Skip to main content
SHOW DETAILS
eye
Title
Date Archived
Creator
Arxiv.org
by Hamidreza Ghafghazi; Amr ElMougy; Hussein T. Mouftah; Carlisle Adams
texts

eye 7

favorite 0

comment 0

In a Public Safety (PS) situation, agents may require critical and personally identifiable information. Therefore, not only does context and location-aware information need to be available, but also the privacy of such information should be preserved. Existing solutions do not address such a problem in a PS environment. This paper proposes a framework in which anonymized Personal Information (PI) is accessible to authorized public safety agents under a PS circumstance. In particular, we propose...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.04493
Arxiv.org
by John Geddes; Mike Schliep; Nicholas Hopper
texts

eye 10

favorite 0

comment 0

Like many routing protocols, the Tor anonymity network has decentralized path selection, in clients locally and independently choose paths. As a result, network resources may be left idle, leaving the system in a suboptimal state. This is referred to as the price of anarchy, where agents acting in their own self interest can make poor decisions when viewed in a global context. In this paper we explore the cost of anarchy in Tor by examining the potential performance increases that can be gained...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.02385
Arxiv.org
by David Arroyo; Fernando Hernandez; Amalia B. Orúe
texts

eye 8

favorite 0

comment 0

The application of synchronization theory to build up new cryptosystems has been a hot topic during the last two decades. In this paper we analyze a recent proposal in this field. We pinpoint the main limitations of the software implementation of chaos-based systems designed on the grounds of synchronization theory. In addition, we show that the cryptosystem under evaluation possesses serious security problems that imply a clear reduction of the key space.
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.08475
Arxiv.org
by Jose Javier Gonzalez Ortiz; Kevin J. Compton
texts

eye 6

favorite 0

comment 0

This paper introduces an SPA power attack on the 8-bit implementation of the Twofish block cipher. The attack is able to unequivocally recover the secret key even under substantial amounts of error. An initial algorithm is described using exhaustive search on error free data. An error resistant algorithm is later described. It employs several threshold preprocessing stages followed by a combined approach of least mean squares and an optimized Hamming mask search. Further analysis of 32 and...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.07109
Arxiv.org
by Zheng Wang
texts

eye 16

favorite 0

comment 0

The threats of caching poisoning attacks largely stimulate the deployment of DNSSEC. Being a strong but demanding cryptographical defense, DNSSEC has its universal adoption predicted to go through a lengthy transition. Thus the DNSSEC practitioners call for a secure yet lightweight solution to speed up DNSSEC deployment while offering an acceptable DNSSEC-like defense. This paper proposes a new defense against cache poisoning attacks, still using but lightly using DNSSEC. In the solution, DNS...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.08459
Arxiv.org
by Muhammad Ikram; Hassan Jameel Asghar; Mohamed Ali Kaafar; Balachander Krishnamurthy; Anirban Mahanti
texts

eye 8

favorite 0

comment 0

Numerous tools have been developed to aggressively block the execution of popular JavaScript programs (JS) in Web browsers. Such blocking also affects functionality of webpages and impairs user experience. As a consequence, many privacy preserving tools (PP-Tools) that have been developed to limit online tracking, often executed via JS, may suffer from poor performance and limited uptake. A mechanism that can isolate JS necessary for proper functioning of the website from tracking JS would thus...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.06289
Arxiv.org
by Li Sun; Steven Versteeg; Serdar Boztas; Asha Rao
texts

eye 6

favorite 0

comment 0

Anomalous user behavior detection is the core component of many information security systems, such as intrusion detection, insider threat detection and authentication systems. Anomalous behavior will raise an alarm to the system administrator and can be further combined with other information to determine whether it constitutes an unauthorised or malicious use of a resource. This paper presents an anomalous user behaviour detection framework that applies an extended version of Isolation Forest...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.06676
Arxiv.org
texts

eye 6

favorite 0

comment 0

Steganography is the discipline that deals with concealing the existence of secret communications. Existing research already provided several fundamentals for defining steganography and presented a multitude of hiding methods and countermeasures for this research discipline. We identified that no work exists that discusses the process of applying steganography from an individual's perspective. This paper presents a phase model that explains pre-conditions of applying steganography as well as...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.06664
Arxiv.org
by John V. Monaco; Charles C. Tappert
texts

eye 5

favorite 0

comment 0

There are numerous opportunities for adversaries to observe user behavior remotely on the web. Additionally, keystroke biometric algorithms have advanced to the point where user identification and soft biometric trait recognition rates are commercially viable. This presents a privacy concern because masking spatial information, such as IP address, is not sufficient as users become more identifiable by their behavior. In this work, the well-known Chaum mix is generalized to a scenario in which...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.07612
Arxiv.org
by Sukriti Bhattacharya; Hector D. Menendez; Earl Barr; David Clark
texts

eye 5

favorite 0

comment 0

Malware creators have been getting their way for too long now. String-based similarity measures can leverage ground truth in a scalable way and can operate at a level of abstraction that is difficult to combat from the code level. We introduce ITect, a scalable approach to malware similarity detection based on information theory. ITect targets file entropy patterns in different ways to achieve 100% precision with 90% accuracy but it could target 100% recall instead. It outperforms VirusTotal...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.02404
Arxiv.org
by Benjamin Greschbach; Tobias Pulls; Laura M. Roberts; Philipp Winter; Nick Feamster
texts

eye 9

favorite 0

comment 0

Previous attacks that link the sender and receiver of traffic in the Tor network ("correlation attacks") have generally relied on analyzing traffic from TCP connections. The TCP connections of a typical client application, however, are often accompanied by DNS requests and responses. This additional traffic presents more opportunities for correlation attacks. This paper quantifies how DNS traffic can make Tor users more vulnerable to correlation attacks. We investigate how...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.08187
Arxiv.org
by Hadrien Barral; Houda Ferradi; Rémi Géraud; Georges-Axel Jaloyan; David Naccache
texts

eye 8

favorite 0

comment 0

We describe a methodology to automatically turn arbitrary ARMv8 programs into alphanumeric executable polymorphic shellcodes. Shellcodes generated in this way can evade detection and bypass filters, broadening the attack surface of ARM-powered devices such as smartphones.
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.03415
Arxiv.org
by Wouter Bokslag
texts

