|
Past Conferences and Journal Special Issues
Last Modified:12/24/07
Note: Please contact
cipher-cfp@ieee-security.org by email if you have any questions..
Contents
ICISS 2007
3rd International Conference on Information Systems Security,
Delhi, India, December 16-20, 2007.
[posted here 2/28/07]
After the successful organization of ICISS 2006 at the Indian Statistical Institute,
Kolkata, India, the 3nd conference will be organized by the University of Delhi.
ICISS presents a forum for disseminating the latest research results in
Information Systems Security and related areas. Topics of interest include
but are not limited to:
- Authentication and Access Control
- Mobile Code Security
- Key Management and Cryptographic Protocols
- E-business / E-commerce Security
- Privacy and Anonymity
- Intrusion Detection and Avoidance
- Security Verification
- Network Security
- Database and Application Security and Integrity
- Digital Rights Management
- Security in P2P, Sensor and Ad hoc Networks
- Digital Forensics
- Biometric Security
- Secure Web Services
- Fault Tolerance and Recovery Methods for Security Infrastructure
- Threats, Vulnerabilities and Risk Management
- Commercial and Industrial Security
For more information, please see
http://siis.cse.psu.edu/iciss07/cfp.htm.
ICICS 2007
9th International Conference on Information and Communications Security,
Zhengzhou, Henan Province, China, December 12-15, 2007.
[posted here 6/26/07]
The 2007 International Conference on Information and Communications Security
will be the 9th event in the ICICS conference series, started in 1997, that
brings together individuals involved in multiple disciplines of Information and
Communications Security in order to foster exchange of ideas.
Original papers on all aspects of information and communications security
are solicited for submission to ICICS 2007. Areas of interests include but
not limited to:
- Access Control
- Anti-Virus and Anti-Worms
- Anonymity
- Authentication and Authorization
- Applied Cryptography
- Biometric Security
- Data and System Integrity
- Database Security
- Distributed Systems Security
- Electronic Commerce Security
- Fraud Control
- Grid Security
- Information Hiding and Watermarking
- Intellectual Property Protection
- Intrusion detection
- Key Management and Key Recovery
- Language-based Security
- Operating System Security
- Network Security
- Risk Evaluation and Security Certification
- Security for Mobile Computing
- Security Models
- Security Protocols
- Trusted Computing
For more information, please see
http://www.icics2007.org.cn/.
ACSAC 2007
23rd Annual Computer Security Applications Conference,
Miami Beach, Florida, USA, December 10-14, 2007.
[posted here 3/21/07]
ACSAC is an internationally recognized forum where practitioners, researchers,
and developers in information system security meet to learn and to exchange
practical ideas and experiences. Papers offering novel contributions in any
aspect of computer and application security are solicited. Papers may present
technique, applications, or practical experience, or theory that has a clear
practical impact. Papers are encouraged on technologies and methods that have
been demonstrated to be useful for improving information systems security and
that address lessons from actual application. Topics of interest include,
but are not limited to:
- Access control
- Applied cryptography
- Audit and audit reduction
- Biometrics
- Certification and accreditation
- Database security
- Denial of service protection
- Defensive information warfare
- Electronic commerce security
- Enterprise security
- Firewalls and other boundary control devices
- Forensics
- Identification and authentication
- Identity Management
- Information survivability
- Insider threat protection
- Integrity
- Intellectual property rights protection
- Incident response planning
- Intrusion detection and event correlation
- Malware
- Middleware and distributed systems security
- Mobile and wireless security
- Modeling and simulation related to security
- Operating systems security
- Peer-to-peer security
- Product evaluation criteria and compliance
- Privacy
- Risk/vulnerability assessment
- Secure location services
- Security engineering and management
- Security in IT outsourcing
- Service Oriented Architectures
- Software assurance
- Trust management
- VoIP Security
- Wireless Security
For more information, please see
http://www.acsac.org.
ASIAN 2007
12th Annual Asian Computing Science Conference Focusing on Computer and Network Security,
Carnegie Mellon University, Doha, Qatar, December 9-11, 2007.
[posted here 6/4/07]
The ASIAN conference series provides a forum for researchers throughout Asia
to present cutting-edge results in yearly-themed areas of Computer Science, to
discuss advances in these fields, and to interact with researchers from other continents.
The 2007 edition focuses on computer and network security.
New results in the fields of computer and network security are welcome.
Also welcome are more exploratory presentations, which may examine open questions and raise
fundamental concerns about existing theories and practices.
Topics of interest include, but are not limited to:
- Access control
- Database security
- Privacy and Anonymity
- Cryptographic protocols
- Trust and trust management
- Authentication
- Digital rights management
- Executable content
- Language-based security
- Formal methods for security
- Data and system integrity
- Distributed systems security
- Security for mobile computing
- Wireless network security
- Denial-of-service and prevention
- Intrusion detection and avoidance
- Digital forensics
- Vulnerabilities and risk management
- Secure electronic commerce
- Secure software engineering
For more information, please see
http://www.qatar.cmu.edu/asian07.
Asiacrypt 2007
13th Annual International Conference on the Theory and Application of
Cryptology & Information Security,
Kuching, Sarawak, Malaysia, December 2-6, 2007.
[posted here 3/19/07]
Original research papers on all technical aspects of cryptology are
solicited for submission to ASIACRYPT 2007, the annual International
Conference on Theory and Application of Cryptology and Information Security.
The conference is sponsored by the International Association for Cryptologic
Research (IACR) in cooperation with the Information Security
Research (iSECURES) Lab of Swinburne University of Technology (Sarawak Campus)
and the Sarawak Development Institute (SDI); and financially supported by the
Sarawak Government.
For more information, please see
http://www.swinburne.edu.my/asiacrypt2007.
HASE 2007
10TH IEEE International Symposium on High Assurance Systems Engineering,
Dallas, TX, USA, November 14-16, 2007.
[posted here 6/11/07]
The IEEE International Symposium on High Assurance Systems Engineering is a
forum for discussion of systems and software engineering issues to achieve high
assurance systems. The focus is on integrated approaches for assuring reliability,
availability, integrity, privacy, confidentiality, safety, and real-time of complex
systems and the methods for assessing the assurance levels of the systems to a
high degree of confidence. Technical and experience papers on algorithms, policies,
middleware, tools, and models for high assurance systems development, verification
and validation, and assessment are welcome.
Topics of interests for the symposium include, but are not limited to:
- Design and development of highly reliable, survivable, secure, safe, and time-assured systems
- Integrated system reliability, availability, security, safety, and timing analysis and evaluation methods
- Policies for reliability, safety, security, integrity, privacy, and confidentiality of high assurance systems
- Formal specification, specification validation, testing, and model checking for high assurance systems
- High assurance software architectures and design
- Transformation-based and evolutionary-based system development
- Reconfigurable system design for evolving high assurance requirements
- Dynamic monitoring and adaptation for run-time assurance
- High assurance information/knowledge systems and data grids
- High assurance embedded systems, ubiquitous systems and sensor networks
- High assurance web services
- Extending web service specifications for reliability, safety, security, privacy and other QoS properties
- Assurance techniques for service-oriented systems
- Case studies, experiments and tools for high assurance systems
For more information, please see
http://hase07.utdallas.edu/.
TGC 2007
The Symposium on Trustworthy Global Computing,
Sophia-Antipolis, France, November 5-6, 2007.
[posted here 6/26/07]
The Symposium on Trustworthy Global Computing is an international annual
venue dedicated to safe and reliable computation in global computers.
It focuses on providing tools and frameworks for constructing well-behaved
applications and for reasoning about their behaviour and properties in
models of computation that incorporate code and data mobility over
distributed networks with highly dynamic topologies and heterogeneous
devices. We solicit paper in all areas of global computing,
including (but not limited to):
- theories, models and algorithms for global computing and service
- oriented computing
- language concepts and abstraction mechanisms
- security through verifiable evidence
- information flow and resource usage policies
- verification of cryptographic protocols and their use
- trust, access control and security enforcement mechanisms
- self configuration, adaptation, and dynamic components management
- software principles to support debugging and verification
- test generators, symbolic interpreters, type checkers
- model checkers, theorem provers
- privacy, reliability and business integrity
For more information, please see
http://www-sop.inria.fr/everest/tgc/tgc07.
STC 2007
2nd ACM Workshop on Scalable Trusted Computing,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Fairfax, VA, USA, November 2, 2007.
[posted here 4/30/07]
In a society increasingly dependent on networked information systems, trusted
computing plays a crucial role. Despite significant progress in trusted computing components,
the issue of scalability in trusted computing and its impact on security are not well-understood.
Consequently, there is a dearth of practical solutions for trusted computing in large-scale systems.
Approaches suitable for small- or medium-scale trusted computing systems might not be applicable
to larger-scale scenarios. This workshop, built on the success of its predecessor (STC'06),
is focused on trusted computing in large-scale systems -- those involving (at the very least)
many millions of users and thousands of third parties with varying degrees of trust.
Topics of interest to the workshop include the following:
- models for trusted computing
- principles of trusted computing
- modeling of computing environments, threats, attacks and countermeasures
- limitations, alternatives and tradeoffs regarding trusted computing
- trust in authentications, users and computing services
- hardware based trusted computing
- software based trusted computing
- pros and cons of hardware based approach
- remote attestation of trusted devices
- censorship-freeness in trusted computing
- cryptographic support in trusted computing
- case study in trusted computing
- applications of trusted computing
- intrusion resilience in trusted computing
- access control for trusted computing
- trust of computing systems
- principles for handling scales
- scalable trust support and service
- trusted embedded computing and systems
- trusted computing in networks and distributed systems
- virtualization and trusted computing
For more information, please see
http://www.cs.utsa.edu/~shxu/stc07/.
CSAW 2007
1st ACM Computer Security Architecture Workshop,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Fairfax, VA, USA, November 2, 2007.
[posted here 4/23/07]
The Computer Security Architecture Workshop (CSAW)}--pronounced
see-saw--solicits papers on security architectures, their interfaces,
implementations, and implications. The design and evaluation of
Security Architectures is of fundamental
importance to security. And yet, many of our fundamental
architectures were created when security was less appreciated and less
well understood. Since it is notoriously difficult to add security
after the fact, our systems are far too susceptible to attack.
Moreover, architectures, because they are broad based, are difficult
to understand and this is a specialized workshop in which Security
Architecture experts will gather. As far as we know, this workshop is
unique in its focus on Security Architectures.
The workshop topics include, but are not limited to:
- Authorization
- Authentication
- Network security
- Distributed systems
- Operating systems
- Privacy
- Applications and security frameworks
- Specialized applications such as voting systems
- Hardware/software co-design for security
- Analysis of architectures
- System composability (properties, pitfalls, analysis & reasoning)
- Assurance techniques
- Case studies
- Usability issues
For more information, please see
http://www.rites.uic.edu/csaw.
WORM 2007
5th ACM Workshop on Recurring Malcode,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Fairfax, VA, USA, November 2, 2007.
[posted here 4/16/07]
Internet-wide infectious epidemics have emerged as one of the leading threats to
information security and service availability. Self-propagating threats, often termed
worms, exploit software weaknesses, hardware limitations, Internet topology, and the open
Internet communication model to compromise large numbers of networked systems. Malware
is increasingly used as a beachhead to launch further malicious activities, such as
installing spyware, deploying phishing servers and spam relays, or performing
information espionage. Unfortunately, current operational practices still face
significant challenges in containing these threats as evidenced by the rise in
automated botnet networks and the continued presence of worms released years ago.
The goal of this workshop is to provide a forum for exchanging ideas, increasing the
understanding, and relating experiences on malicious code from a wide range of communities,
including academia, industry, and the government. We are soliciting papers from researchers
and practitioners on subjects including, but not limited to:
- Automatic malcode detection
- Malicious code characterization
- Botnet detection and disruption
- Malcode reverse engineering
- Modeling and analysis of propagation dynamics
- Forensic methods of attribution
- Threat assessment
- Reactive countermeasures
- Proactive malware defenses
- Significant operational experiences
- Measurement studies
- New threats and related challenges
For more information, please see
http://www.auto.tuwien.ac.at/~chris/worm07.html.
DIM 2007
3rd ACM Workshop on Digital Identity Management,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Fairfax, VA, USA, November 2, 2007.
[posted here 3/16/07]
This year's theme is "Usability Issues for Identity Management." As the Web 2.0 trend exemplifies,
user experiences on the Net are becoming more and more interactive, dynamic, and personalized.
With appropriate control over the number and use of their identity(s), users can enjoy the advantages
of highly sophisticated personal services without the management burden they currently face or
sacrificing their privacy. However, standing in the way of this attractive goal are malicious
identity-motivated attacks (such as phishing & pharming), inadequate user understanding of the
underlying trust models (including the consequences of poorly set security and privacy preferences),
and the complexity of managing how identities are to be used, shared, and delegated.
To address such issues, many technological solutions have been already proposed, both in the
industry and academia, to date with mixed success.
To ensure that the emerging identity management technologies are accepted by end-users,
we must reconcile (or strike the right balance between) two goals that are generally thought
to be contradictory: the usability of the systems on one hand and their security and privacy
on the other. The aim of this workshop is to gather vendors, users, and researchers, in the
areas of identity management, to discuss and provide recommendations for the best approaches
for making implementable and deployable improvements to the usability of identity management.
Topics of particular interest include (but are not limited to):
- User interaction design for identity management
- Social identity
- User centric identity
- Expressing trustworthiness of identity management to users
- Empirical analysis of usability problems with identity management systems
- Evaluation methodologies for usability of identity management systems
- Novel user interface technologies for identity management
- Privacy enhanced user interaction
- User education on identity management
- Elicitation of privacy preferences from end users
- Identity theft prevention
- User-readable privacy policies
- Methodologies and interfaces for managing multiple identities including delegation
- Identity theft prevention
- Privacy-enhancing identity management
- Consistent UI for identity transactions
For more information, please see
http://www2.pflab.ecl.ntt.co.jp/dim2007/.
FMSE 2007
5th ACM Workshop on Formal Methods in Security Engineering: From Specifications to Code,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Fairfax, VA, USA, November 2, 2007.
[posted here 4/16/07]
Information security has become a crucial concern for the commercial deployment of
almost all applications and middleware. Although this is commonly recognized,
the incorporation of security requirements in the software development process
is not yet well understood. The deployment of security mechanisms is often ad hoc,
without a formal security specification or analysis, and practically always without
a formal security validation of the final product. Progress is being made, but there
remains a wide gap between high-level security models and actual code development.
We seek original research papers addressing foundational issues in formal methods
in security engineering. Topics covered include, but are not limited to:
- security requirements and risk analysis
- access control models, information flow models, and trust models
- specification and analysis of security properties
- stepwise development by refinement and composition
- computationally sound abstraction
- program logics and type systems for security
- other techniques for verification and static analysis
- tool support for the development and analysis of security-critical systems
- design and analysis of security protocols
- security aspects of operating systems and middleware
- case studies
For more information, please see
http://www.fmis.informatik.tu-darmstadt.de/fmse07/.
DRM 2007
7th ACM Workshop on Digital Rights Management,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Alexandria, VA, USA, October 29, 2007.
[posted here 4/23/07]
Digital Rights Management (DRM) is an interdisciplinary field intersecting with many
different areas including cryptography, software and computer systems design,
information and signal processing, law, policy-making, as well as business analysis
and economics. Currently human intellectual product is predominantly produced in digital
form and as a result the DRM problem ought to be viewed in the broader sense that
spans the full spectrum of human productivity rather than a narrow perspective that
applies it to music or videos. ACM-DRM is an international workshop that looks at the
DRM problem in its broadest possible interpretation and aims to bring together
scientists and scholars from all the related disciplines for an exchange of ideas
and presentation of cutting edge results related to digital content distribution.
Topics of interest include but are not limited to:
- anonymous publishing, privacy and DRM
- architectures for DRM systems
- business models for online content distribution. risk management
- copyright-law issues, including but not limited to fair use
- digital goods and online multiplayer games
- digital policy management
- implementations and case studies
- robust identification of digital content
- security issues, including authorization, encryption, tamper resistance, watermarking, and fingerprinting
- information theory and combinatorics, including marking assumptions and related codes
- supporting cryptographic technology including but not limited to traitor tracing, broadcast encryption, obfuscation
- threat and vulnerability assessment
- trusted computing, attestation, hardware support for DRM, side-channel attacks
- usability aspects of DRM systems
- web services related to DRM systems
For more information, please see
http://www.cse.uconn.edu/~drm2007.
QoP 2007
3rd International Workshop on Quality of Protection,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Alexandria, VA, USA, October 29, 2007.
[posted here 4/2/07]
In the last few decades, Information Security has gained numerous standards, industrial
certifications, and risk analysis methodologies. However, the field still lacks the strong,
quantitative, measurement-based assurance that we find in other fields. For example, Networking
researchers have created and utilize Quality of Service (QoS), Service Level Agreements (SLAs),
and performance evaluation metrics. Empirical Software Engineering has made similar advances
with software metrics: processes to measure the quality and reliability of software exist
and are appreciated in industry. The goal of the QoP Workshop is to help security research
progress towards a notion of Quality of Protection in Security comparable to the notion of
Quality of Service in Networking, Software Reliability, or Software Measurements and Metrics
in Empirical Software Engineering. The topics of interest include but are not limited to:
- Industrial experience
- Security risk analysis
- Security metrics
- Reliability analysis
- Security quality assurance
- Measurement-based decision making and risk management
- Empirical assessment of security architectures and solutions
- Mining data from attack and vulnerability repositories
- Measurement theory
- Formal theories of security metrics
- Security measurement & monitoring
- Experimental validation of models
- Simulation & statistical analysis
- Stochastic modeling
For more information, please see
http://www.qop-workshop.org/.
WPES 2007
6th ACM Workshop on Privacy in Electronic Society,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Alexandria, VA, USA, October 29, 2007.
[posted here 6/4/07]
The need for privacy-aware policies, regulations, and techniques has been widely recognized.
This workshop discusses the problems related to privacy in the global interconnected society
and their possible solutions. The workshop seeks submissions from academia and industry
presenting novel research on all theoretical and practical aspects of electronic privacy,
as well as experimental studies of fielded systems. We encourage submissions from other
communities such as law and business that present these communities' perspectives on
technological issues. Topics of interest include, but are not limited to:
- anonymity, pseudonymity, and unlinkability
- privacy and confidentiality management
- business model with privacy requirements
- privacy in the electronic records
- data protection from correlation and leakage attacks
- privacy in health care and public administration
- electronic communication privacy
- public records and personal privacy
- information dissemination control
- privacy and virtual identity
- privacy-aware access control
- personally identifiable information
- privacy in the digital business
- privacy policy enforcement
- privacy enhancing technologies
- privacy and data mining
- privacy policies
- relationships between privacy and security
- privacy and anonymity in Web transactions
- user profiling
- Privacy in social networks
- wireless privacy
- privacy threats
- economics of privacy
- privacy and human rights
For more information, please see
http://www.csc2.ncsu.edu/workshops/wpes07/.
