PapersCut A shortcut to recent security papers

Arxiv

Investigating 3D Printer Residual Data

Authors: Daniel Bradford Miller, Jacob Gatlin, William Bradley Glisson, Mark Yampolskiy, Jeffrey Todd McDonald

Abstract: The continued adoption of Additive Manufacturing technologies is raising concerns in the security, forensics, and intelligence gathering communities. These concerns range from identifying and mitigating compromised devices, to theft of intellectual property, to sabotage, to the production of prohibited objects. Previous research has provided insight into the retrieval of configuration information maintained on the devices, but this work shows that the devices can additionally maintain information about the print process. Comparisons between before and after images taken from an AM device reveal details about the device's activities, including printed designs, menu interactions, and the print history. Patterns in the storage of that information also may be useful for reducing the amount of data that needs to be examined during an investigation. These results provide a foundation for future investigations regarding the tools and processes suitable for examining these devices.

Comment: Presented at the 52nd Hawaii International Conference on System Sciences. Jan 8-11, 2019. Wailea, HI, USA. 10 pages, 3 figures. Persistent link https://hdl.handle.net/10125/60154

Date: 22 Jan 2019

PDF »Main page »


Securing Manufacturing Intelligence for the Industrial Internet of Things

Authors: Hussain Al-Aqrabi, Richard Hill, Phil Lane, Hamza Aagela

Abstract: Widespread interest in the emerging area of predictive analytics is driving industries such as manufacturing to explore new approaches to the collection and management of data provided from Industrial Internet of Things (IIoT) devices. Often, analytics processing for Business Intelligence (BI) is an intensive task, and it also presents both an opportunity for competitive advantage as well as a security vulnerability in terms of the potential for losing Intellectual Property (IP). This article explores two approaches to securing BI in the manufacturing domain. Simulation results indicate that a Unified Threat Management (UTM) model is simpler to maintain and has less potential vulnerabilities than a distributed security model. Conversely, a distributed model of security out-performs the UTM model and offers more scope for the use of existing hardware resources. In conclusion, a hybrid security model is proposed where security controls are segregated into a multi-cloud architecture.

Comment: 19 pages, ICICT2019, Brunel, London, Springer

Date: 22 Jan 2019

PDF »Main page »


Perils of Zero-Interaction Security in the Internet of Things

Authors: Mikhail Fomichev, Max Maass, Lars Almon, Alejandro Molina, Matthias Hollick

Abstract: The Internet of Things (IoT) demands authentication systems which can provide both security and usability. Recent research utilizes the rich sensing capabilities of smart devices to build security schemes operating without human interaction, such as zero-interaction pairing (ZIP) and zero-interaction authentication (ZIA). Prior work proposed a number of ZIP and ZIA schemes and reported promising results. However, those schemes were often evaluated under conditions which do not reflect realistic IoT scenarios. In addition, drawing any comparison among the existing schemes is impossible due to the lack of a common public dataset and unavailability of scheme implementations. In this paper, we address these challenges by conducting the first large-scale comparative study of ZIP and ZIA schemes, carried out under realistic conditions. We collect and release the most comprehensive dataset in the domain to date, containing over 4250 hours of audio recordings and 1 billion sensor readings from three different scenarios, and evaluate five state-of-the-art schemes based on these data. Our study reveals that the effectiveness of the existing proposals is highly dependent on the scenario they are used in. In particular, we show that these schemes are subject to error rates between 0.6% and 52.8%.

Comment: Accepted for Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., Vol. 4, No. 1. Will be updated with final version once available

Date: 22 Jan 2019

PDF »Main page »


Perturbation Privacy for Sensitive Locations in Transit Data Publication: A Case Study of Montreal Trajet Surveys

