SECRYPT 2014 Abstracts

Full Papers Short Papers
Full Papers
Paper Nr: 17
Title:

CloudaSec: A Novel Public-key Based Framework to Handle Data Sharing Security in Clouds
Authors:

Nesrine Kaaniche, Maryline Laurent and Mohammed El Barbori
Abstract: Recent years have witnessed the trend of leveraging cloud-based services for large scale content storage, processing, and distribution. Data security and privacy are among top concerns for the public cloud environments. Towards these security challenges, we propose and implement CloudaSec framework for securely sharing outsourced data via the public cloud. CloudaSec ensures the confidentiality of content in the public cloud environments with flexible access control policies for subscribers and efficient revocation mechanisms. CloudaSec proposes several cryptographic tools for data owners, based on a novel content hash keying system, by leveraging the Elliptic Curve Cryptography (ECC). The separation of subscription-based key management and confidentiality-oriented asymmetric encryption policies uniquely enables flexible and scalable deployment of the solution as well as strong security for outsourced data in cloud servers. Through experimental evaluation, we demonstrate the efficiency and scalability of CloudaSec, build upon OpenStack Swift testbed.
Download
Paper Nr: 21
Title:

Keeping Intruders at Large - A Graph-theoretic Approach to Reducing the Probability of Successful Network Intrusions
Authors:

Paulo Shakarian, Damon Paulo, Massimiliano Albanese and Sushil Jajodia
Abstract: It is well known that not all intrusions can be prevented and additional lines of defense are needed to deal with intruders. However, most current approaches use honeynets relying on the assumption that simply attracting intruders into honeypots would thwart the attack. In this paper, we propose a different and more realistic approach, which aims at delaying intrusions, so as to control the probability that an intruder will reach a certain goal within a specified amount of time. Our method relies on analyzing a graphical representation of the computer network’s logical layout and an associated probabilistic model of the adversary’s behavior. We then artificially modify this representation by adding “distraction clusters” – collections of interconnected virtual machines – at key points of the network in order to increase complexity for the intruders and delay the intrusion. We study this problem formally, showing it to be NP-hard and then provide an approximation algo- rithm that exhibits several useful properties. Finally, we present experimental results obtained on a prototypal implementation of the proposed framework.
Download
Paper Nr: 24
Title:

Certificateless Non-Interactive Key Exchange Protocol without Pairings
Authors:

Yun Wei, Fushan Wei and Chuangui Ma
Abstract: Non-interactive key exchange (NIKE) allows two parties to establish a shared key without communications. In ID-based non-interactive key exchange (ID-NIKE) protocols, private key generator (PKG) knows user’s private key, so it can calculate the shared key between two participants, and most constructions of ID-NIKE need expensive pairing operation. To overcome these disadvantages, a security model of certificateless non-interactive key exchange (CL-NIKE) is proposed in this paper. And a scheme without pairings is also given. The proposed protocol is proved secure in the Random Oracle Model (ROM) based on the gap Diffie-Hellman (GDH) and computational Diffie-Hellman (CDH) problem. In the new protocol, key generation center (KGC) only knows user’s partial key and is not able to calculate the shared key. Moreover, the new protocol is more efficient than the existing ID-NIKE schemes because it is pairing-free.
Paper Nr: 29
Title:

Adaptive Oblivious Transfer with Hidden Access Policy Realizing Disjunction
Authors:

Vandana Guleria and Ratna Dutta
Abstract: We propose an efficient adaptive oblivious transfer protocol with hidden access policies. This scheme allows a receiver to anonymously recover a message from a database which is protected by hidden attribute based access policy if the receiver’s attribute set satisfies the associated access policy implicitly. The proposed scheme is secure in the presence of malicious adversary under the q-Strong Diffie-Hellman (SDH), q-Power Decisional Diffie-Hellman (PDDH) and Decision Bilinear Diffie-Hellman (DBDH) assumption in full-simulation security model. The scheme covers disjunction of attributes. The proposed protocol outperforms the existing similar schemes in terms of both communication and computation.
Download
Paper Nr: 35
Title:

A Secure Anonymous Proxy Multi-signature Scheme
Authors:

Vishal Saraswat and Rajeev Anand Sahu
Abstract: A proxy signature scheme enables a signer to delegate its signing rights to any other user, called the proxy signer, to produce a signature on its behalf. In a proxy multi-signature scheme, the proxy signer can produce one single signature on behalf of multiple original signers. We propose an efficient and provably secure threshold-anonymous identity-based proxy multi-signature (IBPMS) scheme which provides anonymity to the proxy signer while also providing a threshold mechanism to the original signers to expose the identity of the proxy signer in case of misuse. The proposed scheme is proved secure against adaptive chosen-message and adaptive chosen-ID attacks under the computational Diffie-Hellman assumption. We compare our scheme with the recently proposed anonymous proxy multi-signature scheme and other ID-based proxy multi-signature schemes, and show that our scheme requires significantly less operation time in the practical implementation and thus it is more efficient in computation than the existing schemes.
Download
Paper Nr: 52
Title:

Pairing-free Single Round Certificateless and Identity Based Authenticated Key Exchange Protocols
Authors:

Saikrishna Badrinarayanan and C. Pandu Rangan
Abstract: Designing efficient key agreement protocols is a fundamental cryptographic problem. In this paper, we first define a security model for key agreement in certificateless cryptography that is an extension of earlier models. We note that the existing pairing free protocols are not secure in our model. We design an efficient pairing-free, single round protocol that is secure in our model based on the hardness assumption of the Computational Diffie Hellman (CDH) problem. We also observe that previously existing pairing-free protocols were secure based on much stronger assumptions such as the hardness of the Gap Diffie Hellman problem. We use a restriction of our scheme to design an efficient pairing-free single round identity based key agreement protocol that is secure in the id-CK+ model based on the hardness assumption of the CDH problem. Additionally, both our schemes satisfy several other security properties such as forward secrecy, resistance to reflection attacks etc.
Download
Paper Nr: 56
Title:

Mobile Devices: A Phisher’s Paradise
Authors:

Nikos Virvilis, Nikolaos Tsalis, Alexios Mylonas and Dimitris Gritzalis
Abstract: Mobile devices - especially smartphones - have gained widespread adoption in recent years, due to the plethora of features they offer. The use of such devices for web browsing and accessing email services is also getting continuously more popular. The same holds true with other more sensitive online activities, such as online shopping, contactless payments, and web banking. However, the security mechanisms that are available on smartphones and protect their users from threats on the web are not yet mature, as well as their effectiveness is still questionable. As a result, smartphone users face increased risks when performing sensitive online activities with their devices, compared to desktop/laptop users. In this paper, we present an evaluation of the phishing protection mechanisms that are available with the popular web browsers of Android and iOS. Then, we compare the protection they offer against their desktop counterparts, revealing and analyzing the significant gap between the two.
Download
Paper Nr: 60
Title:

Dynamic Analysis of Usage Control Policies
Authors:

Yehia Elrakaiby and Jun Pang
Abstract: Usage control extends access control by enabling the specification of requirements that should be satisfied before, while and after access. To ensure that the deployment of usage control policies in target domains achieves the required security goals, policy verification and analysis tools are needed. In this paper, we present an approach for the dynamic analysis of usage control policies using formal descriptions of target domains and their usage control policies. Our approach provides usage control management explicit labeled transition system semantics and enables the automated verification of usage control policies using model checking.
Download
Paper Nr: 71
Title:

Formal Analysis of Electronic Exams
Authors:

Jannik Dreier, Rosario Giustolisi, Ali Kassem, Pascal Lafourcade, Gabriele Lenzini and Peter Y. A. Ryan
Abstract: Universities and other educational organizations are adopting computer and Internet-based assessment tools (herein called e-exams) to reach widespread audiences. While this makes examination tests more accessible, it exposes them to new threats. At present, there are very few strategies to check such systems for security, also there is a lack of formal security definitions in this domain. This paper fills this gap: in the formal framework of the applied pi-calculus, we define several fundamental authentication and privacy properties and establish the first theoretical framework for the security analysis of e-exam protocols. As proof of concept we analyze two of such protocols with ProVerif. The first “secure electronic exam system” proposed in the literature turns out to have several severe problems. The second protocol, called Remark!, is proved to satisfy all the security properties assuming access control on the bulletin board. We propose a simple protocol modification that removes the need of such assumption though guaranteeing all the security properties.
Download
Paper Nr: 72
Title:

Towards a Framework for Assessing the Feasibility of Side-channel Attacks in Virtualized Environments
Authors:

Tsvetoslava Vateva-Gurova, Jesus Luna, Giancarlo Pellegrino and Neeraj Suri
Abstract: Physically co-located virtual machines should be securely isolated from one another, as well as from the underlying layers in a virtualized environment. In particular the virtualized environment is supposed to guarantee the impossibility of an adversary to attack a virtual machine e.g., by exploiting a side-channel stemming from the usage of shared physical or software resources. However, this is often not the case and the lack of sufficient logical isolation is considered a key concern in virtualized environments. In the academic world this view has been reinforced during the last years by the demonstration of sophisticated side-channel attacks (SCAs). In this paper we argue that the feasibility of executing a SCA strongly depends on the actual context of the execution environment. To reflect on these observations, we propose a feasibility assessment framework for SCAs using cache based systems as an example scenario. As a proof of concept we show that the feasibility of cache-based side-channel attacks can be assessed following the proposed approach.
Download
Paper Nr: 74
Title:

FORCE - Fully Off-line secuRe CrEdits for Mobile Micro Payments
Authors:

Vanesa Daza, Roberto Di Pietro, Flavio Lombardi and Matteo Signorini
Abstract: Payment schemes based on mobile devices are expected to supersede traditional electronic payment approaches in the next few years. However, current solutions are limited in that protocols require at least one of the two parties to be on-line, i.e. connected either to a trusted third party or to a shared database. Indeed, in cases where customer and vendor are persistently or intermittently disconnected from the network, any on-line payment is not possible. This paper introduces FORCE, a novel mobile micro payment approach where all involved parties can be fully off-line. Our solution improves over state-of-the-art approaches in terms of payment flexibility and security. In fact, FORCE relies solely on local data to perform the requested operations. Present paper describes FORCE architecture, components and protocols. Further, a thorough analysis of its functional and security properties is provided showing its effectiveness and viability.
Download
Paper Nr: 76
Title:

Privacy Preserving Delegated Word Search in the Cloud
Authors:

Kaoutar Elkhiyaoui, Melek Önen and Refik Molva
Abstract: In this paper, we address the problem of privacy preserving delegated word search in the cloud. We consider a scenario where a data owner outsources its data to a cloud server and delegates the search capabilities to a set of third party users. In the face of semi-honest cloud servers, the data owner does not want to disclose any information about the outsourced data; yet it still wants to benefit from the highly parallel cloud environment. In addition, the data owner wants to ensure that delegating the search functionality to third parties does not allow these third parties to jeopardize the confidentiality of the outsourced data, neither does it prevent the data owner from efficiently revoking the access of these authorized parties. To these ends, we propose a word search protocol that builds upon techniques of keyed hash functions, oblivious pseudo-random functions and Cuckoo hashing to construct a searchable index for the outsourced data, %of distinct words in the encrypted outsourced data, and uses private information retrieval of short information to guarantee that word search queries do not reveal any information about the data to the cloud server. Moreover, we combine attribute-based encryption and oblivious pseudo-random functions to achieve an efficient revocation of authorized third parties. The proposed scheme is suitable for the cloud as it can be easily parallelized.
Download
Paper Nr: 79
Title:

Identifying Cryptographic Functionality in Android Applications
Authors:

Alexander Oprisnik, Daniel Hein and Peter Teufl
Abstract: Mobile devices in corporate IT infrastructures are frequently used to process security-critical data. Over the past few years powerful security features have been added to mobile platforms. However, for legal and organisational reasons it is difficult to pervasively enforce using these features in consumer applications or Bring-Your-Own-Device (BYOD) scenarios. Thus application developers need to integrate custom implementations of security features such as encryption in security-critical applications. Our manual analysis of container applications and password managers has shown that custom implementations of cryptographic functionality often suffer from critical mistakes. During manual analysis, finding the custom cryptographic code was especially time consuming. Therefore, we present the Semdroid framework for simplifying application analysis of Android applications. Here, we use Semdroid to apply machine-learning techniques for detecting non-standard symmetric and asymmetric cryptography implementations. The identified code fragments can be used as starting points for subsequent manual analysis. Thus manual analysis time is greatly reduced. The capabilities of Semdroid have been evaluated on 98 password-safe applications downloaded from Google Play. Our evaluation shows the applicability of Semdroid and its potential to significantly improve future application analysis processes.
Download
Short Papers
Paper Nr: 25
Title:

Robust Multispectral Palmprint Identification System by Jointly Using Contourlet Decomposition & Gabor Filter Response
Authors:

Abdallah Meraoumia, Salim Chitroub and Ahmed Bouridane
Abstract: In current society, reliable identification and verification of individuals are becoming more and more necessary tasks for many fields, not only in police environment, but also in civilian applications, such as access control or financial transactions. Biometric systems are used nowadays in these fields, offering greater convenience and several advantages over traditional security methods based on something that you know (password) or something that you have (keys). In this paper, we propose an efficient online personal identification system based on Multi-Spectral Palmprint (MSP) images using Contourlet Transform (CT) and Gabor Filter (GF) response. In this study, the spectrum image is characterized by the contourlet coefficients sub-bands. Then, we use the Hidden Markov Model (HMM) for modeling the observation vector. In addition, the same spectrum is filtered by the Gabor filter. The real and imaginary responses of the filtering image are used to create another observation vector. Subsequently, the two sub-systems are integrated in order to construct an efficient multi-modal identification system based on matching score level fusion. Our experimental results show the effectiveness and reliability of the proposed method, which brings both high identification and accuracy rate.
Download
Paper Nr: 28
Title:

Shellcode Detection in IPv6 Networks with HoneydV6
Authors:

Sven Schindler, Oliver Eggert, Bettina Schnor and Thomas Scheffler
Abstract: More and more networks and services are reachable via IPv6 and the interest for security monitoring of these IPv6 networks is increasing. Honeypots are valuable tools to monitor and analyse network attacks. HoneydV6 is a low-interaction honeypot which is well suited to deal with the large IPv6 address space, since it is capable of simulating a large number of virtual hosts on a single machine. This paper presents an extension for HoneydV6 which allows the detection, extraction and analyses of shellcode contained in IPv6 network attacks. The shellcode detection is based on the open source library libemu and combined with the online malware analysis tool Anubis. We compared the shellcode detection rate of HoneydV6 and Dionaea. While HoneydV6 is able to detect about 25 % of the malicious samples, the Dionaea honeypot detects only about 6 %.
Download
Paper Nr: 31
Title:

Signaling Attacks in Mobile Telephony
Authors:

Mihajlo Pavloski and Erol Gelenbe
Abstract: Mobile telephony based on UMTS uses finite-state control schemes for wireless channels and for signaling across the network. These schemes are used systematically in various phases of the communication and are vulnerable to attacks that can bring down the network through unjustified bandwidth allocation and excessive signaling across the control plane. In this paper we identify those system parameters which are critical to the success of such attacks, and propose changes that can limit the effect of the attack. The approach is based on establishing a mathematical model of a UMTS system that is undergoing attacks, and on showing how parameters can be optimally modified to minimise the effect of the attack as experienced by the mobile device and the network.
Download
Paper Nr: 32
Title:

Efficient Construction of Infinite Length Hash Chains with Perfect Forward Secrecy Using Two Independent Hash Functions
Authors:

Sebastian Bittl
Abstract: One-way hash chains have been used to secure many applications over the last three decades. To overcome the fixed length limitation of first generation designs, so-called infinite length hash chains have been introduced. Such designs typically employ methods of asynchronous cryptography or hash based message authentication codes. However, none of the proposed schemes offers perfect forward secrecy, keeping former outputs secret once the system got compromised. A novel algorithm for constructing infinite length hash chains with built-in support for perfect forward secrecy is presented in this work. Thereby, the scheme differs significantly from existing proposals by using a combination of two different hash functions. It avoids the computational complexity of public-key algorithms, utilises well studied standard hash functions and keeps the benefits of a hash chain without a length constraint.
Download
Paper Nr: 39
Title:

SMS Spam - A Holistic View
Authors:

Lamine Aouad, Alejandro Mosquera, Slawomir Grzonkowski and Dylan Morss
Abstract: Spam has been infesting our emails and Web experience for decades; distributing phishing scams, adult/dating scams, rogue security software, ransomware, money laundering and banking scams... the list goes on. Fortunately, in the last few years, user awareness has increased and email spam filters have become more effective, catching over 99% of spam. The downside is that spammers are constantly changing their techniques as well as looking for new target platforms and means of delivery, and as the world is going mobile so too are the spammers. Indeed, mobile messaging spam has become a real problem and is steadily increasing year-over-year. We have been analyzing SMS spam data from a large US carrier for over six months, and we have observed all these threats, and more, indiscriminately targeting large numbers of subscribers. In this paper, we touch on such questions as what is driving SMS spam, how do the spammers operate, what are their activity patterns and how have they evolved over time. We also discuss what types of challenges SMS spam has created in terms of filtering, as well as security.
Download
Paper Nr: 42
Title:

Constructing Empirical Tests of Randomness
Authors:

Marek Sýs, Petr Švenda, Martin Ukrop and Vashek Matyáš
Abstract: In this paper we introduce a general framework for automatic construction of empirical tests of randomness. Our new framework generalises and improves a previous approach (Švenda et al., 2013) and it also provides a clear statistical interpretation of its results. This new approach was tested on selected stream ciphers from the eSTREAM competition. Results show that our approach can lay foundations to randomness testing and it is comparable to the Statistical Test Suite developed by NIST. Additionally, the proposed approach is able to perform randomness analysis even when presented with sequences shorter by several orders of magnitude than required by the NIST suite. Although the Dieharder battery still provides a slightly better randomness analysis, our framework is able to detect non-randomness for stream ciphers with limited number of rounds (Hermes, Fubuki) where both above-mentioned batteries fail.
Download
Paper Nr: 49
Title:

Secure Video Player for Mobile Devices Integrating a Watermarking-based Tracing Mechanism
Authors:

Pablo Antón del Pino, Antoine Monsifrot, Charles Salmon-Legagneur and Gwenaël Doërr
Abstract: Content protection relies on several security mechanisms: (i) encryption to prevent access to the content during transport, (ii) trusted computation environment to prevent access during decoding, and we can also add (iii) forensic watermarking to deter content re-acquisition at rendering. With the advent of next generation video and the ever increasing popularity of embedded devices for content consumption, there is a need for new content protection solutions that rely less on hardware. In this context, we propose an architecture that combines the ARM TrustZone technology, an hypervised environment built on Genode and a bit stream watermarking algorithm that inserts serialization marks on the fly in an embedded device. As a result, an attacker cannot get access to video assets in clear form and not watermarked. Reported performances measurements indicate that the induced computational overhead is reasonable.
Download
Paper Nr: 64
Title:

On Reliability of Clock-skew-based Remote Computer Identification
Authors:

Libor Polčák and Barbora Franková
Abstract: Clocks have a small in-built error. As the error is unique, each clock can be identified. This paper explores remote computer identification based on the estimation of clock skew computed from network packets. The previous knowledge of the method is expanded in various ways: (1) we argue about the amount of data that is necessary to get accurate clock skew estimation, (2) the study of different time stamp sources unveils several irregularities that hinders the identification, and (3) the distribution of clock skew in real network makes the precise identification hard or even impossible.
Download
Paper Nr: 66
Title:

KDM-CCA Security of the Cramer-Shoup Cryptosystem, Revisited
Authors:

Jinyong Chang and Rui Xue
Abstract: An encryption scheme is key-dependent message chosen plaintext attack (KDM-CPA) secure means that it is secure even if an adversary obtains encryptions of messages that depend on the secret key. However, there are not many schemes that are KDM-CPA secure, let alone key-dependent message chosen ciphertext attack (KDM-CCA) secure. So far, only two general constructions, due to Camenisch, Chandran, and Shoup (Eurocrypt 2009), and Hofheinz (Eurocrypt 2013), are known to be KDM-CCA secure in the stand model. Another scheme, a concrete implementation, was recently proposed by Qin, Liu and Huang (ACISP 2013), where a KDM-CCA secure scheme was obtained from the classic Cramer-Shoup (CS) cryptosystem w.r.t. a new family of functions. In this paper, we revisit the KDM-CCA security of the CS-scheme and prove that, in two-user case, the CS-scheme achieves KDM-CCA security w.r.t. richer ensembles, which covers the result of Qin et al.. In addition, we present another proof about the result in (QLH13) by extending our approach used in two-user case to n-user case, which achieves a tighter reduction to the decisional Diffie-Hellman (DDH) assumption.
Download
Paper Nr: 67
Title:

A Multiple-server Efficient Reusable Proof of Data Possesion from Private Information Retrieval Techniques
Authors:

Juan Camilo Corena, Anirban Basu, Yuto Nakano, Shinsaku Kiyomoto and Yutaka Miyake
Abstract: A proof of Data Possession (PDP) allows a client to verify that a remote server is still in possession of a file entrusted to it. One way to design a PDP, is to compute a function depending on a secret and the file. Then, during the verification stage, the client reveals the secret input to the server who recomputes the function and sends the output back to the client. The client can then compare both values to determine if the server is still in possession of the file. The problem with this approach is that once the server knows the secret, it is not useful anymore. In this article, we present two PDP schemes inspired in Multiple-Server Private Information Retrieval (MSPIR) protocols. In a traditional MSPIR protocol, the goal is to retrieve a given block of the file from a group of servers storing identical copies of it, without telling the servers what block was retrieved. In contrast, our goal is to let servers evaluate a function using an input that is not revealed to them. We show that our constructions are secure, practical and that they can complement existing approaches in storage architectures using multiple cloud providers. The amount of transmitted information during the verification stage of the protocols is proportional to the square root of the length of the file.
Download
Paper Nr: 69
Title:

A Novel Pseudo Random Number Generator Based on L’Ecuyer’s Scheme
Authors:

Francesco Buccafurri and Gianluca Lax
Abstract: In this paper, we propose a new lightweight L’Ecuyer-based pseudo random number generator (PRNG). We show that our scheme, despite the very simple functions on which it relies on, is strongly secure in the sense that our number sequences pass the state-of-the-art randomness tests and, importantly, an accurate and deep security analysis shows that it is resistant to a number of attacks.
Download
Paper Nr: 78
Title:

Verifying Conformance of Security Implementation with Organizational Access Policies in Community Cloud - A Formal Approach
Authors:

Nirnay Ghosh, Triparna Mondal, Debangshu Chatterjee and Soumya K. Ghosh
Abstract: In a community cloud, infrastructure is shared among several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.). In such a computing model, the security responsibilities rest mostly with the third-party infrastructure provider. Security violations may occur if local access policies from different organizations are not implemented correctly. Therefore, one of the major concerns for a cloud provider is to formally verify whether security implementation conforms to the local access policies, and ensure that shared resources (hosted in the multi-tenant infrastructure) are accessed by only authorized users from various organizations. In this paper, we propose an automated verification framework to address this issue of policy verification. The framework consists of two models: policy and implementation. An algorithm has been developed to reduce the models into Boolean clauses, and is given as input to zchaff SAT solver for formal verification. Experimental results show the efficacy of proposed approach.
Paper Nr: 84
Title:

Randomized Addition of Sensitive Attributes for l-diversity
Authors:

Yuichi Sei and Akihiko Ohsuga
Abstract: When a data holder wants to share databases that contain personal attributes, individual privacy needs to be considered. Existing anonymization techniques, such as l-diversity, remove identifiers and generalize quasi-identifiers (QIDs) from the database to ensure that adversaries cannot specify each individual’s sensitive attributes. Usually, the database is anonymized based on one-size-fits-all measures. Therefore, it is possible that several QIDs that a data user focuses on are all generalized, and the anonymized database has no value for the user. Moreover, if a database does not satisfy the eligibility requirement, we cannot anonymize it by existing methods. In this paper, we propose a new technique for l-diversity, which keeps QIDs unchanged and randomizes sensitive attributes of each individual so that data users can analyze it based on QIDs they focus on and does not require the eligibility requirement. Through mathematical analysis and simulations, we will prove that our proposed method for l-diversity can result in a better tradeoff between privacy and utility of the anonymized database.
Download
Paper Nr: 86
Title:

Optimizing Elliptic Curve Scalar Multiplication with Near-Factorization
Authors:

Pratik Poddar, Achin Bansal and Bernard Menezes
Abstract: Elliptic curve scalar multiplication ( [k]P where k is an integer and P is a point on the elliptic curve) is widely used in encryption and signature generation. In this paper, we explore a factorization-based approach called Near-Factorization that can be used in conjunction with existing optimization techniques such as Window NAF (Non Adjacent Form). We present a performance model of Near-Factorization and validate model results with those from a simulation. We compare Near-Factorization with wNAF for a range of scalar sizes, window sizes, divisor lengths and Hamming weights of divisor. The use of Near-Factorization with wNAF results in a considerable reduction in the effective Hamming weight of the scalar and a reduction in overall computation cost for Koblitz curves.
Download
Paper Nr: 88
Title:

A Hybrid Approach for Content Based Image Authentication
Authors:

Jinse Shin and Christoph Ruland
Abstract: Perceptual image hashing has received an increased attention as one of the most important components for content based image authentication in recent years. Content based image authentication using perceptual image hashing is mainly classified into four different categories according to the feature extraction scheme. However, all the recently published literature that belongs to the individual category has its own strengths and weaknesses related to the feature extraction scheme. In this regard, this paper proposes a hybrid approach to improve the performance by combining two different categories: low-level image representation and coarse image representation. The proposed method employs a well-known local feature descriptor, the so-called Histogram of Oriented Gradients (HOG), as the feature extraction scheme in conjunction with Image Intensity Random Transformation (IIRT), Successive Mean Quantization Transform (SMQT), and bit-level permutation to construct a secure and robust hash value. To enhance the proposed method, a Key Derivation Function (KDF) and Error Correction Code (ECC) are applied to generate a stable subkey based on the coarse image representation. The derived subkey is utilized as a random seed in IIRT and HOG feature computation. Additionally, the experimental results are presented and compared with two existing algorithms in terms of robustness, discriminability, and security.
Download
Paper Nr: 90
Title:

Revisiting a Recent Resource-efficient Technique for Increasing the Throughput of Stream Ciphers
Authors:

Frederik Armknecht and Vasily Mikhalev
Abstract: At CT-RSA 2014, Armknecht and Mikhalev presented a new technique for increasing the throughput of stream ciphers that are based on Feedback Shift Registers (FSRs) which requires practically no additional memory. The authors provided concise sufficient conditions for the applicability of this technique and demonstrated its usefulness on the stream cipher Grain-128. However, as these conditions are quite involved, the authors raised as an open question if and to what extent this technique can be applied to other ciphers as well. In this work, we revisit this technique and examine its applicability to other stream ciphers. On the one hand we show on the example of Grain-128a that the technique can be successfully applied to other ciphers as well. On the other hand we list several stream ciphers where the technique is not applicable for different structural reasons.
Download
Paper Nr: 138
Title:

On the Security of Partially Masked Software Implementations
Authors:

Alessandro Barenghi and Gerardo Pelosi
Abstract: Providing sound countermeasures against passive side channel attacks has received large interest in open literature. The scheme proposed in [Ishai et al., 2003] secures a computation against a d-probing adversary splitting it into d+1 shares, albeit with a significant performance overhead (5x to 20x). We maintain that it is possible to apply such countermeasures only to a portion of the cipher implementation, retaining the same computational security, backing a widespread intuition present among practitioners. We provide the sketch of a computationally bound attacker model, adapted as an extension of the one in [Ishai et al., 2003], and detail the resistance metric employed to estimate the computational effort of such an attacker, under sensible assumptions on the characteristic of the device leakage (which is, to the current state of the art, still lacking a complete formalization).
Download
Paper Nr: 7
Title:

A Formal Model for Forensic Storage Media Preparation Tools
Authors:

Benjamin Aziz, Philippe Massonet and Christophe Ponsard
Abstract: This paper defines a model of a special type of digital forensics tools, known as digital media preparation forensic tools, using the formal refinement language Event-B. The complexity and criticality of many types of computer and Cyber crime nowadays combined with improper or incorrect use of digital forensic tools calls for the evidence produced by such tools to be able to meet the minimum admissibility standards the legal system requires, in general implying that it must be generated from reliable and robust tools. Despite the fact that some research and effort has been spent on the validation of digital media preparation forensic tools by means of testing (e.g. within NIST), the verification of such tools and the formal specification of their expected behaviour remains largely under-researched. The goal of this work is to provide a formal specification against which the implementations of such tools can be analysed and tested in the future.
Download
Paper Nr: 9
Title:

An Efficient Lightweight Security Algorithm for Random Linear Network Coding
Authors:

Hassan Noura, Steven Martin and Khaldoun Al Agha
Abstract: Recently, several encryption schemes have been presented to Random Linear Network Coding (RLNC). The recent proposed lightweight security system for Network Coding is based upon protecting the Global Encoding Vectors (GEV) and using other vector to ensure the encoding process of RLNC at intermediate nodes. However, the current lightweight security scheme, possess several practical challenges to be deployed in real application. Furthermore, achieving a high security level results on a high computational complexity and adds some communication overhead. In this paper, a new scheme is defined that supports some properties to overcome the drawbacks of the lightweight Security scheme, and can be used for RLNC real-time data exchange. First, the cryptographic primitive (AES in CTR mode) is replaced by another approach that is based on the utilization of a new flexible key-dependent invertible matrix (dynamic diffusion layer). Then, we show that this approach reduces the size of communication overhead of GEV from $2\times h$ to $h$ elements. In addition to that, we also demonstrate that besides the information confidentially, both the packet integrity and the source authentication are attained with minimum computational complexity and memory overhead. Indeed, simulation tests and results of this scheme yield to a conclusion that our new proposed scheme has sufficient security strength and good performance characteristics that permits to ensure an efficient and simple implementation. Thus, facilitate the integration of this system in many applications that treat security as a principal requirement.
Download
Paper Nr: 22
Title:

A Steganographic Protocol Based on Linear Error-Block Codes
Authors:

Rabiî Dariti and El Mamoun Souidi
Abstract: We present a steganographic protocol based on linear error-block codes. Recent works have showed that these codes allow to increase the number of information carrier bits within a given cover by exploiting multiple bit planes (not only LSB plane) from pixels which would not have a perceptible influence on the cover. We employ a parameter, called heterogeneity, to assess the ability of pixels to be modified without perturbing the cover. The quality of the modified cover is handled by tuning a vector of heterogeneity thresholds which determines the number of bit planes that we are allowed to use for each pixel in the cover.
Download
Paper Nr: 23
Title:

Enhanced Intrusion Detection System Based on Bat Algorithm-support Vector Machine
Authors:

Adriana-Cristina Enache and Valentin Sgârciu
Abstract: As new security intrusions arise so does the demand for viable intrusion detection systems. These solutions must deal with huge data volumes, high speed network traffics and countervail new and various types of security threats. In this paper we combine existing technologies to construct an Anomaly based Intrusion Detection System. Our approach improves the Support Vector Machine classifier by exploiting the advantages of a new swarm intelligence algorithm inspired by the environment of microbats (Bat Algorithm). The main contribution of our paper is the novel feature selection model based on Binary Bat Algorithm with Lévy flights. To test our model we use the NSL-KDD data set and empirically prove that Lévy flights can upgrade the exploration of standard Binary Bat Algorithm. Furthermore, our approach succeeds to enhance the default SVMclassifier and we obtain good performance measures in terms of accuracy (90.06%), attack detection rate (95.05%) and false alarm rate (4.4%) for unknown attacks.
Download
Paper Nr: 45
Title:

Hybrid-Style Personal Key Management in Ubiquitous Computing
Authors:

Byoungcheon Lee
Abstract: In ubiquitous computing environment it is common that a user owns and uses multiple computing devices, but managing cryptographic keys in those devices is a complicated matter. If certificate-based cryptography (PKI) is used such that each device has independent certificate, then user has to be involved in multiple certificate issuing processes with certification authorities (CA) and has to keep multiple private keys securely. If a single user certificate is copied and shared in multiple user devices, then a single exposure of private key among multiple devices will destroy the secrecy of every devices. Each device has to have import and export function of private key, which will be a major security weakness that attackers will focus on. In this paper we propose a user-controlled personal key management scheme using hybrid approach, in which certificate is used to authenticate a user and self-generated ID keys are used to authenticate user’s computing devices. In this scheme user operates a personal key management server (PKMS) which has the role of personal key generation center (KGC). It is equipped with user’s certified private key as a master key and is used to issue ID private keys to user’s computing devices. Users normally use multiple computing devices equipped with different ID keys and enjoy secure communication with others using ID-based cryptography. We show that the proposed hybrid-style personal key management scheme is efficient in many aspects and reduces user’s key management load drastically.
Download
Paper Nr: 46
Title:

Using the Juliet Test Suite to Compare Static Security Scanners
Authors:

Andreas Wagner and Johannes Sametinger
Abstract: Security issues arise permanently in different software products. Making software secure is a challenging endeavour. Static analysis of the source code can help eliminate various security bugs. The better a scanner is, the more bugs can be found and eliminated. The quality of security scanners can be determined by letting them scan code with known vulnerabilities. Thus, it is easy to see how much they have (not) found. We have used the Juliet Test Suite to test various scanners. This test suite contains test cases with a set of security bugs that should be found by security scanners. We have automated the process of scanning the test suite and of comparing the generated results. With one exception, we have only used freely available source code scanners. These scanners were not primarily targeted at security, yielding disappointing results at first sight. We will report on the findings, on the barriers for automatic scanning and comparing, as well as on the detailed results.
Download
Paper Nr: 51
Title:

On Privacy Protection in the Internet Surveillance Era
Authors:

Dijana Vukovic, Danilo Gligoroski and Zoran Djuric
Abstract: Snowden's whistleblower from the last year made people more aware of the fact that we are living in the Internet surveillance era. Privacy of Internet communication has been disrupted. In this paper, application for privacy protection in chat communication, named CryptoCloak, is presented. CryptoCloak provides privacy protection for chat communication. Encrypted communication is masked with dynamic cheap chat conversation. Communication made this way is not point of interest for mass surveillance spying engines. For implementation of the CryptoCloak, Facebook Messenger API is used. Diffie-Hellman key exchange is done in clandestine manner - instead of sending uniform sequence of numbers, sentences are sent. Current version provides encryption/decryption mechanism for the chat communication using strong symmetric algorithm AES in CBC mode. 256 bits of Diffie-Hellman exchanged key are used for AES-CBC.
Download
Paper Nr: 53
Title:

Framework for Securing Data in Cloud Storage Services
Authors:

Mai Dahshan and Sherif Elkassas
Abstract: Nowadays, users rely on cloud storage as it offers cheap and unlimited data storage that is available for use by multiple devices (e.g. smart phones, notebooks, etc.). Although these cloud storage services offer attractive features, many customers are not adopting them, since data stored in these services is under the control of service providers and this makes it more susceptible to security risks. Therefore, in this paper, we addressed the problem of ensuring data confidentiality against cloud and against accesses beyond authorized rights by designing a secure cloud storage system framework that simultaneously achieves data confidentiality and fine-grained access control on encrypted data. This framework is built on a trusted third party (TTP) service that can be employed either locally on users' machine or premises, or remotely on top of cloud storage services for ensuring data confidentiality. Furthermore, this service combines multi-authority ciphertext policy attribute-based encryption (MA-CP-ABE) and attribute-based Signature (ABS) for achieving many-read-many-write fine-grained data access control on storage services. Last but not least, we validate the effectiveness of our design by carrying out a security analysis.
Download
Paper Nr: 57
Title:

Partial Fingerprint Identification Through Correlation-Based Approach
Authors:

Omid Zanganeh, Nandita Bhattacharjee and Bala Srinivasan
Abstract: Partial fingerprints are likely to be fragmentary or low quality, which mandates the development of accurate fingerprint verification algorithms. Two fingerprints should be aligned properly, in order to measure the similarity between them. Moreover, the common fingerprint recognition methods (minutiae-based) only use the limited information that is available. This affects the reliability of the output of the fingerprint recognition system, especially when dealing with partial fingerprints. To overcome this drawback, in this research, a region-based fingerprint recognition method is proposed in which the fingerprints are compared in a pixel-wise manner by computing their correlation coefficient. Therefore, all the attributes of the fingerprint contribute in the matching decision. Such a technique is promising to accurately recognise a partial fingerprint as well as a full fingerprint compared to the minutiae-based fingerprint recognition methods which only concentrate on parts of the fingerprint. The proposed method is based on simple but effective metrics that has been defined to compute local similarities which is then combined into a global score and then used to make the match/non-match decision. Extensive experiments over FVC2002 data set has proven the superiority of our method compared to the other well-known techniques reported in literature.
Download
Paper Nr: 59
Title:

Framework Implementation Based on Grid of Smartcards to Authenticate Users and Virtual Machines
Authors:

Hassane Aissaoui-Mehrez, Pascal Urien and Guy Pujolle
Abstract: The Security for the Future Networks (SecFuNet) project proposes to integrate the secure microcontrollers in order to introduce, among its many services, authentication and authorization functions for Cloud and virtual environments. One of the main goals of SecFuNet is to develop a secure infrastructure for virtualized environments and Clouds in order to provide strong isolation among virtual infrastructures, and guarantee that one virtual machine (VM) should not interfere with others. The goal of this paper is to describe the implementation and the experimentation of the solution for identifying users and nodes in the SecFuNet architecture. In this implementation, we also employ low-cost smartcards. Only authorized users are allowed to create or instantiate virtual environments. Thus, users and hypervisors are equipped with secure elements, used to open TLS secure channels with strong mutual authentication.
Download
Paper Nr: 68
Title:

Modeling Requirements for Security-enhanced Design of Embedded Systems
Authors:

Alberto Ferrante, Igor Kaitovic and Jelena Milosevic
Abstract: Designing an embedded system is a complex process that involves working on both hardware and software. The first step in the design process is defining functional and non-functional requirements; among them, it is fundamental to also consider security. We propose an effective way for designers to specify security requirements starting from User Security Requirements. User Security Requirements are high-level requirements related to security attacks that the system should be able to withstand. We also provide a mechanism to automatically translate these User Requirements into System Security Requirements, that include a detailed description of security solutions. For expressing requirements we use Unified Modeling Language (UML); specifically, we create a UML profile to describe user requirements and we use model-to-model transformation to automatically generate system requirements. We show the effectiveness of the modeling scheme and of the translation mechanism by applying our methodology to a case study based on wearable devices for e-health monitoring.
Download
Paper Nr: 80
Title:

NFC Based Mobile Single Sign-On Solution as a Chrome Extension
Authors:

Ufuk Celikkan and Can Gelis
Abstract: We describe the design and implementation of Single Sign-On authentication solution that uses a Near Field Communication enabled mobile phone. Such a solution relieves the users from remembering multiple username and passwords when authenticating themselves to various services on the internet. Mobile phones are today’s ubiquitous computing devices, used for a wide variety of purposes including authentication, tracking, medical care, entertainment and electronic payment. The primary advantage of NFC technology is that since it uses short range communication, it inherently provides another level of security, and being contactless, it is easy to use. Our solution is seamlessly integrated into the Chrome browser via a browser extension that allows users easy authentication and management personal information on the phone. The Google Chrome extension is written in JavaScript; However, this code (JavaScript) when running in a browser, cannot access the system resources of the computer due to browser security restrictions. Therefore a program written as a Java applet is implemented to run in the user’s computer. This applet, injected into the current web page by the extension, provides access to NFC Reader and supplies the bridge between Java and JavaScript. The user does not need to enter any account information, because it is retrieved from the phone via NFC and automatically submitted to the web login page.
Download
Paper Nr: 81
Title:

Secure Virtual Machine Migration (SV2M) in Cloud Federation
Authors:

Muhammad Awais Shibli, Naveed Ahmad, Ayesha Kanwal and Abdul Ghafoor
Abstract: Virtual Machine (VM) migration is mainly used for providing high availability, hardware maintenance, workload balancing and fault takeover in Cloud environment. However, it is susceptible to active and passive security attacks during migration process, which makes IT industry hesitant to accept this feature in Cloud. Compromising the VM migration process may result in DOS attacks, loss of data integrity and confidentiality. To cater different attacks such as unauthorized access to images and injecting malicious code on VM disk images, Cloud Providers store images in encrypted form. Therefore, security of VM migration along encrypted disk images keys becomes necessary. Previously, research focus was on the performance of VM migration, leaving security aspects of migration process completely explored. This paper proposes a comprehensive solution for Secure VM Migration (SV2M) in Cloud environment, which ensures authorization, mutual authentication, confidentiality, replay protection, integrity and non-repudiation with minimal changes in existing infrastructure. We have extended the key manager of Cloud provider and introduced new features for management and storage of keys involved in our proposed SV2M solution. In addition to this, we have integrated the proposed solution with OpenStack, which is an open source Cloud platform used by large community for research in Cloud computing. We also evaluated the security of SV2M system using well known automatic protocol verification tool AVISPA
Download
Paper Nr: 91
Title:

Secure Protocol for Financial Transactions Using Smartphones - SPFT - Formally Proved by AVISPA
Authors:

Shizra Sultan, Abdul Ghafoor Abbasi, Awais Shibli and Ali Nasir
Abstract: Smartphones are overpowering the IT world by rising as a prerequisite for other technologies. Emerging technology paradigms such as Cloud computing, web data services, online banking and many others are revamping them as compatibility to smartphones. Banking is a vital and critical need in daily life. It involves routine financial transactions among sellers, buyers and third parties. Several payment protocols are designed for mobile platforms which involve hardware tokens, PIN, credit cards, ATMs etc. for secure transactions. Many of them are not properly verified and have hidden flaws .Numerous vulnerabilities have been found in existing solutions which raise a big question about the defense capability of smartphones to protect user’s data. In this paper we propose a secure payment protocol for smartphones without using any hardware token. It implicates bank as a transparent entity and users rely on a payment gateway to mark a successful transaction. Suggested protocol uses symmetric keys, Digital certificates X.509, and two-factor authentication to make a secure financial deal. To prove the secrecy and authentication properties of the protocol we have formally verified it by AVISPA.
Download
Paper Nr: 96
Title:

A Cryptographic Study of Tokenization Systems
Authors:

Sandra Díaz-Santiago, Lil Maria Rodriguez-Henriquez and Debrup Chakraborty
Abstract: Payments through cards have become very popular in today’s world. All businesses now have options to receive payments through this instrument, moreover most organizations store card information of its customers in some way to enable easy payments in future. Credit card data is a very sensitive information and its theft is a serious threat to any company. Any organization that stores such data needs to achieve payment card industry (PCI) compliance, which is an intricate process. Recently a new paradigm called “tokenization” has been proposed to solve the problem of storage of payment card information. In this paradigm instead of the real credit card data a token is stored. To our knowledge, a formal cryptographic study of this new paradigm has not yet been done. In this paper we formally define the syntax of a tokenization system, and several notions of security for such systems. Finally, we provide some constructions of tokenizers and analyze their security in the light of our definitions.
Download
Paper Nr: 98
Title:

Combined Algebraic and Truncated Differential Cryptanalysis on Reduced-round Simon
Authors:

Nicolas Courtois, Theodosis Mourouzis, Guangyan Song, Pouyan Sepehrdad and Petr Susil
Abstract: Recently, two families of ultra-lightweight block ciphers were proposed, SIMON and SPECK, which come in a variety of block and key sizes (Beaulieu et al., 2013). They are designed to offer excellent performance for hardware and software implementations (Beaulieu et al., 2013; Aysu et al., 2014). In this paper, we study the resistance of SIMON-64/128 with respect to algebraic attacks. Its round function has very low Multiplicative Complexity (MC) (Boyar et al., 2000; Boyar and Peralta, 2010) and very low non-linearity (Boyar et al., 2013; Courtois et al., 2011) since the only non-linear component is the bitwise multiplication operation. Such ciphers are expected to be very good candidates to be broken by algebraic attacks and combinations with truncated differentials (additional work by the same authors). We algebraically encode the cipher and then using guess-then-determine techniques, we try to solve the underlying system using either a SAT solver (Bard et al., 2007) or by ElimLin algorithm (Courtois et al., 2012b). We consider several settings where P-C pairs that satisfy certain properties are available, such as low Hamming distance or follow a strong truncated differential property (Knudsen, 1995). We manage to break faster than brute force up to 10(/44) rounds for most cases we have tried. Surprisingly, no key guessing is required if pairs which satisfy a strong truncated differential property are available. This reflects the power of combining truncated differentials with algebraic attacks in ciphers of low non-linearity and shows that such ciphers require a large number of rounds to be secure.
Download
Paper Nr: 114
Title:

Software and Hardware Certification Techniques in a Combined Certification Model
Authors:

Antonio Muñoz and Antonio Maña
Abstract: Certification has been proved as an essential mechanism for achieving different security properties in new systems. However, it has important advantages; among which we highlighted the increasing in users trust by means of attesting security properties, but it is important to consider that in most of cases the system that is subject of certification is considered to be monolithic, and this feature implies that existing certification schemes do not provide support for dynamic changes of components as required in Cloud Computing running systems. One issue that has special importance of current certification schemes is that these refer to a particular version of the product or system, which derives that changes in the system structure require a process of recertification. This paper presents a solution based on a combination of software certification and hardware-based certification techniques. As a key element in our model we make use of the Trusted Computing functionalities as secure element to provide mechanisms for the hardware certification part. Likewise, our main goal is bringing the gap existing between the software certification and the means for hardware certification, in order to provide a solution for the whole system certification using Trusted Computing technology.
Download
Paper Nr: 117
Title:

Experimental Study of Performance and Security Constraints on Wireless Key Distribution Using Random Phase of Multipath Radio Signal
Authors:

Amir I. Sulimov, Alexey D. Smolyakov, Arkadij V. Karpov and Oleg N. Sherstyukov
Abstract: The paper presents the results of experimental distribution of encryption keys based on random carrier phase of fading radio signal measured in a multipath environment. The random bits extraction scheme was proposed and tested in practice. The proposed scheme is universal and applicable to measurements digitizing of any observable random variable. Experimental study of spatial correlation of multipath signal phase in the case of transverse spatial diversity is carried out. Experimental estimation of the key generation rate and the probability of its passive interception at different distances between the legal user and potential eavesdropper are also performed. It is shown that the parameters of bit extraction procedure significantly affect on the performance and security of the key distribution process.
Download
Paper Nr: 118
Title:

Network-based Intrusion Prevention System Prototype with Multi-Detection - A Position Paper
Authors:

Daniel Kavan, Klára Škodová and Martin Klíma
Abstract: The ongoing need to protect key nodes of network infrastructure has been a pressing issue since the outburst of modern Internet threats. This paper presents ideas on building a novel network-based intrusion prevention system combining the advantages of different types of latest intrusion detection systems. Special attention is also given to means of traffic data acquisition as well as security policy decision and enforcement possibilities. With regard to recent trends in PaaS and SaaS, common deployment specific for private and public cloud platforms is considered.
Download
Paper Nr: 119
Title:

Could Bitcoin Transactions Be 100x Faster?
Authors:

Nicolas T. Courtois, Pinar Emirdag and Daniel A. Nagy
Abstract: Bitcoin is a crypto currency, a distributed peer-to-peer fi nancial system. Well actually it is an electronic system which manages the provisional ownership of a strictly fixed supply of abstract fungible units which really works as a distributed property register or a digital notary service. This is not so diff erent than managing the ownership of shares in traditional fi nancial markets. Modern financial institutions increasingly just do NOT trust each other, they build co-operative robust and decentralized and increasingly transparent, electronic systems which are and able to both serve the diverse objectives of participants (e.g. traders) and uphold certain security policies. Is Bitcoin actually so brilliant to be called the Internet of money as it is sometimes claimed? Not quite. Consider just the question of speed. Super low latency transactions are a norm in the fi nancial industry, and even ordinary people have access to super fast bank transfers and real-time credit card transactions. Bitcoin remains rather the horse carriage of money. In this paper we look at the question of fast transaction acceptance in bitcoin and other crypto currencies. We claim that bitcoin needs to change in order to be able to satisfy the most basic needs of modern users.
Download
Paper Nr: 121
Title:

Using Bitmaps for Executing Range Queries in Encrypted Databases
Authors:

Lil María Rodríguez-Henríquez and Debrup Chakraborty
Abstract: Privacy of data stored at un-trusted servers is an important problem of today. A solution to this problem can be achieved by encrypting the outsourced data, but simple encryption does not allow efficient query processing. In this paper we propose a novel scheme for encrypting relational databases so that range queries can be efficiently executed on the encrypted data. We formally define the syntax and security of the problem and specify a scheme called ESRQ1. ESRQ1 uses a deterministic encryption scheme along with bitmap indices to encrypt a relational database. We provide details of the functionality of ESRQ1 and prove its security in the specified model.
Download
Paper Nr: 122
Title:

Differential Fault Attacks against AES Tampering with the Instruction Flow
Authors:

Silvia Mella, Filippo Melzani and Andrea Visconti
Abstract: Most of the attacks against the Advanced Encryption Standard based on faults mainly aim at either altering the temporary value of the message or key during the computation. Few other attacks tamper the instruction flow in order to reduce the number of round iterations to one or two. In this work, we extend this idea and present fault attacks against the AES algorithm that exploit the misbehavior of the instruction flow during the last round. In particular, we consider faults that cause the algorithm to skip, repeat or corrupt one of the four AES round functions. In principle, these attacks are applicable against both software and hardware implementations, by targeting the execution of instructions or the control logic. As conclusion countermeasures against fault attacks must also cover the instruction flow and not only the processed data.
Download
Paper Nr: 125
Title:

Secure Key Distribution based on Meteor Burst Communications
Authors:

Amir Sulimov and Arkadij Karpov
Abstract: The paper discusses possibility of secure encryption keys distribution based on stochastic properties of meteor burst radio propagation. Unlike wireless key distribution, this method provides much greater channel length and key distribution distances, which is up to 2000 km. Another important advantage is an ability of meteor burst communications to operate in severe climate, under conditions of polar and other remote areas. The paper also considers various physical factors ensuring stochastic variations in characteristics of received radio signal, which are applicable for the secret key generation. The simulation results revealing the most important randomizing factors within meteor burst channel are presented.
Download
Paper Nr: 126
Title:

COGITO: Code Polymorphism to Secure Devices
Authors:

Damien Couroussé, Bruno Robisson, Jean-Louis Lanet, Thierno Barry, Hassan Noura, Philippe Jaillon and Philippe Lalevée
Abstract: In this paper, we advocate the use of code polymorphism as an efficient means to improve security at several levels in electronic devices. We analyse the threats that polymorphism could help thwart, and present the solution that we plan to demonstrate in the scope of a collaborative research project called COGITO. We expect our solution to be effective to improve security, to comply with the computing and memory constraints of embedded devices, and to be easily generalisable to a large set of embedded computing platforms.
Download
Paper Nr: 129
Title:

Using Abductive and Inductive Inference to Generate Policy Explanations
Authors:

Fabio Marfia
Abstract: Providing reliable explanations for the causes of an access response represents an important improvement of applications usability and effectiveness, in a context where users are permitted or denied access to resources. I present an approach composed by two different procedures, both relying on OWL-DL and SWRL Rules, in order to generate policy explanations. The first procedure makes use of OWL Explanation and abductive reasoning. The second uses an algorithm of Association Rule Learning to identifying attributes and states arising together with policy privileges, in an inductive way. The PosSecCo IT Policy language is used in the present paper for representing the policies, but the approach is general enough to be applied in other environments as well.
Download
Paper Nr: 130
Title:

Towards a Legislation Driven Framework for Access Control and Privacy Protection in Public Cloud
Authors:

Maherzia Belaazi, Hanen Boussi Rahmouni and Adel Bouhoula
Abstract: Cloud computing is an emerging IT paradigm proving cost reduction and flexibility benefits. However security and privacy are serious issues challenging its adoption and sustainability in both social and commercial areas. Public clouds, in particular, present a controversial which is brought up by the need to exchange critical and protected data (even sensitive) between heterogeneous domains that are governed by multiple legislation. Access control is one of the essential and traditional security arms of data protection. However, in the context of open and dynamic environments such as clouds, access control becomes more complicated. This is because the security policies, models and related mechanisms have to be defined across various security domains and enforced in an integrated manner as required. Thus, improving the current access control paradigms is crucial in order to ensure privacy compliance in open and heterogeneous environments. In this paper, we propose a framework that is driven by legislation and which aims to assure an access control that preserves privacy while dealing with personal data hosted in public clouds. In addition, the proposed framework deals with the problem of interoperability between heterogeneous policies governing the processing of personal data on a cloud environment. In this regards, the need for access control delegation is also presented and tackled.
Paper Nr: 131
Title:

Pseudorandom Number Generators with Balanced Gray Codes
Authors:

J.-F. Couchot, P.-C. Heam, C. Guyeux, Q. Wang and J. M. Bahi
Abstract: In this article, it is shown that a large class of truly chaotic Pseudorandom Number Generators can be constructed. The generators are based on iterating Boolean maps, which are computed using balanced Gray codes. The number of such Gray codes gives the size of the class. The construction of such generators is automatic for small number of bits, but remains an open problem when this number becomes large. A running example is used throughout the paper. Finally, first statistical experiments of these generators are presented, they show how efficient and promising the proposed approach seems.
Paper Nr: 133
Title:

Keeping an Eye on Your Security Through Assurance Indicators
Authors:

Moussa Ouedraogo, Chien-Ting Kuo, Simon Tjoa, David Preston, Eric Dubois, Paulo Simoes and Tiago Cruz
Abstract: Despite the incommensurable effort made from across computer sciences disciplines to provide more secure systems, compromising the security of a system has now become a very common and stark reality for organizations of all sizes and from a variety of sectors. The lax in the technology has often been cited as the salient cause of systems insecurity. In this paper we advocate the need for a Security Assurance (SA) system to be embedded within current IT systems. Such a system has the potential to address one facet of cyber insecurity, which is the exploit of lax within the deployed security and its underlining policy. We discuss the challenges associated to such an SA assessment and present the flavor of its evaluation and monitoring through an initial prototype. By providing indicators on the status of a security matter that is more and more devolved to the provider as it is the case in the cloud, the SA tool can be used as a means of fostering better security transparency between a cloud provider and client.
Download
Paper Nr: 137
Title:

QR Steganography - A Threat to New Generation Electronic Voting Systems
Authors:

Jordi Cucurull, Sandra Guasch, Alex Escala, Guillermo Navarro-Arribas and Víctor Acín
Abstract: Quick Response (QR) codes, used to store machine readable information, have become very common nowadays and have found many applications in different scenarios. One of such applications is electronic voting systems. Indeed, some electronic voting systems are starting to take advantage of these codes, e.g. to hold the ballots used to vote, or even as a proof of the voting process. Nevertheless, QR codes are susceptible to steganographic techniques to hide information. This steganographic capability enables a covert channel that in electronic voting systems can suppose an important threat. A misbehaving equipment (e.g. infected with malware) can introduce hidden information in the QR code with the aim of breaking voters’ privacy or enabling coercion and vote-selling. This paper shows a method for hiding data inside QR codes and an implementation of a QR writer/reader application with steganographic capabilities. The paper analyses different possible attacks to electronic voting systems that leverage the steganographic properties of the QR codes. Finally, it proposes some solutions to detect the mentioned attacks.
Download
Paper Nr: 141
Title:

RBAC with ABS - Implementation Practicalities for RBAC Integrity Policies
Authors:

Mikko Kiviharju
Abstract: Role-based access control (RBAC) is the de facto access control model used in current information systems. Cryptographic access control (CAC), on the other hand, is an implementation paradigm intended to enforce AC-policies cryptographically. CAC-methods are also attractive in cloud environments due to their distributed and offline nature of operation. Combining the capabilities of both RBAC and CAC fully seems elusive, though. This paper studies the feasibility of implementing RBAC with respect to write-permissions using a recent type of cryptographic schemes called attribute-based signatures (ABS), which fall under a concept called functional cryptography. We map the functionalities and elements of RBAC to ABS elements and show a sample XACML-based architecture, how signature generation and verification conforming to RBAC-type processes could be implemented.
Download