CCS 2007
14th ACM Conference on Computer and Communications Security,
Alexandria, VA, USA, October 29 - November 2, 2007.
[posted here 12/4/06]
The conference seeks submissions from academia and industry presenting novel
research on all theoretical and practical aspects of computer security,
as well as case studies and implementation experiences. Papers should have practical
relevance to the construction, evaluation, application, or operation of secure
systems. Theoretical papers must make convincing argument for the practical
significance of the results. Topics of interest include, but are not limited to:
- access control
- trust models
- smartcards
- key management
- information warfare
- authentication
- anonymity
- applied cryptography
- secure networking
- security management
- accounting and audit
- peer-to-peer security
- database security
- intrusion detection
- electronic fraud relating to phishing
- privacy-enhancing technology
- data and application security
- inference/controlled disclosure
- intellectual property protection
- commercial and industry security
- trust management policies
- digital rights management
- secure location services
- security for mobile code
- cryptographic protocols
- data/system integrity
- identity management
- security in IT outsourcing
For more information, please see
http://www.acm.org/sigs/sigsac/ccs/CCS2007/.
IWSEC 2007
2nd International Workshop on Security,
Nara, Japan, October 29-31, 2007.
[posted here 11/13/06]
The complex structure of networks, middleware, agents, P2P applications
and ubiquitous computing for commercial, personal, communal and public use,
brought forth the advent of information society in the cyberspace.
However the system poses new and diverse threats to the world. It is imperative
for the security researchers to look into the issues from an interdisciplinary
perspective. Papers may present theory, applications or practical experiences
on topics including, but not limited to:
- Fundamental Tools for Information Security
- Network and Distributed Systems Security
- Privacy Enhancing Technology
- Secure Living and Working Environments
- Security in Commerce and Government
- Security Management
- Software and System Security
- Protection of Critical Infrastructures
- Testing, Verification and Certification
- Law, Policy, Ethics and Related Technologies
For more information, please see
http://www.iwsec.org/.
VizSEC 2007
4th Workshop on Visualization for Computer Security,
Held in conjunction with IEEE Vis 2007 and IEEE InfoVis 2007,
Sacramento, California, USA, October 29, 2007.
[posted here 8/13/07]
The VizSEC 2007 Workshop on Visualization for Computer Security will provide
a forum for new research in visualization for computer security.
In many applications, visualization proves very effective to understand large high-dimensional data.
Thus, there is a growing interest in the development of visualization methods as alternative or
complementary solutions to the pressing cyber security problems.
However, while security visualization research has addressed the development of applications,
there has only been limited coverage of user needs and designing visualization to support
those needs. To address this shortcoming, the theme of this year's workshop will be on
applying user-centered design to VizSEC research, focusing on integrating users' needs,
visualization design, and evaluation. We solicit papers that report results on
visualization techniques and systems in solving all aspects of cyber security
problems. Topics include, but are not limited to:
- Visualization of Internet routing for security
- Visualization of packet traces and network flows for security
- Visualization of security vulnerabilities and attack paths
- Visualization of intrusion detection alerts
- Visualization of application processes for security
- Visualization for forensic analysis
- Visualization for correlating events
- Visualization for computer network defense training
- Visualization for offensive information operations
- Visualization for feature selection
- Visualization for detecting anomalous activity
- Deployment and field testing of VizSEC systems
- Evaluation and user testing of VizSEC systems
- User and design requirements for VizSEC systems
- Lessons learned from VizSEC systems development and deployment
For more information, please see
http://vizsec.org/workshop2007/.
StaR_SEC 2007
1st ACM Workshop on Information and Communications Security Standards and Regulations,
Held in conjunction with the 14th ACM Conference on Computer and Communications Security (CCS 2007),
Alexandria, VA, USA, October 29, 2007.
[posted here 4/2/07]
The main objective of the StaR_SEC 2007 Workshop is to explore the security aspects of
standards, regulations and certifications for Information and Communication Systems.
For many years the Security field was somehow isolated in the Information and
Communications Technology arena. Inevitably this isolation has been inherited to
the standards governing the security techniques and mechanisms that are currently
employed. It is therefore important to inform the scientific community about these
problems and facilitate better collaboration on the security aspects of international
standards and regulations. We welcome the submission of papers that address Security
Standards and Regulations activities, including, but not limited to:
- Access Control and Authorization
- Assurance Services
- Auditing and Forensic Information Management
- Authentication, Authorization, and Accounting
- Business Services
- Biometrics Technologies
- Confidentiality and Privacy Services
- Developing Secure Information and Communications Infrastructures
- Digital Rights Management
- eBusiness, eCommerce, eGovernment Security: Establishing Trust and Confidence of Citizens in eTransactions and eServices
- eHealth Security
- Lawful Interception Architectures and Functions
- Legal Issues
- Location Privacy and Secure Localization
- Long-term Archive and Notary Services
- Mail Security
- Methodologies for Authentication and Traceability
- Mobile, Ad hoc and Sensors Networks Security
- Multicast Security
- Network Defense Services
- PKI and PMI environments
- Privacy and Identity Management
- Registration and Authentication Services
- Security and Interoperability
- Security Challenges to the use and deployment of Disruptive Technologies (Trusted Computing, VoIP, WiMAX, RFID, IPv6)
- Securing Critical Information and Communication Infrastructures
- Security issues in Network Event Logging
- Security Policies
- Security Solutions for IP Multimedia Systems
- Standardization Aspects of Electronic Signatures
- Trust Services
- Wireless Security
For more information, please see
http://www.aegean.gr/StaR_SEC_2007.
PADM 2007
6th International Workshop on Privacy Aspects of Data Mining,
Held in conjunction with the IEEE International Conference on Data Mining (ICDM 2007) ,
Omaha, NE, USA, October 28, 2007.
[posted here 5/21/07]
Privacy aspects of data mining have an important impact on many data
analysis applications. The aim of the workshop is to bring together researchers
and practitioners interested in the privacy aspects of data mining, both
by from a technical perspective and from social and legal
perspectives. We hope to attract interest across a wide range of
possible data mining subareas, including: web mining, medical data
mining, spatio-temporal data mining, ubiquitous knowledge discovery,
stream data mining, multimedia mining, and obviously,
privacy-preserving data mining.
Topics of interest to the workshop include the following:
- Cryptographic tools for privacy preserving data mining
- Inference and disclosure control for data mining
- Learning algorithms for randomized/perturbed data
- Legal and regulatory frameworks for data mining and privacy
- Privacy and anonymity in e-commerce and user profiling
- Privacy aspects of business processes and enterprise management
- Privacy aspects of geographic, spatial, and temporal data
- Privacy aspects of ubiquitous computing systems
- Privacy enhancement technologies in web environments
- Privacy policy infrastructure, enforcement, and analysis
- Privacy preserving link and social network analysis
- Privacy preserving applications for homeland security
- Privacy preserving data integration
- Privacy protection in fraud and identify theft prevention
- Privacy threats due to data mining
- Biomedical and healthcare data mining research privacy
- Query systems and access control
- Trust management for data mining
For more information, please see
http://cimic.rutgers.edu/~padm.
NordSec 2007
12th Nordic Workshop on Secure IT Systems,
Reykjavik, Iceland, October 11-12, 2007.
[posted here 2/8/07]
Since 1996, the NordSec workshops have brought together computer security researchers
and practitioners from the Nordic countries, Northern Europe, and elsewhere.
The workshop is focused on applied computer security and is intended to encourage
interchange and cooperation between research and industry. Topics include, but are
not limited to, the following areas of computer security:
- Applied Cryptography
- Commercial Security Policies and Enforcement
- Communication and Network Security
- Computer Crime and Information Warfare
- Hardware and Smart Card Applications
- Internet and Web Security
- Intrusion Detection
- Language-based Techniques for Security
- New Ideas and Paradigms in Security
- Operating System Security
- PKI Systems and Key Escrow
- Privacy and Anonymity
- Security Education and Training
- Security Evaluations and Measurements
- Security Management and Audit
- Security Models
- Security Protocols
- Social-Engineering and Phishing
- Software Security, Attacks, and Defenses
- Trust and Trust Management
For more information, please see
http://www.ru.is/nordsec2007/.
IDMAN 2007
1st IFIP WG 11.6 working conference on Policies & Research in Identity Management,
Rotterdam, The Netherlands, October 11-12, 2007.
[posted here 4/16/07]
Papers offering research contributions focusing on national identity management are
solicited for submission to the 1st IFIP WG-11.6 International Conference on
National Identity Management. Papers may present theory, applications or practical
experiences in the field of national identity management, including, but not necessarily
limited to:
- History
- Law
- Philosophical and ethical aspects
- Economics
- Impact of free travel, weakening national borders and cyberspace on character and importance
- Impact on society and politics
- Impact on e-government and e-government applications
- Quality of national identity management in general
- Quality of national identity data
- Security of national identity management
- Central storage of general and biometric identity data
- Effectiveness of national identity management in fighting terrorism, international crime and human trafficking
- Methods of identification, authentication and authorisation
- Models of identity and access control procedures
- Government PKI
- (Possible) role of pseudonymous and anonymous identity in national identity management
- Electronic IDs
- European and worldwide policies and cooperation
- (Inter)national policies on social security numbers / personalisation IDs
- (Inter)national applications of passport biometrics
- Vulnerabilities of electronic passport protocols
- Multilateral national identity management
- Biometric verification, assurance, metrics and measurements
- Fraud resistance of biometrics
- Data Protection
- Privacy and Privacy Enhancing Technologies (PETs) and national identity management
- (Inter)national threats
- Intelligence
- Fraud and fraud detection
- Impersonation, identity fraud, identity forge and identity theft
- Tracing, monitoring and forensics
- Attacks on national identity and access management infrastructure and procedures
For more information, please see
http://privare.fbk.eur.nl/idman07/.
WSNS 2007
3rd IEEE International Workshop on Wireless and Sensor Networks Security,
Held in conjunction with the 4th IEEE International Conference on Mobile Ad-hoc and Sensor Systems (MASS 2007),
Pisa, Italy, October 8, 2007.
[posted here 3/12/07]
Wireless networks have experienced an explosive growth during the last few years.
Nowadays, there is a large variety of networks spanning from the well-known cellular
networks to non-infrastructure wireless networks such as mobile ad hoc networks and
sensor networks. Security issue is a central concern for achieving secured communication
in these networks. This one day workshop aims to bring together researchers and practitioners
from wireless and sensor networking, security, cryptography, and distributed computing
communities, with the goals of promoting discussions and collaborations. We are interested
in novel research on all aspects of security in wireless and sensor networks and tradeoff
between security and performance such as QoS, dependability, scalability, etc.
Topics include, but not limited to:
- Authentication and Access Control
- Cryptographic Protocol
- Experimental Studies
- Key Management
- Information Hiding
- Intrusion Detection and Response
- Privacy and Anonymity
- Secure Localization and Synchronization
- Security and Performance tradeoff
- Security Policy and Enforcement Issues
- Security Protocols Design, Analysis and Verification
- Secure Routing/MAC
- Surveillance and Monitoring
- Trust Management
For more information, please see
http://www7.informatik.uni-erlangen.de/~dressler/wsns07/.
EC2ND 2007
3rd European Conference on Computer Network Defence,
Heraklion, Crete, Greece, October 4-5, 2007.
[posted here 5/21/07]
The theme of the conference is the protection of computer networks.
The conference will draw participants from academia and industry in Europe and beyond to
discuss hot topics in applied network and systems security.
EC2ND invites submissions presenting novel ideas at an early stage with the intention to
act as a discussion forum and feedback channel for promising, innovative security research.
While our goal is to solicit ideas that are not completely worked out, and might have
challenging and interesting open questions, we expect submissions to be supported by some
evidence of feasibility or preliminary quantitative results.
Topics include but are not limited to:
- Intrusion Detection
- Denial-of-Service
- Privacy Protection
- Security Policies
- Peer-to-Peer and Grid Security
- Network Monitoring
- Web Security
- Vulnerability Management and Tracking
- Network Forensics
- Wireless and Mobile Security
- Cryptography
- Network Discovery and Mapping
- Incident Response and Management
- Malicious Software
- Web Services Security
- Legal and Ethical Issues
For more information, please see
http://2007.ec2nd.org/index.html.
eCrime 2007
2nd APWG eCrime Researchers Summit,
Pittsburgh, PA, USA, October 4-5, 2007.
[posted here 1/22/07]
The second Anti-Phishing Working Group (APWG) eCrime Researchers Summit
will be hosted by Carnegie Mellon CyLab, October 4-5, 2007, in Pittsburgh, PA.
Original papers on all aspects of electronic crime are solicited for submission
to eCrime '07. Topics of relevance include but are not limited to:
- Phishing, pharming, click-fraud, crimeware, extortion and emerging attacks.
- Technical, legal, political, social and psychological aspects of fraud and fraud prevention.
- Techniques to assess the risks and yields of attacks and the success rates of countermeasures.
- Delivery techniques, including spam, voice mail and rank manipulation; and countermeasures.
- Spoofing of different types, and applications to fraud.
- Techniques to avoid detection, tracking and takedown; and ways to block such techniques.
- Honeypot design, datamining, and forensic aspects of fraud prevention.
- Design and evaluation of user interfaces in the context of fraud and network security.
- Best practices related to digital forensics tools and techniques, investigative procedures,
and evidence acquisition, handling and preservation.
For more information, please see
http://www.ecrimeresearch.com/2007/cfp.html.
CRITIS 2007
2nd International Workshop on Critical Information Infrastructures Security,
Benalmadena-Costa, Malaga, Spain, October 3-5, 2007.
[posted here 5/14/07]
CRITI workshop aims at bringing together researchers and professionals from universities,
private companies and Public Administrations interested or involved in all security-related
heterogeneous aspects of Critical Information Infrastructures.
We invite research papers, work-in-progress reports, R&D projects results, surveying
works and industrial experiences describing significant security advances in the
following (non-exclusive) areas of Critical Information Infrastructures for which
we plan to have sessions:
- Code of Practice and Metrics
- Communication Risk & Assurance
- Early Warning Systems
- Economics on CIP
- R&D Agenda
- SCADA and Embedded Security
- National and Cross Border Issues
- Information Sharing and Exchange
- Policy Options Elaboration
- Threats and Attacks Modeling
- Continuity of Services and Resiliency
- Dependable Infrastructure Communications
- Internet-based remote control
- Forensic Techniques
- Incident Response
- Network Survivability
- Trust Models in Critical Scenarios
- Security Logistics
For more information, please see
http://critis07.lcc.uma.es.
SISW 2007
4th International IEEE Security in Storage Workshop,
San Diego, California, USA, September 27, 2007.
[posted here 2/8/07]
Stored information critical to individuals, corporations and governments
must be protected, but the continually changing uses of storage and the
exposure of storage media to adverse conditions make meeting that
challenge increasingly difficult. Example uses include employment of large
shared storage systems for cost reduction and, for convenience, wide use of
transiently-connected storage devices offering significant capacities and
manifested in many forms, often embedded in mobile devices.
Protecting intellectual property, personal records, health records, and
military secrets when media or devices are lost, stolen, or captured
is critical to information owners. To remain or become viable, activities
that rely on storage technology require a comprehensive systems approach
to storage security. This workshop serves as an open forum to discuss storage
threats and the technology and deployment of countermeasures.
The workshop seeks submissions from academia and industry presenting
novel research on all theoretical and practical aspects of designing,
building and managing secure storage systems; possible topics include,
but are not limited to the following:
- Cryptographic Algorithms for Storage
- Cryptanalysis of Systems and Protocols
- Key Management for Sector and File based Storage Systems
- Balancing Usability, Performance and Security concerns
- Unintended Data Recovery
- Attacks on Storage Area Networks and Storage
- Insider Attack Countermeasures Security for Mobile Storage
- Defining and Defending Trust Boundaries in Storage
- Relating Storage Security to Network Security
- Database Encryption
- Search on Encrypted Information
For more information, please see
http://ieeeia.org/sisw/2007/.
ESORICS 2007
12th European Symposium on Research in Computer Security,
Dresden, Germany, September 24-26, 2007.
[posted here 1/22/07]
Papers offering novel research contributions on any aspect of computer security
are solicited for submission to the Twelfth European Symposium on Research
in Computer Security (ESORICS 2007). Organized in a series of European countries,
ESORICS is confirmed as the European research event in computer security.
Papers may present theory, mechanisms, applications, or practical experience on all
traditional or emerging topics relevant for security in computing systems. For example,
the submissions might treat any innovative aspects of one or several topics listed
in the following:
- security architecture and secure components (trusted computing modules, smartcards,
personal computing devices, networks, information systems, applications,
peer-to-peer connections, language-based security, ... )
- access control (authorization, privileges, delegation, revocation, credentials,
authentication, accountability, safety analysis, ... )
- information control (data flows, information flows, inferences,
covert channel analysis, ... )
- applied cryptography (protocol design, protocol verification,
authentication protocols, identity management, key distribution, ... )
- tolerance and survivability (attack models, vulnerability analysis, intrusion detection,
malware collection and analysis, ... )
- security management (requirements engineering, policy specification,
trust evaluation, policy enforcement, ... )
- secure electronic commerce, administration, and government
(digital rights management, intellectual property protection,
privacy-enhancing technologies, e-voting, ... )
- formal methods in security (security models, security verification, ... )
For more information, please see
http://esorics2007.inf.tu-dresden.de/.
NSS 2007
IFIP International Workshop on Network and System Security,
Dalian, China, September 20, 2007.
[posted here 2/28/07]
In recent years, there has been significant increase in Internet attacks, such as DDoS,
viruses, worms, spyware, and malware, etc, causing huge economical and social damage.
