2012 IEEE Sixth International Conference on Software Security and Reliability Companion最新文献_第2页

A Novel Security Scheme for Online Banking Based on Virtual Machine 一种基于虚拟机的网上银行安全方案

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.28

Bei Guan, Y. Wu, Yongji Wang

{"title":"A Novel Security Scheme for Online Banking Based on Virtual Machine","authors":"Bei Guan, Y. Wu, Yongji Wang","doi":"10.1109/SERE-C.2012.28","DOIUrl":"https://doi.org/10.1109/SERE-C.2012.28","url":null,"abstract":"Current online banking scheme built on ordinary software stack, which comprises of the operating system and its applications running on it, is facing attacks including Phishing, Pharming, Malicious Software Attacks (MSW), Man in the Middle Attacks (MITM) and Key logger. Today's countermeasures either prevent only part of these attacks or have high cost on performance and usability. In this paper, we introduce the Domain Online Banking (DOBank), a novel security scheme for online banking that combines the virtual machine (VM) technology with web services. Firstly, DOBank encapsulates the banking service into a lightweight domain and protects it from any attacks caused by virus from the user's host. Secondly, the domain can access certain hardware devices exclusively against Key logger and gains nearly native performance using the pass through technology. Finally, we use the virtual Trusted Platform Module (vTPM) for the online banking domain's integrity verification as well as the SSL/TLS (Security Sockets Layer/Transport Layer Security) protocol for the confidentiality of data transaction over the internet. We show that this scheme is secure enough to prevent typical viruses that threaten the online banking. The experiments on the network throughput and the time consumed of integrity measurement show it adds little overhead to the overall system.","PeriodicalId":403736,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability Companion","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133270431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Revising a Security Tactics Hierarchy through Decomposition, Reclassification, and Derivation 通过分解、重分类和派生来修正安全策略层次结构

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.18

J. Ryoo, P. Laplante, R. Kazman

{"title":"Revising a Security Tactics Hierarchy through Decomposition, Reclassification, and Derivation","authors":"J. Ryoo, P. Laplante, R. Kazman","doi":"10.1109/SERE-C.2012.18","DOIUrl":"https://doi.org/10.1109/SERE-C.2012.18","url":null,"abstract":"Software architecture is the set of important design decisions that address cross-cutting system quality attributes such as security, reliability, availability, and performance. Practitioners often face difficulty in beginning an architectural design due to the lack of concrete building blocks available to them. Tactics are fundamental design decisions and play the role of these initial design primitives and complement the existing design constructs such as architectural or design patterns. A tactic is a relatively new design concept, and tactics repositories are still being developed. However, the maturity of these repositories is inconsistent, and varies depending on the quality attribute. To address this inconsistency and to promote a more rigorous, repeatable method for creating and revising tactics hierarchies, we propose a novel methodology of extracting tactics. This methodology, we claim, can accelerate the development of tactics repositories that are truly useful to practitioners. We discuss three approaches for extracting these tactics. The first is to derive new tactics from the existing ones. The second is to decompose an existing architectural pattern into its constituent tactics. Finally, we extract tactics that have been misidentified as patterns. Among the many types of tactics available, this paper focuses on security tactics. Using our methodology, we revise a well-known taxonomy of security tactics. We contend that the revised hierarchy is complete enough for use in practical applications.","PeriodicalId":403736,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability Companion","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130550912","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 17

Invalid Pointer Dereferences Detection for CPS Software Based on Extended Pointer Structures 基于扩展指针结构的CPS软件无效指针解引用检测

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.30

Longming Dong, Wei Dong, Liqian Chen

引用次数: 0

A Framework for Automated Security Testing of Android Applications on the Cloud 基于云的Android应用程序自动安全测试框架

