract metrics are used to assess the utility of dierent k-anonymizations, based on the structure of the dataset. However, these abstract metrics do not properly reect the usefulness of the anonymized datasets in real-world applications. Hence, in this work, we provide a novel framework that helps to evaluate the given abstract metrics from the literature in terms of their performance in measuring utility in the context of urban mobility. To do this, we de- ne a set of potential data science use cases that can be derived from a publicly available dataset on taxi drives and compute multiple real- izations of k-anonymity. By training prediction models on the original dataset and the anonymized datasets and comparing the corresponding performance decrease with the abstract metrics from the literature, we are able to derive recommendations on the usage of abstract metrics to evaluate the utility of potential realizations to achieve k-anonymity.
Zur Publikation
In our modern world, the ever-expanding exchange of data and the increased complexity of interconnected software systems make software security challenging. Ideally, security concerns are already addressed early, as discussed with security by design. Here, architecture-based modeling enables the analysis of security threats such as confidentiality violations or targeted attacks. Such analyses leverage the structural properties of software architecture and information about the system context like deployment and usage. However, this requires security-specific model annotations and adapted propagation rules. In this paper, we present two architectural propagation analyses that extend the concept of change impact analysis for security analysis. Both analyses build on the architecture modeling language PCM. The former propagates uncertainty in software architectures and predicts its impact on the system’s confidentiality. The latter identifies attack paths using vulnerabilities and access control properties in attacker propagation.
Zur Publikation
Digitalization is one of the biggest drivers of advancements in the modern automotive domain. The resulting increase in communication is leading to a more intensive exchange of data and the opening up of for merly closed systems. This raises questions about security and data protection. Software architecture analyses can help identify potential issues, thereby making systems more secure and compliant with data protection laws. Such analyses require representative case studies for development and evaluation. In this paper, we showcase the results of applying requirements and processes for case-study research during three bachelor theses with students. The resulting three case studies center around the automotive and mobility domain and focus on different security and privacy properties. We discuss our insights and experiences regarding the creation of case studies.
Zur Publikation
The transformation of mobility is on the cusp of a significant shift,driven by data-centric technologies in both individual and public transport. However, this data often contains sensitive private data, which can be used, for instance, for tracking a person. Hence, anonymization of this mobility data is important. In this report, we present a structured literature review about anonymization methods in the mobility domain. Based on our findings, we present different anonymization methods and discuss their application scenarios and characteristics for public transport and individual one. Additionally, an industry-driven survey on anonymization methods within public transport, particularly centered around video technologies, is presented. This industry-driven survey, conducted within a video surveillance solutions company, highlights current trends and underscores the necessity for continued research. This report was created within the ANYMOS project.
Zur Publikation
Analyzing attacks and potential attack paths can help to identify and avoid potential security incidents. Manually estimating an attack path to a targeted software element can be complex since a software system consists of multiple vulnerable elements, such as components, hardware resources, or network elements. In addition, the elements are protected by access control. Software architecture describes the structural elements of the system, which may form elements of the attack path. However, estimating attack paths is complex since different attack paths can lead to a targeted element. Additionally, not all attack paths might be relevant since attack paths can have different properties based on the attacker’s capabilities and knowledge. We developed an approach that enables architects to identify relevant attack paths based on the software architecture. We created a metamodel for filtering options and added support for describing attack paths in an architectural description language. Based on this metamodel, we developed an analysis that automatically estimates attack paths using the software architecture. This can help architects to identify relevant attack paths to a targeted component and increase the system’s overall security. We evaluated our approach on five different scenarios. Our evaluation goals are to investigate our analysis’s accuracy and scalability. The results suggest a high accuracy and good runtime behavior for smaller architectures.
