PapersCut A shortcut to recent security papers

Arxiv

Tamper Detection against Unitary Operators

Authors: Naresh Goud Boddu, Upendra S. Kapshikar

Abstract: We consider (Enc, Dec) schemes which are used to encode a classical/quantum message $m$ and derive an $n$-qubit quantum codeword $\psi_m$. The quantum codeword $\psi_m$ can adversarially tamper via a unitary $U \in \mathcal{U}$ from some known tampering unitary family $\mathcal{U}$, resulting in $U \psi_m U^\dagger$. Firstly, we initiate the general study of quantum tamper detection codes, which must detect that tampering occurred with high probability. In case there was no tampering, we would like to output the message $m$ with a probability of $1$. We show that quantum tamper detection codes exist for both classical messages and quantum messages for any family of unitaries $\mathcal{U}$, such that $|\mathcal{U}| < 2^{2^{\alpha n}}$ for some known constant $\alpha \in (0,1)$ and all the unitaries satisfy one additional condition : \begin{itemize} \item Far from Identity : For each $U \in \mathcal{U}$, we require that its modulus of trace value isn't too much i.e. $ |Trace(U)| \leq \phi N$, where $N=2^n.$ \end{itemize} Quantum tamper-detection codes are quantum generalizations of classical tamper detection codes studied by Jafargholi et al. \cite{JW15}. Additionally for classical message $m$, if we must either output message $m$ or detect that tampering occurred and output $\perp$ with high probability, we show that it is possible without the restriction of Far from Identity condition for any family of unitaries $\mathcal{U}$, such that $|\mathcal{U} | < 2^{2^{\alpha n}}$. We also provide efficient (Enc, Dec) schemes when the family of tampering unitaries are from Pauli group $\mathcal{P}_n$, which can be thought of as a quantum version of the algebraic manipulation detection (AMD) codes of Cramer et al. \cite{CDFPW08}.

Date: 10 May 2021

PDF »Main page »


T-Cash: Transferable Fiat Backed Coins

Authors: Hitesh Tewari

Abstract: Numerous electronic cash schemes have been proposed over the years - however none have been embraced by financial institutions as an alternative to fiat currency. David Chaum's ecash scheme was the closest to something that mimicked a modern day currency system, with the important property that it provided anonymity for users when purchasing coins from a bank, and subsequently spending them at a merchant premises. However it lacked a crucial element present in current fiat-based systems - the ability to continuously spend or transfer coins. Bitcoin reignited the interest in cryptocurrencies in the last decade but is now seen as more of an asset store as opposed to a financial instrument. One interesting thing that has come out of the Bitcoin system is blockchains and the associated distributed consensus protocols. In this paper we propose a transferable electronic cash scheme using blockchain technology which allows users to continuously reuse coins within the system.

Date: 10 May 2021

PDF »Main page »


Physical Fault Injection and Side-Channel Attacks on Mobile Devices: A Comprehensive Survey

Authors: Carlton Shepherd, Konstantinos Markantonakis, Nico van Heijningen, Driss Aboulkassimi, Clément Gaine, Thibaut Heckmann, David Naccache

Abstract: The past decade has seen the rapid deployment of mobile devices with densely packaged system-on-chips (SoCs) with multi-core, high-frequency CPUs and complex pipelines. In parallel, sophisticated SoC-assisted security mechanisms, such as trusted execution environments (TEEs), full-disk and file-based encryption, have also been deployed for protecting sensitive data. Both advancements have dramatically complicated the use of physical attacks, which has recently led to the development of specialised attack methods. In this survey, we consolidate recent developments in physical fault injections (FIAs) and side-channel attacks (SCAs) on modern mobile devices. In total, we comprehensively survey over 50 fault injection and side-channel attack papers published between 2009-2021. We evaluate the prevailing attack methods, compare existing attacks using a common framework, identify several challenges and shortcomings, and suggest future directions of research.