While the attack systems have become more easy-to-use, sophisticated, and powerful, interest
has greatly increased in the field of building more effective, intelligent, and active defense
systems which are distributed and networked. We will focus our program on issues related to Network
and System Security, such as authentication, access control, availability, integrity, privacy,
confidentiality, dependability and sustainability of network defense systems. We also welcome
research reports on network attack systems; because we believe only by fully understanding the
attack mechanisms can we perform effective and comprehensive defense. The aim of this workshop is
to provide a leading edge forum to foster interaction between researchers and developers with the
network and system security communities, and to give attendees an opportunity to network with experts
in network and system security. Topics include, but not limited to:
- Active Defense Systems
- Benchmark, Analysis and Evaluation of Security Systems
- Distributed Access Control and Trust Management
- Distributed Attack Systems and Mechanisms
- Distributed Database Security
- Distributed Intrusion Detection/Prevention Systems
- Denial-of-Service Attacks and Countermeasures
- Identity Management and Authentication
- Implementation, Deployment and Management of Security Systems
- Intelligent Defense Systems
- Internet and Network Forensics
- Security Architectures in Distributed Network Systems
- Security for Large-scale Systems and Critical Infrastructures
- Security for P2P systems and Grid Systems
- Security for Ad-Hoc and Sensor Networks
- Security in E-Commerce
- Secure Mobile Agents and Mobile Code
- Security Theory and Tools in Network Systems
- Viruses, Worms, and Other Malicious Code
- World Wide Web Security
For more information, please see
http://nss2007.cqu.edu.au/.
NSPW 2007
New Security Paradigms Workshop,
White Mountain Hotel and Resort, New Hampshire, USA, September 18-21, 2007.
[posted here 4/6/07]
NSPW is a unique workshop that is devoted to the critical examination of new paradigms
in security. Each year, since 1992, we examine proposals for new principles upon which
information security can be rebuilt from the ground up. We conduct extensive, highly
interactive discussions of these proposals, from which we hope both the audience and the
authors emerge with a better understanding of the strengths and weaknesses of what has
been discussed. The New Security Paradigms workshop is dedicated to the proposition that
what Kuhn called "anomalies"---signs that the prevailing paradigm can no longer explain
phenomena observed in the real world---are already visible in the science of information
security, and, indeed, that the anomalies are so obvious and so serious that the
prevailing information security paradigm is or soon will be in crisis. NSPW aspires to
be the philosophical and intellectual breeding ground from which a revolution in the
science of information security will emerge. We solicit and accept papers on any topic in
information security subject to the following caveats:
- Papers that present a significant shift in thinking about difficult security issues are welcome.
- Papers that build on a recent shift are also welcome.
- Contrarian papers that dispute or call into question accepted practice or policy in
security are also welcome.
- We solicit papers that are not technology-centric, including those that deal with public
policy issues and those that deal with the psychology and sociology of security theory and practice.
- We discourage papers that represent established or completed works as well as those that
substantially overlap other submitted or published papers.
- We discourage papers which extend well-established security models with incremental improvements.
- We encourage a high level of scholarship on the part of contributors. Authors are expected to be
aware of related prior work in their topic area, even if it predates Google. In the course of
preparing an NSPW paper, it is far better to read an original source than to cite a text book
interpretation of it.
Our program committee particularly looks for new paradigms, innovative approaches to
older problems, early thinking on new topics, and controversial issues that might not
make it into other conferences but deserve to have their try at shaking and breaking
the mold.
For more information, please see
http://www.nspw.org/current/.
SecureComm 2007
3rd International Conference on Security and Privacy in Communication Networks,
Nice, France, September 17-21, 2007.
[posted here 12/4/06]
Securecomm seeks high-quality research contributions in the form of well-developed full papers.
Topics of interest encompass research advances in ALL areas of secure communications and
networking. Topics in other areas (e.g., formal methods, database security, secure software,
theoretical cryptography) will be considered only if a clear connection to private or secure
communication/networking is demonstrated. Securecomm brings together security and privacy
experts in academia, industry and government as well as practitioners, standards developers
and policy makers. Securecomm also serves as a venue for learning about state-of-the-art in
security and privacy research. Presentations reporting on cutting-edge research results
are supplemented by panels on controversial issues and invited talks on timely and
important topics.
- Security & Privacy in Wired, Wireless, Mobile, Hybrid, Sensor, Ad Hoc networks
- Network Intrusion Detection and Prevention, DoS Countermeasures
- Firewalls, Routers, Filters and Malware detectors
- Public Key Infrastructures and Other Security Architectures
- Secure Web Communication
- Communication Privacy and Anonymity
- Secure/Private E-commerce
- Secure Routing, Naming/Addressing, Network Management
- Security & Privacy in Pervasive and Ubiquitous Computing, e.g., RFIDs
For more information, please see
http://www.securecomm.org/2007/.
SECOVAL 2007
3rd Annual Workshop on the Value of Security through Collaboration in cooperation,
Held in conjunction with the 3rd International Conference on Security and Privacy in Communication Networks (SecureComm 2007),
Nice, France, September 17, 2007.
[posted here 1/31/07]
Security is usually centrally managed, for example in the form of policies duly
executed by individual nodes. The SECOVAL workshop covers the alternative trend of using
collaboration and trust to provide security. Instead of centrally managed security
policies, nodes may use specific knowledge (both local and acquired from other
nodes) to make security-related decisions. For example, in reputation- based schemes, the reputation
of a given node (and hence its security access rights) can be determined based on the
recommendations of peer nodes. As systems are being deployed on ever-greater scale without
direct connection to their distant home base, the need for self- management is rapidly
increasing. Interaction after interaction, as the nodes collaborate, there is the emergence of
a digital ecosystem. By guiding the local decisions of the nodes, for example, with whom the
nodes collaborate, global properties of the ecosystem where the nodes operate may be
guaranteed. Thus, the security property of the ecosystem may be driven by self-organizing
mechanisms. Depending on which local collaboration is preferred, a more trustworthy
ecosystem may emerge.
This year SECOVAL is focusing upon a special research subtopic within the scope of collaborative
security, namely, Privacy and Data Sanitization. Any useful collaboration is at some point sharing
data. Unfortunately, data sharing is one of the greatest hurdles getting in the way of
otherwise beneficial collaborations. Data regarding one's security stance is particularly
sensitive, often indicating ones own security weaknesses. This data could include computer or
network logs of security incidents, architecture documents, or sensitive organizational
information. Even when the data may not compromise the data owner's security stance, sharing
may violate a customer's privacy. Data sanitization techniques such as anonymization and other
mechanisms such as privacy-preserving data mining and statistical data mining try to address
this tension between the need to share information and protect sensitive information and user
privacy. Topics of interest to the workshop include, but are not limited to:
- Legal aspects of privacy and anonymization
- Economic issues of privacy enhancing tech
- Data sanitizing and privacy enhancing tools
- Data sharing and anonymization case studies
- Real-time anonymization issues
- Anonymization policy creation & negotiation
- Data sharing & sanitizing best practices
- Anonymity in Peer-to-Peer networks
- Classification of attacks against anonymization
- Metrics of utility, anonymization strength and information loss
- Anonymization / privacy-preserving algorithms
- Data injection and inference attacks
- Identification of sensitive fields and data
- Privacy-preserving Data Mining
- Statistical databases and protection of sensitive information
- Data mining multiple anonymized data sources
- Consistent pseudonym mappings in multi-party anonymization
- Identification of data sources and types useful to share for collaborative computer security
- Insights from industry and case studies
- Usability issues of current anonymization tools
For more information, please see
http://www.trustcomp.org/secoval/.
MMM–ACNS 2007
International Conference on Mathematical Methods, Models and Architectures
for Computer Networks Security,
St. Petersburg, Russia, September 16-18, 2007.
[posted here 12/4/06]
The First, Second and Third International Workshops "Mathematical Methods, Models
and Architectures for Computer Networks Security" organized in 2001, 2003 and
2005 were very successful. These workshops demonstrated the high interest of the
international scientific community to the theoretical aspects of the
computer network and information security and the need for conducting of such
workshops as on-going series. The proposed MMM-ACNS-2007 Conference is intended
as a next step in this series and will be focused on theoretical problems in the area
under consideration. Its objectives are to bring together leading researchers from
academia and governmental organizations as well as practitioners in the area of
computer networks and information security, facilitating personal interactions
and discussions on various aspects of information technologies in conjunction with
computer network and information security problems arising in large-scale computer
networks engaged in information storing, transmitting, and processing.
Papers may present theory, technique, and applications on topics including
but not restricted to:
- Adaptive security
- Authentication, Authorization and Access Control
- Computer and network forensics
- Covert channels
- Data and application security
- Data mining, machine learning, and bio-inspired approaches for security
- Deception systems and honeypots
- Denial-of-service attacks and countermeasures
- Digital Rights Management
- eCommerce, eBusiness and eGovernment Security
- Firewall Technologies
- Formal analysis of security properties
- Information warfare
- Internet and web security
- Intrusion detection and prevention
- Language-based security
- Network survivability
- New ideas and paradigms for security
- Operating system security
- Risk analysis and risk management
- Security and Privacy in Pervasive and Ubiquitous Computing
- Security for Grid Computing
- Security of emerging technologies (sensor, wireless/mobile, peer-to-peer and overlay networks)
- Security of autonomous agents and multi-agent systems
- Security modeling and simulation
- Security policies
- Security protocols
- Security verification
- Software protection
- Trust management
- Viruses, worms, and other malicious code
- Vulnerability assessment
For more information, please see
http://www.comsec.spb.ru/mmm-acns07/.
CHES 2007
9th Workshop on Cryptographic Hardware and Embedded Systems,
Vienna, Austria, September 10-13, 2007.
[posted here 12/18/06]
The focus of this workshop is on all aspects of cryptographic
hardware and security in embedded systems. The workshop is a forum
for new results from the research community as well as from the
industry. Of special interest are contributions that describe new
methods for secure and efficient hardware implementations, and
high-speed or leak-resistant software for embedded systems, e.g.
smart cards, microprocessors, DSPs, etc. The workshop helps to
bridge the gap between the cryptography research community and the
application areas of cryptography. Consequently, we encourage
submissions from academia, industry, and other organizations. All
submitted papers will be reviewed. The topics of CHES 2007
include but are not limited to:
- Computer architectures for public-key and secret-key cryptosystems
- Reconfigurable computing in cryptography \& FPGAs
- Cryptography for pervasive computing (RFID, sensor networks, etc.)
- Device identification
- Cryptography in wireless applications (mobile phone, LANs, etc.)
- Smart card attacks and architectures
- True and pseudo random number generators
- Embedded security
- Efficient algorithms for embedded processors
- Cryptographic processors and co-processors
- Nonclassical cryptographic technologies
- Security in commercial consumer applications such as pay-TV systems, automotive etc.
- Tamper resistance on the chip and board level
- Special-purpose hardware for cryptanalysis
- Side channel cryptanalysis
- Trusted computing platforms
For more information, please see
http://www.chesworkshop.org/.
RAID 2007
10th International Symposium on Recent Advances in Intrusion Detection,
Gold Coast, Queensland, Australia, September 5-7, 2007.
[posted here 1/8/07]
This symposium, the 10th in an annual series, brings together leading
researchers and practitioners from academia, government, and industry to
discuss issues and technologies related to intrusion detection and defense.
The Recent Advances in Intrusion Detection (RAID) International Symposium series
is intended to further advances in intrusion defense by promoting the exchange of
ideas in a broad range of topics. As in previous years, all topics related to
intrusion detection, prevention and defense systems and technologies are within
scope, including but not limited to the following:
- Intrusion detection and prevention techniques
- High-performance intrusion detection
- Intrusion detection in special environments (e.g., mobile networks)
- IDS cooperation and event correlation
- Formal models and analysis
- Attack response, countermeasures, and intrusion tolerance
- Survivability and self-protection
- Attacks against IDS and evasion
- Insider threat detection and mitigation
- Deception systems and honeypots
- Malicious code detection and containment
- Visualization techniques
- Intrusion detection assessment and benchmarking
- IDS interoperability standards and standardization
- Vulnerability analysis and risk assessment
- Legal and social issues
For more information, please see
http://www.isi.qut.edu.au/go/raid07.
SPatterns 2007
1st International Workshop on Secure Systems Methodologies Using Patterns,
Held in conjunction with the 4th International Conference on Trust, Privacy & Security in Digital Business (TrustBus 2007),
Regensburg, Germany, September 3-7, 2007.
[posted here 1/22/07]
Security patterns have arrived to a stage where there are a significant number
of them, two books about them have been published, and industry is starting to
accept and use them. Analysis and design patterns have been around for about
ten years and have found practical use in many projects. They have been
incorporated into several software development methodologies where less
experienced developers can use them to receive the advice and knowledge of
experts. The situation is not so clear for security patterns because
no accepted methodology exists for their use. This workshop focuses on
secure software methodologies. We seek papers describing individual security
patterns, new methodologies, new aspects of existing methodologies, pattern
languages to use in the methodologies, reference architectures, blueprints,
and related aspects. Experiences in applying the methodologies to real
situations are especially welcome.
For more information, please see
http://www-ifs.uni-regensburg.de/spattern07/.
TrustBus 2007
4th International Conference on Trust, Privacy & Security in Digital Business,
Held in conjunction with the 18th International Conference on Database and Expert Systems Applications (DEXA 2007),
Regensburg, Germany, September 3-7, 2007.
[posted here 12/4/06]
TrustBus’07 will bring together researchers from different disciplines,
developers, and users all interested in the critical success factors of digital
business systems. We are interested in papers, work-in-progress reports, and
industrial experiences describing advances in all areas of digital business
applications related to trust and privacy, including, but not limited to:
- Anonymity and pseudonymity in business transactions
- Business architectures and underlying infrastructures
- Common practice, legal and regulatory issues
- Cryptographic protocols
- Delivery technologies and scheduling protocols
- Design of businesses models with security requirements
- Economics of Information Systems Security
- Electronic cash, wallets and pay-per-view systems
- Enterprise management and consumer protection
- Identity and Trust Management
- Intellectual property and digital rights management
- Intrusion detection and information filtering
- Languages for description of services and contracts
- Management of privacy & confidentiality
- Models for access control and authentication
- Multimedia web services
- New cryptographic building-blocks for e-business applications
- Online transaction processing
- PKI & PMI
- Public administration, governmental services
- P2P transactions and scenarios
- Real-time Internet E-Services
- Reliability and security of content and data
- Reliable auction, e-procurement and negotiation technology
- Reputation in services provision
- Secure process integration and management
- Security and Privacy models for Pervasive Information Systems
- Security Policies
- Shopping, trading, and contract management tools
- Smartcard technology
- Transactional Models
- Trust and privacy issues in mobile commerce environments
- Usability of security technologies and services
For more information, please see
http://www.icsd.aegean.gr/trustbus07/.
WICS 2007
5th International Workshop on Internet Communications Security,
Held in conjunction with the International Conference on Database and Expert Systems Applications (DEXA 2007),
Regensburg, Germany, September 3-7, 2007.
[posted here 1/9/07]
With the advent of Web and its increasing dominant force in industry and
commerce, the Internet has become not only a communications means, but also
a key tool for businesses, research and social development. Nowadays it is
possible for us to file our tax report, buy books and CD's from a vendor in
another continent and even download multimedia content to out TV, thanks to
the use of those information networks. However, the more information is being
transmitted, the more probable is that we are interested in providing that
communication with some type of security (let it be confidentiality,
authenticity, non-repudiation, etc...) Furthermore, with the emergence of
new technologies and devices that are capable of getting access to the Internet,
we are also looking for solutions that allow these devices to secure the
information they transmit in a similar way that it is done with personal
computers. Original research papers on all technical aspects of Internet
security are solicited for submission to WICS 07. Topics of relevance
include but are not limited to:
- Authentication and authorization
- Intrusion detection and response
- Biometrics
- Key management
- Computer Forensics
- Mobile communications security
- Cryptography and its applications
- Network security
- Security Interoperability
- E-Commerce security
- Non repudiation
- Information Assurance
- Security protocols
- Intellectual property protection
- Security for emerging technologies
- Security in new generation technologies for the Internet: VoIP, contact-less smartcards, RFID, ...
For more information, please see
http://aspects.uc3m.es/wics07/.
SecCo 2007
5th International Workshop on Security Issues in Concurrency,
Lisboa, Portugal, September 3, 2007.
[posted here 4/2/07]
Emerging trends in concurrency theory require the definition of models and languages
adequate for the design and management of new classes of applications, mainly to
program either WANs (like Internet) or smaller networks of mobile and portable devices
(which support applications based on a dynamically reconfigurable communication structure).
Due to the openness of these systems, new critical aspects come into play, such as the
need to deal with malicious components or with a hostile environment. Current research
on network security issues (e.g. secrecy, authentication, etc.) usually focuses on
opening cryptographic point-to-point tunnels. Therefore, the proposed solutions in
this area are not always exploitable to support the end-to-end secure interaction
between entities whose availability or location is not known beforehand.
The aim of the workshop is to cover the gap between the security and the concurrency
communities. In particular, we look for papers dealing with security issues
(such as authentication, integrity, privacy, confidentiality, access control, denial
of service, service availability, safety aspects, fault tolerance, trust, language-based
security) in emerging fields like web services, mobile ad-hoc networks, agent-based infrastructures,
peer-to-peer systems, context-aware computing, global/ubiquitous/pervasive computing.
For more information, please see
http://www.dsi.uniroma1.it/~gorla/SecCo07/.
IAS 2007
3rd International Symposium on Information Assurance and Security,
Manchester, United Kingdom, August 29-31, 2007.
[posted here 12/18/06]
Information assurance and security has become an important research issue
in networked and distributed information sharing environments. Finding effective
ways to protect information systems, networks and sensitive data within the
critical information infrastructure is challenging even with the most advanced
technology and trained professionals. The International Symposium on Information
Assurance and Security aims to bring together researchers, practitioners,
developers, and policy makers involved in multiple disciplines of information
security and assurance to exchange ideas and to learn the latest development in
this important field. Previously unpublished work offering novel research and
application contributions in any aspect of information assurance, security and
privacy are solicited for submission to the IAS'07 symposium. Proposals for
workshops, panels and tutorials are also welcome. Topics of interest include,
but are not limited to, the following:
- Agent and Mobile Code Security
- Anonymity and User Privacy
- Authentication and Identity Management
- Authorization and Access Control
- Biometrics Security and Applications
- Computer Forensics
- Cryptographic Protocols
- Data Integrity and Privacy
- Database Security
- Denial of Service and Intrusion Detection
- Distributed System Security
- E-Commerce and E-Government Security
- Fraud Control
- Information Warfare and Cyber-terrorism
- Intellectual Property Protection
- Internet and Web Services Security
- Key Management and Recovery
- New Ideas and Paradigms for Security
- Operating System Security
- Secure Hardware and Smartcards
- Secure Software Technologies
- Security Education and Training
- Security Management and Strategy
- Security Models and Architectures
- Security Verification, Evaluations and Measurements
- Trust Negotiation, Establishment and Management
- Ubiquitous Computing Security
For more information, please see
http://www.ias07.org/.
