Information Security and Privacy Research

Name: Information Security and Privacy Research | 27th IFIP TC 11 Information Security and Privacy Conference, SEC 2012, Heraklion, Crete, Greece, June 4-6, 2012, Proceedings
Brand: Springer
Price: 96.29 EUR
Availability: OnlineOnly

27th IFIP TC 11 Information Security and Privacy Conference, SEC 2012, Heraklion, Crete, Greece, June 4-6, 2012, Proceedings

Dimitris Gritzalis Steven Furnell Marianthi Theoharidou(Herausgeber*in)

Springer (Verlag)

Erschienen am 6. Juni 2012

XVI, 592 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-642-30436-1 (ISBN)

96,29 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Title
Preface
Organization
Table of Contents
Attacks and Malicious Code
Relay Attacks on Secure Element-EnabledMobile Devices
Introduction
Smartcard Communication
Android's Secure Element API
Related Work
Attacking Mobile Phones
Relay Attack on the Secure Element
Limitations by the Communication Protocol
Implementation
Measurement Results
Conclusion and Outlook
References
Would You Mind Forking This Process?A Denial of Service Attack on Android
Introduction
The Android Architecture
The Android Layers
The Linux Layer
Interaction between the Android Layers and the Linux Layer
The Vulnerability
Countermeasures
Checking Fork Requests Inside the Zygote Process
Modifying the Linux Permissions of the Zygote Socket
Experimental Results
Exploiting the Vulnerability
Testing the Countermeasures
Related Works
Conclusions
References
An Approach to Detecting Inter-Session Data Flow Induced by Object Pooling
Introduction
Related Work
Inter-Session Data Flow
Analyzed Frameworks
Problem
Example
Detection Approach
Evaluation
Evaluated Programs
Analysis Results
Discussion
Conclusion and Outlook
References
Embedded Eavesdropping on Java Card
Introduction
Forewords on the APDU Buffer and Targeted Platforms
The APDU Buffer Usage
Specificities of the APDU Buffer in a Java Card
Targeted Platforms
The APDU Buffer Storage Attacks
A Fault Attack to Store the APDU Buffer
Attacking a Java Card 3.0 Classic Edition
Attacking a Java Card 3.0 Connected Edition
Case Study
Attacking through the GP Environment: OPEN
Attacking through the CAT/(U)SAT
Attacking through the Eavesdropping Restartable Task
Conclusion
References
Security Architectures
Authenticated Key Exchange (AKE) in Delay Tolerant Networks
Introduction
Related Work
Authenticated Key Establishment
The Setting
Preliminaries, Goals and Requirements
The Protocol
Evaluation
Conclusion and Areas of Ongoing and Future Research
References
OFELIA - A Secure Mobile AttributeAggregation Infrastructure for User-CentricIdentity Management
Introduction
Architecture
OpenID Connect Identity Services
The RP/SP (Relying Party/Service Provider)
Attribute Authorities
The Identity Broker
The Smart-Phone as a Secure Digital Wallet
The XMPP Messaging Protocol
OFELIA Secure Access Authorization Tokens
The OFELIA TRUST Infrastructure
Entities Enrollment and Communication Schemes
Attribute Authority Enrollment
Identity Broker Enrollment
Service Provider Enrollment
Usage Case Scenario
Conclusions
References
Smart OpenID:A Smart Card Based OpenID Protocol
Introduction
Role of Mobile Network Operators
OpenID
Smart Cards
Related Work
OpenID 2.0 Security
3GPP OpenID/GBA
SSL Certificate Based OpenID Authentication
Liberty Alliance Advanced Client
The Smart OpenID Protocol
Additional Privacy Using Identifier Select Mode
Attribute Assertions Using Identifier Select Mode
Implementation
Binding to Network Authentication
Analysis of Smart OpenID
Conclusions
References
Peer to Peer Botnet Detection Based on Flow Intervals
Introduction
Related Work
Approach
Foundation
Attribute Selection
Classifier Selection
Evaluation
Evaluation Dataset
Evaluation Results
Comparison with BotHunter
Conclusion
References
System Security
Towards a Universal Data Provenance Framework Using Dynamic Instrumentation
Introduction
Background
Design
Configurable Logging
Assisted Discovery
Case Studies
File-System
Database (SQLite)
Web Browser (Safari)
Discussion and Future Directions
Related Work
Conclusion
References
Improving Flask Implementation Using Hardware Assisted In-VM Isolation
Introduction
Background
The Flask Architecture Overview
EPT Overview
Assumption and Threat Model
Overview of Our Approach
Implementation
Isolated Address Space Construction
Entry Gate and Exit Gate Implementation
Loading a Module to Enforce the Settings
Evaluation
Performance Overhead
Security Analysis
Related Work