Date: 10 May 2021

PDF »Main page »


Forsage: Anatomy of a Smart-Contract Pyramid Scheme

Authors: Tyler Kell, Haaroon Yousaf, Sarah Allen, Sarah Meiklejohn, Ari Juels

Abstract: Pyramid schemes are investment scams in which top-level participants in a hierarchical network recruit and profit from an expanding base of defrauded newer participants. Pyramid schemes have existed for over a century, but there have been no in-depth studies of their dynamics and communities because of the opacity of participants' transactions. In this paper, we present an empirical study of Forsage, a pyramid scheme implemented as a smart contract and at its peak one of the largest consumers of resources in Ethereum. As a smart contract, Forsage makes its (byte)code and all of its transactions visible on the blockchain. We take advantage of this unprecedented transparency to gain insight into the mechanics, impact on participants, and evolution of Forsage. We quantify the (multi-million-dollar) gains of top-level participants as well as the losses of the vast majority (around 88%) of users. We analyze Forsage code both manually and using a purpose-built transaction simulator to uncover the complex mechanics of the scheme. Through complementary study of promotional videos and social media, we show how Forsage promoters have leveraged the unique features of smart contracts to lure users with false claims of trustworthiness and profitability, and how Forsage activity is concentrated within a small number of national communities.

Comment: 17 pages, 13 figures

Date: 10 May 2021

PDF »Main page »


Attacks on a Privacy-Preserving Publish-Subscribe System and a Ride-Hailing Service

Authors: Srinivas Vivek

Abstract: A privacy-preserving Context-Aware Publish-Subscribe System (CA-PSS) enables an intermediary (broker) to match the content from a publisher and the subscription by a subscriber based on the current context while preserving confidentiality of the subscriptions and notifications. While a privacy-preserving Ride-Hailing Service (RHS) enables an intermediary (service provider) to match a ride request with a taxi driver in a privacy-friendly manner. In this work, we attack a privacy-preserving CA-PSS proposed by Nabeel et al. (2013), where we show that any entity in the system including the broker can learn the confidential subscriptions of the subscribers. We also attack a privacy-preserving RHS called lpRide proposed by Yu et al. (2019), where we show that any rider/driver can efficiently recover the secret keys of all other riders and drivers. Also, we show that any rider/driver will be able to learn the location of any rider. The attacks are based on our cryptanalysis of the modified Paillier cryptosystem proposed by Nabeel et al. that forms a building block for both the above protocols.

Date: 10 May 2021

PDF »Main page »


ADASYN-Random Forest Based Intrusion Detection Model

Authors: Zhewei Chen, Linyue Zhou, Wenwen Yu

Abstract: Intrusion detection has been a key topic in the field of cyber security, and the common network threats nowadays have the characteristics of varieties and variation. Considering the serious imbalance of intrusion detection datasets will result in low classification performance on attack behaviors of small sample size and difficulty to detect network attacks accurately and efficiently, using ADASYN oversampling method to balance datasets was proposed in this paper. In addition, random forest algorithm was used to train intrusion detection classifiers. Through the comparative experiment of Intrusion detection on CICIDS 2017 dataset, it is found that ADASYN with Random Forest performs better. Based on the experimental results, the improvement of precision, recall and F1 values after ADASYN is then analyzed. Experiments show that the proposed method can be applied to intrusion detection with large data, and can effectively improve the classification accuracy of network attack behaviors. Compared with traditional machine learning models, it has better performance, generalization ability and robustness.

Date: 10 May 2021

PDF »Main page »


Advanced Metering Infrastructures: Security Risks and Mitigation

Authors: Gueltoum Bendiab, Konstantinos-Panagiotis Grammatikakis, Ioannis Koufos, Nicholas Kolokotronis, Stavros Shiaeles

Abstract: Energy providers are moving to the smart meter era, encouraging consumers to install, free of charge, these devices in their homes, automating consumption readings submission and making consumers life easier. However, the increased deployment of such smart devices brings a lot of security and privacy risks. In order to overcome such risks, Intrusion Detection Systems are presented as pertinent tools that can provide network-level protection for smart devices deployed in home environments. In this context, this paper is exploring the problems of Advanced Metering Infrastructures (AMI) and proposing a novel Machine Learning (ML) Intrusion Prevention System (IPS) to get optimal decisions based on a variety of factors and graphical security models able to tackle zero-day attacks.