Zur Publikation
In ANYMOS werden Anforderungen und Methoden für eine Anonymisierung und anschließende Auswertung von zuvor personenbezogenen Daten untersucht. Dabei wird im Kompetenzcluster die Anwendungsdomäne Mobilität betrachtet und sich auf den Personenverkehr, da durch die Mobilität von Gütern nicht immer unmittelbar personenbezogene Daten anfallen, fokussiert. Die Notwendigkeit des Kompetenzclusters ANYMOS ergibt sich daraus, dass im Mobilitätsbereich bei zahlreichen Anwendungen große Datenmengen anfallen und es aufgrund der zu erwartenden Entwicklungen zu einem weiteren Anstieg dieser Datenmenge kommen wird. Um diese Daten in Zukunft sinnvoll nutzen zu können, ohne dabei durch die Verwendung personenbezogener Daten Persönlichkeitsrechte und/oder rechtliche Vorgaben zu verletzen, muss zunächst erforscht werden, wann diese Daten gesammelt werden und inwieweit sie auch nach einer Anonymisierung noch über einen Nutzwert verfügen.
Im zweiten Abschnitt des Whitepapers wird daher zunächst Anonymität beschrieben und das Spannungsfeld zwischen juristischem und technischen Begriffsverständnis erörtert.
Im dritten Abschnitt erfolgt eine Strukturierung der Mobilitätsdomäne. Dadurch soll das gemeinsame Verständnis der Begrifflichkeiten und der Relevanz der verschiedenen Themenbereiche für das Kompetenzcluster ANYMOS gefördert werden.
Abschließend wird ein Ausblick – auch auf die weiteren Arbeiten in ANYMOS gegeben.
Zur Publikation
Die betriebswirtschaftliche Literatur identifiziert Geschäftsmodelle als ein entscheidendes Element von Unternehmen, das ihnen im Wettbewerb Vorteile verschafft. Der vorliegende Beitrag geht den Fragen nach: Welche sind die Trends, die Geschäftsmodellen vor dem Hintergrund der Digitalisierung zugrunde liegen, und was sind kennzeichnende Charakteristika von digitalen Geschäftsmodellen? Hierzu wird zunächst anhand der identifizierten Literatur nachgezeichnet, was digitale Geschäftsmodelle sind und was Geschäftsmodellinnovation ausmacht. Weiterhin werden Digitalisierungstrends aufgeführt, die einen Einfluss auf die Gestaltung von Geschäftsmodellen haben. Es zeigt sich, dass die Hybridisierung von Produkten die Logik der digitalen Welt in die physische Welt trägt. Außerdem kommt der Nutzerin und dem Nutzer eine zunehmend zentrale Rolle zu: Sie oder er nimmt die dreifache Rolle der Kundin oder des Kunden, des Datenbeitragenden und des Produkts ein. Ein zu beachtender Bereich ist dabei die Datensouveränität der Nutzerin und des Nutzers, deren Bedeutung in der Literatur zunehmend diskutiert wird. Schließlich rücken bei der Digitalisierung Preis- und Qualitätsmerkmale in den Hintergrund, der Zugang zur Kundin und zum Kunden findet vielmehr über eine Identitätsleistung des Anbieters statt. Digitale Geschäftsmodelle weisen die folgenden drei kennzeichnenden Charakteristika auf: (1) Eine Integration von Nutzerinnen und Nutzern sowie Kundinnen und Kunden, (2) eine Dienstleistungsorientierung und (3) die Kernkompetenz der Anbieter auf große Datenmengen, also Analytics von Big Data. Der Beitrag führt zu jedem der drei Charakteristika Beispiele für digitale Geschäftsmodelle auf.
Zur Publikation
Through the increasing interconnection between various systems, the need for confidential systems is increasing. Confidential systems share data only with authorized entities. However, estimating the confidentiality of a system is complex, and adjusting an already deployed software is costly. Thus, it is helpful to have confidentiality analyses, which can estimate the confidentiality already at design time. Based on an existing data-flow-based confidentiality analysis concept, we reimplemented a data flow analysis as a Java-based tool. The tool uses the software architecture to identify access violations based on the data flow. The evaluation for our tool indicates that we can analyze similar scenarios and scale for certain scenarios better than the existing analysis.
Zur Publikation