Search

Mobile communication is becoming the mainstream with the rapid growth of mobile devices penetrating our daily life. More and more mobile devices such as mobile phones, personal digital assistants, notebooks etc, are capable of Internet access. Mobile devices frequently change their communication IP addresses in mobile IPv6 network following its current attached domain. This raises a big challenge for building firewall for mobile devices. The conventional firewalls are primarily based on IPv4 networks where the security criteria are specified only to the fixed IP addresses or subnets, which apparently do not apply to mobile IPv6. In this paper we propose three solutions for mobile IPv6 firewall. Our approaches make the firewall adaptive to dynamic IP addresses in mobile IPv6 network. They have different expense and weight corresponding to different degree of universality. The paper focuses the study more from practical aspect. [ABSTRACT FROM AUTHOR]

Distributed Denial of Service (DDoS) attack poses a severe threat to the Internet. It is difficult to find the exact signature of attacking. Moreover, it is hard to distinguish the difference of an unusual high volume of traffic which is caused by the attack or occurs when a huge number of users occasionally access the target machine at the same time. The entropy detection method is an effective method to detect the DDoS attack. It is mainly used to calculate the distribution randomness of some attributes in the network packets' headers. In this paper, we focus on the detection technology of DDoS attack. We improve the previous entropy detection algorithm, and propose two enhanced detection methods based on cumulative entropy and time, respectively. Experiment results show that these methods could lead to more accurate and effective DDoS detection. [ABSTRACT FROM AUTHOR]

Autonomous spreading malware in the form of worms or bots has become a severe threat in today's Internet. Collecting the sample as early as possible is a necessary precondition for the further treatment of the spreading malware, e.g., to develop antivirus signatures. In this paper, we present an integrated toolkit called HoneyBow, which is able to collect autonomous spreading malware in an automated manner using high-interaction honeypots. Compared to low-interaction honeypots, HoneyBow has several advantages due to a wider range of captured samples and the capability of collecting malware which propagates by exploiting new vulnerabilities. We validate the properties of HoneyBow with experimental data collected during a period of about nine months, in which we collected thousands of malware binaries. Furthermore, we demonstrate the capability of collecting new malware via a case study of a certain bot. [ABSTRACT FROM AUTHOR]

Crash implies that a software is unstable and possibly vulnerable. Stack overflow is one of many causes of crashes. This kind of bug is often hard to debug because of the corrupted stack, so that debuggers cannot trace the control flow of the programs. A control-type crash caused by stack overflow is easy to be developed as a control interception attack. We develop a method to locate this attack and implement it as a plug-in of Valgrind [1]. This tool can be used in the honeypot to detect and diagnose zero-day exploits. We use it to detect several vulnerabilities and automatically locate the bugs. [ABSTRACT FROM AUTHOR]

In this paper, we present a new approach called Secure Virtual Execution Environment (SVEE) which enables users to "try out" untrusted software without the fear of damaging the system in any manner. A key feature of SVEE is that it implements the OS isolation by executing untrusted code in a hosted virtual machine. Another key feature is that SVEE faithfully reproduces the behavior of applications, as if they were running natively on the underlying host OS. SVEE also provides a convenient way to compare the changes within SVEE and host OS. Referring to these comparison results, users can make a decision to commit these changes or not. With these powerful characteristics, SVEE supports a wide range of tasks, including the study of malicious code, controlled execution of untrusted software and so on. This paper focuses on the execution model of SVEE and the security evaluation for this model. [ABSTRACT FROM AUTHOR]

The Trusted Mobile Platform (TMP) is developed and promoted by the Trusted Computing Group (TCG), which is an industry standard body to enhance the security of the mobile computing environment. The built-in SHA-1 engine in TMP is one of the most important circuit blocks and contributes the performance of the whole platform because it is used as key primitives supporting platform integrity and command authentication. Mobile platforms have very stringent limitations with respect to available power, physical circuit area, and cost. Therefore special architecture and design methods for low power SHA-1 circuit are required. In this paper, we present a novel and efficient hardware architecture of low power SHA-1 design for TMP. Our low power SHA-1 hardware can compute 512-bit data block using less than 7,000 gates and has a power consumption about 1.1 mA on a 0.25μm CMOS process. [ABSTRACT FROM AUTHOR]

The BIOS's security threats to computer system are analyzed and security requirements for firmware BIOS are summarized in this paper. Through discussion about TCG's trust transitivity, a new approach about CRTM implementation based on BIOS is developed. In this paper, we also put forward a new trusted BIOS architecture-UTBIOS which is built on Intel Framework for EFI/UEFI. The trustworthiness of UTBIOS is based on trusted hardware TPM. In UTBIOS, trust encapsulation and trust measurement are used to construct pre-OS trust chain. Performance of trust measurement is also analyzed in the end. [ABSTRACT FROM AUTHOR]

Non-interference properties are an important class of security properties. Many different non-interference properties have been presented based on different underlying models including the process algebraic languages. Usually, in specifying the non-interference properties using process algebraic languages, a specific semantic equivalence is introduced. Though weak bisimulation based non-interference properties have been studied extensively, it is not always satisfactory. This paper considers the topic on pursuing a probably more suitable semantic equivalence for specifying the non-interference properties. We find several alternatives, e.g., should testing equivalence, impossible future equivalence and possible future equivalence, etc. As another topic in the paper, based on the structural operational semantics, we suggest a compositional rule format, the SISNNI format, for an impossible future equivalence based non-interference property, i.e., the SISNNI property. We show that the SISNNI property is compositional in any SISNNI languages, i.e., languages in the SISNNI format. [ABSTRACT FROM AUTHOR]

