Strengthening and formally verifying privacy in identity management systems

In a digital world, users’ Personally Identifiable Information (PII) is normally managed with a system called an Identity Management System (IMS). There are many types of IMSs. There are situations when two or more IMSs need to communicate with each other (such as when a service provider needs to obtain some identity information about a user from a trusted identity provider). There could be interoperability issues when communicating parties use different types of IMS. To facilitate interoperability between different IMSs, an Identity Meta System (IMetS) is normally used. An IMetS can, at least theoretically, join various types of IMSs to make them interoperable and give users the illusion that they are interacting with just one IMS. However, due to the complexity of an IMS, attempting to join various types of IMSs is a technically challenging task, let alone assessing how well an IMetS manages to integrate these IMSs. The first contribution of this thesis is the development of a generic IMS model called the Layered Identity Infrastructure Model (LIIM). Using this model, we develop a set of properties that an ideal IMetS should provide. This idealized form is then used as a benchmark to evaluate existing IMetSs. Different types of IMS provide varying levels of privacy protection support. Unfortunately, as observed by Jøsang et al (2007), there is insufficient privacy protection in many of the existing IMSs. In this thesis, we study and extend a type of privacy enhancing technology known as an Anonymous Credential System (ACS). In particular, we extend the ACS which is built on the cryptographic primitives proposed by Camenisch, Lysyanskaya, and Shoup. We call this system the Camenisch, Lysyanskaya, Shoup - Anonymous Credential System (CLS-ACS). The goal of CLS-ACS is to let users be as anonymous as possible. Unfortunately, CLS-ACS has problems, including (1) the concentration of power to a single entity - known as the Anonymity Revocation Manager (ARM) - who, if malicious, can trivially reveal a user’s PII (resulting in an illegal revocation of the user’s anonymity), and (2) poor performance due to the resource-intensive cryptographic operations required. The second and third contributions of this thesis are the proposal of two protocols that reduce the trust dependencies on the ARM during users’ anonymity revocation. Both protocols distribute trust from the ARM to a set of n referees (n > 1), resulting in a significant reduction of the probability of an anonymity revocation being performed illegally. The first protocol, called the User Centric Anonymity Revocation Protocol (UCARP), allows a user’s anonymity to be revoked in a user-centric manner (that is, the user is aware that his/her anonymity is about to be revoked). The second protocol, called the Anonymity Revocation Protocol with Re-encryption (ARPR), allows a user’s anonymity to be revoked by a service provider in an accountable manner (that is, there is a clear mechanism to determine which entity who can eventually learn - and possibly misuse - the identity of the user). The fourth contribution of this thesis is the proposal of a protocol called the Private Information Escrow bound to Multiple Conditions Protocol (PIEMCP). This protocol is designed to address the performance issue of CLS-ACS by applying the CLS-ACS in a federated single sign-on (FSSO) environment. Our analysis shows that PIEMCP can both reduce the amount of expensive modular exponentiation operations required and lower the risk of illegal revocation of users’ anonymity. Finally, the protocols proposed in this thesis are complex and need to be formally evaluated to ensure that their required security properties are satisfied. In this thesis, we use Coloured Petri nets (CPNs) and its corresponding state space analysis techniques. All of the protocols proposed in this thesis have been formally modeled and verified using these formal techniques. Therefore, the fifth contribution of this thesis is a demonstration of the applicability of CPN and its corresponding analysis techniques in modeling and verifying privacy enhancing protocols. To our knowledge, this is the first time that CPN has been comprehensively applied to model and verify privacy enhancing protocols. From our experience, we also propose several CPN modeling approaches, including complex cryptographic primitives (such as zero-knowledge proof protocol) modeling, attack parameterization, and others. The proposed approaches can be applied to other security protocols, not just privacy enhancing protocols.

Towards defining semantic foundations for purpose-based privacy policies

We define a semantic model for purpose, based on which purpose-based privacy policies can be meaningfully expressed and enforced in a business system. The model is based on the intuition that the purpose of an action is determined by its situation among other inter-related actions. Actions and their relationships can be modeled in the form of an action graph which is based on the business processes in a system. Accordingly, a modal logic and the corresponding model checking algorithm are developed for formal expression of purpose-based policies and verifying whether a particular system complies with them. It is also shown through various examples, how various typical purpose-based policies as well as some new policy types can be expressed and checked using our model.

Dryness : the aesthetic condition of landscape design in Australia

Despite having a band of greenness around the edge, Australia is fundamentally a dry country. Australian vegetation has developed a high range of mechanisms to cope with the dryness, but after 200 years of white settlement, Australians still have not really come to terms with the real dryness of their country, and still exploit European paradigms that attempted to transplant European aesthetic conditions, greenness, to the brown land of Australia. Australia is going through serious water shortages that are still and will continue with the Greenhouse effect, to become a major factor in the location and extent of urbanisation, and also Australia's carrying capacity. While such aesthetic concerns might seem ornamental, until the population changes its attitude to the real condition of the country, it will keep using water and operating unsustainably. The design of the public landscape, however, offers the opportunity to contribute to changing people's aesthetic perception of the country, which might in turn help to redirect their water use practices. This essay develops a language for discussion dryness based around the experiences of water. After having developed this sensibility it then discusses a range of different approaches that landscape design in Australia has used to try to develop geographically appropriate design languages, including the Bush Garden and the Mediterranean Garden. It then discusses four design projects, one from the 1970's, the other three from the last five years that demonstrate what such an aesthetic might look like.