WISA 2007
8th International Workshop on Information Security Applications,
Jeju Island, Korea, August 27-29, 2007.
[posted here 12/4/06]
The focus of the 8th International Workshop on Information Security Applications
(WISA 2007) is on all technical and practical aspects of cryptographic and
non-cryptographic security applications. The workshop will serve as a forum for
new results from the academic research community as well as from the industry.
The areas of interest include, but are not limited to:
- Internet & Wireless Security
- E-Commerce Protocols
- Access Control & Database Security
- Biometrics & Human Interface
- Network Security & Intrusion Detection
- Security & Trust Management
- Digital Rights Management
- Secure Software & Systems
- Information Hiding & Watermarking
- Information Security Management
- Computer Forensics & Cyber Indication
- Smart Cards & Secure Hardware
- Mobile & Application Security
- Privacy & Anonymity
- Public Key Crypto Applications
- Threats & Information Warfare
- Virus Protection & Applications
- Ubiquitous Computing Security
- Peer-to-Peer Security & Applications
For more information, please see
http://www.wisa.or.kr/.
WDFIA 2007
2nd Annual Workshop on Digital Forensics and Incident Analysis,
Samos, Greece, August 27-28, 2007.
[posted here 3/14/07]
The field of digital forensics is rapidly evolving and continues to gain significance
in both the law enforcement and the scientific community. The field is intrinsically
interdisciplinary, drawing upon fields such as information & communication technologies,
law, social sciences and business administration. The second workshop on digital
forensics and incident analysis, hosted by the University of the Aegean in the island
of Samos, aims to provide a forum for researchers and practitioners focusing on different
aspects of digital forensics and incident analysis to present original, unpublished
research results and innovative ideas. We welcome the submission of papers from the
full spectrum of issues relating to the theory and practice of digital forensics and
incident analysis. Areas of special interest include, but are not limited to:
- Digital forensics tools
- Forensic procedures
- Network forensics
- Network traffic analysis, traceback and attribution
- Legal, ethical and policy issues related to digital forensics
- Integrity of digital evidence and live investigations
- Multimedia analysis
- Incident response and investigation
- Portable electronic device forensics
- Data hiding and recovery
- Data mining and information discovery
- Digital evidence visualisation and communication
- Digital evidence storage and preservation
- Digital forensics case studies
For more information, please see
http://www.aegean.gr/wdfia07.
CRYPTO 2007
27th Annual International Cryptology Conference,
Santa Barbara, California, USA, August 19-23, 2OO7.
[posted here 1/15/07]
Original research papers on all technical aspects of cryptology are solicited
for submission to CRYPTO 2007, the Twenty-Seventh Annual International Cryptology
Conference. CRYPTO 2007 is sponsored by the International Association for Cryptologic
Research (IACR), in cooperation with the IEEE Computer Society Technical Committee on
Security and Privacy, and the Computer Science Department of the
University of California, Santa Barbara.
For more information, please see
http://www.iacr.org/conferences/crypto2007/.
DFRWS 2007
7th Annual Digital Forensic Research Workshop,
Pittsburgh, PA, USA, August 13-15, 2007.
[posted here 2/28/07]
DFRWS brings together leading researchers, developers, practitioners, and educators
interested in advancing the state of the art in digital forensics from around the world.
As the most established venue in the field, DFRWS is the preferred place to present
both cutting- edge research and perspectives on best practices for all aspects of
digital forensics. As an independent organization, we promote open community discussions
and disseminate the results of our work to the widest audience. We invite original contributions
as research papers (long and short), panel proposals, and demo proposals.
All papers are evaluated through a double-blind peer-review process, and those accepted
will be published in printed proceedings by Elsevier. Topics of Interest are:
- Incident response and live analysis
- Digital evidence storage and preservation
- Event reconstruction methods and tools
- File system and memory analysis
- Application analysis
- Network traffic analysis, traceback and attribution
- Embedded systems
- Mobile devices
- Large-scale investigations
- Data mining and information discovery
- Data hiding and recovery
- Multimedia analysis
- Tool testing and development
- Digital evidence and the law
- Case studies and trend reports
- Non-traditional approaches to forensic analysis
For more information, please see
http://www.dfrws.org/.
CNSS 2007
Computer and Network Security Symposium,
Held in conjunction with the International Wireless Communications & Mobile Computing Conference (IWCMC 2007),
Honolulu, Hawaii, USA, August 12-16, 2007.
[posted here 2/28/07]
The main objective of this symposium is to promote further research interests
and activities on computer and network security. It is also aimed at increasing the
synergy between academic and industrial researchers working in this area. We are
interested in theoretic, experimental, and systems-related papers in all aspects
of computer and network security.
Scope of the Computer and Network Security Symposium includes, but is not limited to:
- Novel and emerging secure architecture
- Cryptographic algorithms and applications
- Study of attack strategies, attack modeling
- Key management
- Intrusion detection techniques
- Intrusion response, alarm management, and correlation analysis
- Study of tradeoffs between security and system performance
- Intrusion tolerance systems
- Denial of service
- Distributed system security
- Wireless network security (WiFi, WiMAX, WiMedia and others)
- Sensor network security
- Mobile ad hoc network security
For more information, please see
http://www.cs.ndsu.nodak.edu/~xdu/CNSS_IWCMC07.htm.
PODC 2007
26th Annual ACM SIGACT-SIGOPS Symposium on the Principles of Distributed Computing,
Portland, Oregon, USA, August 12-15, 2007.
[posted here 1/8/07]
PODC 2007 solicits papers on all areas of distributed systems and networking.
We encourage submissions dealing with any aspect of distributed computing,
including theory and practice. The common goal is to shed light on the principles
of distributed computing. Topics of interest include the following
subjects in distributed systems:
- communication and synchronization protocols
- distributed algorithms, analysis, and complexity
- distributed operating systems, middleware platforms, and databases
- economical aspects of distributed computing and selfish agents
- experiments and performance measurements in distributed systems
- fault-tolerance, reliability, availability, and self organization
- high-performance, cluster, and grid computing
- internet, world wide web, and social networks
- location- and context-aware distributed systems
- mobile computing, mobile networks, and mobile agents
- multiprocessor and multi-core architectures and algorithms
- networking: architectures, services, routing, and applications
- peer-to-peer systems, overlay networks, and distributed data management
- security issues in distributed computing, and cryptographic protocols
- sensor, mesh, and ad hoc networks
- shared and transactional memory, and concurrent programming
- specification, semantics, verification, and testing of distributed systems
For more information, please see
http://www.podc.org/podc2007.
USENIX-SECURITY 2007
16th USENIX Security Symposium,
Boston, MA, USA, August 6–10, 2007.
[posted here 10/2/06]
The USENIX Security Symposium brings together researchers, practitioners,
system administrators, system programmers, and others interested in the
latest advances in the security of computer systems and networks.
All researchers are encouraged to submit papers covering novel and scientifically
significant practical works in security or applied cryptography.
Refereed paper submissions are solicited in all areas relating to systems
and network security, including:
- Adaptive security and system management
- Analysis of network and security protocols
- Applications of cryptographic techniques
- Attacks against networks and machines
- Authentication and authorization of users, systems, and applications
- Automated tools for source code analysis
- Cryptographic implementation analysis and construction
- Denial-of-service attacks and countermeasures
- File and filesystem security
- Firewall technologies
- Forensics and diagnostics for security
- Intrusion and anomaly detection and prevention
- Malicious code analysis
- Network infrastructure security
- Operating system security
- Privacy-preserving (and compromising) systems
- Public key infrastructure
- Rights management and copyright protection
- Security architectures
- Security in heterogeneous and large-scale environments
- Security of agents and mobile code
- Security policy
- Self-protecting and healing systems
- Techniques for developing secure systems
- Technologies for trustworthy computing
- Voting systems analysis and security
- Wireless and pervasive/ubiquitous computing security
- World Wide Web security
For more information, please see
http://www.usenix.org/events/sec07/.
EVT 2007
2007 USENIX/ACCURATE Electronic Voting Technology Workshop,
Held in conjunction with the the 16th USENIX Security Symposium (USENIX-Security 2007),
Boston, Massachusetts, USA, August 6, 2007.
[posted here 3/26/07]
In the United States and many other countries, most votes are counted and transported
electronically, but the practical and policy implications of introducing electronic
machines into the voting process are emerging in this new area. Both voting
technology and its regulations are very much in flux, with open concerns including
reliability, robustness, security, human factors, transparency, equality, privacy,
and accessibility. The USENIX/ACCURATE Electronic Voting Technology (EVT) workshop
seeks to bring together researchers from a variety of disciplines, ranging from
computer science and human factors experts through political scientists, legal experts,
election administrators, and voting equipment vendors. EVT will consider papers covering
the gamut of technology as it is used in elections, ranging from voter registration
and vote collection through tabulation and post-election auditing. We are interested
in both future technologies and systems widely used today around the world.
In particular, we welcome papers considering:
- Design and analysis of electronic voting schemes and protocols
- Deployment and lifecycle concerns
- Mitigating threats (including insider threats)
- Usability and accessibility (both for voters and for administrators)
- Legal issues, including how voting systems must comply with the ADA and HAVA or the
effect of intellectual property rights and nondisclosure agreements on voting system
testing, certification, and deployment
- The technology standards process and how it should evolve
For more information, please see
http://www.usenix.org/evt07/cfpa.
IFIPTM 2007
Joint iTrust and PST Conferences on Privacy, Trust Management and Security,
Moncton, New Brunswick, Canada, July 30 - August 2, 2007.
[posted here 1/18/07]
In 2007, the iTrust and PST conferences will join together to provide a truly global
platform for the reporting of research, development, policy and practice in the
interdependent areas of Privacy, Security, and Trust.
Topics of interest for iTrust-PST 2007 include, but are not limited to:
- Privacy Preserving/Enhancing Technologies
- Critical Infrastructure Protection
- Network and Wireless Security
- Operating Systems Security
- Public Safety and Emergency Management
- Intrusion Detection Systems and Technologies
- Secure Software Development and Architecture
- Representations and formalizations of Trust in electronic and physical social systems
- PST challenges in e-services, e.g. e-Health, e-Government, e-Banking, e-Commerce, and e-Marketing
- Information filtering, recommendation, reputation and delivery technologies, spam handling technologies
- Trust technologies, technologies for building trust in e-Business Strategy
- Observations of PST in practice, society, policy and legislation
- Digital Rights Management
- Human Computer Interaction and PST
- Implications of, and technologies for, Lawful Surveillance
- Biometrics, National ID cards, identity theft
- PST in services computing
- Privacy, traceability, and anonymity
- Obligation Systems
- Trust and reputation in self-organizing environments
- Anonymity and privacy vs. accountability
- Access control and capability delegation
- The legal notion of trust in computer science and engineering
- Requirements and methodologies to ensure that the user can reasonably trust the functioning of software systems
- Trust management frameworks for secure collaborations in dynamic Virtual Organizations
- Design of trust-based architectures and decision-making mechanisms for e-community and e-service interactions
- Trust specification, analysis and reasoning
- Dynamics of trust dispositions and relations
- Realization of prototypes of software architectures and applications
- Trust elements in contract negotiation, execution monitoring, re-negotiation and arbitration
- Trust in interaction and cooperation mediated through computer and network, and the balance of control and intervention
- Research in on-line trust, the trust of the consumer towards the web sites of distribution companies
- Analysis of the relationship between trust and such notions as Confidence, distrust, diffidence, expectation, risk, and reliance
For more information, please see
http://pstnet.unb.ca/itrust-pst2007.
SECRYPT 2007
International Conference on Security and Cryptography,
Barcelona, Spain, July 28-31, 2007.
[posted here 12/18/06]
The purpose of SECRYPT 2007 the International Conference on Security and Cryptography
is to bring together researchers, mathematicians, engineers and practitioners interested
on security aspects related to information and communication. Theoretical and practical
advances in the fields of cryptography and coding are a key factor in the growth of
data communications, data networks and distributed computing. In addition to the
mathematical theory and practice of cryptography and coding, SECRYPT also focus on
other aspects of information systems and network security, including applications
in the scope of the knowledge society in general and information systems development
in particular, especially in the context of e-business, internet and global
enterprises. Papers describing original work are invited in any of
the areas listed below:
- Access Control and Intrusion Detection
- Network Security and Protocols
- Cryptographic Techniques and Key Management
- Information Assurance
- Security in Information Systems
For more information, please see
http://www.secrypt.org.
IWSSE 2007
1st IEEE International Workshop on Security in Software Engineering,
Held in conjunction with the 31st Annual International Computer Software and Applications Conference (COMPSAC 2007),
Beijing, China, July 24-27, 2OO7.
[posted here 1/8/07]
The ever growing demand in software security has made it a well recognized
multi-disciplinary sub-area across software engineering, security engineering,
and programming languages. Software security has thus become a fundamental problem
in software engineering, as it mainly focuses on developing secure software and
understanding the security risks and managing these risks throughout the
lifecycle of software. The purpose of the workshop is to bring together researchers
and practitioners in software and application security in order to create a forum
for discussing recent advances in improving security in software engineering and
inspiring research on new methods and techniques to advance security engineering in
industrial practice. Researchers and practitioners worldwide are invited to present
their research expertise and experience, and discuss the issues and challenges in
security from software engineering perspective. Submissions are invited of quality
papers in the following non-exhaustive list of topics:
- Management of software security in industrial practice
- Security requirements and policies
- Abuse cases and threat modeling
- Architecture and design for security
- Model-based security
- Language-based security
- Malicious code prevention and code safety
- Security risk analysis
- Security taxonomy and metrics
- Testing for security
- Application security: detection and protection
- Software piracy and protection
For more information, please see
http://conferences.computer.org/compsac/2007/workshops/IWSSE.html.
SecPerU 2007
3rd International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing,
Held in conjunction with the EEE International Conference on Pervasive Services (ICPS 2007),
Istanbul, Turkey, July 20, 2007.
[posted here 2/19/07]
Ambient assisted living concept is envisioned through a new paradigm of
interaction inspired by constant provision to information and computational
resources. This provision will be enabled through invisible devices that offer
distributed computing power and spontaneous connectivity. A nomad traversing
residential, working, and advertising environments will seamlessly and constantly be
served by small mobile devices like portables, handheld, embedded or wearable computers.
This paradigm of leaving and interacting introduces new security, trust and privacy
risks. Thus, methods and technology to support confidence in this concept are revisited.
The objectives of the SecPerU2007 Workshop are to develop new security, privacy and
trust concepts for complex application scenarios based on systems like handhelds, phones,
smart cards, sensors, actuators and RF tags, with the emerging technology of ubiquitous
and pervasive computing. We welcome the submission of papers from the full spectrum of
issues related with security, privacy and trust in pervasive and ubiquitous computing.
Papers may focus on architectures, methods, technologies, protocols, prototype developments,
case studies, applications, practical experiences, simulation results and analysis, theory
and validation on pervasive and ubiquitous computing topics include, but not limited to:
- Reasoning about Security, Privacy and Trust
- Access control and authorization
- Key management and authentication
- Identity management
- Authorization
- Threat and vulnerability
- Denial of service attacks
- Intrusion detection and protection systems
- Malware in pervasive environments ands services
- Privacy, anonymity, pseudonymity, and unlinkability
- Location privacy and secure localization
- Network security issues and protocols
- Information hiding and watermarking
- Trust and reputation management
- Role of RFID, sensors and biometrics to enable security
- Deploying security policies
- Developing secure infrastructures
- Auditing and forensic information management in pervasive settings
- Ethics and law for pervasive services
- Case Studies
For more information, please see
http://www.icsd.aegean.gr/SecPerU2007/.
IPTComm 2007
Principles, Systems and Applications of IP Telecommunications,
Columbia University, New York, NY, USA, July 19-20, 2007.
[posted here 1/8/07]
While standards and products now support PSTN-equivalent services for
voice, video and text over IP, there are significant difficulties in deploying
large-scale, reliable and secure IP telecommunication systems.
Services that go beyond basic call features remain hard to develop and deploy.
The aim of the IPTComm conference is to serve as a platform for researchers from
academia and research labs, industry and government to share their ideas, views,
results and experiences in the field of IP-based telecommunication.
IPTComm will include presentations of theoretical and experimental achievements,
innovative security systems, prototyping efforts, case studies, and advancements
in technology directly affecting IP-based telecommunication in general and
VoIP and IMS services in particular. We invite authors to submit papers in the
following and related areas:
VoIP and IMS Security:
- Denial of Service detection and prevention
- Security models of voice, video and text over IP services
- Detection and prevention of SPIT, Phreaking, Vishing
- Fraud detection and prevention
- Prevention and mitigation of security attacks
- End-to-end security
- Inter-provider trust and verification schemes
Qos and billing:
- QoS for voice and video
- Traffic and QoS measurement of VoIP and IMS traffic
- Billing, AAA
- Management of VoIP infrastructure and services
- VoIP and IMS system performance, reliability and scalability
Convergent Services:
- VoIP emergency services
- Service architectures (e.g. Parlay, SIP Servlets, IMS)
- Service creation environments and languages
- Presence and event notification
- Interactive collaboration beyond voice, video and text
- Feature interaction
For more information, please see
http://iptcomm.org.
SOUPS 2007
Symposium On Usable Privacy and Security,
Carnegie Mellon University, Pittsburgh, PA, USA, July 18-20, 2007.
[posted here 11/6/06]
The 2007 Symposium on Usable Privacy and Security (SOUPS) will bring together
an interdisciplinary group of researchers and practitioners in human computer
interaction, security, and privacy. The program will feature technical papers,
a poster session, panels and invited talks, discussion sessions, and in-depth
sessions (workshops and tutorials). We invite authors to submit original papers
describing research or experience in all areas of usable privacy and security.
Topics include, but are not limited to:
- innovative security or privacy functionality and design,
- new applications of existing models or technology,
- field studies of security or privacy technology,
- usability evaluations of security or privacy features or security
testing of usability features, and
- lessons learned from deploying and using usable privacy and
security features.
For more information, please see
http://cups.cs.cmu.edu/soups/2007/cfp.html.
USM 2007
Workshop on Usable IT Security Management,
Held in conjunction with the 3rd Symposium On Usable Privacy and Security (SOUPS 2007),
Pittsburgh, PA, USA, July 18, 2007.
[posted here 3/12/07]
USM '07 solicits short position papers from academia and industry about all aspects
of IT security management usability. The workshop will provide an opportunity for
interdisciplinary researchers and practitioners to discuss this fascinating and
important topic. Those interested in presenting at the workshop should submit a
position paper of up to four pages along with a cover letter describing their
research interests, experience, and background in the area of usable IT security management.