eye 8

favorite 1

comment 0

This paper will discuss the Logjam attack on TLS. The Logjam attack allows, under certain conditions, to defeat the security provided by TLS. This is done by manipulating server and client into using weak and deprecated export grade crypto, and subsequently breaking the Diffie-Hellman key exchange. We explore how the attack works conceptually and how exactly TLS is vulnerable to this attack. Also, the conditions under which the attack can be mounted are discussed, and an estimate of the impact...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.02396
Arxiv.org
by Uri Kanonov; Avishai Wool
texts

eye 10

favorite 0

comment 0

Bring Your Own Device (BYOD) is a growing trend among enterprises, aiming to improve workers' mobility and productivity via their smartphones. The threats and dangers posed by the smartphones to the enterprise are also ever-growing. Such dangers can be mitigated by running the enterprise software inside a "secure container" on the smartphone. In our work we present a systematic assessment of security critical areas in design and implementation of a secure container for Android using...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.08567
Arxiv.org
by Sam Fletcher; Md Zahidul Islam
texts

eye 75

favorite 0

comment 0

We propose a new differentially-private decision forest algorithm that minimizes both the number of queries required, and the sensitivity of those queries. To do so, we build an ensemble of random decision trees that avoids querying the private data except to find the majority class label in the leaf nodes. Rather than using a count query to return the class counts like the current state-of-the-art, we use the Exponential Mechanism to only output the class label itself. This drastically reduces...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.03572
Arxiv.org
texts

eye 7

favorite 0

comment 0

In this document we describe the design of a multi-party messaging encryption protocol "Strongvelope". We hope that it will prove useful to people interested in understanding the inner workings of this protocol as well as cryptography and security experts to review the underlying concepts and assumptions. In this design paper we are outlining the perspective of chat message protection through the Strongvelope module. This is different from the product (the Mega chat) and the transport...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.04593
Arxiv.org
by Moreno Ambrosin; Paolo Braca; Mauro Conti; Riccardo Lazzaretti
texts

eye 8

favorite 0

comment 0

The large spread of sensors and smart devices in urban infrastructures are motivating research in the area of Internet of Thing (IoT), to develop new services and improve citizens' quality of life. Sensors and smart devices generate large amount of measurement data from sensing the environment, which is used to enable services, such as control power consumption or traffic density. To deal with such a large amount of information, and provide accurate measurements, service providers can adopt...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.06694
Arxiv.org
by George Bissias; Brian Neil Levine; A. Pinar Ozisik; Gavin Andresen
texts

eye 19

favorite 0

comment 0

We present and validate a novel mathematical model of the blockchain mining process and use it to conduct an economic evaluation of the double-spend attack, which is fundamental to all blockchain systems. Our analysis focuses on the value of transactions that can be secured under a conventional double-spend attack, both with and without a concurrent eclipse attack. Our model quantifies the importance of several factors that determine the attack's success, including confirmation depth, attacker...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.07985
Arxiv.org
texts

eye 7

favorite 0

comment 0

We introduce a Semantic Identification Attack, in which an adversary uses semantic signals about the pages visited in one browsing session to identify other browsing sessions launched by the same user. This attack allows an adver- sary to determine if two browsing sessions originate from the same user regardless of any measures taken by the user to disguise their browser or network. We use the MSNBC Anonymous Browsing data set, which contains a large set of user visits (labeled by category) to...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.09417
Arxiv.org
by Peter Henderson; Muthucumaru Maheswaran
texts

eye 9

favorite 0

comment 0

Embedded systems permeate through nearly all aspects of modern society. From cars to refrigerators to nuclear refineries, securing these systems has never been more important. Intrusions, such as the Stuxnet malware which broke the centrifuges in Iran's Natanz refinery, can be catastrophic to not only the infected systems, but even to the wellbeing of the surrounding population. Modern day protection mechanisms for these embedded systems generally look only at protecting the network layer, and...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.00742
Arxiv.org
by Marcus Pendleton; Richard Garcia-Lebron; Shouhuai Xu
texts

eye 4

favorite 0

comment 0

The importance of security metrics can hardly be overstated. Despite the attention that has been paid by the academia, government and industry in the past decades, this important problem stubbornly remains open. In this survey, we present a survey of knowledge on security metrics. The survey is centered on a novel taxonomy, which classifies security metrics into four categories: metrics for measuring the system vulnerabilities, metrics for measuring the defenses, metrics for measuring the...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1601.05792
Arxiv.org
by Jeremy Maitin-Shepard; Mehdi Tibouchi; Diego Aranha
texts

eye 6

favorite 0

comment 0

A homomorphic, or incremental, multiset hash function, associates a hash value to arbitrary collections of objects (with possible repetitions) in such a way that the hash of the union of two collections is easy to compute from the hashes of the two collections themselves: it is simply their sum under a suitable group operation. In particular, hash values of large collections can be computed incrementally and/or in parallel. Homomorphic hashing is thus a very useful primitive with applications...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1601.06502
Arxiv.org
by Krzysztof Grining; Marek Klonowski; Piotr Syga
texts

eye 4

favorite 0

comment 0

During Financial Cryptography 2012 Chan et al. presented a novel privacy-protection fault-tolerant data aggregation protocol. Comparing to previous work, their scheme guaranteed provable privacy of individuals and could work even if some number of users refused to participate. In our paper we demonstrate that despite its merits, their method provides unacceptably low accuracy of aggregated data for a wide range of assumed parameters and cannot be used in majority of real-life systems. To show...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.04138
In this position paper, we address the problems of automated road congestion detection and alerting systems and their security properties. We review different theoretical adaptive road traffic control approaches, and three widely deployed adaptive traffic control systems (ATCSs), namely, SCATS, SCOOT and InSync. We then discuss some related research questions, and the corresponding possible approaches, as well as the adversary model and potential attack scenarios. Two theoretical concepts of...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.01010
Arxiv.org
by Aanjhan Ranganathan; Hildur Ólafsdóttir; Srdjan Capkun
texts

eye 12

favorite 0

comment 0

Global Positioning System (GPS) is used ubiquitously in a wide variety of applications ranging from navigation and tracking to modern smart grids and communication networks. However, it has been demonstrated that modern GPS receivers are vulnerable to signal spoofing attacks. For example, today it is possible to change the course of a ship or force a drone to land in an hostile area by simply spoofing GPS signals. Several countermeasures have been proposed in the past to detect GPS spoofing...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.05462
Arxiv.org
by Myungsun Kim
texts

