2013 International Conference on Availability, Reliability and Security最新文献_第3页

Estimating the Value of Personal Information with SNS Utility 利用SNS效用估算个人信息的价值

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.67

Memiko Ootsuki, N. Sonehara

引用次数: 10

Run-Time Risk Management in Adaptive ICT Systems 自适应ICT系统的运行时风险管理

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.20

M. Surridge, B. Nasser, Xiaoyu Chen, A. Chakravarthy, P. Melas

引用次数: 13

Reputation-Controlled Business Process Workflows 声誉控制的业务流程工作流

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.11

B. Aziz, G. Hamilton

引用次数: 2

Revisiting Circuit Clogging Attacks on Tor 重新审视对Tor的电路阻塞攻击

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.17

Eric Chan-Tin, Ji-Ahn Shin, Jiangmin Yu

{"title":"Revisiting Circuit Clogging Attacks on Tor","authors":"Eric Chan-Tin, Ji-Ahn Shin, Jiangmin Yu","doi":"10.1109/ARES.2013.17","DOIUrl":"https://doi.org/10.1109/ARES.2013.17","url":null,"abstract":"Tor is a popular anonymity-providing network used by over 500,000 users daily. The Tor network is made up of volunteer relays. To anonymously connect to a server, a user first creates a circuit, consisting of three relays, and routes traffic through these proxies before connecting to the server. The client is thus hidden from the server through three Tor proxies. If the three Tor proxies used by the client could be identified, the anonymity of the client would be reduced. One particular way of identifying the three Tor relays in a circuit is to perform a circuit clogging attack. This attack requires the client to connect to a malicious server (malicious content, such as an advertising frame, can be hosted on a popular server). The malicious server alternates between sending bursts of data and sending little traffic. During the burst period, the three relays used in the circuit will take longer to relay traffic due to the increase in processing time for the extra messages. If Tor relays are continuously monitored through network latency probes, an increase in network latency indicates that this Tor relay is likely being used in that circuit. We show, through experiments on the real Tor network, that the Tor relays in a circuit can be identified. A detection scheme is also proposed for clients to determine whether a circuit clogging attack is happening. The costs for both the attack and the detection mechanism are small and feasible in the current Tor network.","PeriodicalId":302747,"journal":{"name":"2013 International Conference on Availability, Reliability and Security","volume":"115 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123455991","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 14

A Problem-Based Threat Analysis in Compliance with Common Criteria 符合通用标准的基于问题的威胁分析

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.21

Kristian Beckers, Denis Hatebur, M. Heisel

{"title":"A Problem-Based Threat Analysis in Compliance with Common Criteria","authors":"Kristian Beckers, Denis Hatebur, M. Heisel","doi":"10.1109/ARES.2013.21","DOIUrl":"https://doi.org/10.1109/ARES.2013.21","url":null,"abstract":"In order to gain their customers' trust, software vendors can certify their products according to security standards, e.g., the Common Criteria (ISO 15408). A Common Criteria certification requires a comprehensible documentation of the software product, including a detailed threat analysis. In our work, we focus on improving that threat analysis. Our method is based upon an attacker model, which considers attacker types like software attacker that threaten only specific parts of a system. We use OCL expressions to check if all attackers for a specific domain have been considered. For example, we propose a computer-aided method that checks if all software systems have either considered a software attacker or documented an assumption that excludes software attackers. Hence, we propose a structured method for threat analysis that considers the Common Criteria's (CC) demands for documentation of the system in its environment and the reasoning that all threats are discovered. We use UML4PF, a UML profile and support tool for Jackson's problem frame method and OCL for supporting security reasoning, validation of models, and also to generate Common Criteria-compliant documentation. Our threat analysis method can also be used for threat analysis without the common criteria, because it uses a specific part of the UML profile that can be adapted to other demands with little effort. We illustrate our approach with the development of a smart metering gateway system.","PeriodicalId":302747,"journal":{"name":"2013 International Conference on Availability, Reliability and Security","volume":"52 1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123458551","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

Some General Properties of Multi-state Physical Models 多态物理模型的一些一般性质

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.96

P. Rocchi, G. Tsitsiashvili

引用次数: 0

Overview of Recent Advances in CCTV Processing Chain in the INDECT and INSIGMA Projects CCTV处理链在INDECT和INSIGMA项目中的最新进展综述

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.112

A. Dziech, Jaroslaw Bialas, A. Glowacz, Pawel Korus, M. Leszczuk, Andrzej Matiolański, R. Baran

引用次数: 6

Scope of Security Properties of Sanitizable Signatures Revisited 重新讨论可消毒液签名的安全属性范围

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.26

H. Meer, H. C. Pöhls, J. Posegga, Kai Samelin

{"title":"Scope of Security Properties of Sanitizable Signatures Revisited","authors":"H. Meer, H. C. Pöhls, J. Posegga, Kai Samelin","doi":"10.1109/ARES.2013.26","DOIUrl":"https://doi.org/10.1109/ARES.2013.26","url":null,"abstract":"Sanitizable signature schemes allow for altering signed data in a signer-controlled way by a semi-trusted third party. This is contrary to standard digital signature schemes, which do not permit any modifications by any party without invalidating the signature. Due to transparency, a strong privacy notion, outsiders cannot see if the signature for a message was created by the signer or by the semi-trusted party. Accountability allows the signer to prove to outsiders if a message was original or touched by the semi-trusted party. Currently, block-level accountability requires to drop transparency. We allow for accountability for sanitizable signatures with transparency on the block-level. Additionally, we generalize the concept of block-level properties to groups. This offers a even more fine-grained control and leads to more efficient schemes. We prove that group-level definitions imply both the block-level and message-level notions. We derive a provably secure construction, achieving our enhanced notions. A further modification of our construction achieves efficient group-level non-interactive public accountability. This construction only requires a constant amount of signature generations to achieve this property. Finally, we have implemented our constructions and the scheme introduced by Brzuska et al. at PKC '09 and provide a detailed performance analysis of our reference implementations.","PeriodicalId":302747,"journal":{"name":"2013 International Conference on Availability, Reliability and Security","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116176608","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 12

Federated Identity Management and Usage Control - Obstacles to Industry Adoption 联邦身份管理和使用控制——行业采用的障碍

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.10

Jostein Jensen, Åsmund Ahlmann Nyre

引用次数: 1

Detection of Hidden Fraudulent URLs within Trusted Sites Using Lexical Features 使用词法功能检测可信站点内隐藏的欺诈性url

2013 International Conference on Availability, Reliability and Security Pub Date : 2013-09-02 DOI: 10.1109/ARES.2013.31

E. Sorio, Alberto Bartoli, Eric Medvet

引用次数: 16