Conclusions and Future Work
References
HyperForce: Hypervisor-enForced Execution of Security-Critical Code
Introduction
Design
Motivation
Core Idea
Evaluation
Macro-benchmarks
Micro-benchmarks
Related Work
Conclusion
References
RandHyp: Preventing Attacksvia Xen Hypercall Interface
Introduction
Related Work
Xen Architecture, Threat Model, and Design Goals
Architecture Overview
Threat Model
Information Leakage Attack.
Denial of Service Attack.
Design Overview
Implementation
Randomization
Kernel-Level Randomization.
User-Level Randomization.
De-randomization
Security Discussion
Attacks Using Direct Hypercall Invocation.
Attacks Using Indirect Hypercall Invocation.
Evaluation
Experimental Setup
Performance Evaluation
Disk I/O Performance.
Network I/O Performance.
Real-world Benchmarks.
Effectiveness Evaluation
Conclusion
References
Access Control
Role Mining under Role-Usage CardinalityConstraint
Introduction
Role Mining with Role-Usage Cardinality Constraints
Role Priority Based Approach (RPA)
Illustrative Example.
Coverage of Permissions Based Approach (CPA)
Illustrative Example.
Experimental Results
Related Work
Conclusions and Future Direction
References
HIDE DHCP: Covert Communications throughNetwork Configuration Messages
Introduction
Related Work
Covert Channel Analysis and Requirements
The Scenario
Protocol Analysis
HIDE_DHCP: A New Subliminal Channel
Xid Implementation
Sname and File Implementation
Options Implementation
Covert Channel Analysis
Conclusions
References
Handling Stateful Firewall Anomalies
Introduction
Motivation
Related Work
Handling Anomalies on Stateful Firewall Intra-State Rules
Handling Inter-state Rule Anomalies
Conclusion
References
A Framework for Threat Assessmentin Access Control Systems
Introduction
Threat Assessment Approaches
Assumptions
Defining ``Threat''
Running Example
Object-Based Threat Assessment
Subject-Based Threat Assessment
Difference of Scores-Based Threat Assessment
Difference Weighted by Object Sensitivity Score.
Difference Weighted by Subject Trustworthiness Score.
Discussion and Related Work
Conclusions
References
Database Security
Support for Write Privileges on Outsourced Data
Introduction
Basic Concepts
Enforcement of Write Authorizations
Key Derivation Structure
Resource Encryption, Write Tags, and Access Control Enforcement
Write Integrity Control and Resource Management
Related Work
Conclusions
References
Malicious Users' Transactions: Tackling Insider Threat
Introduction
Related Work
Insider Threat and Malicious Transactions
The Proposed Model
The Labeling Mechanism
The Damage Predictor
Real Events Analyzer
System Architecture
Conclusions
References
Privacy Attitudes and Properties
Privacy-Preserving Television Audience Measurement Using Smart TVs
Introduction
The PrivTAM System
The PrivTAM Protocol
Problem Definition
Outline of the Computation
The Protocol's Security
Experimental Results
Conclusions
References
Tracking Users on the Internet with Behavioral Patterns: Evaluation of Its Practical Feasibility
Introduction
Related Work
Modeling Behavior-Based Tracking
Dataset
Behavior-Based Tracking Technique
Multinomial Naïve Bayes Classifier
Transformation of Frequency Vectors
Resolving Ambiguous Predictions with Cosine Similarity
Evaluation
Cross Validation
Evaluation in Real-World Setting
Dealing with Fluctuating Activity
Future Work
Countermeasures
Conclusion
References
Smartphone Forensics: A Proactive Investigation Schemefor Evidence Acquisition
Introduction
Smartphone Evidence
Smartphone Evidence Taxonomy
Evidence Transport Channels
Proactive Smartphone Forensics Investigation
Proactive Smartphone Forensics Scheme
Scheme Processes
Legal Considerations
Conclusions
References
Social Networks and Social Engineering
Modeling Social Engineering Botnet Dynamicsacross Multiple Social Networks
Introduction
Related Work
Scene Analysis
Background
The SS-Botnet Propagation Process
Affecting Factors
Modeling Methodology
Related Notations
Theoretical Description
Evaluation
Statistical Investigation
Simulation Experiment
Limitations and Discussion
Conclusion
References
Layered Analysis of Security Ceremonies
Introduction
A Security Ceremony Model
Example Ceremony Outline
Representing Layer III of Security Ceremonies
Analysing Layer III of Security Ceremonies Formally
Formal Specification of the Example Ceremony
Formal Verification of the Example Ceremony
Conclusions
References
Applied Cryptography, Anonymity and Trust
A Small Depth-16 Circuit for the AES S-Box
Introduction