eye 3

favorite 0

comment 0

Web searching is becoming an essential activity because it is often the most effective and convenient way of finding information. However, a Web search can be a threat to the privacy of the searcher because the queries may reveal sensitive information about the searcher. Private Web search (PWS) solutions allow users to find information on the Internet while preserving their privacy. Here, privacy means maintaining the confidentiality of the identity of the communicating users. According to...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1604.02782
Arxiv.org
by Joshua Joy; Minh Le; Mario Gerla
texts

eye 3

favorite 0

comment 0

Today, mobile data owners lack consent and control over the release and utilization of their location data. Third party applications continuously process and access location data without data owners granular control and without knowledge of how location data is being used. The proliferation of IoT devices will lead to larger scale abuses of trust. In this paper we present the first design and implementation of a privacy module built into the GPSD daemon. The GPSD daemon is a low-level GPS...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.09605
Arxiv.org
by Marco Rocchetto; Nils Ole Tippenhauer
texts

eye 3

favorite 0

comment 0

We propose extensions to the Dolev-Yao attacker model to make it suitable for arguments about security of Cyber-Physical Systems. The Dolev-Yao attacker model uses a set of rules to define potential actions by an attacker with respect to messages (i.e. information) exchanged between parties during a protocol execution. As the traditional Dolev-Yao model considers only information (exchanged over a channel controlled by the attacker), the model cannot directly be used to argue about the security...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1607.02562
Arxiv.org
by Younes Hatri; Ayoub Otmani; Kenza Guenda
texts

eye 4

favorite 0

comment 0

Authenticated Key Exchange (AKE) protocols represent an important cryptographic mechanism that enables several parties to communicate securely over an open network. Elashry, Mu and Susilo proposed in 2015 an Identity Based Authenticated Key Exchange (IBAKE) protocol where different parties establish secure communication by means of their public identities. The authors also introduced a new security notion for IBAKE protocols called resiliency, that is, if a shared secret between a group of...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.07299
Arxiv.org
by Fatemeh Shirazi; Milivoj Simeonovski; Muhammad Rizwan Asghar; Michael Backes; Claudia Diaz
texts

eye 6

favorite 0

comment 0

The Internet has undergone dramatic changes in the past 15 years, and now forms a global communication platform that billions of users rely on for their daily activities. While this transformation has brought tremendous benefits to society, it has also created new threats to online privacy, ranging from profiling of users for monetizing personal information to nearly omnipotent governmental surveillance. As a result, public interest in systems for anonymous communication has drastically...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.05538
Arxiv.org
by Arash Shaghaghi; Mohamed Ali; Kaafar; Sandra Scott-Hayward; Salil S. Kanhere; Sanjay Jha
texts

eye 3

favorite 0

comment 0

In this paper, we coin the term Policy Enforcement as a Service (PEPS), which enables the provision of innovative inter-layer and inter-domain Access Control. We leverage the architecture of Software-Defined-Network (SDN) to introduce a common network-level enforcement point, which is made available to a range of access control systems. With our PEPS model, it is possible to have a `defense in depth' protection model and drop unsuccessful access requests before engaging the data provider (e.g....
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.02526
Arxiv.org
by Birhanu Eshete; Rigel Gjomemo; Md Nahid Hossain; Sadegh Momeni; R. Sekar; Scott Stoller; V. N. Venkatakrishnan; Junao Wang
texts

eye 3

favorite 0

comment 0

This report presents attack analysis results of the first adversarial engagement event stream for the first engagement of the DARPA TC program conducted in October 2016. The analysis was performed by Stony Brook University and University of Illinois at Chicago. The findings in this report are obtained without prior knowledge of the attacks conducted.
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.06936
Arxiv.org
by Seunghwan Park; Dong Hoon Lee; Kwangsu Lee
texts

eye 4

favorite 0

comment 0

In identity-based encryption (IBE) systems, an efficient key delegation method to manage a large number of users and an efficient key revocation method to handle the dynamic credentials of users are needed. Revocable hierarchical IBE (RHIBE) can provide these two methods by organizing the identities of users as a hierarchy and broadcasting an update key for non-revoked users per each time period. To provide the key revocation functionality, previous RHIBE schemes use a tree-based revocation...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.07948
Arxiv.org
by Hongrui Wang; Tao Lu; Xiaodai Dong; Peixue Li; Michael Xie
texts

eye 5

favorite 0

comment 0

We propose a novel hierarchical online intrusion detection system (HOIDS) for supervisory control and data acquisition (SCADA) networks based on machine learning algorithms. By utilizing the server-client topology while keeping clients distributed for global protection, high detection rate is achieved with minimum network impact. We implement accurate models of normal-abnormal binary detection and multi-attack identification based on logistic regression and quasi-Newton optimization algorithm...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.09418
Arxiv.org
by Tobias Fiebig; Franziska Lichtblau; Florian Streibelt; Thorben Krueger; Pieter Lexis; Randy Bush; Anja Feldmann
texts

eye 3

favorite 0

comment 0

Today's Internet utilizes a multitude of different protocols. While some of these protocols were first implemented and used and later documented, other were first specified and then implemented. Regardless of how protocols came to be, their definitions can contain traps that lead to insecure implementations or deployments. A classical example is insufficiently strict authentication requirements in a protocol specification. The resulting Misconfigurations, i.e., not enabling strong...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.05531
Arxiv.org
by Johannes Schneider; Thomas Locher
texts

eye 39

favorite 0

comment 0

Protecting source code against reverse engineering and theft is an important problem. The goal is to carry out computations using confidential algorithms on an untrusted party while ensuring confidentiality of algorithms. This problem has been addressed for Boolean circuits known as `circuit privacy'. Circuits corresponding to real-world programs are impractical. Well-known obfuscation techniques are highly practicable, but provide only limited security, e.g., no piracy protection. In this...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1612.03345
Arxiv.org
by Jagmohan Chauhan; Benjamin Zi Hao Zhao; Hassan Jameel Asghar; Jonathan Chan; Mohamed Ali Kaafar
texts

eye 5

favorite 0

comment 0

We propose that by integrating behavioural biometric gestures---such as drawing figures on a touch screen---with challenge-response based cognitive authentication schemes, we can benefit from the properties of both. On the one hand, we can improve the usability of existing cognitive schemes by significantly reducing the number of challenge-response rounds by (partially) relying on the hardness of mimicking carefully designed behavioural biometric gestures. On the other hand, the observation...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.09044
Arxiv.org
by Aguessy François-Xavier; Bettan Olivier; Blanc Grégory; Conan Vania; Debar Hervé
texts

