2021 18th International Conference on Privacy, Security and Trust (PST)最新文献_第5页

EPF: An Evolutionary, Protocol-Aware, and Coverage-Guided Network Fuzzing Framework EPF:一个进化的、协议感知的、覆盖引导的网络模糊测试框架

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647801

René Helmke, Eugen Winter, Michael Rademacher

{"title":"EPF: An Evolutionary, Protocol-Aware, and Coverage-Guided Network Fuzzing Framework","authors":"René Helmke, Eugen Winter, Michael Rademacher","doi":"10.1109/PST52912.2021.9647801","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647801","url":null,"abstract":"Network fuzzing is a complex domain requiring fuzzers to handle highly structured input and communication schemes. In fuzzer development, such protocol-dependent semantics usually cause a focus on applicability: Resulting fuzz engines provide powerful APIs to add new protocols but rarely incorporate algorithmic fuzz improvements like the successful coverage-guidance. This paper aims to combine applicability and well-established algorithms for increased network fuzzing effectiveness. We introduce EPF, a coverage-guided and protocol-aware network fuzzing framework. EPF uses population-based simulated annealing to heuristically schedule packet types during fuzzing. In conjunction with a genetic algorithm that uses coverage metrics as fitness function, the framework steers input generation towards coverage maximization. Users can add protocols by defining packet models and state graphs through a Scapy-powered API. We collect first data in a case study on fuzzing the IEC 60870-5-104 SCADA protocol and compare EPF with AFLNet. Based on a total of 600 CPU days of fuzzing, we measure effectiveness using bug and coverage metrics. We report promising results that a) indicate similar performance to AFLNet without any optimizations and b) point out the potential and shortcomings of our approach.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"77 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128160051","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

SteelEye: An Application-Layer Attack Detection and Attribution Model in Industrial Control Systems using Semi-Deep Learning 基于半深度学习的工业控制系统应用层攻击检测与归因模型

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647777

Sanaz Nakhodchi, B. Zolfaghari, Abbas Yazdinejad, A. Dehghantanha

引用次数: 18

Clear the Fog: Towards a Taxonomy of Self-Sovereign Identity Ecosystem Members 澄清迷雾:走向自我主权认同生态系统成员的分类

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647797

Kaja Schmidt, Alexander Mühle, Andreas Grüner, C. Meinel

引用次数: 5

Balancing Efficiency and Security for Network Access Control in Space-Air-Ground Integrated Networks 天空地一体化网络中网络接入控制的效率与安全平衡

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647772

Miao He, Xiangman Li, Jianbing Ni, Haomiao Yang

{"title":"Balancing Efficiency and Security for Network Access Control in Space-Air-Ground Integrated Networks","authors":"Miao He, Xiangman Li, Jianbing Ni, Haomiao Yang","doi":"10.1109/PST52912.2021.9647772","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647772","url":null,"abstract":"In this paper, we investigate the efficiency of network access control with the co-existence of multiple network operators and propose an efficient and secure network access control architecture (ESNAC) that offers fast identity authentication and access authorization in space-air-ground integrated networks. The major challenge lies in enabling multiple independent network operators to authorize and authenticate mobile users for network access in a secure and efficient way, even they are not mutually trusted. To address this challenge, we introduce an aggregate anonymous credential mechanism to enable a mobile user to present network access authorization of a group of network operators based on the consolidated anonymous credential that is aggregated from the partial anonymous credentials of the network operators. In addition, the efficient authentication of packet delivery is provided based on a sequential aggregate signature that allows each network operator to sign network packets for authentication and sequentially aggregate signatures for communication efficiency. Finally, we discuss the desired security properties of ESNAC and demonstrate its computational and communication efficiency by comparing with the conventional scheme without aggregation.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125024627","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Towards Privacy-Friendly Smart Products 迈向保护私隐的智能产品