Authors: Godwin Badu-Marfo, Bilal Farooq, Zachary Patterson

Abstract: Smartphone based travel data collection has become an important tool for the analysis of transportation systems. Interest in sharing travel survey data has gained popularity in recent years as "Open Data Initiatives" by governments seek to allow the public to use these data, and hopefully be able to contribute their findings and analysis to the public sphere. The public release of such precise information, particularly location data such as place of residence, opens the risk of privacy violation. At the same time, in order for such data to be useful, as much spatial resolution as possible is desirable for utility in transportation applications and travel demand modeling. This paper evaluates geographic random perturbation methods (i.e. Geo-indistinguishability and the Donut geomask) in protecting the privacy of respondents whose residential location may be published. We measure the performance of location privacy methods, preservation of utility and randomness in the distribution of perturbation distances with varying parameters. It is found that both methods produce distributions of spatial perturbations that conform closely to common probability distributions and as a result, that the original locations can be inferred with little information and a high degree of precision. It is also found that while Achieved K-estimate anonymity increases linearly with desired anonymity for the Donut geomask, Geo-Indistinguishability is highly dependent upon its privacy budget factor (epsilon) and is not very effective at assuring desired Achieved K-estimate anonymity.

Comment: Presented at 98th Annual Meeting of Transportation Research Board and under review in Transportation Research Record

Date: 22 Jan 2019

PDF »Main page »


Universal Rules for Fooling Deep Neural Networks based Text Classification

Authors: Di Li, Danilo Vasconcellos Vargas, Sakurai Kouichi

Abstract: Recently, deep learning based natural language processing techniques are being extensively used to deal with spam mail, censorship evaluation in social networks, among others. However, there is only a couple of works evaluating the vulnerabilities of such deep neural networks. Here, we go beyond attacks to investigate, for the first time, universal rules, i.e., rules that are sample agnostic and therefore could turn any text sample in an adversarial one. In fact, the universal rules do not use any information from the method itself (no information from the method, gradient information or training dataset information is used), making them black-box universal attacks. In other words, the universal rules are sample and method agnostic. By proposing a coevolutionary optimization algorithm we show that it is possible to create universal rules that can automatically craft imperceptible adversarial samples (only less than five perturbations which are close to misspelling are inserted in the text sample). A comparison with a random search algorithm further justifies the strength of the method. Thus, universal rules for fooling networks are here shown to exist. Hopefully, the results from this work will impact the development of yet more sample and model agnostic attacks as well as their defenses, culminating in perhaps a new age for artificial intelligence.

Date: 22 Jan 2019

PDF »Main page »


SoK: Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses

Authors: Ilias Giechaskiel, Kasper Bonne Rasmussen

Abstract: Research on how hardware imperfections impact security has primarily focused on side-channel leakage mechanisms produced by power consumption, electromagnetic emanations, acoustic vibrations, and optical emissions. However, with the proliferation of sensors in security-critical devices, the impact of attacks on sensor-to-microcontroller and microcontroller-to-actuator interfaces using the same channels is starting to become more than an academic curiosity. These out-of-band signal injection attacks target connections which transform physical quantities to analog properties and fundamentally cannot be authenticated, posing previously unexplored security risks. This paper contains the first survey of such out-of-band signal injection attacks, with a focus on unifying their terminology, and identifying commonalities in their causes and effects. The taxonomy presented contains a chronological, evolutionary, and thematic view of out-of-band signal injection attacks which highlights the cross-influences that exist and underscores the need for a common language irrespective of the method of injection. By placing attack and defense mechanisms in the wider context of their dual counterparts of side-channel leakage and electromagnetic interference, our paper identifies common threads and gaps that can help guide and inform future research. Overall, the ever-increasing reliance on sensors embedded in everyday commodity devices necessitates that a stronger focus be placed on improving the security of such systems against out-of-band signal injection attacks.

Date: 21 Jan 2019

PDF »Main page »


Towards a Functional Fee Market for Cryptocurrencies

Authors: Soumya Basu, David Easley, Maureen O'Hara, Emin Gün Sirer

Abstract: Blockchain-based cryptocurrencies prioritize transactions based on their fees, creating a unique kind of fee market. Empirically, this market has failed to yield stable equilibria with predictable prices for desired levels of service. We argue that this is due to the absence of a dominant strategy equilibrium in the current fee mechanism. We propose an alternative fee setting mechanism that is inspired by generalized second price auctions. The design of such a mechanism is challenging because miners can use any criteria for including transactions and can manipulate the results of the auction after seeing the proposed fees. Nonetheless, we show that our proposed protocol is free from manipulation as the number of users increases. We further show that, for a large number of users and miners, the gain from manipulation is small for all parties. This results in users proposing fees that represent their true utility and lower variance of revenue for miners. Historical analysis shows that Bitcoin users could have saved $272,528,000 USD in transaction fees while miners could have reduced the variance of fee income by an average factor of 7.4 times.