eye 6

favorite 0

comment 0

Because of the threat of advanced multi-step attacks, it is often difficult for security operators to completely cover all vulnerabilities when deploying remediations. Deploying sensors to monitor attacks exploiting residual vulnerabilities is not sufficient and new tools are needed to assess the risk associated to the security events produced by these sensors. Although attack graphs were proposed to represent known multi-step attacks occurring in an information system, they are not directly...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.09042
Arxiv.org
by Chris J Mitchell
texts

eye 4

favorite 0

comment 0

This paper reconsiders the security offered by 2-key triple DES, an encryption technique that remains widely used despite recently being de-standardised by NIST. A generalisation of the 1990 van Oorschot-Wiener attack is described, constituting the first advance in cryptanalysis of 2-key triple DES since 1990. We give further attack enhancements that together imply that the widely used estimate that 2-key triple DES provides 80 bits of security can no longer be regarded as conservative; the...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.06229
Arxiv.org
by Eleftherios Kokoris-Kogias; Philipp Jovanovic; Nicolas Gailly; Ismail Khoffi; Linus Gasser; Bryan Ford
texts

eye 5

favorite 0

comment 0

While showing great promise, Bitcoin requires users to wait tens of minutes for transactions to commit, and even then, offering only probabilistic guarantees. This paper introduces ByzCoin, a novel Byzantine consensus protocol that leverages scalable collective signing to commit Bitcoin transactions irreversibly within seconds. ByzCoin achieves Byzantine consensus while preserving Bitcoin's open membership by dynamically forming hash power-proportionate consensus groups that represent...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.06997
Arxiv.org
by Huan Feng; Kang G. Shin
texts

eye 8

favorite 0

comment 0

In Android, communications between apps and system services are supported by a transaction-based Inter-Process Communication (IPC) mechanism. Binder, as the cornerstone of this IPC mechanism, separates two communicating parties as client and server. As with any client-server model, the server should not make any assumption on the validity (sanity) of client-side transaction. To our surprise, we find this principle has frequently been overlooked in the implementation of Android system services....
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1604.06964
Arxiv.org
by Max Wolotsky; Mohammad Husain; Elisha Choe
texts

eye 4

favorite 0

comment 0

Current alphanumeric and biometric authentication systems cannot withstand situations where a user is coerced into releasing their authentication materials under hostile circumstances. Existing approaches of coercion resistant authentication systems (CRAS) propose authentication factors such as implicit learning tasks, which are non-transferable, but still have the drawback that an attacker can force the victim (causing stress) to perform the task in order to gain unauthorized access....
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.01072
Arxiv.org
by Oguzhan Ersoy; Kamer Kaya; Kerem Kaskaloglu
texts

eye 6

favorite 0

comment 0

A recent work of Harn and Fuyou presents the first multilevel (disjunctive) threshold secret sharing scheme based on the Chinese Remainder Theorem. In this work, we first show that the proposed method is not secure and also fails to work with a certain natural setting of the threshold values on compartments. We then propose a secure scheme that works for all threshold settings. In this scheme, we employ a refined version of Asmuth-Bloom secret sharing with a special and generic Asmuth-Bloom...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.07988
Arxiv.org
texts

eye 14

favorite 0

comment 0

The Long Term Evolution (LTE) is the latest mobile standard being implemented globally to provide connectivity and access to advanced services for personal mobile devices. Moreover, LTE networks are considered to be one of the main pillars for the deployment of Machine to Machine (M2M) communication systems and the spread of the Internet of Things (IoT). As an enabler for advanced communications services with a subscription count in the billions, security is of capital importance in LTE....
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1607.05171
Arxiv.org
by M. Tarek Ibn Ziad; Amr Alanwar; Moustafa Alzantot; Mani Srivastava
texts

eye 22

favorite 0

comment 0

Cloud computing services provide a scalable solution for the storage and processing of images and multimedia files. However, concerns about privacy risks prevent users from sharing their personal images with third-party services. In this paper, we describe the design and implementation of CryptoImg, a library of modular privacy preserving image processing operations over encrypted images. By using homomorphic encryption, CryptoImg allows the users to delegate their image processing operations...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.00881
Arxiv.org
by Michel Toulouse; Hai Le; Cao Vien Phung; Denis Hock
texts

eye 6

favorite 0

comment 0

Consensus algorithms provide strategies to solve problems in a distributed system with the added constraint that data can only be shared between adjacent computing nodes. We find these algorithms in applications for wireless and sensor networks, spectrum sensing for cognitive radio, even for some IoT services. However, consensus-based applications are not resilient to compromised nodes sending falsified data to their neighbors, i.e. they can be the target of Byzantine attacks. Several solutions...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.04227
Arxiv.org
by Dominik Leibenger; Christoph Sorge
texts

eye 6

favorite 0

comment 0

We present sec-cs, a hash-table-like data structure for file contents on untrusted storage that is both secure and storage-efficient. We achieve authenticity and confidentiality with zero storage overhead using deterministic authenticated encryption. State-of-the-art data deduplication approaches prevent redundant storage of shared parts of different contents irrespective of whether relationships between contents are known a priori or not. Instead of just adapting existing approaches, we...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.03368
Arxiv.org
by Alex Biryukov; Dmitry Khovratovich
texts

eye 30

favorite 0

comment 0

In this paper we explore several contexts where an adversary has an upper hand over the defender by using special hardware in an attack. These include password processing, hard-drive protection, cryptocurrency mining, resource sharing, code obfuscation, etc. We suggest memory-hard computing as a generic paradigm, where every task is amalgamated with a certain procedure requiring intensive access to RAM both in terms of size and (very importantly) bandwidth, so that transferring the computation...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.03588
Arxiv.org
by Mohamed Amine Ferrag; Leandros A. Maglaras; Helge Janicke; Jianmin Jiang
texts

eye 6

favorite 0

comment 0

In this paper, we present a comprehensive survey of authentication protocols for Internet of Things (IoT). Specifically, we select and in-detail examine more than forty authentication protocols developed for or applied in the context of the IoT under four environments, including: (1) Machine to machine communications (M2M), (2) Internet of Vehicles (IoV), (3) Internet of Energy (IoE), and (4) Internet of Sensors (IoS). We start by reviewing all survey articles published in the recent years that...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1612.07206
Arxiv.org
texts

