Back to Philip Fong's home page.
We are interested in the specification, design, implementation and analysis of novel access control models and policy languages that are motivated by the security and privacy needs of emerging application domains such as electronic health record systems, social computing, etc. A research focus is on Relationship-Based Access Control (ReBAC).
Pooya Mehregan and Philip W. L. Fong. Policy Negotiation for Co-owned Resources in Relationship-Based Access Control. In Proceedings of the 21st ACM Symposium on Access Control Models and Technologies (SACMAT'2016), pages 125-136, Shanghai, China, June 6-8, 2016.
Syed Zain Rizvi and Philip W. L. Fong. Interoperability of Relationship- and Role-Based Access Control. In Proceedings of the 6th ACM Conference on Data and Application Security and Privacy (CODASPY'2016), pages 231-242, New Orleans, LA, March 9-11, 2016.
Appointed to the NSERC Computer Science Evaluation Group on a three-year term.
Syed Zain Rizvi, Philip W. L. Fong, Jason Crampton, and James Sellwood. Relationship-Based Access Control for an Open-Source Medical Records System. In Proceedings of the 20th ACM Symposium on Access Control Models and Technologies (SACMAT'2015), pages 113-124, Vienna, Austria, June 1-3, 2015.
Mohammad Jafari, Reihaneh Safavi-Naini, Philip W. L. Fong, and Ken Barker. A Framework for Expressing and Enforcing Purpose-Based Privacy Policies. ACM Transactions on Information and System Security, 17(1), August 2014.
Ebrahim Tarameshloo and Philip W. L. Fong. Access Control Models for Geo-Social Computing Systems. In Proceedings of the 19th ACM Symposium on Access Control Models and Technologies (SACMAT'2014), pages 115-126, London, Ontario, Canada, June 25-27, 2014.
Ebrahim Tarameshloo, Philip W. L. Fong, and Payman Mohassel. On Protection in Federated Social Computing Systems. In Proceedings of the Fourth ACM Conference on Data and Application Security and Privacy (CODASPY'2014), pages 75-86, San Antonio, TX, USA, March 3-5, 2014.
Philip W. L. Fong, Pooya Mehregan, and Ram Krishnan. Relational Abstraction in Community-Based Secure Collaboration. In Proceedings of the 20th ACM Conference on Computer and Communications Security (CCS'2013), pages 585-598, Berlin, Germany, November 4-8, 2013. The companion technical report appears as Technical Report 2013-1045-12, Department of Computer Science, University of Calgary, Calgary, Alberta, Canada, November 2013.
Jayalakshmi Balasubramaniam and Philip W. L. Fong. A White-Box Policy Analysis and its Efficient Implementation. In Proceedings of the 18th ACM Symposium on Access Control Models and Technologies (SACMAT'2013), pages 149-160, Amsterdam, The Netherlands, June 12-14, 2013.
Arif Akram Khan and Philip W. L. Fong. Satisfiability and Feasibility in a Relationship-based Workflow Authorization Model. In Proceedings of the 17th European Symposium on Research in Computer Security (ESORICS'2012), volume 7459 of Lecture Notes in Computer Science, pages 109--126, Pisa, Italy, September 10-14, 2012.
Glenn Bruns, Philip W. L. Fong, Ida Siahaan, and Michael Huth. Relationship-Based Access Control: Its Expression and Enforcement Through Hybrid Logic. In Proceedings of the 2nd ACM Conference on Data and Application Security and Privacy (CODASPY'2012), San Antonio, TX, USA, February 7-9, 2012. A longer version appears as Technical Report 2011/12, Department of Computing, Imperial College, London, UK.
Philip W. L. Fong and Ida Siahaan. Relationship-Based Access Control Policies and Their Policy Languages. In Proceedings of the 16th ACM Symposium on Access Control Models and Technologies (SACMAT'11), pages 51-60, Innsbruck, Austria, June 15-17, 2011.
Philip W. L. Fong. Preventing Sybil Attacks by Privilege Attenuation: A Design Principle for Social Network Systems. In Proceedings of the 2011 IEEE Symposium on Security and Privacy (S&P'11), pages 263-278, Oakland, California, USA, May 22-25, 2011.
Philip W. L. Fong. Relationship-Based Access Control: Protection Model and Policy Language. In Proceedings of the First ACM Conference on Data and Application Security and Privacy (CODASPY'11), pages 191-202, San Antonio, Taxas, USA, February 21-23, 2011.
Mohammad Jafari, Philip W. L. Fong, Reihaneh Safavi-Naini, Ken Barker, and Nicholas Paul Sheppard. Towards Defining Semantic Foundations for Purpose-Based Privacy Policies. In Proceedings of the First ACM Conference on Data and Application Security and Privacy (CODASPY'11), pages 213-224, San Antonio, Taxas, USA, February 21-23, 2011.
Philip W. L. Fong, Mohd Anwar and Zhen Zhao. A Privacy Preservation Model for Facebook-Style Social Network Systems. In Proceedings of the 14th European Symposium on Research In Computer Security (ESORICS'09), volume 5789 of Lecture Notes in Computer Science, pages 303-320, Saint Malo, France, September 21-23, 2009.
We are interested in the security and privacy issues in the application layer and the middleware layer of the Internet of Things (IoT).
Web-based social computing applications such as online social networks, blogs, wikis and the like have emerged as popular platforms for decentralized information sharing as well as collaborative authoring. A first objective of this project is to better understand the protection models of existing social computing platforms, as well as formally articulating the security and privacy goals of such platforms. A second objective is the design and implementation of novel protection technologies to address the specific security and privacy challenges motivated by the peculiar architecture and usage of these platforms.