Workshop papers will be posted on the SOUPS website and distributed to
attendees on the SOUPS 2007 CD. However, workshop papers will not be formally
published, and therefore may include work the authors plan to publish elsewhere.
For more information, please see
http://cups.cs.cmu.edu/soups/2007/usm.html.
ACSF 2007
2nd Conference on Advances in Computer Security and Forensics,
Liverpool, UK, July 12-13, 2007.
[posted here 2/20/07]
Computer security and computer forensics are at the forefront in the fight
against malicious activity facilitated by our increased use of computer and network
technologies. Computer security preserves system integrity whilst computer forensics
aims to explain the cause for an event or set of events. Computer security is an
established field of computer science, whilst computer forensics is receiving an increased
amount of attention amongst the research community. Due to the degree of overlap in the
raw material used by both fields, they have much to learn from one another. The purpose
of this conference is to bring together researchers and practitioners to present and
share the latest developments in research and applications from both fields.
The topics below are for guidance only and not as an exhaustive list:
- Incident Response and Management
- Legal issues in computer forensics
- Mobile device forensics
- Collecting evidence
- Network forensics
- Practitioner case studies
- Storage media and file forensic techniques
- Intrusion Detection Systems
- Wireless and ad hoc network security
- Mobile agents for secure systems
- Web security
- Distributed Denial-of-Service attack countermeasures
- Network Security
- Viruses and hostile code
- Cryptography
- Privacy and anonymity
- Digital Rights Management (DRM) and intellectual property
- Access control, auditing and accountability
For more information, please see
http://www.cms.livjm.ac.uk/acsf2/.
DIMVA 2007
4th GI International Conference on Detection of Intrusions & Malware, and Vulnerability Assessment,
Lucerne, Switzerland, July 12-13, 2007.
[posted here 9/14/06]
The annual DIMVA conference serves as a premier forum for advancing the
state of the art in intrusion detection, malware detection, and
vulnerability assessment. DIMVA particularly encourages papers that
discuss the integration of intrusion, malware, and vulnerability
detection in large-scale operational communication networks.
DIMVA's scope includes, but is not restricted to the following areas:
Intrusion Detection
- Approaches
- Implementations
- Prevention and response
- Result correlation
- Evaluation
- Potentials and limitations
- Operational experiences
- Evasion and other attacks
- Legal and social aspects
Malware
- Techniques
- Detection
- Prevention
- Evaluation
- Trends and upcoming risks
- Forensics and recovery
Vulnerability Assessment
- Vulnerabilities
- Vulnerability detection
- Vulnerability prevention
For more information, please see
http://www.dimva.org/dimva2007.
RFIDSec 2007
International Conference on RFID Security,
Málaga, Spain, July 11-13, 2007.
[posted here 3/26/07]
RFID technology is one of the most promising technologies. Its reduced cost defines a huge
area of potential applications. Some experts even consider it could provide a technological
revolution comparable to that provided by mobile phones or Internet. Security and privacy are
of vital importance to achieve the desired level of real implementations. RFID security issues
are a challenge for researchers due to the implementation constraints imposed by its low
complexity. Conference aims to provide a bridge between academia and industry working on this fast-growing
research area to share their experiences and state-of-the-art works. The topics of
interest include but are not limited to:
- New application for secure RFID
- Privacy-enhancing techniques for RFID
- Cryptographic protocols for RFID (Authentication, Key update, Scalability issues)
- Integration of secure RFID systems (Middleware and security, (Public-key) Infrastructures)
- Resource-efficient implementation of cryptography (Small-footprint hardware, Low-power architectures)
For more information, please see
http://www.rfidsec07.etsit.uma.es.
GOCP 2007
1st International Workshop on Group-Oriented Cryptographic Protocols,
Held in conjunction with the 34th International Colloquium on Automata, Languages and Programming (ICALP 2007),
Wroclaw, Poland, July 9, 2007.
[posted here 1/22/07]
Group-oriented cryptographic protocols are foundational for the security
of various group applications, like digital conferencing, groupware, group
communication systems, computer-supported collaborative work-flow systems,
multi-user information distribution and sharing, data base and server
replication systems, peer-to-peer and ad-hoc groups, group-based admission
and access management, electronic voting and election, applications in
federative or distributed environment, etc. A variety of cryptographic
techniques and assumptions provides a solid basis for the design of provably
secure group-oriented cryptographic protocols, which is an important and
challenging task. Formal security models for group-oriented cryptographic
protocols require consideration of a large number of potential threats
resulting from the attacks on the communication channel and from the
misbehavior of some protocol participants. These challenges and the emerging
development of multi-party and group-oriented applications are just some reasons
for setting up a new cryptographic workshop, solely dedicated to the security
issues of cryptographic protocols used in these scenarios. The GOCP 2007 workshop
encourages submissions concerning cryptographic foundations, formal security models,
and actual design of all kinds of group-oriented cryptographic protocols, schemes,
and applications. Topics of interest include (in alphabetical order):
- Access and admission control in groups
- Anonymity and privacy in group communications
- Broadcast and multicast communication security
- Cryptographic group-oriented protocols
- Electronic election and voting
- Formal security models (proofs) for group-oriented cryptographic protocols
- Group key exchange/distribution
- Group-oriented signatures
- Secure multi-party computation
- Security in distributed group applications
- Security in mobile and ad hoc groups
- Security in peer-to-peer groups
- Trust management in groups
For more information, please see
http://www.hgi.rub.de/gocp07/.
IFIP-DBSEC 2007
21st Annual IFIP WG 11.3 Working Conference on Data and Applications Security,
Redondo Beach, CA, USA, July 8-11, 2007.
[posted here 12/18/06]
The conference provides a forum for presenting original unpublished research results,
practical experiences, and innovative ideas in data and applications security.
The conference is limited to about forty participants so that ample time is
provided for discussion and interaction. Proceedings will be published by Springer
as the next volume in the Research Advances in Database and Information Systems
Security series. Papers may present theory, technique, applications, or
practical experience on topics of interest to IFIP WG 11.3:
- Access Control
- Secure transaction processing
- Applied Cryptography
- Secure information integration
- Identity theft and countermeasures
- Secure sensor monitoring
- Integrity maintenance
- Security assessment methodologies
- Intrusion detection
- Secure Semantic Web
- Knowledge discovery and privacy
- Secure Web Services
- Organization security
- Threats and vulnerabilities
- Privacy
- Trust management
For more information, please see
http://www.dcs.kcl.ac.uk/staff/steve/ifip07/index.html.
WCAN 2007
3rd Workshop on Cryptography for Ad hoc Networks,
Held in conjunction with the 34th International Colloquium on Automata, Languages and Programming (ICALP 2007),
Wroclaw, Poland, July 8, 2007.
[posted here 4/25/07]
Wireless ad hoc networks are today receiving much attention for military, commercial
and civilian applications, thus becoming a challenging area in security research.
The security research community has mainly focused on securing routing and is only
recently widening its scope of analysis. The cryptography research community has mainly
focused on abstract models of networks like the Internet; however, cryptographic protocols
for the Internet face serious challenges to be adapted to the ad-hoc, partial-connectivity,
mobile, resource-constrained and infrastructureless nature of ad-hoc networks.
The aim of this workshop is to help bridging this gap, towards a more comprehensive
investigation of security and cryptographic tools, analysis and modeling methodologies
over ad hoc networks, by bringing together the cryptography, network security,
and wireless networking communities.
We seek submissions containing original research on all aspects of cryptology that
are motivated by their applicability to ad hoc networks, including wireless, cellular,
sensor, mesh, peer-to-peer, vehicular and RFID-based networks.
Areas of special interest include, but are not limited to:
- Modeling of cryptographic tasks
- Solutions to cryptographic tasks under party mobility
- Solutions to cryptographic tasks under resource constraints
- Secure routing
- Bootstrapping of security associations
- Distributed public-key infrastructures
- Key-agreement, key-management and key-(pre)distribution
- Entity authentication
- Trust establishment
- Privacy-enhancing technologies
- Threshold cryptography
- Identity-Based cryptography
- Policy-based cryptography
- Secure multi-party protocols
- Security in distributed algorithms and protocols
For more information, please see
http://www.argreenhouse.com/society/wcan07/wcan07page.html.
CSF-20
20th IEEE Computer Security Foundations Symposium,
Venice, Italy, July 6-8, 2007.
[posted here 10/20/06]
The IEEE Computer Security Foundations Workshop (CSFW) series brings together
researchers in computer science to examine foundational issues in computer
security. Over the past two decades, many seminal papers and techniques have been
presented first at CSFW. New theoretical results in computer security are welcome.
Also welcome are more exploratory presentations, which may examine open questions
and raise fundamental concerns about existing theories. Panel proposals are
welcome as well as papers. Possible topics include, but are not limited to:
- Authentication
- Information flow
- Security protocols
- Anonymity and Privacy
- Electronic voting
- Network security
- Resource usage control
- Access control
- Trust and trust management
- Security models
- Intrusion detection
- Data and system integrity
- Database security
- Distributed systems security
- Security for mobile computing
- Executable content
- Decidability and complexity
- Formal methods for security
- Language-based security
For more information, please see
http://www.cs.chalmers.se/~andrei/CSF07/cfp.html.
FCC 2007
3rd Workshop on Formal and Computational Cryptography,
Venice, Italy, July 4-5, 2007.
[posted here 3/19/07]
Cryptographic protocols are small distributed programs that add security
services, like confidentiality or authentication, to network communication.
Since the 1980s, two approaches have been developed for analyzing security protocols.
One of the approaches relies on a computational model that considers issues of
complexity and probability. The other approach relies on a symbolic model of protocol
executions in which cryptographic primitives are black boxes.
The workshop focuses on the relation between the symbolic (Dolev-Yao) model and
the computational (complexity-theoretic) model. Recent results have shown that in
some cases the symbolic analysis is sound with respect to the computational model.
Recent results have shown that in some cases the symbolic analysis is sound with
respect to the computational model. A more direct approach which is also investigated
considers symbolic proofs in the computational model. The workshop seeks results in any
of these areas, and more generally, in the area of system and program verification for
security and cryptography. The workshop seeks results in any of these areas.
For more information, please see
http://www-verimag.imag.fr/~lakhnech/FCC/.
PAIRING 2007
1st International Conference on Pairing-based Cryptography,
Tokyo, Japan, July 2-4, 2007.
[posted here 7/31/06]
Since the introduction of pairings in constructive cryptographic
applications, an ever increasing number of protocols have appeared in
the literature: identity-based encryption, short signature, and
efficient broadcast encryption to mention but a few.
An appropriate mix of theoretical foundations and practical
considerations is essential to fully exploit the possibilities offered
by pairings: number theory, cryptographic protocols, software and
hardware implementations, new security applications, etc.
Authors are invited to submit papers describing original research on
all aspects of pairing-based cryptography, including, but not limited
to the following topics:
Novel cryptographic protocols
- ID-based cryptosystem
- broadcast encryption
- short signatures
- ring or group signatures
- aggregate or multi signatures
- undeniable signatures
- key agreement protocol
- authenticated encryption
Mathematical foundation
- Weil, Tate, Eta, and Ate pairings
- security consideration of pairing
- generation of pairing friendly curves
- (hyper-) elliptic curve cryptosystem
- number theoretic algorithms
SW/HW implementation
- secure operating system
- efficient software implementation
- FPGA or ASIC implementation
- smartcard implementation
- side channel attack
- fault attack
Applied security
- novel security applications
- secure ubiquitous computing
- security management
- grid computing
- PKI model
- application to network security
For more information, please see
http://www.pairing-conference.org/.
ESAS 2007
4th European Workshop on Security and Privacy in Ad hoc and Sensor Networks,
Sidney Sussex College, Cambridge, England, July 2-3, 2007.
[posted here 11/20/06]
The vision of ubiquitous computing has generated a lot of interest in
wireless ad hoc and sensor networks. However, besides their potential
advantages, these new generations of networks also raise some
challenging problems with respect to security and privacy. The aim of
this workshop is to bring together the network security,
cryptography, and wireless networking communities in order to discuss
these problems and to propose new solutions. The fourth ESAS workshop
seeks submissions that present original research on all aspects of
security and privacy in wireless ad hoc and sensor networks.
Submission of papers based on work-in-progress is encouraged. Topics
of interest include, but are not limited to the following:
- Privacy and anonymity
- Prevention of traffic analysis
- Location privacy
- Secure localization
- Secure MAC protocols
- Secure topology control
- Secure routing
- Secure context aware computing
- Security for embedded systems
- Distributed intrusion detection
- Secure in-network processing
- Secure time synchronization
- Cooperation and fairness
- Key management
- Trust establishment
For more information, please see
http://www.netlab.nec.de/esas/.
CYBER-FRAUD 2007
1st International Workshop on Cyber-Fraud,
Held in conjunction with the International Conference on Internet Monitoring and Protection (ICIMP 2007),
San Jose, California, USA, July 1-6, 2OO7.
[posted here 2/11/07]
Attacks against private and public networks have had a significant spreading
in the last years. With simple or sophisticated behavior, the attacks tend to
damage user confidence, cause huge privacy violations and enormous economic losses.
The International Workshop on Cyber-Fraud, CYBER-FRAUD 2007, focuses on specific
aspects related to attacks and counterattacks, public information, privacy and safety
on cyber-attacks information. It also targets secure mechanisms to record, retrieve,
share, interpret, prevent and post-analyze of cyber-crime attacks.
Topics of interest include, but are not limited to:
- Epidemiological models for warware and cyber-crime propagation
- Record and retrieval of cyber-crimes
- Forensic analysis
- Cyber-crime prevention
- Cyber-crime vulnerabilities
- Cyber-counterattack at source
- Distributed cyber-attacks
- Orchestrated cyber-attacks
- Recursion attacks
- Cyber-storm attacks
- Spyware and malware
- Cyber-pranks, hoaxes
- Phishing/Farming and anti-phishing
- Cyber-terrorism
- Online cyber-crime reporting
- Accuracy and security of cyber-reports
- Fighting cyber-crimes
- Cyber-crime laws
For more information, please see
http://www.iaria.org/conferences2007/CYBERFRAUD.html.
EUROPKI 2007
4th European PKI Workshop: Theory and Practice,
Mallorca, Spain, June 28-30, 2007.
[posted here 12/18/06]
The 4th European PKI Workshop: Theory and Practice is focusing on
all research aspects of Public Key Applications, Services and Infrastructures.
Submitted papers may present theory, applications or practical
experiences on topics including, but not limited to:
- Architecture and Modeling
- Authentication
- Authorization and Delegation
- Bridge CA
- Case Studies
- Certificates Status
- Certification Policy
- Certification Practices
- Cross Certification
- Directories
- eCommerce/eGovernment
- Evaluation
- Fault-Tolerance
- Federations
- ID-based schemes
- Identity Management
- Implementations
- Interoperability
- Key Management
- Legal issues
- Long-time archiving
- Mobile PKI
- Policies & Regulations
- Privacy
- Privilege Management
- Protocols
- Reliability in PKI
- Repositories
- Risk/attacks
- Standards
- Timestamping
- Trust
- Ubiquitous scenarios
- Verification
For more information, please see
http://dmi.uib.es/europki07.
DSN-ACS 2007
Workshop on Assurance Cases for Security - The Metrics Challenge,
Held in conjunction with the 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2007),
Edinburgh, Scotland - UK, June 27, 2007.
[posted here 1/18/07]
For critical systems it is important to know whether the system is trustworthy and to
be able to communicate, review and debate the level of trust achieved. In the safety domain,
explicit Safety Cases are increasingly required by law, regulations and standards. It has become
common for the case to be made using a goal-based approach, where claims (or goals) are made about
the system and arguments and evidence are presented to support those claims.
Prior workshops, beginning with one held at DSN 2004, have identified a number of technical,
policy and research challenges. This workshop will focus on one of these challenges: metrics for
assurance cases for security. Such metrics can be essential for supporting decisions regarding the
resources provided to develop the assurance case, and the efficacy of the resulting case. However,
there is no commonly accepted approach to this topic.
The purpose of the workshop is to understand these and other questions in the context of
assurance cases for security and to identify viable technical approaches.
For more information, please see
http://www.dsn.org/call/workshops/assurance/.
HotDep 2007
Workshop on Hot Topics in System Dependability,
Held in conjunction with the 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2007),
Edinburgh, Scotland - UK, June 27, 2007.
[posted here 1/18/07]
The goals of HotDep'07 are to bring forth cutting-edge research ideas spanning the
domains of fault tolerance/reliability and systems, and to build linkages between the
two communities (e.g., between people who attend traditional "dependability" conferences
such as DSN and ISSRE, and those who attend "systems" conferences such as OSDI, SOSP, and EuroSys).
HotDep'07 will center on critical components of the infrastructures touching our everyday lives:
operating systems, networking, security, wide-area and enterprise-scale distributed systems,
mobile computing, compilers, and language design. We seek participation and contributions from
both academic researchers and industry practitioners to achieve a mix of long-range research
vision and technology ideas anchored in immediate reality.
Possible topics include but are not limited to the following:
- automated failure management, enabling systems to adapt on the fly
to changes or exceptional conditions
- techniques for better detection, diagnosis, or recovery from failures
- forensic tools for use by administrators and programmers after a
failure or attack
- techniques and metrics for quantifying aspects of dependability in
specific domains (e.g., measuring the security, scalability,
responsiveness, or other properties of a software service)
- tools/concepts/techniques for optimizing tradeoffs among
availability, performance, correctness, and security
- novel uses of technologies not originally intended for
dependability (e.g., using virtual machines to enhance
dependability)
- advances in the automation of management technologies, such as
better ways to specify management policy, advances on mechanisms
for carrying out policies, or insights into how policies can be
combined or validated
For more information, please see
http://www.hotdep.org/2007.
ICDCS 2007
27th International Conference on Distributed Computing Systems,
Toronto, Canada, June 25-29, 2007.
[posted here 9/3/06]
The conference provides a forum for engineers and scientists in academia,
industry and government to present their latest research findings in any
aspects of distributed and parallel computing. Topics of particular interest
include, but are not limited to:
- Algorithms and Theory
- Autonomic Computing
- Data Management
- Fault-Tolerance and Dependability
- Internet Computing and Applications
- Network Protocols
- Operating Systems and Middleware
- Parallel, cluster and GRID Computing
- Peer to Peer
- Security
- Sensor Networks and Ubiquous Computing
- Wireless and Mobile Computing
For more information, please see
http://www.eecg.utoronto.ca/icdcs07/.
IAW 2007
8th Annual IEEE SMC Information Assurance Workshop,
West Point, New York, USA, June 20-22, 2007.
[posted here 11/27/06]
The workshop is designed to provide a forum for Information Assurance
researchers and practitioners to share their research and experiences.
