2021 IEEE Secure Development Conference (SecDev)最新文献

Android Remote Unlocking Service using Synthetic Password: A Hardware Security-preserving Approach 基于合成密码的Android远程解锁服务:一种硬件安全保护方法

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00025

Sungmin Lee, Y. Jung, Jae-hwi Lee, Byoungyoung Lee, T. Kwon

{"title":"Android Remote Unlocking Service using Synthetic Password: A Hardware Security-preserving Approach","authors":"Sungmin Lee, Y. Jung, Jae-hwi Lee, Byoungyoung Lee, T. Kwon","doi":"10.1109/SecDev51306.2021.00025","DOIUrl":"https://doi.org/10.1109/SecDev51306.2021.00025","url":null,"abstract":"Remote unlocking for Android devices may benefit both users and manufacturers. Users can continue using the device without factory-resetting when they unexpectedly forget their passphrases. Manufacturers can improve non-face-to-face customer services in the COVID-19 era. Nevertheless, not many manufacturers support remote unlocking services for Android devices. If the remote unlocking service is triggered by requests over-the-air, it may increase the attack surface of Android security. Android security is hardware-based (e.g., hardware-backed Keystore), so we seek to preserve this security level by designing a new remote unlocking service without modifying trusted execution environments. Our design supports two-factor authentication, distributed authority, trust-boundary minimization, and key management. Since a synthetic password used for remote unlocking is not exposed to the outside of an Android device, the manufacturer still cannot unlock the device without user consent. We identify 208 security threats in the proposed remote unlocking service using the STRIDE model and ensure that our design has countermeasures for all high-level security threats. After passing quality verification and penetration tests, the proposed remote unlocking service has been officially installed on commercial devices.","PeriodicalId":154122,"journal":{"name":"2021 IEEE Secure Development Conference (SecDev)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129925572","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Shhh!: 12 Practices for Secret Management in Infrastructure as Code 嘘!:以代码形式进行基础设施秘密管理的12个实践

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00024

A. Rahman, F. Barsha, P. Morrison

引用次数: 5

Hands-on Tutorial: How Exploitable is Insecure C Code? 动手教程:不安全的C代码是如何被利用的?

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00015

David Svoboda

引用次数: 0

Automated Threat Analysis and Management in a Continuous Integration Pipeline 持续集成管道中的自动威胁分析和管理

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00021

Laurens Sion, D. Landuyt, Koen Yskout, Stef Verreydt, W. Joosen

{"title":"Automated Threat Analysis and Management in a Continuous Integration Pipeline","authors":"Laurens Sion, D. Landuyt, Koen Yskout, Stef Verreydt, W. Joosen","doi":"10.1109/SecDev51306.2021.00021","DOIUrl":"https://doi.org/10.1109/SecDev51306.2021.00021","url":null,"abstract":"Security and privacy threat modeling is commonly applied to systematically identify and address design-level security and privacy concerns in the early stages of architecture and design. Identifying and resolving these threats should remain a continuous concern during the development lifecycle. Especially with contemporary agile development practices, a single-shot upfront analysis becomes quickly outdated. Despite it being explicitly recommended by experts, existing threat modeling approaches focus largely on early development phases and provide limited support during later implementation phases.In this paper, we present an integrated threat analysis toolchain to support automated, continuous threat elicitation, assessment, and mitigation as part of a continuous integration pipeline in the GitLab DevOps platform. This type of automation allows for continuous attention to security and privacy threats during development at the level of individual commits, supports monitoring and managing the progress in addressing security and privacy threats over time, and enables more advanced and fine-grained analyses such as assessing the impact of proposed changes in different code branches or merge/pull requests by analyzing the changes to the threat model.","PeriodicalId":154122,"journal":{"name":"2021 IEEE Secure Development Conference (SecDev)","volume":"66 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116382268","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

Towards Zero Trust: An Experience Report 迈向零信任:经验报告

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00027

Jason Lowdermilk, S. Sethumadhavan

引用次数: 1

Tutorial: Making C Programs Safer with Checked C 教程:使用Checked C使C程序更安全

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00018

Jie Zhou, M. Hicks, Yudi Yang, J. Criswell

引用次数: 0

[Title page i] [标题页i]

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/secdev51306.2021.00001

引用次数: 0

Compressing Network Attack Surfaces for Practical Security Analysis 压缩网络攻击面用于实际安全分析

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00020

D. Everson, Long Cheng

引用次数: 0

[Title page iii] [标题页iii]

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/secdev51306.2021.00002

引用次数: 0

Analyzing OpenAPI Specifications for Security Design Issues 分析安全设计问题的OpenAPI规范

2021 IEEE Secure Development Conference (SecDev) Pub Date : 2021-10-01 DOI: 10.1109/SecDev51306.2021.00019

C. Cheh, Binbin Chen

{"title":"Analyzing OpenAPI Specifications for Security Design Issues","authors":"C. Cheh, Binbin Chen","doi":"10.1109/SecDev51306.2021.00019","DOIUrl":"https://doi.org/10.1109/SecDev51306.2021.00019","url":null,"abstract":"Modern web and mobile applications rely on an ever increasing set of services defined by their respective API (Application Programming Interface) specifications. The complexity of today’s APIs, in terms of scale and inter-dependency, poses a challenge for security analyses as it requires much manual effort to conduct a check for design flaws. In this work, we leverage the standardized OpenAPI specification as input and propose a semi-automatic approach to infer various key information about that API specification’s security issues. Our case study based on the OpenAPI specification of the Open Bank Project (consisting of 304 API calls and 402 data fields) shows that our approach can: 1) identify sensitive and insensitive data fields, 2) identify insecure or high-risk API calls that may leak sensitive data, and 3) calculate the exposure level of each data field and API call. In particular, we identified 31 sensitive data fields, 29 insufficiently protected API calls that access a subset of those sensitive data, and 34 high-risk API calls that may result in sensitive data exposure. Furthermore, our exposure level calculation shows that transactions-related fields generally have higher exposure level, hence requiring more scrutiny.","PeriodicalId":154122,"journal":{"name":"2021 IEEE Secure Development Conference (SecDev)","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134008170","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1