Seyed Hossein Ahmadinejad, Philip W. L. Fong, and Rei Safavi-Naini. Privacy and Utility of Inference Control Mechanisms for Social Computing Applications. In Proceedings of the 11th ACM Asia Conference on Computer and Communication Security (ASIACCS'2016), pages 829-840, Xi'an, China, May 30 - June 3, 2016.
Seyed Hossein Ahmadinejad and Philip W. L. Fong. Unintended Disclosure of Information: Inference Attacks by Third-Party Extensions to Social Network Systems. Computers and Security, 44:75-91, July 2014. Elsevier.
Pooya Mehregan and Philip W. L. Fong. Design Patterns for Multiple Stakeholders in Social Computing. In Proceedings of the 28th Annual IFIP WG 11.3 Working Conference on Data and Applications Security and Privacy (DBSec'2014), Vienna, Austria, July 14-16, 2014.
Ebrahim Tarameshloo and Philip W. L. Fong. Access Control Models for Geo-Social Computing Systems. In Proceedings of the 19th ACM Symposium on Access Control Models and Technologies (SACMAT'2014), pages 115-126, London, Ontario, Canada, June 25-27, 2014.
Ebrahim Tarameshloo, Philip W. L. Fong, and Payman Mohassel. On Protection in Federated Social Computing Systems. In Proceedings of the Fourth ACM Conference on Data and Application Security and Privacy (CODASPY'2014), pages 75-86, San Antonio, TX, USA, March 3-5, 2014.
Philip W. L. Fong, Pooya Mehregan, and Ram Krishnan. Relational Abstraction in Community-Based Secure Collaboration. In Proceedings of the 20th ACM Conference on Computer and Communications Security (CCS'2013), pages 585-598, Berlin, Germany, November 4-8, 2013. The companion technical report appears as Technical Report 2013-1045-12, Department of Computer Science, University of Calgary, Calgary, Alberta, Canada, November 2013.
Seyed Hossein Ahmadinejad and Philip W. L. Fong. On the Feasibility of Inference Attacks by Third-Party Extensions to Social Network Systems. In Proceedings of the 8th ACM Symposium on Information, Computer and Communications Security (ASIACCS'2013), pages 161-166, Hangzhou, China, May 7-10, 2013.
Mohd Anwar and Philip W. L. Fong. A Visualization Tool for Evaluating Access Control Policies in Facebook-style Social Network Systems. In Proceedings of the 27th ACM Symposium on Applied Computing (SAC'12), Security Track, Riva del Garda, Trento, Italy, March 26-30, 2012.
Philip W. L. Fong. Preventing Sybil Attacks by Privilege Attenuation: A Design Principle for Social Network Systems. In Proceedings of the 2011 IEEE Symposium on Security and Privacy (S&P'11), pages 263-278, Oakland, California, USA, May 22-25, 2011.
Seyed Hossein Ahmadinejad, Mohd Anwar, and Philip W. L. Fong. Inference Attacks by Third-Party Extensions to Social Network Systems. In Proceedings of the 3rd IEEE International Workshop on Security and Social Networking (SESOC'11) (published as part of Proceedings for the 2011 IEEE International Conference on Pervasive Computing and Communications Workshops - PERCOM Workshops), pages 282--287, Seattle, Washington, USA, March 21, 2011.
Mohd Anwar, Philip W. L. Fong, Xue-Dong Yang, and Howard Hamilton. Visualizing Privacy Implications of Access Control Policies in Social Network Systems. In Proceedings of the Fourth International Workshop on Data Privacy Management, Saint Malo, France, September 24, 2009.
Philip W. L. Fong, Mohd Anwar and Zhen Zhao. A Privacy Preservation Model for Facebook-Style Social Network Systems. In Proceedings of the 14th European Symposium on Research In Computer Security (ESORICS'09), volume 5789 of Lecture Notes in Computer Science, pages 303-320, Saint Malo, France, September 21-23, 2009.
We are interested in applying programming language technology to address the security challenges of complex software systems.
Cheng Xu and Philip W. L. Fong. The Specification and Compilation of Obligation Policies for Program Monitoring. In Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security (ASIACCS'2012), Seoul, South Korea, May 1-3, 2012. A longer version appears as Technical Report 2011-996-08, Department of Computer Science, University of Calgary, Calgary, Alberta, Canada, April 2011.
Philip W. L. Fong and Simon Orr. Isolating Untrusted Software Extensions by Custom Scoping Rules. Computer Languages, Systems and Structures, 36(3):268-287, October 2010. Elsevier.
Fei Yan and Philip W. L. Fong. Efficient IRM Enforcement of History-Based Access Control Policies. In Proceedings of the Fourth ACM Symposium on Information, Computer and Communication Security (ASIACCS'09), pages 35-46, Sydney, Australia, March 10-12, 2009.
Philip W. L. Fong. Discretionary Capability Confinement. International Journal of Information Security, 7(2):137-154, April 2008. Springer.
Philip W. L. Fong. Discretionary Capability Confinement. In Proceedings of the 11th European Symposium On Research In Computer Security (ESORICS'06), volume 4189 of Lecture Notes in Computer Science, pages 127-144, Hamburg, Germany, September 18-20, 2006. Springer.
Philip W. L. Fong and Simon Orr. A Module System for Isolating Untrusted Software Extensions. In Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC'06), pages 203-212, Miami Beach, Florida, USA, December 11-15, 2006.
Philip W. L. Fong. Access Control by Tracking Shallow Execution History. In Proceedings of the 2004 IEEE Symposium on Security and Privacy (S&P'04), pages 43-55, Berkeley, California, USA, May 9-12, 2004.
$Id: index.html,v 1.24 2016/07/02 00:48:04 pwlfong Exp $