Attendees hail from industry, government, and academia. The focus of this
workshop is on innovative, new technologies designed to address important
Information Assurance issues. Topics include, but are not limited to:
Technical:
- Privacy (area of emphasis)
- Visualization and data representation (area of emphasis)
- Honeynet technologies
- Innovative intrusion detection and response methodologies
- Information warfare
- Biometrics
- Secure software technologies
- Wireless security
- Computer forensics
- Data Protection
Experience:
- Best practices
- Information assurance education
- Information assurance professional development
For more information, please see
http://www.itoc.usma.edu/workshop/2007/index.htm.
PET 2007
7th workshop on Privacy Enhancing Technologies,
Ottawa, Canada, June 20-22, 2007.
[posted here 9/25/06]
Privacy and anonymity are increasingly important in the online world.
Corporations, governments, and other organizations are realizing and exploiting
their power to track users and their behavior. Approaches to protecting individuals,
groups, but also companies and governments from profiling and censorship include
decentralization, encryption, distributed trust, and automated policy disclosure.
The 7th workshop on Privacy Enhancing Technologies addresses the design and
realization of such privacy services for the Internet and other communication
networks by bringing together anonymity and privacy experts from around the world
to discuss recent advances and new perspectives. The workshop seeks submissions
from academia and industry presenting novel research on all theoretical and practical
aspects of privacy technologies, as well as experimental studies of fielded systems.
We encourage submissions from other communities such as law and business that present
their perspectives on technological issues.
Suggested topics include but are not restricted to:
- Anonymous communications and publishing systems
- Censorship resistance
- Pseudonyms, identity management, linkability, and reputation
- Data protection technologies
- Location privacy
- Privacy in Ubiquitous Computing Environments
- Policy, law, and human rights relating to privacy
- Privacy and anonymity in peer-to-peer architectures
- Economics of privacy
- Fielded systems and techniques for enhancing privacy in existing systems
- Protocols that preserve anonymity/privacy
- Privacy-enhanced access control or authentication/certification
- Privacy threat models
- Models for anonymity and unobservability
- Attacks on anonymity systems
- Traffic analysis
- Profiling and data mining
- Privacy vulnerabilities and their impact on phishing and identity theft
- Deployment models for privacy infrastructures
- Novel relations of payment mechanisms and anonymity
- Usability issues and user interfaces for PETs
- Reliability, robustness and abuse prevention in privacy systems
For more information, please see
http://petworkshop.org/2007/.
FIRST 2007
19th FIRST Global Computer Security Network conference,
Seville, Spain, June 17-22, 2007.
[posted here 9/10/06]
Privacy is the genie in the bottle for all data-holding organizations –
once out, whether through crime or carelessness, private and personal information
is out for ever, and has a power to do harm which is almost incalculable.
In the wake of losses and thefts which have exposed millions of customers to
fraud and identity theft, states in America and governments in many other countries
are legislating or plan to legislate to compel corporate and other data-holders to
report publicly all violations of digital privacy. The impact on reputation for
those “named and shamed” may be catastrophic, and the risk to revenues and even to
survival will be profound. New threats to privacy are emerging every day, and at the
same time, tensions are rising between governments who want to harvest and store data
about individual citizens and use it to oversee and steer behavior, and corporate
who collect data from and about citizens who are also customers. Already, brands
which have been exposed by the media for “shopping” customers or “blocking” behavior
have suffered serious blows to their reputations. Understanding these complex issues
and being adequately prepared in case of exposure will be crucial if organizations
are to navigate successfully all the trials that digital privacy is posing.
The FIRST program committee solicits original contributions on network security for
refereed paper presentations, tutorials, invited talks, and panel discussions.
Past topics have included creating and managing CSIRTs, computer vulnerability,
threat detection, computer forensics, and case studies.
For more information, please see
http://www.first.org/conference/2007/papers/.
PLAS 2007
ACM SIGPLAN Workshop on Programming Languages and Analysis for Security,
San Diego, CA, USA, June 14, 2007.
[posted here 1/9/07]
PLAS aims to provide a forum for exploring and evaluating ideas on the
use of programming language and program analysis techniques to improve the
security of software systems. Strongly encouraged are proposals of new,
speculative ideas; evaluations of new or known techniques in practical settings;
and discussions of emerging threats and important problems.
The scope of PLAS includes, but is not limited to:
- Language-based techniques for security
- Verification of security properties in software
- Automated introduction and/or verification of security enforcement mechanisms
- Program analysis techniques for discovering security vulnerabilities
- Compiler-based security mechanisms, such as host-based intrusion detection and in-line reference monitors
- Specifying and enforcing security policies for information flow and access control
- Model-driven approaches to security
- Applications, examples, and implementations of these security techniques
For more information, please see
http://www.cs.umd.edu/~mwh/PLAS07/.
Policy 2007
8th IEEE International Workshop on Policies for Distributed Systems and Networks,
Bologna, Italy, June 13-15, 2007.
[posted here 10/2/06]
Policy 2007 aims to bring together researchers and practitioners working on
policy-based management across a wide range of application domains including
networks, security and privacy, storage, and databases.
This year, the workshop will have a special focus on the Semantic Web.
The Semantic Web provides promising technologies for policy-based management
both for the Web and other distributed systems such as the pervasive
environments, grid computing, and multi-agent systems.
Submitted papers will be evaluated for technical contribution, originality,
and significance. Topics of interest include, but are not limited to the following:
Policy Models and Languages:
- Abstract models and languages for policy specification
- Policy standards, their extensions and refinements
- Formal semantics of policies
- Relationships between policies, both going vertically from
policies for IT processes to policies for IT devices, and
crossing horizontally through multiple application domains
- Methodologies and tools for discovering, specifying, analyzing,
and refining policy
- Models of policy negotiation
- Representation of belief, trust, and risk in policies
- Systems and tools for the management of policies
Policy Applications:
- Case studies of applying policy-based management in different
application domains
- Application of policies for resource allocation, autonomic
computing, systems management, QoS adaptation, security.
- Application of policies for identity and privacy management
- Policy based networking, including active networks, pervasive
computing, and mobile systems
- Business rules and organizational modeling
- Risk adaptive policy systems
- Database policies
- Policy applications in on-demand, utility based computing
- Resource virtualization and policy-based collaboration
Semantic Web Policies --- special focus track
- Representing policies in XML, RDF, and OWL
- SW rule languages (such as N3Logic, SWRL, Rule-ML, RIF) for policy reasoning
- Policy conflict management
- Case studies for policy management using semantic web technologies
- Network routing
- Storage management
- Grid computing
- Mobile computing
- Information filtering
- Digital rights management
- Collaboration
- Access control models for the Web/Semantic Web
- Privacy and accountability on the Web
- Identity management
- Policy authoring based on SW languages
- Modeling belief and trust using SW technologies
- Web services security
- Analysis of or systems based on proposed policy standards
(such as WS-Policy, WSPL, and XACML)
- Semantic Web and eGovernment management
For more information, please see
http://www.policy-workshop.org/2007.
WEIS 2007
6th Workshop on the Economics of Information Security,
Carnegie Mellon University, Pittsburgh, PA, USA, June 7-8, 2007.
[posted here 11/20/06]
The 2007 Workshop on the Economics of Information Security builds on
the success of the previous five Workshops and invites original research
papers on topics related to the economics of information security and the
economics of privacy. Security and privacy threats rarely have purely
technical causes. Economic, behavioral, and legal factors often contribute
as much as technology to the dependability of information and information
systems. Until recently, research in security and dependability focused
almost exclusively on technical factors, rather than incentives. The
application of economic analysis to these problems has now become an
exciting and fruitful area of research.
We encourage economists, computer scientists, business school researchers,
law scholars, security and privacy specialists, as well as industry experts
to submit their research and attend the Workshop. Suggested topics include
(but are not limited to) empirical and theoretical economic studies of:
- Optimal security investment
- Software and system dependability
- Privacy, confidentiality, and anonymity
- Vulnerabilities, patching, and disclosure
- DRM and trusted computing
- Trust and reputation systems
- Security models and metrics
- Behavioral security and privacy
- Information systems liability and insurance
- Information threat modeling and risk management
- Phishing and spam
For more information, please see
http://weis2007.econinfosec.org/.
ACNS 2007
5th International Conference on Applied Cryptography and Network Security,
Zhuhai, China, June 5-8, 2007.
[posted here 8/27/06]
ACNS'07, the 5th International Conference on Applied Cryptography and Network
Security, brings together industry and academic researchers interested in the
technical aspects of cryptology and the latest advances in the application of
crypto systems. Original papers on all aspects of applied cryptography and network
security are solicited for submission to ACNS '07. Topics of relevance include
but are not limited to:
- Applied cryptography and provably-secure cryptographic protocols
- Design and analysis of efficient cryptographic primitives: public-key and
symmetric-key cryptosystems, block ciphers, and hash functions
- Network security protocols
- Techniques for anonymity; trade-offs between anonymity and utility
- Integrating security into the next-generation Internet: DNS security, routing,
naming, denial-of-service attacks, TCP/IP, secure multicast
- Economic fraud on the Internet: phishing, pharming, spam, and click fraud
- Email and web security
- Public key infrastructure, key management, certification, and revocation
- Security and privacy for emerging technologies: sensor networks,
mobile (ad hoc) networks, peer-to-peer networks, bluetooth, 802.11, RFID
- Trust metrics and robust trust inference in distributed systems
- Security and usability
- Intellectual property protection: metering, watermarking, and digital rights management
- Modeling and protocol design for rational and malicious adversaries
- Automated analysis of protocols
For more information, please see
http://www.i2r.a-star.edu.sg/icsd/acns2007/.
ICITS 2007
International Conference on Information Theoretic Security,
Madrid, Spain, May 25-29, 2007.
[posted here 2/2/07]
The first event was the 2005 IEEE Information Theory Workshop on Theory and Practice
in Information-Theoretic Security (ITW 2005, Japan) October 16-19, 2005.
The goal is to continue this conference on a regular basis. The modern unclassified research
on cryptography started with Shannon's work on cryptography using information theory.
Since then we have seen several research topics studied requiring information theoretical security,
also called unconditional security. Examples are anonymity, authenticity, reliable and private
networks, secure multi-party computation, traitor tracing, etc. Moreover, we have also seen
that coding as well as other aspects of information theory have been used in the design of
cryptographic schemes. Post-conference proceedings will be published by Springer Verlag in the Lecture
Notes in Computer Science. Informal preproceedings will be available at the conference.
The topics of interest are on work on any aspect of information theoretical security, this means
security based on information theory. This includes, but is not limited to the following topics:
- Analysis of Security
- Anonymity
- Authentication Codes
- Conventional Cryptography using Codes
- Fingerprinting
- Ideal Ciphers
- Information Hiding
- Key Distribution
- Oblivious Transfer
- Private and Reliable Networks
- Public Key Cryptosystems using Codes
- Quantum Cryptography
- Quantum Information Theory
- Randomness
- Secret Sharing
- Secure Multiparty Computation
- Traitor Tracing
For more information, please see
http://www.cs.ucl.ac.uk/staff/Y.Desmedt/ICITS/.
AusCERT 2007
Asia Pacific Information Technology Security Conference,
Gold Coast, Queensland, Australia, May 21-25, 2007.
[posted here 12/18/06]
Original papers are solicited for submission to the refereed R&D
stream of AusCERT2007 - the AusCERT Asia Pacific Information Technology
Security Conference. Full papers submitted to this stream will be refereed by
members of the international program committee and published in the conference
proceedings. Topics of interest include, but are not limited to:
- Intrusion Detection
- Critical Infrastructure Protection
- Incident Response
- Network and Wireless Security
- Legal and Regulatory Issues
- Attack Detection / Honeypots
- Intrusion Forensics
For more information, please see
http://www.isi.qut.edu.au/go/.
W2SP 2007
Workshop on Web 2.0 Security and Privacy ,
The Claremont Resort, Oakland, California, USA, May 24, 2007.
[posted here 2/28/07]
The goal of this one day workshop is to bring together researchers and
practitioners from academia and industry to focus on understanding Web 2.0 security and privacy
issues, and establishing new collaborations in these areas. Web 2.0 is about connecting people
and amplifying the power of working together. The goal of connecting people is bringing
together a broad range of technologies and social forces. We have witnessed a rapid
proliferation of social computing web sites and content. This mixing of technology and
social interaction is also occurring in the context of a wave of technologies supporting
rapid development of these interpersonal interactions. Many of these new web technologies
rely on the composition of content and services from multiple sources. On one end of the
technology spectrum we have simple services such as blogs and wikis. However there are
far more complex technology composition (mash-up) examples. The content composition trend
is likely to continue. The lure is the promise of inexpensive and easy ways to compose
software service and content.
However, there are issues with respect to management of identities, reputation, privacy,
anonymity, transient and long term relationships, and composition of function and content,
both on the server side and inside the web browser. While the security and privacy issues
are not new (many of these issues already exist with portal servers and browsers),
the security issue is increasingly becoming acute as the technologies are adopted and
adapted to appeal to a wider developer audience. Some of these technologies deliberately
bypass existing security mechanisms. This workshop is intended to discuss the limitations
of the current technologies and explore alternatives.
The scope of W2SP 2007 includes, but is not limited to:
- Identity, privacy, reputation and anonymity
- End-to-end security architectures
- Security of content composition
- Security and privacy policy definition and modeling of content composition
- Provenance and governance
- Usable security and privacy models
- Static and dynamic analysis for security
- Security as a service
For more information, please see
http://www.ieee-security.org/TC/SP2007/oakland07.html.
Oakland 2007
The 2007 IEEE Symposium on Security and Privacy,
The Claremont Resort, Berkeley/Oakland, California, USA, May 20-23, 2007.
[posted here 9/10/06]
Since 1980, the IEEE Symposium on Security and Privacy has been the premier
forum for the presentation of developments in computer security and electronic
privacy, and for bringing together researchers and practitioners in the field.
Previously unpublished papers offering novel research contributions in any
aspect of computer security or electronic privacy are solicited for submission
to the 2007 symposium. Papers may represent advances in the theory, design,
implementation, analysis, or empirical evaluation of secure systems, either
for general use or for specific application domains. The 2007 Symposium is
open to submissions not only of full-length papers but also short papers
(extended abstracts) describing less mature work. It is also open to the
submission of co-located half-day or one-day workshops. See below for
these and other program elements.
Topics of interest include, but are not limited to, the following:
- Access control and audit
- Anonymity and pseudonymity
- Application-level security
- Biometrics
- Cryptographic protocols
- Database security
- Denial of service
- Distributed systems security
- Formal methods for security
- Information flow
- Intrusion detection and prevention
- Language-based security
- Malicious code prevention
- Network security
- Operating system security
- Peer-to-peer security
- Privacy
- Risk analysis
- Secure hardware and smartcards
- Security engineering
- Security policy
- User authentication
The full call for papers can be found at
http://www.ieee-security.org/TC/SP2007/oakland07.html.
IFIP-SEC 2007
22nd IFIP TC-11 International Information Security Conference,
Theme: New approaches for Security, Privacy and Trust in Complex Environments,
Sandton Convention Centre Sandton, South Africa, May 14-16, 2007.
[posted here 8/21/06]
Information is now the most important commodity in a global market. Individuals,
businesses and governments are dependable on information embedded in secure,
privacy aware and trustworthy IT infrastructures. Classical information security
services such as authentication and authorisation urgently demand a re-design and
improved implementation to ensure security, privacy and trust features in today's
integrated and complex information rich environments. Papers offering research
contributions focusing on security, privacy and trust are solicited for submission
to the 22nd IFIP TC-11 International Information Security Conference.
Papers may present theory, applications or practical experiences including,
but not limited to:
- Applications of cryptography, key management and PKI
- Architectures for Information Security, Privacy and Trust
- New approaches to Fraud Management Systems in Advanced Network Infrastructures
- New approaches to classical Information Security Services such as Identification,
Authentication, Authorization, Integrity and Non-repudiation
- Information Security culture including ethics and social issues
- Change Management Systems for implementing Security, Privacy and Trust in organizational environments
- Information security as part of Corporate Governance
- Digital Forensics and Forensic Auditing
- Security, Privacy and Trust for advanced application infrastructures
- Incorporating Security, Privacy and Trust in educational activities
- New approaches for enhancing security, privacy and trust in E-mail environments
- Firewalls for the next generation networks
- Future visions for Information Security Management
- Designing / re-designing Human Computer Interaction for Security, Privacy and Trust
- Identity theft and management
- New applications for steganography
- Information warfare and critical infrastructure protection
- Security, Privacy and Trust in RFID and Sensor networks
- New approaches for Intrusion detection
- Security, Privacy and Trust for Wireless environments
- New requirements for international Information Security Standards
- Privacy Enhancing Technologies (PETs)
- Risk analysis and risk management for complex environments
- Standards, Certification, Accreditation and Evaluation of Information Security in companies
- Incorporating Security, Privacy and Trust in System development methodologies
- Trust Models and Management
- Information Security Metrics
- Vulnerability Assessments for integrated environments
For more information, please see
http://www.sbs.co.za/ifipsec2007/.
WISTP 2007
Workshop in Information Security Theory and Practices: Smart Cards, Mobile and Ubiquitous Computing Systems,
Heraklion, Crete, Greece, May 9-11, 2007.
[posted here 11/27/06]
With the rapid technological development of information technologies, computer
systems and especially embedded systems are becoming more mobile and ubiquitous,
increasingly interfacing with the physical world. Ensuring the security of these
complex and yet, resource constraint systems has emerged as one of the most
pressing challenges. The aim of this first workshop is to bring together researchers
and practitioners in related areas and to encourage interchange and cooperation
between the research community and the industrial/consumer community.
Topics of interest include, but are not limited to:
Smart Cards and Trusted Devices Security
- Biometrics, National ID cards
- Embedded Systems Security and TPMs
- Interplay of TPMs and Smart Cards
- New Applications for Secure RFID Systems
- RFID Systems Security
- Smart Card Security
- Smart Card Applications
Ad Hoc and Mobile Networks Security
- Ad Hoc Networks Security
- Delay-Tolerant Network Security
- Domestic Network Security
- Mobile Codes Security
- Mobile Devices Security
- Security Issues in Mobile and Ubiquitous Networks
- Security of GSM/GPRS/UMTS Systems
- Sensor Networks Security
- Vehicular Network Security
- Wireless Communication Security (WiFi, WiMAX, WiMedia, others)
Ubiquitous Computing Systems Security
- Distributed Systems Security
- Grid Computing Security
- Intrusion Detection and Information Filtering
- Peer-to-Peer Networks Security
Security Protocols, Policies and Management for Mobility
- Critical Infrastructure (e.g. for Medical or Military Applications) Security
- Digital Rights Management (DRM)
- Industrial and Multimedia Applications
- Information Assurance
- Localization Systems Security (Tracking of People and Goods)
- New Applications of Secure Systems
- Public Administration and Governmental Services
- Security Models and Architecture
- Security Policies (Human-Computer Interaction and Human Behavior Impact)
- Security Protocols (for Identification and Authentication, Confidentiality and Privacy, and Integrity)
- Security Measurements
- Trust Management
For more information, please see
http://wistp2007.xlim.fr/.