eye 19

favorite 0

comment 0

Software Defined Networking (SDN), has introduced many advanced platforms for managing networks and adopting different security tools with them, but the cost of these platforms should be considered as well. In this paper, we present an extension of the existing approach to the optimal placement of virtual security appliances in a pre-defined network setting. The approach proposed by Bouet [1] only considered one security appliance, we extended his approach to several virtual security...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.08155
Arxiv.org
by Luka Malisa; Kari Kostiainen; Thomas Knell; David Sommer; Srdjan Capkun
texts

eye 12

favorite 0

comment 0

Many terminals are used in safety-critical operations in which humans, through terminal user interfaces, become a part of the system control loop (e.g., medical and industrial systems). These terminals are typically embedded, single-purpose devices with restricted functionality, sometimes air-gapped and increasingly hardened. We describe a new way of attacking such terminals in which an adversary has only temporary, non-invasive, physical access to the terminal. In this attack, the adversary...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1604.04723
Arxiv.org
by Sungho Jeon; Jeong-Han Yun; Seungoh Choi; Woo-Nyon Kim
texts

eye 9

favorite 0

comment 0

We present the first technique of passive fingerprinting for Supervisory Control And Data Acquisition (SCADA) networks without Deep Packet Inspection (DPI) and experience on real environment. Unlike existing work, our method does not rely on the functions of a specific product or DPI of the SCADA protocol. Our inference method, which is based on the intrinsic characteristics of SCADA, first identifies the network port used for the SCADA protocol, then consecutively infers the field devices and...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.07679
Arxiv.org
by Riccardo Spolaor; Laila Abudahi; Veelasha Moonsamy; Mauro Conti; Radha Poovendran
texts

eye 10

favorite 0

comment 0

More and more people are regularly using mobile and battery-powered handsets, such as smartphones and tablets. At the same time, thanks to the technological innovation and to the high user demands, those devices are integrating extensive functionalities and developers are writing battery-draining apps, which results in a surge of energy consumption of these devices. This scenario leads many people to often look for opportunities to charge their devices at public charging stations: the presence...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.02750
Arxiv.org
by David J. Wu; Ankur Taly; Asim Shankar; Dan Boneh
texts

eye 6

favorite 0

comment 0

Automatic service discovery is essential to realizing the full potential of the Internet of Things (IoT). While discovery protocols like Multicast DNS, Apple AirDrop, and Bluetooth Low Energy have gained widespread adoption across both IoT and mobile devices, most of these protocols do not offer any form of privacy control for the service, and often leak sensitive information such as service type, device hostname, device owner's identity, and more in the clear. To address the need for better...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1604.06959
Arxiv.org
by Lu Zhang; Luis Vega; Michael Taylor
texts

eye 6

favorite 0

comment 0

Power side-channel attacks are a very effective cryptanalysis technique that can infer secret keys of security ICs by monitoring the power consumption. Since the emergence of practical attacks in the late 90s, they have been a major threat to many cryptographic-equipped devices including smart cards, encrypted FPGA designs, and mobile phones. Designers and manufacturers of cryptographic devices have in response developed various countermeasures for protection. Attacking methods have also...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.00681
Arxiv.org
by Maryam Mehrnezhad; Ehsan Toreini; Siamak F. Shahandashti; Feng Hao
texts

eye 11

favorite 0

comment 0

In this paper, we present the actual risks of stealing user PINs by using mobile sensors versus the perceived risks by users. First, we propose PINlogger.js which is a JavaScript-based side channel attack revealing user PINs on an Android mobile phone. In this attack, once the user visits a website controlled by an attacker, the JavaScript code embedded in the web page starts listening to the motion and orientation sensor streams without needing any permission from the user. By analysing these...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.05549
Arxiv.org
by Nicolas Papernot; Patrick McDaniel
texts

eye 4

favorite 0

comment 0

We report experimental results indicating that defensive distillation successfully mitigates adversarial samples crafted using the fast gradient sign method, in addition to those crafted using the Jacobian-based iterative attack on which the defense mechanism was originally evaluated.
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1607.05113
Arxiv.org
by Yonatan Sompolinsky; Aviv Zohar
texts

eye 5

favorite 0

comment 0

We revisit the fundamental question of Bitcoin's security against double spending attacks. While previous work has bounded the probability that a transaction is reversed, we show that no such guarantee can be effectively given if the attacker can choose when to launch the attack. Other approaches that bound the cost of an attack have erred in considering only limited attack scenarios, and in fact it is easy to show that attacks may not cost the attacker at all. We therefore provide a different...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.09193
Arxiv.org
texts

eye 4

favorite 0

comment 0

In the age of cloud computing, cloud users with a limited amount of storage can outsource their data to remote servers. The cloud servers, in lieu of monetary benefits, offer retrievability of their clients' data at any point of time. Secure cloud storage protocols ensure the integrity of the outsourced data that can be dynamic (or static) in nature depending on whether the client can (or cannot) update the uploaded data as needed. In this work, we explore the possibility of constructing a...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1612.08029
Arxiv.org
by Jeremiah Blocki; Anirudh Sridhar
texts

eye 30

favorite 0

comment 0

Offline attacks on passwords are increasingly commonplace and dangerous. An offline adversary is limited only by the amount of computational resources he or she is willing to invest to crack a user's password. The danger is compounded by the existence of authentication servers who fail to adopt proper password storage practices like key-stretching. Password managers can help mitigate these risks by adopting key stretching procedures like hash iteration or memory hard functions to derive site...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.00913
Arxiv.org
by Jeffrey Spaulding; Shambhu Upadhyaya; Aziz Mohaisen
texts

eye 7

favorite 0

comment 0

With more than 294 million registered domain names as of late 2015, the domain name ecosystem has evolved to become a cornerstone for the operation of the Internet. Domain names today serve everyone, from individuals for their online presence to big brands for their business operations. Such ecosystem that facilitated legitimate business and personal uses has also fostered "creative" cases of misuse, including phishing, spam, hit and traffic stealing, online scams, among others. As a...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.02767
Arxiv.org
by Syed Taha Ali; Judy Murray
texts

eye 34

favorite 0

comment 0

Advances in E2E verifiable voting have the potential to fundamentally restore trust in elections and democratic processes in society. In this chapter, we provide a comprehensive introduction to the field. We trace the evolution of privacy and verifiability properties in the research literature and describe the operations of current state-of-the-art E2E voting systems. We also discuss outstanding challenges to the deployment of E2E voting systems, including technical, legal, and usability...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.08554
Arxiv.org
by Thomas Shortell; Ali Shokoufandeh
texts