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647826

Kimberly García, Zaira Zihlmann, S. Mayer, Aurelia Tamó-Larrieux, Johannes Hooss

{"title":"Towards Privacy-Friendly Smart Products","authors":"Kimberly García, Zaira Zihlmann, S. Mayer, Aurelia Tamó-Larrieux, Johannes Hooss","doi":"10.1109/PST52912.2021.9647826","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647826","url":null,"abstract":"Smart products, such as toy robots, must comply with multiple legal requirements of the countries they are sold and used in. Currently, compliance with the legal environment requires manually customizing products for different markets. In this paper, we explore a design approach for smart products that enforces compliance with aspects of the European Union’s data protection principles within a product’s firmware through a toy robot case study. To this end, we present an exchange between computer scientists and legal scholars that identified the relevant data flows, their processing needs, and the implementation decisions that could allow a device to operate while complying with the EU data protection law. By designing a data-minimizing toy robot, we show that the variety, amount, and quality of data that is exposed, processed, and stored outside a user’s premises can be considerably reduced while preserving the device’s functionality. In comparison with a robot designed using a traditional approach, in which 90% of the collected types of information are stored by the data controller or a remote service, our proposed design leads to the mandatory exposure of only 7 out of 15 collected types of information, all of which are legally required by the data controller to demonstrate consent. Moreover, our design is aligned with the Data Privacy Vocabulary, which enables the toy robot to cross geographic borders and seamlessly adjust its data processing activities to the local regulations.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116830740","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

The Race-Timing Prototype 比赛计时原型

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647804

Andrés Rainiero Hernández Coronado, Wonjun Lee, Wei-Ming Lin

{"title":"The Race-Timing Prototype","authors":"Andrés Rainiero Hernández Coronado, Wonjun Lee, Wei-Ming Lin","doi":"10.1109/PST52912.2021.9647804","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647804","url":null,"abstract":"The disclosure of transient execution attacks, such as Meltdown and Spectre, has once again highlighted the threat of cache side-channel configurations. It has now been demonstrated that the cache hierarchy of modern processors functions as a micro-architectural medium where the transient execution may leak private data, in addition to also serving as an attack surface that adversaries can use to directly spy on victim programs. As a response to tamper the effectiveness of cache side-channel configurations, hardware manufacturers, and most notably AMD, have now opted to reduce the processor’s cycle counter resolution to prevent adversaries from mounting side-channels in the higher levels of the cache hierarchy, specially in the L1D cache. This partially works because classic cache side-channel techniques, namely Prime+Probe or Flush+Reload, heavily rely on the processor’s cycle counter to detect changes in the cache state, which is normally done by tracking cache hits and misses. Yet, we present The Race-Timing Prototype to prove that devoted adversaries no longer rely on the processor’s cycle counter resolution to effectively distinguish cache hits from misses, and that a cache side-channel can still be configured by only utilizing controlled memory race conditions. In view that our implementation is hardware agnostic and does not rely on any proprietary instruction set extension, we demonstrate that our prototype works on processors from both Intel and AMD. Additionally, with propose a new semantic of Out-of-Order Detachment that further allows our Race-Timing measurements to closely match the accuracy of hardware Performance Monitoring Counters to distinguish fast L1D and L2 cache accesses in Intel processors. Ultimately, this work demonstrates that an adversary can exploit a cache side-channel with high-precision timing, and without utilizing cycle counters at all.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129756481","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Preparing for National Cyber Crises Using Non-linear Cyber Exercises 利用非线性网络演习为国家网络危机做准备

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647795

Florian Skopik, Maria Leitner

{"title":"Preparing for National Cyber Crises Using Non-linear Cyber Exercises","authors":"Florian Skopik, Maria Leitner","doi":"10.1109/PST52912.2021.9647795","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647795","url":null,"abstract":"Cyber exercises are a well-received and established means to strengthen the problem-solving skills of personnel and to prepare staff for future cyber incidents. While this concept seems to work for the majority of expected issues, where practicing the application of specific processes, tools and methods to mitigate the effects of large-scale cyber attacks is key, existing cyber exercise approaches are just of limited use for crises management. The reason for this lies in the very nature of a crisis. While ‘common’ incidents appear to be more predictable and can usually be dealt with thoroughly prepared standard procedures and well-rehearsed responses, crises however, are inherently uncertain, and off-the-shelf solutions may even be counterproductive. Complex decisions are to be made in short time-frames, influenced by a lot more stakeholders compared to internal incidents, including regulators, the media, and even the general public. These decisions can barely be guided by prepared plans or checklists, thus new forms of preparation are required, which challenge the participants to practice decision making under pressure, but further give them the opportunity to re-consider choices, walk alternative paths and enable them to find the best possible solution for a given situation. For this purpose, this paper discusses a new approach for non-linear cyber exercises, which allow branching points to develop a storyline, and employ new techniques, such as ‘Fast Forward’ to quickly progress to the critical stages of long-lasting crises, ‘Playback’ to consolidate gained skills, and ‘Pause-Adapt-Repeat’ to play through alternative paths. In this paper, we discuss limiting factors of today’s cyber exercises for large-scale cyber crises preparation, and introduce concepts for non-linear exercises to compensate these issues.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"9 6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125621888","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Deletion-Compliance in the Absence of Privacy 删除-在没有隐私的情况下的遵从