Date: 10 May 2021

PDF »Main page »


Threat Landscape for Smart Grid Systems

Authors: Christos-Minas Mathas, Konstantinos-Panagiotis Grammatikakis, Costas Vassilakis, Nicholas Kolokotronis, Vasiliki-Georgia Bilali, Dimitris Kavallieros

Abstract: Smart Grids are energy delivery networks, constituting an evolution of power grids, in which a bidirectional flow between power providers and consumers is established. These flows support the transfer of electricity and information, in order to support automation actions in the context of the energy delivery network. Insofar, many smart grid implementations and implementation proposals have emerged, with varying degrees of feature delivery and sophistication. While smart grids offer many advantages, their distributed nature and information flow streams between energy producers and consumers enable the launching of a number of attacks against the smart grid infrastructure, where the related consequences may range from economic loss to complete failure of the smart grid. In this paper, we survey the threat landscape of smart grids, identifying threats that are specific to this infrastructure, providing an assessment of the severity of the consequences of each attack type, discerning features that can be utilized to detect attacks and listing methods that can be used to mitigate them.

Date: 10 May 2021

PDF »Main page »


EPICTWIN: An Electric Power Digital Twin for Cyber Security Testing, Research and Education

Authors: Nandha Kumar Kandasamy, Sarad Venugopalan, Tin Kit Wong, Leu Junming Nicholas

Abstract: Cyber-Physical Systems (CPS) rely on advanced communication and control technologies to efficiently manage devices and the flow of information in the system. However, a wide variety of potential security challenges has emerged due to the evolution of critical infrastructures (CI) from siloed sub-systems into connected and integrated networks. This is also the case for CI such as a smart grid. Smart grid security studies are carried out on physical test-beds to provide its users a platform to train and test cyber attacks, in a safe and controlled environment. However, it has limitations w.r.t modifying physical configuration and difficulty to scale. To overcome these shortcomings, we built a digital power twin for a physical test-bed that is used for cyber security studies on smart grids. On the developed twin, the users can deploy real world attacks and countermeasures, to test and study its effectiveness. The difference from the physical test-bed is that its users may easily modify their power system components and configurations. Further, reproducing the twin for using and advancing the research is significantly cheaper. The developed twin has advanced features compared to any equivalent system in the literature. To illustrate a typical use case, we present a case study where a cyber attack is launched and discuss its implications.

Date: 10 May 2021

PDF »Main page »


SIRNN: A Math Library for Secure RNN Inference

Authors: Deevashwer Rathee, Mayank Rathee, Rahul Kranti Kiran Goli, Divya Gupta, Rahul Sharma, Nishanth Chandran, Aseem Rastogi

Abstract: Complex machine learning (ML) inference algorithms like recurrent neural networks (RNNs) use standard functions from math libraries like exponentiation, sigmoid, tanh, and reciprocal of square root. Although prior work on secure 2-party inference provides specialized protocols for convolutional neural networks (CNNs), existing secure implementations of these math operators rely on generic 2-party computation (2PC) protocols that suffer from high communication. We provide new specialized 2PC protocols for math functions that crucially rely on lookup-tables and mixed-bitwidths to address this performance overhead; our protocols for math functions communicate up to 423x less data than prior work. Some of the mixed bitwidth operations used by our math implementations are (zero and signed) extensions, different forms of truncations, multiplication of operands of mixed-bitwidths, and digit decomposition (a generalization of bit decomposition to larger digits). For each of these primitive operations, we construct specialized 2PC protocols that are more communication efficient than generic 2PC, and can be of independent interest. Furthermore, our math implementations are numerically precise, which ensures that the secure implementations preserve model accuracy of cleartext. We build on top of our novel protocols to build SIRNN, a library for end-to-end secure 2-party DNN inference, that provides the first secure implementations of an RNN operating on time series sensor data, an RNN operating on speech data, and a state-of-the-art ML architecture that combines CNNs and RNNs for identifying all heads present in images. Our evaluation shows that SIRNN achieves up to three orders of magnitude of performance improvement when compared to inference of these models using an existing state-of-the-art 2PC framework.

Comment: IEEE Security and Privacy 2021

Date: 10 May 2021

PDF »Main page »


Loading ...