eye 8

favorite 0

comment 0

Secure signal processing is becoming a de facto model for preserving privacy. We propose a model based on the Fully Homomorphic Encryption (FHE) technique to mitigate security breaches. Our framework provides a method to perform a Fast Fourier Transform (FFT) on a user-specified signal. Using encryption of individual binary values and FHE operations over addition and multiplication, we enable a user to perform the FFT in a fixed point fractional representation in binary. Our approach bounds the...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.08769
Arxiv.org
by Der-Yeuan Yu; Aanjhan Ranganathan; Ramya Jayaram Masti; Claudio Soriente; Srdjan Capkun
texts

eye 4

favorite 0

comment 0

The Location Service (LCS) proposed by the telecommunication industry is an architecture that allows the location of mobile devices to be accessed in various applications. We explore the use of LCS in location-enhanced server authentication, which traditionally relies on certificates. Given recent incidents involving certificate authorities, various techniques to strengthen server authentication were proposed. They focus on improving the certificate validation process, such as pinning,...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.04563
Arxiv.org
by John V. Monaco
texts

eye 4

favorite 0

comment 0

The Keystroke Biometrics Ongoing Competition (KBOC) presented an anomaly detection challenge with a public keystroke dataset containing a large number of subjects and real-world aspects. Over 300 subjects typed case-insensitive repetitions of their first and last name, and as a result, keystroke sequences could vary in length and order depending on the usage of modifier keys. To deal with this, a keystroke alignment preprocessing algorithm was developed to establish a semantic correspondence...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.09075
Arxiv.org
by Duggirala Meher Krishna; Duggirala Ravi
texts

eye 11

favorite 0

comment 0

In this paper, algorithms for multivariate public key cryptography and digital signature are described. Plain messages and encrypted messages are arrays, consisting of elements from a fixed finite ring or field. The encryption and decryption algorithms are based on multivariate mappings. The security of the private key depends on the difficulty of solving a system of parametric simultaneous multivariate equations involving polynomial or exponential mappings. The method is a general purpose...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.06472
In this short note we argue that the state-of-art inverted index based public key searchable encryption scheme proposed by Wang et al may not be completely correct by giving a counterexample.
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.06753
Arxiv.org
texts

eye 7

favorite 0

comment 0

Android is the most widely used smartphone OS with 82.8% market share in 2015. It is therefore the most widely targeted system by malware authors. Researchers rely on dynamic analysis to extract malware behaviors and often use emulators to do so. However, using emulators lead to new issues. Malware may detect emulation and as a result it does not execute the payload to prevent the analysis. Dealing with virtual device evasion is a never-ending war and comes with a non-negligible computation...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.04718
In 2004, Muzereau et al. showed how to use a reduction algorithm of the discrete logarithm problem to Diffie-Hellman problem in order to estimate lower bound on Diffie-Hellman problem on elliptic curves. They presented their estimates for various elliptic curves that are used in practical applications. In this paper, we show that a much tighter lower bound for Diffie-Hellman problem on those curves can be achieved, if one uses the multiplicative group of a finite field as an auxiliary group....
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.01354
Arxiv.org
by Arthur Blot; Masaki Yamamoto; Tachio Terauchi
texts

eye 4

favorite 0

comment 0

A promising approach to defend against side channel attacks is to build programs that are leakage resilient, in a formal sense. One such formal notion of leakage resilience is the n-threshold-probing model proposed in the seminal work by Ishai et al. In a recent work, Eldib and Wang have proposed a method for automatically synthesizing programs that are leakage resilient according to this model, for the case n=1. In this paper, we show that the n-threshold-probing model of leakage resilience...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.05603
Arxiv.org
texts

eye 3

favorite 0

comment 0

Cryptographic protocols aim at securing communications over insecure networks such as the Internet, where dishonest users may listen to communications and interfere with them. A secure communication has a different meaning depending on the underlying application. It ranges from the confidentiality of a data to e.g. verifiability in electronic voting systems. Another example of a security notion is privacy. Formal symbolic models have proved their usefulness for analysing the security of...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.08279
Arxiv.org
texts

eye 3

favorite 0

comment 0

Understanding the severity of vulnerabilities within cloud services is particularly important for today service administrators.Although many systems, e.g., CVSS, have been built to evaluate and score the severity of vulnerabilities for administrators, the scoring schemes employed by these systems fail to take into account the contextual information of specific services having these vulnerabilities, such as what roles they play in a particular service. Such a deficiency makes resulting scores...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.07383
Arxiv.org
texts

eye 4

favorite 0

comment 0

This paper proposes a novel, non-linear collusion attack on digital fingerprinting systems. The attack is proposed for fingerprinting systems with finite alphabet but can be extended to continuous alphabet. We analyze the error probability of the attack for some classes of proposed random and deterministic schemes and obtain a bound on the number of colluders necessary to correctly estimate the host signal. That is, it requires fewer number of colluders to defeat the fingerprinting scheme. Our...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1604.08071
Arxiv.org
by Jing Yang Koh; Ido Nevat; Derek Leong; Wai-Choong Wong
texts

eye 5

favorite 0

comment 0

We develop a new location spoofing detection algorithm for geo-spatial tagging and location-based services in the Internet of Things (IoT), called Enhanced Location Spoofing Detection using Audibility (ELSA) which can be implemented at the backend server without modifying existing legacy IoT systems. ELSA is based on a statistical decision theory framework and uses two-way time-of-arrival (TW-TOA) information between the user's device and the anchors. In addition to the TW-TOA information, ELSA...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.05335
Arxiv.org
by Minglong Qi; Shengwu Xiong; Jinbgling Yuan; Wenbi Rao; Luo Zhong
texts

eye 3

favorite 0

comment 0

Pseudorandom sequences with optimal three-level autocorrelation have important applications in CDMA communication systems. Constructing the sequences with three-level autocorrelation is equivalent to finding cyclic almost difference sets as their supports. In a paper of Ding, Helleseth, and Martinsen, the authors developed a new method known as the Ding-Helleseth-Martinsens Constructions in literature to construct the almost difference set using product set between GF(2) and union sets of...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.06007
Arxiv.org
texts