Soundness of workflow nets with reset arcs

Petri nets are often used to model and analyze workflows. Many workflow languages have been mapped onto Petri nets in order to provide formal semantics or to verify correctness properties. Typically, the so-called Workflow nets are used to model and analyze workflows and variants of the classical soundness property are used as a correctness notion. Since many workflow languages have cancelation features, a mapping to workflow nets is not always possible. Therefore, it is interesting to consider workflow nets with reset arcs. Unfortunately, soundness is undecidable for workflow nets with reset arcs. In this paper, we provide a proof and insights into the theoretical limits of workflow verification.

Managing process model complexity via concrete syntax modifications

While Business Process Management (BPM) is an established discipline, the increased adoption of BPM technology in recent years has introduced new challenges. One challenge concerns dealing with the ever-growing complexity of business process models. Mechanisms for dealing with this complexity can be classified into two categories: 1) those that are solely concerned with the visual representation of the model and 2) those that change its inner structure. While significant attention is paid to the latter category in the BPM literature, this paper focuses on the former category. It presents a collection of patterns that generalize and conceptualize various existing mechanisms to change the visual representation of a process model. Next, it provides a detailed analysis of the degree of support for these patterns in a number of state-of-the-art languages and tools. This paper concludes with the results of a usability evaluation of the patterns conducted with BPM practitioners.

Why teaching about Asia matters in higher education

I commence this opinion piece with specific reference to the Gillard Government's decision to cut funding for the Australian Learning and Teaching Council (ALTC)in 2011. I then consider impact of this decision on quality teaching in higher education with specific reference to Studies of Asia. In particular, I reflect on the teaching of Asian languages and cultures in Australia since the 1970 Auchmuty report, and conclude that despite the efforts of policy makers, not much has really changed. In doing so, I emphasise the importance of quality teaching in higher education for inspiring students to challenge their cultural assumptions and to prompt them to develop new views of the world.

Regrounding critical literacy : representation, facts and reality

A discussion of the pivotal theoretical and practical issue in the teaching of critical literacies: the relationship between representation and material social, economic and ecosystemic reality. The argument here is that models of critical literacy are contingent upon a principled and grounded pursuit of material social, economic and ecological realities 'outside' of textual representation per se.

Soundness of workflow nets: classification, decidability, and analysis

Workflow nets, a particular class of Petri nets, have become one of the standard ways to model and analyze workflows. Typically, they are used as an abstraction of the workflow that is used to check the so-called soundness property. This property guarantees the absence of livelocks, deadlocks, and other anomalies that can be detected without domain knowledge. Several authors have proposed alternative notions of soundness and have suggested to use more expressive languages, e.g., models with cancellations or priorities. This paper provides an overview of the different notions of soundness and investigates these in the presence of different extensions of workflow nets.We will show that the eight soundness notions described in the literature are decidable for workflow nets. However, most extensions will make all of these notions undecidable. These new results show the theoretical limits of workflow verification. Moreover, we discuss some of the analysis approaches described in the literature.

Reduction rules for reset/inhibitor nets

Reset/inhibitor nets are Petri nets extended with reset arcs and inhibitor arcs. These extensions can be used to model cancellation and blocking. A reset arc allows a transition to remove all tokens from a certain place when the transition fires. An inhibitor arc can stop a transition from being enabled if the place contains one or more tokens. While reset/inhibitor nets increase the expressive power of Petri nets, they also result in increased complexity of analysis techniques. One way of speeding up Petri net analysis is to apply reduction rules. Unfortunately, many of the rules defined for classical Petri nets do not hold in the presence of reset and/or inhibitor arcs. Moreover, new rules can be added. This is the first paper systematically presenting a comprehensive set of reduction rules for reset/inhibitor nets. These rules are liveness and boundedness preserving and are able to dramatically reduce models and their state spaces. It can be observed that most of the modeling languages used in practice have features related to cancellation and blocking. Therefore, this work is highly relevant for all kinds of application areas where analysis is currently intractable.

Doorway to research : Issues in the development of an interactive website for international graduate students

This paper describes results of a study evaluating the content, functionality and design features of an innovative online website called the Doorway to Research (http://rsc.acid.net.au/Main.aspx) , which was developed to support international graduate students studying at universities in Australia. First, the key features of the website are described. Second, the result of a pilot study involving 12 students and faculty members who tested key aspects of the design, content and functionality of the website and provided written and oral feedback base on task-based questions and focus group discussions are explored. Finally, recommendations for future development are presented. Results of the study indicate general student satisfaction with the website and its design, content and functionality, with specific areas identified for further development.