Combinational Circuit Optimization
The Tower Field Construction: A Nonlinear Component
A Greedy Heuristic for Linear Components
Local Optimizations
The Circuits
Conclusion
References
Formal Verification of the mERA-Based eServices with Trusted Third Party Protocol
Introduction
mERA-Based eServices with Trusted Third Party Protocol
Cryptographic Primitives
Description of the Protocol
The Formal Verification Tool: ProVerif
Proof Engine
The Language
Verifying mERA Protocol
Modelisation of Cryptographic Primitives
Declarations and Channels
Processes
Properties Formally Verified
Liveness Property
Security Properties
Conclusion
References
Usable Security
My Authentication Album:Adaptive Images-Based Login Mechanism
Introduction
The Fallback Authentication Challenge
Graphical Passwords
Contributions
Paper Layout
Mechanism Description
Security Analysis
Applications
Authentication to Highly-Sensitive Sites
Authentication to Less-Sensitive Sites
User Study
Study's Framework System
Results
Conclusions and Future Work
References
Balancing Security and Usability of Local Security Mechanisms for Mobile Devices
Introduction
Related Work
Requirements and Evaluation Framework
Attack Scenarios and Impact
Evaluation Criteria
Design of a Security Mechanism
Design Decisions
Entities and Used Technologies
Process Description
Evaluation
Conclusion
References
Analyzing Value Conflicts for a Work-FriendlyISS Policy Implementation
Introduction
ISSP Implementation and Value Conflicts
Theory and Methodology
Case Background
Research Methodology
Value Conflicts in Social Services
ISS Values in the Context of Social Work
The Identified Areas of Value Conflicts
Reasons for Value Conflicts and Suggested Solutions
Discussion
Conclusion and Future Research
References
When Convenience Trumps Security:Defining Objectives for Security and Usability of Systems
Introduction
Value Focused Security and Usability Objectives
Quantitatively Derived Parsimonious Set of Securityand Usability Objectives
Method
Data
Discussion
Conclusion
References
Security and Trust Models
Security-by-Contract for the OSGi Platform
Introduction
The SC Architecture
The Running Example
The OSGi Platform Formal Model
Evaluation
Related Work
Conclusions
References
Cyber Weather Forecasting:Forecasting Unknown Internet WormsUsing Randomness Analysis
Introduction
Cyber Weather Forecasting
ADUR (Anomaly Detection Using Randomness Check): The Context
FORE (FOrecasting Using REgression Analysis) : The Proposed Model
Time Series Analysis
Linear Regression Analysis
Reliability Analysis
Evaluation Results
Conclusions
References
Incentive Compatible Moving Target Defenseagainst VM-Colocation Attacks in Clouds
Introduction
Preliminaries
Assumptions and Notations
Incentive Compatible Game
VM-Migration Based Moving Target Defence
The Optimal Number of Moving VMs
The Constant Cost of Migration
Defense Timeline
Evaluation
Security
Practicability
Discussion and Conclusion
References
Give Rookies A Chance: A Trust-BasedInstitutional Online Supplier RecommendationFramework
Introduction
Related Works
Trust, Trustworthiness and Reputation
Trust for Newcomers
Reputation Utility and Online Trust Game
Reputation Utility
Online Trust Game
Trust-Based Auto-selection Framework and Algorithms
Normalization
Utilization
Trustworthiness Determination
Recommend Supplier
Implementation and Experiments
Environment Settings and Implementation
Experiment
Conclusion and Future Work
References
Security Economics
A Game-Theoretic Formulation of SecurityInvestment Decisions under Ex-ante Regulation
Introduction
Stakeholders and Information Release
Ex-ante Regulation of Damage Sharing
Surplus Functions
The Customer
The Service Provider
A Game Formulation for Investments and Risk
Customer's Best Response Function
Service Provider's Best Response Function
Analysis of Nash Equilibrium
Conclusions
References
Optimizing Network Patching Policy Decisions
Introduction
Disruption Trade-Offs
Cost Function
Reducing the Cost of Disruption
A Systems Model of Network Vulnerability Management
Patch Release and Patch Management Processes
The Threat Environment
Measuring Disruption
Results from Simulations with Core Model Settings
Changes in the Threat Environment
Increased Arrival Rate of Exploits
Faster Exploit Development
Discussion
Related Work
Conclusions
References
A Risk Assessment Method for Smartphones
Introduction
Smartphone: Definition and Assets
Smartphone Risk Assessment
Case Study: Risk Assessment in Android
Conclusions