Date: 21 Jan 2019

PDF »Main page »


Hierarchical 2-D Feature Coding for Secure Pilot Authentication in Multi-User Multi-Antenna OFDM Systems: A Reliability Bound Contraction Perspective

Authors: Dongyang Xu, Pinyi Ren, James A. Ritcey

Abstract: Due to the publicly known and deterministic characteristic of pilot tones, pilot authentication (PA) in multi-user multi-antenna orthogonal frequency-division multiplexing systems is very susceptible to the jamming/nulling/spoofing behaviors. To solve this, in this paper, we develop a hierarchical 2-D feature (H2DF) coding theory that exploits the hidden pilot signal features, i.e., the energy feature and independence feature, to secure pilot information coding which is applied between legitimate parties through a well-designed five-layer hierarchical coding model to achieve secure multiuser PA (SMPA). The reliability of SMPA is characterized using the identification error probability (IEP) of pilot encoding and decoding with the exact closed-form upper and lower bounds. However, this phenomenon of non-tight bounds brings about the risk of long-term instability in SMPA. Therefore, a reliability bound contraction theory is developed to shrink the bound interval, and practically, this is done by an easy-to-implement technique, namely, codebook partition within the H2DF code. In this process, a tradeoff between the upper and lower bounds of IEP is identified and a problem of optimal upper and lower bound tradeoff is formulated, with the objective of optimizing the cardinality of sub-codebooks such that the upper and lower bounds coincide. Solving this, we finally derive an exact closed-form expression for IEP, which realizes a stable and highly reliable SMPA. Numerical results validate the stability and resilience of H2DF coding in SMPA.

Date: 21 Jan 2019

PDF »Main page »


Ring Oscillator and its application as Physical Unclonable Function (PUF) for Password Management

Authors: Alireza Shamsoshoara

Abstract: Mobile and embedded devices are becoming inevitable parts of our daily routine. Similar to other electronic devices such as read access memory (RAM) and storage, mobile devices require to authenticate and to be authenticated in a secure way. Usually, this can be accomplished by servers which possess private information for all devices. Since these devices are inherently mobile and operating in untrusted environments, they are prone to be accessed by untrustworthy users. Physical unclonable function (PUF) is a unique physical feature of a semiconductor device such as a microprocessor that can be generated from physical conditions such as supply voltage, temperature, etc. Ring oscillators are the principal parts of PUFs that are synthesized on a field-programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). Password manager systems are used in order to keep a database of usernames and password for clients in order for registration and authentication. This table plays a crucial role in authentication in many systems. Hence, security is one of the important features of these systems. Normally, in these tables only usernames and passwords are stored; however, they are vulnerable to many attacks. So, the first method of enhancing the security is using the hash instead of the original data, but, advanced hackers can break these hash data again. Hence, the method that we are going to use in this project is utilizing PUF to store the challenge of each user instead of saving the hash of passwords.

Comment: 21 Pages, 15 Figures

Date: 20 Jan 2019

PDF »Main page »


The Asymptotic Complexity of Coded-BKW with Sieving Using Increasing Reduction Factors

Authors: Erik Mårtensson

Abstract: The Learning with Errors problem (LWE) is one of the main candidates for post-quantum cryptography. At Asiacrypt 2017, coded-BKW with sieving, an algorithm combining the Blum-Kalai-Wasserman algorithm (BKW) with lattice sieving techniques, was proposed. In this paper, we improve that algorithm by using different reduction factors in different steps of the sieving part of the algorithm. In the Regev setting, where $q = n^2$ and $\sigma = n^{1.5}/(\sqrt{2\pi}\log_2^2 n)$, the asymptotic complexity is $2^{0.8917n}$, improving the previously best complexity of $2^{{0.8951n}}$. When a quantum computer is assumed or the number of samples is limited, we get a similar level of improvement.

Comment: Longer version of a paper submitted to ISIT 2019. Includes an appendix with a proof

Date: 19 Jan 2019

PDF »Main page »


Loading ...