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647774

Jonathan Godin, Philippe Lamontagne

{"title":"Deletion-Compliance in the Absence of Privacy","authors":"Jonathan Godin, Philippe Lamontagne","doi":"10.1109/PST52912.2021.9647774","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647774","url":null,"abstract":"Garg, Goldwasser and Vasudevan (Eurocrypt 2020) invented the notion of deletion-compliance to formally model the “right to be forgotten’, a concept that confers individuals more control over their digital data. A requirement of deletion-compliance is strong privacy for the deletion requesters since no outside observer must be able to tell if deleted data was ever present in the first place. Naturally, many real world systems where information can flow across users are automatically ruled out.The main thesis of this paper is that deletion-compliance is a standalone notion, distinct from privacy. We present an alternative definition that meaningfully captures deletion-compliance without any privacy implications. This allows broader class of data collectors to demonstrate compliance to deletion requests and to be paired with various notions of privacy. Our new definition has several appealing properties:•It is implied by the stronger definition of Garg et al. under natural conditions, and is equivalent when we add a strong privacy requirement.•It is naturally composable with minimal assumptions.•Its requirements are met by data structure implementations that do not reveal the order of operations, a concept known as history-independence.Along the way, we discuss the many challenges that remain in providing a universal definition of compliance to the “right to be forgotten.”","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133708489","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Deterministic and Statistical Strategies to Protect ANNs against Fault Injection Attacks 防范故障注入攻击的确定性和统计策略

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647763

Troya Çağıl Köylü, C. Reinbrecht, S. Hamdioui, M. Taouil

引用次数: 2

PUPy: A Generalized, Optimistic Context Detection Framework for Implicit Authentication PUPy:一种用于隐式认证的广义乐观上下文检测框架

2021 18th International Conference on Privacy, Security and Trust (PST) Pub Date : 2021-12-13 DOI: 10.1109/PST52912.2021.9647739

Matthew Rafuse, U. Hengartner

{"title":"PUPy: A Generalized, Optimistic Context Detection Framework for Implicit Authentication","authors":"Matthew Rafuse, U. Hengartner","doi":"10.1109/PST52912.2021.9647739","DOIUrl":"https://doi.org/10.1109/PST52912.2021.9647739","url":null,"abstract":"Devices like smartphones and laptops employ some form of user authentication to ensure that access to confidential data by the wrong user is avoided. Implicit authentication aims to limit the number of explicit authentications that a user is subjected to by using passive approaches to authenticate the user. Context detection frameworks aim to reduce explicit authentications by disabling explicit authentication entirely when appropriate. Since explicit and implicit authentication are not mutually exclusive, we can also use context detection frameworks to decide whether explicit or implicit authentication should be used when authentication is required. We present a novel context detection framework, PUPy, that uses sensed context data to infer and make available three values–privacy, unfamiliarity, and proximity–allowing clients of our framework, like authentication services, to better adapt to different contexts. As opposed to existing work, our context detection framework is based on an optimistic approach to context detection. Our assumption is that the absence of data, like the inability to detect nearby people or devices, can be taken as a sign that a context is safe. Such an optimistic approach may provide less security than a pessimistic approach, but provides a significantly improved user experience due to reducing the number of explicit authentications. We provide an Android implementation of the framework, including an API that allows other developers to contribute modules to the system. We also conduct a statistical analysis of our framework based on a large real-world dataset. We find that PUPy compares favourably to existing works, permitting a 77.2% reduction in the number of explicit authentications.","PeriodicalId":144610,"journal":{"name":"2021 18th International Conference on Privacy, Security and Trust (PST)","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126355143","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0