References
Empirical Benefits of Training to Phishing Susceptibility
Introduction
Efforts to Assess the Phishing Threat
Training Users: Effective or a Waste of Time?
Methodology
Task Procedures and Experimental Design
Results
Conclusions and Recommendations
References
Authentication and Delegation
Multi-modal Behavioural Biometric Authenticationfor Mobile Devices
Introduction
An Overview of Biometric Authentication
Behaviour Profiling
Keystroke Dynamics
Linguistic Profiling
Experiment Procedure
Behaviour Profiling
Keystroke Dynamics
Linguistic Profiling
Fusions
Results
Behaviour Profiling
Keystroke Dynamics
Linguistic Profiling
Fusion
Discussion
Conclusions
References
Analysis and Modeling of False Synchronizationsin 3G-WLAN Integrated Networks
Introduction
Background
False Synchronizations in 3G-WLAN Integrated Networks
Modeling Procedure
Conclusions
References
Password Protected Smart Card and Memory StickAuthentication against Off-Line Dictionary Attacks
Introduction
Security Models
Smart Card Based Secure Authentication and Key Agreement
Symmetric Key Based Scheme: SSCA
Public Key Based Scheme: PSCAb
Public Key Based Scheme: PSCA
Public Key Based Scheme with Password Validation Data at Server: PSCAV
Remote Authentication with Password Protected Portable Memory Sticks
References
Distributed Path Authentication for Dynamic RFID-Enabled Supply Chains
Introduction
Background
Dynamic RFID-Enabled Supply Chain
Adversary Model
Requirements of RFID-Enabled Path Authentication System
Our Construction
Building Tools
Protocol Details
Analysis
Security
Privacy
Performance
Conclusions
References
Enhanced Dictionary Based Rainbow Table
Introduction
Background
Enhanced Dictionary Based Rainbow Table
Enhanced Rainbow Table
Design of Dictionary Based Enhanced Rainbow Table
Methods of Constructing Chains
Conclusion
References
Short Papers
Authorization Policies for Materialized Views
Introduction
Datalog for Authorization
Contribution
Related Work
Conclusion
References
Enhancing the Security of On-line Transactionswith CAPTCHA Keyboard
Introduction
Secure On-line Transaction Protocol
Security Model
Security-Enhanced TLS Protocol
On-screen CAPTCHA Keyboard
Discussion
Security
Performance Comparison
References
Fighting Pollution Attack in Peer-to-Peer StreamingNetworks: A Trust Management Approach
Introduction
Trust Management in P2P Streaming Networks
Confidence Factor
Direct Trust
Indirect Trust
Trust Updates
Utilization of Trust Values
Performance Evaluation under Potential Attacks
Bad-Mouthing Attack
On-Off Attack
Conclusion
References
A Framework for Anonymizing GSM Callsover a Smartphone VoIP Network
Introduction and Motivation
Related Work
The Proposed Scheme
The Anonymous Communication Scenario
Private VoIP to GSM Gateway Discovery
Performance Evaluation
Concluding Remarks and Areas for Future Research
Acknowledgments.
References
A Browser-Based Distributed System for the Detectionof HTTPS Stripping Attacks againstWeb Pages
Introduction
Analysis of the Attack
The Proposed Countermeasure
Prototype
Page Characterization
Page Evaluation
Information Sharing
Experimental Validation
Conclusions and Future Work
References
Privacy-Preserving Mechanisms for OrganizingTasks in a Pervasive eHealth System
Introduction
The System Architecture
System Functionality
The Scheduling Service
Patient's Schedules and Caregiver's Profiles
Protocol Assumptions
Scheduling a Task
Retrieval of Assignments
Contacting a Caregiver
Conclusion
References
Web Services Security Assessment:An Authentication-Focused Approach
Introduction and Related Work
Web Services Threats and Countermeasures
Experimentation Results
Conclusions and Further Research
References
Open Issues and Proposals in the IT SecurityManagement of Commercial Ports:The S-PORT National Case
Introduction
Existing Efforts and Open Issues
Proposals for Enhancing Maritime IT Security Management
S-PORT: A National Project
Conclusions and Acknowledgments
References
A Response Strategy Modelfor Intrusion Response Systems
Introduction
Related Work
Response Strategy Model (RSM)
Case Study
Case Study Results
Conclusion
References
Intrusion Tolerance of Stealth DoS Attacksto Web Services
Introduction
Building Stealth Attacks
The Intrusion Tolerant Approach
Experiments and Results
Conclusion and Future Work
References
Towards Use-Based Usage Control
Introduction
Main Definitions
Elements
Decision Factors
Example
Conclusion
References
Author Index

Systemvoraussetzungen

Als PDF speichern Als Link merken