eye 4

favorite 0

comment 0

A marketplace is defined where the private data of suppliers (e.g., prosumers) are protected, so that neither their identity nor their level of stock is made known to end customers, while they can sell their products at a reduced price. A broker acts as an intermediary, which takes care of providing the items missing to meet the customers' demand and allows end customers to take advantages of reduced prices through the subscription of option contracts. Formulas are provided for the option price...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.00182
Arxiv.org
by Min Lyu; Dong Su; Ninghui Li
texts

eye 4

favorite 0

comment 0

The Sparse Vector Technique (SVT) is a fundamental technique for satisfying differential privacy and has the unique quality that one can output some query answers without apparently paying any privacy cost. SVT has been used in both the interactive setting, where one tries to answer a sequence of queries that are not known ahead of the time, and in the non-interactive setting, where all queries are known. Because of the potential savings on privacy budget, many variants for SVT have been...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.01699
Arxiv.org
texts

eye 3

favorite 0

comment 0

Due to non-experts also developing security relevant applications it is necessary to support them too. Some improvements in the current research may not reach or impact these developers. Nonetheless these developers use security libraries. There are findings that even their usage is not easily possible and applications are left vulnerable to supposedly treated threats. So it is important to improve the usability of the security libraries. This is itself is not straightforward because of a...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.07086
Arxiv.org
by Nils Ulltveit-Moe; Henrik Nergaard; László Erdödi; Terje Gjøsæter; Erland Kolstad; Pål Berg
texts

eye 11

favorite 0

comment 0

This paper investigates how secure information sharing with external vendors can be achieved in an Industrial Internet of Things (IIoT). It also identifies necessary security requirements for secure information sharing based on identified security challenges stated by the industry. The paper then proposes a roadmap for improving security in IIoT which investigates both short-term and long-term solutions for protecting IIoT devices. The short-term solution is mainly based on integrating existing...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1601.04301
Arxiv.org
by S. Matthew English; Fabrizio Orlandi; Soeren Auer
texts

eye 13

favorite 0

comment 0

Different versions of peer-to-peer electronic cash exist as data represented by separate blockchains. Payments between such systems cannot be sent directly from one party to another without going through a financial institution. Bitcoin provided part of the solution but its utility is limited to intra-blockchain transactions. The benefits are lost if a trusted third party is required to execute inter-blockchain transactions. We propose a solution to the inter-blockchain transaction problem...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.02598
Arxiv.org
texts

eye 6

favorite 0

comment 0

A critically important component of most signal processing procedures is that of computing the distance between signals. In multi-party processing applications where these signals belong to different parties, this introduces privacy challenges. The signals may themselves be private, and the parties to the computation may not be willing to expose them. Solutions proposed to the problem in the literature generally invoke homomorphic encryption schemes, secure multi-party computation, or other...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.05178
Arxiv.org
by Gina Gallegos-Garcia; Vincenzo Iovino; Alfredo Rial; Peter B. Roenne; Peter Y. A. Ryan
texts

eye 11

favorite 0

comment 0

In traditional e-voting protocols, privacy is often provided by a trusted authority that learns the votes and computes the tally. Some protocols replace the trusted authority by a set of authorities, and privacy is guaranteed if less than a threshold number of authorities are corrupt. For verifiability, stronger security guarantees are demanded. Typically, corrupt authorities that try to fake the result of the tally must always be detected. To provide verifiability, many e-voting protocols use...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.06343
Arxiv.org
by Rui Tan; Varun Badrinath Krishna; David K. Y. Yau; Zbigniew Kalbarczyk
texts

eye 4

favorite 0

comment 0

Modern information and communication technologies used by smart grids are subject to cybersecurity threats. This paper studies the impact of integrity attacks on real-time pricing (RTP), a key feature of smart grids that uses such technologies to improve system efficiency. Recent studies have shown that RTP creates a closed loop formed by the mutually dependent real-time price signals and price-taking demand. Such a closed loop can be exploited by an adversary whose objective is to destabilize...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.02860
Arxiv.org
by Mehmet Sabir Kiraz; Osmanbey Uzunkol
texts

eye 7

favorite 0

comment 0

Several pairing-based cryptographic protocols are recently proposed with a wide variety of new novel applications including the ones in emerging technologies like cloud computing, internet of things (IoT), e-health systems and wearable technologies. There have been however a wide range of incorrect use of these primitives. The paper of Galbraith, Paterson, and Smart (2006) pointed out most of the issues related to the incorrect use of pairing-based cryptography. However, we noticed that some...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.02826
Arxiv.org
by Adam Bates; Kevin Butler; Alin Dobra; Brad Reaves; Patrick Cable; Thomas Moyer; Nabil Schear
texts

eye 3

favorite 0

comment 0

Data provenance is a valuable tool for detecting and preventing cyber attack, providing insight into the nature of suspicious events. For example, an administrator can use provenance to identify the perpetrator of a data leak, track an attacker's actions following an intrusion, or even control the flow of outbound data within an organization. Unfortunately, providing relevant data provenance for complex, heterogenous software deployments is challenging, requiring both the tedious...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.00266
Arxiv.org
by Udaya Sampath K. Perera Miriya Thanthrige; Jagath Samarabandu; Xianbin Wang
texts

eye 3

favorite 0

comment 0

Intrusion detection is only a starting step in securing IT infrastructure. Prediction of intrusions is the next step to provide an active defense against incoming attacks. Current intrusion prediction methods focus mainly on prediction of either intrusion type or intrusion category and do not use or provide contextual information such as source and target IP address. In addition most of them are dependant on domain knowledge and specific scenario knowledge. The proposed algorithm employs a...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1610.07276
Arxiv.org
by Mohamed Amine Ferrag; Leandros A. Maglaras; Helge Janicke; Jianmin Jiang
texts

eye 4

favorite 0

comment 0

In this paper, we present a comprehensive survey of privacy-preserving schemes for Smart Grid communications. Specifically, we select and in-detail examine thirty privacy preserving schemes developed for or applied in the context of Smart Grids. Based on the communication and system models, we classify these schemes that are published between 2013 and 2016, in five categories, including, 1) Smart grid with the advanced metering infrastructure, 2) Data aggregation communications, 3) Smart grid...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1611.07722
Arxiv.org
by Arman Noroozian; Maciej Korczyński; Samaneh TajalizadehKhoob; Michel van Eeten
texts