WWW-SPRE 2007
16th International World Wide Web Conference,
Security, Privacy, Reliability and Ethics (SPRE) Track,
Banff, Alberta, Canada, May 8-12, 2007.
[posted here 10/20/06]
The flexibility and richness of the Web architecture have come at the price of
increasing complexity and lack of a sound overall security
architecture. The movement toward Web-based services, and the increasing
dependency on the Web, have also made reliability a first-rate security
concern. From malware and spyware, drive-by downloads, typo squatting,
denial of service attacks, to phishing and identity theft, a variety of
threats make the Web an increasingly hostile and dangerous environment.
By undermining user trust, these problems are hampering e-commerce and the
growth of online communities.
This track promotes the view that security, privacy, reliability, and
sound guiding ethics must be part of the texture of a successful World
Wide Web. In addition to devising practical tools and techniques, it is
the duty of the research community to promote and guide business
adoption of security technology for the Web and to help inform related
legislation. We seek novel research (both theoretical and practical) in
security, privacy, reliability, and ethics as they relate to the Web,
including but not limited to the following areas:
- Authentication, authorization, and auditing on the web
- Availability and reliability of web servers and services
- Intrusion detection and honeypots
- The Insider threat
- Privacy-enhancing technologies, including anonymity, pseudonymity and
identity management, specifically for the web
- Phishing and pharming, and countermeasures
- User interfaces and usability as they relate to use of
cryptography and online scams such as phishing and pharming
- Applications of cryptography to the web, including PKI and supporting
concepts like digital signatures, certification, etc.
- Electronic commerce, particularly security mechanisms for e-cash,
auctions, payment, and fraud detection
- Electronic fraud and attack vectors
- Economic / business analysis of Web security and privacy
- Legal and legislative approaches to issues of Web security and privacy
- Secure and robust management of server farms
- Dealing with client-side risks
- Security for new web services (blogs, RSS, wikis, etc.)
- Wireless web security (including RFID, sensors, and mobile phones)
- Content protection and abuse on the web (DRM, web/blog spam, etc.)
For more information, please see
http://www2007.org/cfp-SPaE.php.
SIN 2007
International Conference on Security of Information and Networks,
Gazimagusa (TRNC), North Cyprus, May 8-10, 2007.
[posted here 11/27/06]
The International Conference on Security of Information and Networks
(SIN 2007) provides an international forum for presentation of research
and applications of security in information and networks.
Broad areas of interest in security will include, but are not limited to,
the following:
- Access control and intrusion detection
- Cryptographic techniques and key management
- Information assurance
- Network security and protocols Security in information systems
- Security tools and development platforms
- Security ontology, models, protocols & policies
- Standards, guidelines and certification
For more information, please see
http://www.sinconf.org/.
GPC 2007
Workshop on Grid and Pervasive Computing Security,
Held in conjunction with the 2007 International Conference on Multimedia and Ubiquitous Engineering (MUE 2007),
Seoul, Korea, April 26-28, 2007.
[posted here 11/6/06]
Grid and Pervasive Computing (GPC) are emerging technologies that enable
access to a pervasive flow of information, data and services anytime and
anywhere. As the security is of paramount importance to the design and deployment
of GPC, the benefits of GPC will only be fully realized if security aspects can
be appropriately addressed. The goal of this symposium is to take the grid and
pervasive security significantly forward through analyses of new security and
privacy issues arising from the novel architecture of Grid and pervasive systems
and to propose solutions to safely deploy services and appliances. To this end,
we solicit original high quality submissions on topics in security in
computational/data grids and pervasive computing:
- Novel and emerging secure architectures
- Self-protecting and healing systems
- Analyses of new security and privacy issues
- Study of attack strategies, attack modeling
- Security in sensor networks
- Trust Models and Management
- Implementations and performance analysis
- Privacy-preserving techniques
- Key management
- Malicious code prevention
- Denial-of-service attacks and countermeasures
- Intrusion and anomaly detection and prevention
- Network infrastructure security
- Wireless and pervasive/ubiquitous computing security
- Data protection technologies
For more information, please see
http://www.sersc.org/MUE2007/contents/page/GPCS07.html.
PKI R&D 2007
6th Annual PKI R&D Workshop,
Gaithersburg, Maryland, USA, April 17-19, 2007.
[posted here 9/6/06]
This workshop considers the full range of public key technology used for security
decisions and supporting functionalities, including authentication, authorization,
identity management, federation, and trust. This year's focus is striking the
proper balance to permit users to easily complete tasks requiring security while
exposing the appropriate security details through all layers of software.
We solicit papers, case studies, panel proposals, and participation
from researchers, systems architects, vendor engineers, and users.
Suggested topics include but are not limited to:
- Reports of real-world experience with the use and deployment of
applications that leverage PKI, how best to integrate such usage into legacy
systems, and future research directions
- Federated versus Non-Federated trust models
- Standards related to PKI and security decision systems,
such as X.509, SPKI/SDSI, PGP, XKMS, XACML, XRML, XML signatures, and SAML
- Identity management (Shibboleth, Liberty, Higgins, InfoCard, etc.)
- Cryptographic and alternative methods for supporting security decisions,
including the characterization and encoding of data
- Intersection of policy-based systems and PKI
- Human-Computer Interaction (HCI) advances that improve usability of
PKI for users and administrators
- Privacy protection and implications
- Use of PKI in emerging technologies (e.g., sensor networks)
- Scalability and performance of PKI systems
- Security of the components of PKI systems
- Security infrastructures for constrained environments
- Improved human factor designs for security-related interfaces,
including authorization and policy management, naming, signatures, encryption,
use of multiple private keys, and selective disclosure
- New paradigms in PKI architectures
For more information, please see
http://middleware.internet2.edu/pki07/.
NetCri 2007
1st International Workshop on Research Challenges in Next Generation Networks
for First Responders and Critical Infrastructures,
Held in conjunction with IEEE IPCCC 2007,
New Orleans, Louisiana, USA, April 11-13, 2007.
[posted here 10/20/06]
As advances in pervasive computing, wireless communication and sensor
networks continue, more opportunities are open to first responders and critical
infrastructures to benefit from these technologies. Providing first responders
with the best possible technology, infrastructure and services help save the lives
of the general public and the first responders as well. One of the main challenges
to the operations of first responders and critical infrastructures is to deploy a
communication network that is dependable, secure, and rapidly deployable. In order to
operate effectively, the deployed network supports services such as location
determination, audio and video communication, and in site and remote sensing.
Another key feature for first responders and critical infrastructures networks is
to support interactions among multiple heterogeneous networks.
This workshop provides a forum for researchers, industry, and government agencies
to discuss the challenges facing the design, deployment and operational issues for
next generation network support for first responders and critical infrastructure.
The workshop will identify and define fundamental concepts and techniques, resolve
conflicts between different approaches in the area, and provide a common ground for
an advanced research and development agenda. Topics of interest include,
but are not limited to:
- Smart environments (buildings, roads, vehicles, etc.)
- Fast roaming in heterogonous network environment
- Localization and time synchronization
- Rapidly deployable and self configuring services and networks
- Security, dependability, privacy, and performance trade-offs
- QoS in heterogeneous wireless networks
- Sensor and actuator networks for information gathering and real-time control
- Network and system support for augmented reality and visual analytics
- Simulation studies of first responders and critical infrastructures’ networks
- Novel and adaptive communication protocols to support first responders and
critical infrastructure’ operation
- Resource management and allocation
- Power control management
- Admission, load and flow control
- Performance analysis and experimentation of heterogeneous wireless networks
- Security techniques and methods for heterogeneous wireless networks
- Interoperability among WLANs, Cellular, WSN and wired networks
- Metrics and measurements on heterogeneous networks
- Mobility models and traffic patterns in disaster areas
- Cross-layer design
- Testbeds
For more information, please see
http://www.cs.umd.edu/~sharno/NetCri07.
WIA 2007
3rd International Workshop on Information Assurance,
Held in conjunction with the 26th IEEE International Performance Computing and Communications Conference (IPCCC 2007),
New Orleans, Louisiana, USA, April 11-13, 2007.
[posted here 11/6/06]
Information Assurance (IA) is defined as the operations undertaken to protect and defend
information and information systems by ensuring their availability, integrity,
authentication, confidentiality and non-repudiation. Availability implies that
networks and systems must be survivable and fault tolerant – they should possess
redundancies to operate under failures or security breaches. For example, networks
should be designed with sufficient spare and working capacity, efficient traffic
restoration protocols, alarms and network management. Security encompasses the
other aspects of IA, namely integrity, access-control, authentication,
confidentiality and non-repudiation as they apply to both networks and systems.
The increasing reliance of business-to-business and business-to-consumer applications
on networked information systems dramatically magnifies the consequence of damages
resulting from even simple system faults and intrusions, making the task of assuring
confidentiality, availability and integrity of information difficult. Although several
piecemeal solutions address concerns related to the security and fault tolerance of
various components of such networked information systems, there is a growing need
to leverage the synergy between security and survivability to provide a higher level
of information assurance in the face of faults and attacks. We seek papers that
address theoretical, experimental, systems-related and work in-progress in the
area of Information Assurance at the network and system levels. We expect to have
three types of sessions - the first related to survivability and fault tolerance,
the second related to security, and the third related to the interactions between
security and survivability. Papers should describe original, previously unpublished
work, not currently under review by another conference, workshop, or journal.
Papers accepted for presentation will be published in the IPCCC conference proceedings.
The workshop will also include invited papers. Topics of interest include,
but are not limited to:
- Authorization and access control
- Web services security
- Database and system security
- Risk analysis and security management
- Security verification/validation
- Wireless Security & Survivability
- Network Restoration techniques
- Network Reliability/Availability
- Digital Rights Management
- DoS protection for the Internet
- Cryptographic protocols and Key management
- Intrusion Detection Techniques
- Ad hoc sensor network security
- Models and architectures for systems security and survivability
- Security / survivability in optical networks
- E/M-commerce security and survivability architectures
- Public policy issues for security and survivability
- Botnets detection and response
- Trust negotiation/management
- Privacy models and mechanisms
For more information, please see
http://www.sis.pitt.edu/~lersais/WIA2007/.
ASC 2007
6th Annual Security Conference,
Las Vegas, Nevada, USA, April 11-12, 2007.
[posted here 5/22/06]
With the development of more complex networking systems and the rapid
transition to the e-world, information security has become a real concern for
many individuals and organizations. Advanced safeguards are required to protect
the information assets of not only large but also small and distributed enterprises.
New approaches to information security management, such as policies and certifications,
are now being required. The security of strategic corporate information has become the
foremost concern of many organizations, and in order to assure this security, methods and
techniques must be conceptualized for small enterprises both from a functional and
technical viewpoint. Recommended topics (but not limited to) include:
- E-Commerce security
- Biometrics
- Smart Cards
- Secure small distribution applications
- Security of intelligent tokens
- Methodologies for security of small to medium size enterprises
- Methodologies and techniques for certification and accreditation
- Evaluation of Information Security in companies
- Information security surveys and case studies
- International standards for Information Security Management
For more information, please see
http://www.security-conference.org.
SecSE 2007
1st International Workshop on Secure Software Engineering,
Vienna, Austria, April 10-13, 2007.
[posted here 9/24/06]
In our modern society, software is an integral part of everyday life, and
we expect and depend upon software systems to perform correctly.
Software security is about ensuring that systems continue to function correctly
also under malicious attack. As most systems now are web-enabled, the number
of attackers with access to the system increases dramatically and so the threat
scenario changes. The traditional approach to secure a system includes putting
up defence mechanisms like IDS and firewalls, but this is no longer sufficient.
We need to be able to build better, more robust and more secure systems. Even more
importantly, however, we should strive to achieve these qualities in all software
systems, not just the ones that need special protection.
This workshop will focus on techniques, experiences and lessons learned for
engineering secure software. Suggested topics include, but are not limited to:
- Secure architecture and design
- Security in agile software development
- Security requirements
- Risk management in software projects
- Secure implementation
- Secure deployment
- Testing for security
- Static analysis for security
- Lessons learned
- Security and usability
- Teaching secure software development
- Experience reports on successfully attuning developers to secure
software engineering
For more information, please see
http://www.ares-conference.eu/conf/.
DeSeGov 2007
2nd International Workshop on Dependability and Security in e-Government,
Held in conjunction with the Second International Conference on Availability, Reliability and Security (ARES 2007),
Vienna, Austria, April 10-13, 2007.
[posted here 11/27/06]
Many governments have now significant e-government applications that
offer more and more the day-to-day services to the citizen.
ICT infrastructure has become as important as government offices and its
officials: crucial for the functioning of the state. Modern government is
today dependent on its functioning ICT: the systems must be available,
reliable, safe, confidential, integer and secure.
The aim of this workshop is to foster a forum for discussing and resenting
recent research results on dependability and security in e-Government
applications.
Scientific rigor and discussions of state of the art of dependability
and security in e-Government are strongly encouraged. Besides, innovative
research work in progress and studies of dependability aspects of practical
e-Government projects and systems implementation are also welcome.
Topics of interest include, although not limited to, the following:
- Trust and security: provisions and instruments
- Online availability of public services
- Service survivability and maintainability
- Interoperability of services
- Security in e-democracy (including e-participation and e-voting)
- E-justice (administration and workflow security for legal processes)
- Secure federating information access (from different government and third party agencies)
- Security and reliability in media integration
- Secure e-government and Identity Management
- Security and reliability of Smart Card System
- Availability and reliability of mobile services
- Data protection and data privacy (e.g. e-health and e-education)
- Intrusion detection and prevention
- Anti-spam legislation and solution
- Public-private- partnerships management
- Role-based management and usage restriction
For more information, please see
http://desegov.ares-conference.eu/.
SADFE 2007
2nd International Workshop on Systematic Approaches to Digital Forensic Engineering,
Seattle, Washington, USA, April 10-12, 2007.
[posted here 9/24/06]
SADFE promotes systematic approaches to cyber crime investigation, by
furthering the advancement of digital forensic engineering as a disciplined
practice. Unlike ad-hoc computer forensics, digital forensic engineering is
characterized by the application of scientific and mathematical principles to the
investigation and establishment of facts or evidence, either for use within a
court of law or to aid understanding of cyber crimes or cyber-enabled crimes.
Advancing digital forensics engineering requires the expertise of technologists,
analysts, and legal experts to produce sound computer systems and sound forensic
practices which will meet the needs of courtroom presentation as well as minimizing
negative effects on the cyber-system? original purpose.
This workshop brings together top digital forensic researchers, advanced tool/product
builders, and expert law enforcement representatives from around the world for
information exchange and R&D collaboration. Topics of interest include, but not limited to:
Digital Evidence Management: advanced digital evidence discovery, collection, and storage
- Identification and collection of digital evidence
- Post-collection handling of evidence
- Evidence preservation and storage
- Forensic-enabled architectures and processes
- Managing geographically, politically and/or jurisdictionally dispersed data
Principle-based Digital Forensic Processes: systematic engineering processes
supporting digital evidence management which are sound on both technical and legal grounds
- Legal and technical aspects of admissibility and evidence tests
- Examination environments for digital data
- Courtroom expert witness and case presentation
- Case studies illustrating privacy, legal and legislative issues
- Forensic tool validation: legal implications and issues
Digital Evidence Analytics: advanced digital evidence analysis, correlation, and presentation
- Advanced search, analysis, and presentation of digital evidence
- Progressive cyber crime scenario analysis and reconstruction technology
- Legal case construction & digital evidence support
- Cyber-crime strategy analysis & modeling
- Combining digital and non-digital evidence
- Supporting qualitative or statistical evidence
Forensic-support technologies: forensic-enabled and proactive monitoring/response
- Forensics of embedded or non-traditional devices (e.g. digicams, cell phones, SCADA)
- Innovative forensic engineering tools and applications
- Forensic-enabled support for incident response
- Forensic tool validation: methodologies and principles
- Legal and technical collaboration
- Digital Forensics Surveillance Technology and Procedures
For more information, please see
http://conf.ncku.edu.tw/sadfe.
WRAITS 2007
Workshop on Recent Advances on Intrusion-Tolerant Systems,
Held in conjunction with the European Conference on Computer Systems (EuroSys 2007),
Lisbon, Portugal, March 23, 2007.
[posted here 1/18/07]
The First Workshop on Recent Advances on Intrusion-Tolerant Systems aims to bring together
researchers in the related areas of Intrusion Tolerance, Distributed Trust, Survivability,
Byzantine Fault Tolerance, and Resilience. These areas have the purpose of enhancing the
Dependability and Security of computer systems by tolerating both malicious faults
(attacks, intrusions) and accidental faults. The workshop will be specially interested
in “intrusion-tolerant systems”: how to build them? How to evaluate and test their
dependability and security? What systems need to be intrusion-tolerant? The workshop
will provide a forum for researchers in these areas to present recent results,
discuss open problems that still need research, the steps that need to be taken for
intrusion-tolerant systems to be deployed in practice, and the target application
domains for intrusion tolerance.
Topics of interest related to intrusion tolerance include, but are not limited to:
- innovative system architectures
- wide-area intrusion-tolerant systems
- secure control and embedded systems
- security of critical infrastructures
- practical applications for intrusion tolerance
- state machine replication
- Byzantine quorum systems
- proactive recovery
- Byzantine fault-tolerant algorithms
- diversity and failure independence
- determinism and interoperability issues
- confidentiality and replication
- dependability and security evaluation
- performance evaluation
- risk assessment
- distributed trust
- survivable systems
- cross-organization systems
For more information, please see
http://wraits07.di.fc.ul.pt/.
ASIACCS 2007
ACM Symposium on InformAtion, Computer and Communications Security,
Singapore, March 20-22, 2007.
[posted here 5/29/06]
To build on the success of ACM Conference on Computer and Communications
Security (CCS) and ACM Transactions on Information and System Security
(TISSEC), the ACM Special Interest Group on Security, Audit, and Control
(SIGSAC) formally established the annual ACM Symposium on InformAtion,
Computer and Communications Security (ASIACCS) in 2005.