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.39

S. Malek, N. Esfahani, Thabet Kacem, Riyadh Mahmood, Nariman Mirzaei, A. Stavrou

{"title":"A Framework for Automated Security Testing of Android Applications on the Cloud","authors":"S. Malek, N. Esfahani, Thabet Kacem, Riyadh Mahmood, Nariman Mirzaei, A. Stavrou","doi":"10.1109/SERE-C.2012.39","DOIUrl":"https://doi.org/10.1109/SERE-C.2012.39","url":null,"abstract":"App markets are stirring a paradigm shift in the way software is provisioned to the end users. The benefits of this model are plenty, including the ability to rapidly and effectively acquire, introduce, maintain, and enhance software used by the consumers. This paradigm shift, however, has given rise to a new set of security challenges. In parallel with the emergence of app markets, we have witnessed increased security threats that are exploiting this model of provisioning software. The key obstacle is the ability to rapidly assess the security and robustness of applications submitted to the market. The problem is that security testing is generally a manual, expensive, and cumbersome process. This is precisely the challenge that we have begun to address in a project targeted at the development of a framework that aids the analysts in testing the security of Android apps. The framework is comprised of a tool-suite that given an application automatically generates and executes numerous test cases, and provides a report of uncovered security vulnerabilities to the human analyst.","PeriodicalId":403736,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability Companion","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123000405","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

Bodhi: Detecting Buffer Overflows with a Game 菩提:检测缓冲区溢出的游戏

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.35

Jing Chen, Xiaoguang Mao

引用次数: 4

A Survey of Software Testing in the Cloud 云中的软件测试综述

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.32

Koray Inçki, Ismail Ari, Hasan Sözer

引用次数: 91

Thinking Towards a Pattern Language for Predicate Based Encryption Crypto-Systems 基于谓词的加密系统模式语言的思考

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.34

Jan de Muijnck-Hughes, I. Duncan

引用次数: 5

A Privacy Preserving Smart Metering System Supporting Multiple Time Granularities 一种支持多时间粒度的隐私保护智能计量系统

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.22

Hsiao-Ying Lin, Shiuan-Tzuo Shen, B. Lin

{"title":"A Privacy Preserving Smart Metering System Supporting Multiple Time Granularities","authors":"Hsiao-Ying Lin, Shiuan-Tzuo Shen, B. Lin","doi":"10.1109/SERE-C.2012.22","DOIUrl":"https://doi.org/10.1109/SERE-C.2012.22","url":null,"abstract":"Advanced smart meters generate meter readings in a time unit less than a second. Fine-grained meter readings enable various smart grid applications, such as load monitoring, automatic billing, and power generation planning. However, those meter readings threaten individuals' privacy by revealing details of one's daily activities. The time granularity of smart meters is often much finer than the one a smart grid application demands. Thus, the storage and access control mechanisms of meter readings are critical to balancing privacy requirements and application functionalities. Previous studies address the issue by considering a locally trusted storage device and using cryptographic primitives. We consider a storage outsourcing scenario, where the external storage environment is semi-trusted. We construct a privacy preserving metering system by using a trusted platform module in a smart meter and pseudorandom number generators inside the module. Our system guarantees the secure storage of meter readings and supports multiple time granularities. In our system, a user grants a service provider an access right over meter readings at a time granularity S. The granted service provider is only allowed to get the power consumption at a time unit of the granted time granularity. Our system provides a simple yet very practical solution to the privacy preserving smart metering system. Moreover, we provide a privacy model to capture the privacy requirement and show that our system is privacy preserving against honest-but-curious service providers.","PeriodicalId":403736,"journal":{"name":"2012 IEEE Sixth International Conference on Software Security and Reliability Companion","volume":"78 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131298329","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 12

Testing is an Event-Centric Activity 测试是一个以事件为中心的活动

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.24

F. Belli, Mutlu Beyazit, A. Memon

引用次数: 21

Virtual Machine Replay Update: Improved Implementation for Modern Hardware Architecture 虚拟机重放更新:现代硬件架构的改进实现

2012 IEEE Sixth International Conference on Software Security and Reliability Companion Pub Date : 2012-06-20 DOI: 10.1109/SERE-C.2012.26

Jiageng Yu, Peng Zhou, Y. Wu, Chen Zhao

引用次数: 4