Binang gurri: turning a deaf ear to indigenous hearing loss

Objective: This paper asks whether Indigenous health policies might be improved if governments listened to Indigenous voices, both Australian and those who drafted the Declaration on the Rights of Indigenous Peoples, 2007. Methods: A fundamental tenet of the Declaration, which Australia endorsed in 2009, is respect for Indigenous knowledge and voice. The author analyses legal, cultural and historical sources for evidence of this respect. The metaphorical and empirical framework of the analysis is the epidemic of otitis media among Indigenous children. Results: A survey of Indigenous advice about health clearly demonstrates that access to their land and respect for the diversity of Indigenous cultures should inform health policies. Despite, however, claiming to consult Indigenous peoples, policy-makers have not been listening. In many Indigenous languages not listening, or ‘bad ears’, has connotations of disrespect. Conclusions: By turning a deaf ear to Indigenous knowledge governments are undermining any respect Indigenous peoples may have for them and their policies. A new approach is needed. Implications: The Declaration on the Rights of Indigenous Peoples can provide federal, state and territory governments with benchmarks against which health policy can be developed and implemented. Authentic consultation could restore Indigenous confidence in government policies.

Interactive peer-based learning in a comparative case study : what do students gain?

As English increasingly becomes one of the most commonly spoken languages in the world today for a variety of economic, social and cultural reasons, education is impacted by globalisation, the internationalisation of universities and the diversity of learners in classrooms. The challenge for educators is to find more effective ways of teaching English language so that students are better able to create meaning and communicate in the target language as well as to transform knowledge and understanding into relevant skills for a rapidly changing world. This research focuses broadly on English language education underpinned by social constructivist principles informing communicative language teaching and in particular, interactive peer learning approaches. An intervention of interactive peer-based learning in two case study contexts of English as Foreign Language (EFL) undergraduates in a Turkish university and English as Second Language (ESL) undergraduates in an Australian university investigates what students gain from the intervention. Methodology utilising qualitative data gathered from student reflective logs, focus group interviews and researcher field notes emphasises student voice. The cross case comparative study indicates that interactive peer-based learning enhances a range of learning outcomes for both cohorts including engagement, communicative competence, diagnostic feedback as well as assisting development of inclusive social relationships, civic skills, confidence and self efficacy. The learning outcomes facilitate better adaptation to a new learning environment and culture. An iterative instructional matrix tool is a useful product of the research for first year university experiences, teacher training, raising awareness of diversity, building learning communities, and differentiating the curriculum. The study demonstrates that English language learners can experience positive impact through peer-based learning and thus holds an influential key for Australian universities and higher education.

SAP webflow made configurable: unifying workflow templates into a configurable model

To facilitate the implementation of workflows, enterprise and workflow system vendors typically provide workflow templates for their software. Each of these templates depicts a variant of how the software supports a certain business process, allowing the user to save the effort of creating models and links to system components from scratch by selecting and activating the appropriate template. A combination of the strengths from different templates is however only achievable by manually adapting the templates which is cumbersome. We therefore suggest in this paper to combine different workflow templates into a single configurable workflow template. Using the workflow modeling language of SAP’s WebFlow engine, we show how such a configurable workflow modeling language can be created by identifying the configurable elements in the original language. Requirements imposed on configurations inhibit invalid configurations. Based on a default configuration such configurable templates can be used as easy as the traditional templates. The suggested approach is also applicable to other workflow modeling languages

A Virtual Evaluation Track for Cross Language Link Discovery

The Wikipedia has become the most popular online source of encyclopedic information. The English Wikipedia collection, as well as some other languages collections, is extensively linked. However, as a multilingual collection the Wikipedia is only very weakly linked. There are few cross-language links or cross-dialect links (see, for example, Chinese dialects). In order to link the multilingual-Wikipedia as a single collection, automated cross language link discovery systems are needed – systems that identify anchor-texts in one language and targets in another. The evaluation of Link Discovery approaches within the English version of the Wikipedia has been examined in the INEX Link the-Wiki track since 2007, whilst both CLEF and NTCIR emphasized the investigation and the evaluation of cross-language information retrieval. In this position paper we propose a new virtual evaluation track: Cross Language Link Discovery (CLLD). The track will initially examine cross language linking of Wikipedia articles. This virtual track will not be tied to any one forum; instead we hope it can be connected to each of (at least): CLEF, NTCIR, and INEX as it will cover ground currently studied by each. The aim is to establish a virtual evaluation environment supporting continuous assessment and evaluation, and a forum for the exchange of research ideas. It will be free from the difficulties of scheduling and synchronizing groups of collaborating researchers and alleviate the necessity to travel across the globe in order to share knowledge. We aim to electronically publish peer-reviewed publications arising from CLLD in a similar fashion: online, with open access, and without fixed submission deadlines.