Papers representing original research in both
the theory and practice concerning information, computer and
communications security are solicited. Topics of interest include, but
are not limited to:
- Access control and authorization
- Applied cryptography
- Authentication, biometrics, smartcards
- Data integrity and audit
- Database security
- Digital Rights Management
- Distributed systems security
- E-commerce and mobile e-commerce
- Electronic privacy, anonymity
- Formal verification and testing
- Hardware design
- High speed networks
- Information flow
- Intrusion detection and survivability
- Mobile code and mobile agent security
- P2P & ad hoc networks
- RFID applications
- Security protocols
- Viruses and other malicious codes
- Watermarking and data hiding
- Wireless communications
- Wireless sensor networks
For more information, please see
http://asiaccs07.i2r.a-star.edu.sg/.
IFIP-CIP 2007
1st Annual IFIP WG 11.10 International Conference on Critical Infrastructure Protection,
Hanover, New Hampshire, USA, March 19-21, 2007.
[posted here 8/20/06]
The IFIP Working Group 11.10 on Critical Infrastructure Protection is an
active international community of researchers, infrastructure operators and
policy-makers dedicated to applying scientific principles, engineering techniques
and public policy to address current and future problems in information
infrastructure protection. Papers are solicited in all areas of critical
infrastructure protection. Areas of special interest include, but are not
limited to:
- Infrastructure vulnerabilities, threats and risks
- Security challenges, solutions and implementation issues
- Infrastructure sector interdependencies and security implications
- Infrastructure protection case studies
- Legal, ethical, economic and policy issues related to critical infrastructure protection
- Distributed control systems/SCADA security
- Telecommunications network security
For more information, please see
http://www.cis.utulsa.edu/ifip1110/Conferences/WG11-10CallForPapers.asp.
SAC-CF 2007
22nd Annual ACM Symposium on Applied Computing,
Computer Forensics Track,
Seoul, Korea, March 11 - 15, 2007.
[posted here 9/3/06]
With the exponential growth of computer users, the number of criminal
activities that involves computers has increased tremendously. The field of
Computer Forensics has gained considerable attention in the past few years.
It is clear that in addition to law enforcement agencies and legal personnel,
the involvement of computer savvy professionals is vital for any digital incident
investigation. Unfortunately, there are not many well-qualified computer crime
investigators available to meet this demand. An approach to solve this problem
is to develop state-of-the-art research and development tools for practitioners
in addition to creating awareness among computer users.
The primary goal of this track will be to provide a forum for researchers, practitioners,
and educators interested in Computer Forensics in order to advance research and
educational methods in this increasingly challenging field. We expect that people
from academia, industry, government, and law enforcement will share their
previously unpublished ideas on research, education, and practice through this
track. We solicit original, previously unpublished papers in the following general
(non-exhaustive) list of topics:
- Incident Response and Live Data Analysis
- Operating System and Application Analysis
- File System Analysis
- Network Evidence Collection
- Forensic Profiles
- Network Forensics
- Data Hiding and Recovery
- Event Reconstruction and Tracking
- Legal, Ethical and Privacy Issues
For more information, please see
http://comp.uark.edu/~bpanda/sac-cf.htm.
SAC-CLAT 2007
22nd Annual ACM Symposium on Applied Computing,
Computer-aided Law and Advanced Technologies Track,
Seoul, Korea, March 11 - 15, 2007.
[posted here 9/3/06]
Advances in computer applications and the social cyberspaces created by computing
networks highlight the need for a revised legal framework to deal with emerging
issues. Similarly, the legal domain can benefit from such technical advances.
On the other hand, dematerialization of documents and documental flows call for
appropriate technical tools that allow to design paradigms meeting the relevant
legal requirements. A combined effort of the computer science and law communities
would have benefical consequences in areas such as e-Business, e-Government,
e-Commerce,... A track that focuses on the intersection of law and technology
represents a broad and diverse forum for the discussion of research in computer-aided
law and can provide synergies when aligned with other areas of SAC.
Topics of interest include, but are not limited to:
TECHNOLOGICAL SUPPORT FOR:
- Agent-treatable legal issues
- Civil liability
- Codes of conduct
- Contracts
- Copyright protection
- Counter-Terrorism Initiatives
- Criminal liability
- e-Business
- e-Governance
- e-Government
- Electronic Court proceedings
- Electronic evidence
- Intellectual property
- Legal publicity
- On-line dispute resolution
- Privacy
- Protection of consumer rights
- Torts
- Trust and reputation
LEGAL ASPECTS OF:
- Agent-based Paradigms
- Artificial Intelligence
- Cybercrime
- Databases
- Dematerialization of Documental Flows
- Digital Signatures
- Electronic Documents
- Electronic Mail
- Network Security
- Online Creative Industries
- Privacy-preserving Data-Mining
- Public Key Infrastructures
- Security Mechanisms (Encryption, Authentication, Access Control, etc.)
- Simulation
- Software protection
- Traffic Monitoring and Logging
- Trust and reputation models
- Virtual Communities
- Watermarking and Fingerprinting Techniques
For more information, please see
http://www.clat.unibo.it/.
SAC-TRECK 2007
22nd Annual ACM Symposium on Applied Computing,
Trust, Recommendations, Evidence and other Collaboration Know-how (TRECK) Track,
Seoul, Korea, March 11 - 15, 2007.
[posted here 7/3/06]
Computational models of trust and online reputation mechanisms have been
gaining momentum. One reason for this is that traditional security
mechanisms are challenged by open, large scale and decentralised
environments. The use of an explicit trust/reputation management component
goes beyond security though.
The goal of the ACM SAC 2007 TRECK track remains to review the set of
applications that benefit from the use of computational trust and online
reputation. Computational trust has been used in reputation systems, risk
management, collaborative filtering, social/business networking services,
dynamic coalitions and virtual organisations. In last year TRECK, a paper
even described how computational trust and reputation could mitigate the
privacy issues of trusted computing hardware modules. The TRECK track covers
all computational trust applications, especially those used in real-world
applications. The topics of interest include, but are not limited to:
- Recommender and reputation systems
- Trust-enhanced collaborative applications
- Trusted computing, trusted platorm modules (TPM, TCG, TCPA, NGSCB...)
- Trading privacy for trust and security
- Tangible guarantees given by formal models of trust and risk
- Trust metrics assessment and threat analysis
- Pervasive computational trust and use of context-aware features
- Trust/risk-based security frameworks
- Automated collaboration and trust negotiation
- Trust in peer-to-peer systems
- Technical trust evaluation
- Impacts of social networks on computational trust
- Evidence gathering and management
- Real-world applications, running prototypes and advanced simulations
- Applicability in large-scale, open and decentralised environments
- Legal and economic aspects related to the use of trust engines
- User-studies and user interfaces of computational trust applications
For more information, please see
http://www.acm.org/conferences/sac/sac2007/.
NDSS 2007
14th Annual Network and Distributed System Security Symposium,
San Diego, California, USA, February 28-March 2, 2007.
[posted here 8/3/06]
The symposium fosters information exchange among research scientists and
practitioners of network and distributed system security services.
The target audience includes those interested in practical aspects of network
and distributed system security, with a focus on actual system design and
implementation (rather than theory). A major goal is to encourage and enable
the Internet community to apply, deploy, and advance the state of available
security technology. Submissions are solicited in, but not limited to,
the following areas:
- Integrating security in Internet protocols: routing, naming, TCP/IP, multicast,
network management, and the Web.
- Intrusion prevention, detection, and response: systems, experiences
and architectures.
- Privacy and anonymity technologies.
- Network perimeter controls: firewalls, packet filters, application gateways.
Virtual private networks.
- Security for emerging technologies: sensor networks, specialized testbeds,
wireless/mobile (and ad hoc) networks, personal communication systems, RFID systems,
peer-to-peer and overlay network systems.
- Secure electronic commerce: e.g., payment, barter, EDI, notarization,
timestamping, endorsement, and licensing.
- Supporting security mechanisms and APIs; audit trails; accountability.
- Implementation, deployment and management of network security policies.
- Intellectual property protection: protocols, implementations, metering,
watermarking, digital rights management.
- Fundamental services on network and distributed systems: authentication,
data integrity, confidentiality, authorization, non-repudiation,
and availability.
- Integrating security services with system and application security facilities
and protocols: e.g., message handling, file transport/access, directories,
time synchronization, data base management, boot services, mobile computing.
- Public key infrastructure, key management, certification, and revocation.
- Special problems and case studies: e.g., tradeoffs between security and efficiency,
usability, reliability and cost.
- Security for collaborative applications: teleconferencing and video-conferencing,
electronic voting, groupwork, etc.
- Software hardening: e.g., detecting and defending against software bugs (overflows, etc.)
- Security for large-scale systems and critical infrastructures.
For more information, please see
http://www.isoc.org/isoc/conferences/ndss/07/cfp.shtml.
USEC 2007
Workshop on Usable Security,
Held in conjunction with the 11th Conference on Financial Cryptography and Data Security (FC 2007),
Lowlands, Scarborough, Trinidad/Tobago, February 15-16, 2007.
[posted here 8/27/06]
Some of the most challenging problems in designing and maintaining secure systems
involve human factors. A great deal remains to be understood about users' capabilities
and motivations to perform security tasks. Usability problems have been at the root
of many widely reported security failures in high-stakes financial, commercial
and voting applications. USEC'07 seeks submissions of novel research from academia
and industry on all theoretical and practical aspects of usable security in the
context of finance and commerce.
For more information, please see
http://www.usablesecurity.org/.
FC 2007
11th International Conference on Financial Cryptography and Data Security,
Scarborough, Trinidad and Tobago, February 11 - 15, 2007.
[posted here 7/15/06]
At its 11th year edition, Financial Cryptography and Data Security
(FC'07) is a well established and major international forum for
research, advanced development, education, exploration, and debate
regarding security in the context of finance and commerce. Original
papers, surveys and presentations on all aspects of financial and
commerce security are invited. Submissions must have a strong and
visible bearing on financial and commerce security issues, but can be
interdisciplinary in nature and need not be exclusively concerned with
cryptography or security. Possible topics for submission to the
various sessions include, but are not limited to:
- Anonymity and Privacy
- Auctions
- Audit and Auditability
- Authentication and Identification, including Biometrics
- Certification and Authorization
- Commercial Cryptographic Applications
- Commercial Transactions and Contracts
- Digital Cash and Payment Systems
- Digital Incentive and Loyalty Systems
- Digital Rights Management
- Financial Regulation and Reporting
- Fraud Detection
- Game Theoretic Approaches to Security
- Identity Theft, Physhing and Social Engineering
- Infrastructure Design
- Legal and Regulatory Issues
- Microfinance and Micropayments
- Monitoring, Management and Operations
- Reputation Systems
- RFID-Based and Contactless Payment Systems
- Risk Assessment and Management
- Secure Banking and Financial Web Services
- Securing Emerging Computational Paradigms
- Security and Risk Perceptions and Judgments
- Security Economics
- Smart Cards and Secure Tokens
- Trust Management
- Trustability and Trustworthiness
- Underground-Market Economics
- Voting system security
For more information, please see
http://fc07.ifca.ai/.
AISW-PET 2007
Australasian Information Security Workshop 2007 (Privacy Enhancing Technologies),
Victoria, Australia, January 30 - February 2, 2007.
[posted here 7/27/06]
AISW-Pet aims at promoting research on privacy enhancing technologies
and increasing the synergy between academic and industrial researchers
working in this area. It is a one-day workshop to be held in conjunction
with the Australasian Computer Science Conference.
We seek submissions from academic and industrial researchers on all
theoretical and practical aspects of privacy enhancing technologies.
Suggested topics include but are not restricted to:
- Anonymity and unobservability modeling
- Attacks on anonymity systems
- Cryptography
- Ethics, policy and law relating to privacy
- Identity management and identity theft
- Privacy and anonymity in peer-to-peer architectures
- Privacy-enhanced data authentication/certification
- Privacy in ubiquitous computing
- Privacy preserving access control
- Privacy preserving data mining
- Protocols that preserve anonymity/privacy
- Security of statistical databases
- Usability issues and user interfaces for PETs
- Traffic analysis
- Trust and privacy
For more information, please see
http://www.newcastle.edu.au/conference/aisw2007/.
IFIP-DF 2007
3rd Annual IFIP WG 11.9 International Conference on Digital Forensics,
Orlando, Florida, USA, January 29-31, 2007.
[posted here 8/20/06]
The IFIP Working Group 11.9 on Digital Forensics is an active international
community of scientists, engineers and practitioners dedicated to advancing the
state of the art of research and practice in the emerging field of digital forensics.
Technical papers are solicited in all areas related to the theory and practice
of digital forensics. Areas of special interest include, but are not limited to:
- Theories, techniques and tools for extracting, analyzing and preserving digital evidence
- Operating system and file system forensics
- Network forensics
- Portable electronic device forensics
- Digital forensic processes and workflow models
- Digital forensic case studies
- Legal, ethical and policy issues related to digital forensics
For more information, please see
http://www.cis.utulsa.edu/ifip119/Conferences/WG11-9CallForPapers.asp.
DIMACS-ISE 2007
DIMACS Workshop on Information Security Economics,
Rutgers University, Piscataway, New Jersey, USA, January 18 - 19, 2007.
[posted here 9/3/06]
The DIMACS Workshop on Information Security Economics aims at enlarging
the interest in this area by bringing together researchers already engaged
in the field with other scientists and investigators in disciplines such as
economics, business, statistics, and computer science. We encourage researchers
and industry experts to submit manuscripts with original work to the workshop;
we especially encourage collaborative and interdisciplinary research from
authors in multiple fields.
Topics of interest include (but are not limited to) empirical and
theoretical works on the economics of:
- vulnerabilities and malicious code
- spam, phishing, and identity theft
- privacy, reputation, and trust
- DRM and trusted computing
- cyber-insurance, returns on security investments, and security risk management
- security risk perception at the firm and individual levels
For more information, please see
http://dimacs.rutgers.edu/Workshops/InformationSecurity/.
IAMCOM 2007
1st Workshop on Information Assurance Middleware for COMmunications,
Bangalore, India, January 12, 2007.
[posted here 8/20/06]
The goal of IAMCOM workshop is to offer a focused forum to discuss the on-going
research in the area of middleware for dependable communications. Middleware for
dependable communications addresses the issues of providing sustainable guarantees on
session-level QoS, performance, integrity, availability and security through a
repertoire of generic software/hardware tools and models. Papers are solicited
on middleware topics pertaining to the communication layers of a distributed network
system. Topics of interest include, but not limited to:
- QoS assurance architectures
- Network state fusion, monitoring
- Tools for detecting DOS attacks
- Utility-based QoS adaptation
- Communication security: authentication, confidentiality
- Adaptive encryption techniques
- Capacity provisioning
- Network survivability
- Dynamic bandwidth allocations
- Traffic engineering
- Distributed consensus/voting
- Self-healing networks
- Topology management
- Failure detectors
- Diversity management and control
For more information, please see
http://www.iamcom.org/.
HICSS-CTER 2007
40th Annual Hawaii International Conference on System Sciences,
Cyber-Threats and Emerging Risks Minitrack,
Waikoloa, Hawaii, USA, January 3-6, 2007.
[posted here 6/10/06]
This mini-track addresses issues related to detecting, mitigating
and preventing the threat of computer-based attacks and operational
failures. Papers that address improving the security of
computer-reliant organizations from these threats through technical
or behavioral change are encouraged. These may include simulation
studies, case-based research, and other applications of quantitative
and qualitative methods. Topics include, but are not limited to::
- Identifying modes of misuse
- Applications of access policies
- Analysis of known and unknown modes of attack
- Separating anomalous from routine behavior
- Adapting outsider-based threat prevention to insider risks
- Modeling risks and approaches to mitigation
- Teaching and training security and business managers about the risks of cyber-attacks
For more information, please see
http://www.hicss.hawaii.edu/hicss_40/fincfp.htm#Cyber-Threats%20and%20Emerging%20Risks.
HICSS-SSADIA 2007
40th Annual Hawaii International Conference on System Sciences,
Secure Software Architecture, Design, Implementation and Assurance (SSADIA) Minitrack,
Waikoloa, Hawaii, USA, January 3-6, 2007.
[posted here 3/27/06]
The Secure Software Architecture, Design, Implementation and
Assurance minitrack focuses on the research and automation
required to develop secure software systems that do not
compromise other system properties such as performance or reliability.
Current security engineering methods are demonstrably inadequate, as
software vulnerabilities are currently being discovered at the rate of
over 4,000 per year. These vulnerabilities are caused by software designs
and implementations that do not adequately protect systems and by
development practices that do not focus sufficiently on eliminating
implementation defects that result in security flaws. An opportunity
exists for systematic improvement that can lead to secure software
architectures, designs, and implementations.
The following topics are appropriate topics for research papers:
- Static analysis tools and techniques for detecting security
flaws and software vulnerabilities in source or binary code
- Dynamic analysis tools for detecting security flaws and
software vulnerabilities in source or binary code
- Model checking tools for detecting security flaws and software
vulnerabilities in software systems
- Software architectures and designs for securing against
denial-of-service attacks and other software exploits
- Coding practices for improved security and secure library
implementations
- Computational security engineering
- Other tools and techniques for reducing or eliminating
vulnerabilities during development and maintenance
For more information, please see
http://www.sei.cmu.edu/community/hicss/.
HICSS-HTC 2007
40th Annual Hawaii International Conference on System Sciences,
Highly Trustworthy computing (HTC) mini-track,
Waikoloa, Hawaii, USA, January 3-6, 2007.
[posted here 5/1/06]
HICSS conferences are devoted to advances in the information, computer,
and system sciences, and encompass developments in both theory and
practice. Starting in HICSS 40, the Software Technology track has a
cluster of complementary mini-tracks in the area of computer security.
The Highly Trustworthy computing (HTC) mini-track focuses on both
applied and fundamental research to support the protection of high
value information, such that both the behavior of the system and the
absence of contrary behavior can be ensured to a high degree. The use of
formal methods, hardware-based security primitives, and rigorous development
processes are some of the significant components in HTC. We are interested
in papers describing new results in the application, theory and
foundations of highly trustworthy computing. We invite papers that
demonstrate results through mathematical techniques as well as those
that provide convincing analysis and/or data regarding new concepts.
The topics covered in this category include, but are not limited to the
support of highly trustworthy computing through:
- System development and verification techniques
- System and network security architectures
- Support for dynamic security policies
- Relationship of dynamic security to multi-level security
- Hardware-software co-design
- System and network evaluation techniques
- Formal models and other theoretical foundations
For more information, please see
http://cisr.nps.edu/HICSS/.
|