eye 4

favorite 0

comment 0

Research into cybercrime often points to concentrations of abuse at certain hosting providers. The implication is that these providers are worse in terms of security; some are considered `bad' or even `bullet proof'. Remarkably little work exists on systematically comparing the security performance of providers. Existing metrics typically count instances of abuse and sometimes normalize these counts by taking into account the advertised address space of the provider. None of these attempts have...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1612.03641
Arxiv.org
by Justin DeBenedetto; Marina Blanton
texts

eye 3

favorite 0

comment 0

Growth in research collaboration has caused an increased need for sharing of data. However, when this data is private, there is also an increased need for maintaining security and privacy. Secure multi-party computation enables any function to be securely evaluated over private data without revealing any unintended data. A number of tools and compilers have been recently developed to support evaluation of various functionalities over private data. PICCO is one of such compilers that transforms...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1612.08678
Arxiv.org
by Sashank Dara; V. N. Muralidhara
texts

eye 6

favorite 0

comment 0

Collaboration among multiple organizations is imperative for contemporary intrusion detection. As modern threats become well sophisticated it is difficult for organizations to defend with threat context local to their networks alone. Availability of global \emph{threat intelligence} is must for organizations to defend against modern advanced persistent threats (APTs). In order to benefit from such global context of attacks, privacy concerns continue to be of major hindrance. In this position...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1602.02452
Arxiv.org
by Ziqiao Zhou; Michael K. Reiter; Yinqian Zhang
texts

eye 5

favorite 0

comment 0

We present a software approach to mitigate access-driven side-channel attacks that leverage last-level caches (LLCs) shared across cores to leak information between security domains (e.g., tenants in a cloud). Our approach dynamically manages physical memory pages shared between security domains to disable sharing of LLC lines, thus preventing "Flush-Reload" side channels via LLCs. It also manages cacheability of memory pages to thwart cross-tenant "Prime-Probe" attacks in...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.05615
Arxiv.org
by Eugene Panferov
texts

eye 4

favorite 0

comment 0

On the premise that we are using passwords composed of multiple English words, we argue that using syntactically correct passphrases has no significant impact on the security in comparison to randomly arranged collections of words. We only analyze the contribution of the syntax itself. A comparison to the other kinds of passwords is out of the scope.
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1603.06133
Arxiv.org
by Martin Harrigan; Christoph Fretter
texts

eye 3

favorite 0

comment 0

Address clustering tries to construct the one-to-many mapping from entities to addresses in the Bitcoin system. Simple heuristics based on the micro-structure of transactions have proved very effective in practice. In this paper we describe the primary reasons behind this effectiveness: address reuse, avoidable merging, super-clusters with high centrality, and the incremental growth of address clusters. We quantify their impact during Bitcoin's first seven years of existence.
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.06369
Arxiv.org
by Haibo Hong; Jun Shao; Licheng Wang; Haseeb Ahmad; Yixian Yang
texts

eye 4

favorite 0

comment 0

In this paper, we propose a brand new public key encryption scheme in the Lie group that is a non-abelian group. In particular, we firstly investigate the intractability assumptions in the Lie group, including the non-abelian factoring assumption and non-abelian inserting assumption. After that, by using the FO technique, a CCA secure public key encryption scheme in the Lie group is proposed. At last, we present the security proof in the random oracle based on the non-abelian inserting...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1605.06608
Arxiv.org
by Guy Kloss
texts

eye 5

favorite 0

comment 0

For secure communication it is not just sufficient to use strong cryptography with good and strong keys, but to actually have the assurance, that the keys in use for it are authentic and from the contact one is expecting to communicate with. Without that, it is possible to be subject to impersonation or man-in-the-middle (MitM) attacks. Mega meets this problem by providing a hierarchical authentication mechanism for contacts and their keys. To avoid any hassle when using multiple types of keys...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1606.04599
Arxiv.org
by James Christopher Foreman; Franklin Pacheco
texts

eye 5

favorite 0

comment 0

Advanced Metering Infrastructure (AMI) have rapidly become a topic of international interest as governments have sponsored their deployment for the purposes of utility service reliability and efficiency, e.g., water and electricity conservation. Two problems plague such deployments. First is the protection of consumer privacy. Second is the problem of huge amounts of data from such deployments. A new architecture is proposed to address these problems through the use of Aggregators, which...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1607.06377
Arxiv.org
by Eric Yong Xie; Chengqing Li; Simin Yu; Jinhu Lü
texts

eye 4

favorite 0

comment 0

Utilizing complex dynamics of chaotic maps and systems in encryption was studied comprehensively in the past two and a half decades. In 1989, Fridrich's chaotic image encryption scheme was designed by iterating chaotic position permutation and value substitution some rounds, which received intensive attention in the field of chaos-based cryptography. In 2010, Solak \textit{et al.} proposed a chosen-ciphertext attack on the Fridrich's scheme utilizing influence network between cipher-pixels and...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1609.05352
Arxiv.org
by Gabriele Spini; Gilles Zémor
texts

eye 6

favorite 0

comment 0

In the model that has become known as "Perfectly Secure Message Transmission"(PSMT), a sender Alice is connected to a receiver Bob through n parallel two-way channels. A computationally unbounded adversary Eve controls t of these channels, meaning she can acquire and alter any data that is transmitted over these channels. The sender Alice wishes to communicate a secret message to Bob privately and reliably, i.e. in such a way that Eve will not get any information about the message...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.01909
Arxiv.org
by Michael Backes; Sven Bugiel; Oliver Schranz; Philipp von Styp-Rekowsky; Sebastian Weisgerber
texts

eye 10

favorite 0

comment 0

We present ARTist, a compiler-based application instrumentation solution for Android. ARTist is based on the new ART runtime and the on-device dex2oat compiler of Android, which replaced the interpreter-based managed runtime (DVM) from Android version 5 onwards. Since dex2oat is yet uncharted, our approach required first and foremost a thorough study of the compiler suite's internals and in particular of the new default compiler backend Optimizing. We document the results of this study in this...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1607.06619
Arxiv.org
by Jacques M. Bahi; Jean-François Couchot; Christophe Guyeux
texts

eye 39

favorite 0

comment 0

Hash functions are cryptographic tools, which are notably involved in integrity checking and password storage. They are of primary importance to improve the security of exchanges through the Internet. However, as security flaws have been recently identified in the current standard in this domain, new ways to hash digital data must be investigated. In this document an original keyed hash function is evaluated. It is based on asynchronous iterations leading to functions that have been proven to...
Topics: Cryptography and Security, Computing Research Repository
Source: http://arxiv.org/abs/1608.05928