SMS4 is a 32-round block cipher with a 128-bit block size and a 128-bit user key. It is used in WAPI, the Chinese WLAN national standard. In this paper, we present a rectangle attack on 14-round SMS4, and an impossible differential attack on 16-round SMS4. These are better than any previously known cryptanalytic results on SMS4 in terms of the numbers of attacked rounds. [ABSTRACT FROM AUTHOR]

Traffic traces are generally anonymized before used in analysis. Prefix-preserving anonymization is often used to avoid privacy issues as well as preserve prefix relationship after anonymization. To facilitate research on real time high speed network traffic, address anonymization algorithm should be fast and consistent. In this paper, the bit string based algorithm and the embedded bit string algorithm will be introduced. Bit string based algorithm uses precomputed bit string to improve the anonymization performance. Instead of only using the LSB of each Rijndael output, the embedded bit string algorithm will take advantage of the full size Rijndael output to anonymize several bits at the same time. The implementation can be downloaded from https://sourceforge.net/projects/ipanon. [ABSTRACT FROM AUTHOR]

CLEFIA is a new 128-bit block cipher proposed by SONY corporation recently. The fundamental structure of CLEFIA is a generalized Feistel structure consisting of 4 data lines. In this paper, the strength of CLEFIA against the differential fault attack is explored. Our attack adopts the byte-oriented model of random faults. Through inducing randomly one byte fault in one round, four bytes of faults can be simultaneously obtained in the next round, which can efficiently reduce the total induce times in the attack. After attacking the last several rounds' encryptions, the original secret key can be recovered based on some analysis of the key schedule. The data complexity analysis and experiments show that only about 18 faulty ciphertexts are needed to recover the entire 128-bit secret key and about 54 faulty ciphertexts for 192/256-bit keys. [ABSTRACT FROM AUTHOR]

Experimental testing shows that the relative relation in the number of samples among the neighboring bins and the audio frequency centroid are two robust features to the Time Scale Modification (TSM) attacks. Accordingly, an audio watermark algorithm based on frequency centroid and histogram is proposed by modifying the frequency coefficients. The audio histogram with equal-sized bins is extracted from a selected frequency coefficient range referred to the audio centroid. The watermarked audio signal is perceptibly similar to the original one. The experimental results show that the algorithm is very robust to resample TSM and a variety of common attacks. Subjective quality evaluation of the algorithm shows that embedded watermark introduces low, inaudible distortion of host audio signal. [ABSTRACT FROM AUTHOR]

Checking whether a committed integer lies in a specific interval has many cryptographic applications. In Eurocrypt'98, Chan et al. proposed an instantiation (CFT Proof). Based on CFT, Boudot presented a popular range-bounded commitment scheme in Eurocrypt'2000. Both CFT Proof and Boudot Proof are based on the encryption $E(x, r)=g^xh^r\ \mbox{mod}\ n$, where n is an RSA modulus whose factorization is unknown by the prover. They did not use a single base as usual. Thus an increase in cost occurs. In this paper, we show that it suffices to adopt a single base. The cost of the modified Boudot Proof is about half of that of the original scheme. Moreover, the key restriction in the original scheme, i.e., both the discrete logarithm of g in base h and the discrete logarithm of h in base g are unknown by the prover, which is a potential menace to the Boudot Proof, is definitely removed. [ABSTRACT FROM AUTHOR]

In this paper, a square like attack on Camellia is presented, by which 9-round 128-bit key Camellia without FL/FL− 1 functions layer and whitening is breakable with complexity of 2 86.9 encryptions and 266 data and 12-round 256-bit key Camellia without FL/FL− 1 function layer and whitening is breakable with the complexity of 2250.8 encryptions and 266 data. And we can also apply such method to block cipher having XORing sBoxes in diffusion layer. [ABSTRACT FROM AUTHOR]

Homomorphism based multiparty computation techniques are studied in this paper as they have several advantages over the other multiparty computation schemes. A new homomorphism based multiparty computation technique is proposed to evaluate functions in DNF form. The new technique exploits homomorphism of a certain sealing function to evaluate a function in DNF. The new technique has two advantages over the existing homomorphism based multiparty computation schemes. Firstly, it supports any input format. Secondly, a general method to reduce any function to DNFs is proposed in this paper. With this method, functions like the famous millionaire problem can be reduced to DNFs and efficiently evaluated. Security of the new scheme is formally defined in the static active adversary model and proved in a new simulation model. [ABSTRACT FROM AUTHOR]

This paper proposed a robust watermarking scheme based on discrete wavelet transform to hide a grayscale watermark in a digital image for image authentication. The proposed scheme employed toral automorphism to scramble the host image and the watermark so as to enhance the security and fidelity of the embedded watermark. Later, the permuted watermark and the permuted host image were transformed by discrete wavelet transform. Next, the transformed watermark was concealed in the low frequency coefficient of the transformed image by using the concept of codebook matching. Simulation results showed that the required extra storage of the proposed scheme for extracting the watermark was lower than that of Lu et al.'s scheme. In addition, the extracted watermark image quality of the proposed methods was better than that of Shieh et al.'s scheme. According to the experimental results, the proposed scheme indeed outperformed Shieh et al.'s and Lu et al.'s schemes. Moreover, the proposed scheme was robust to various attacks, such as JPEG compression, Gaussian blurred, sharpening, cropping, brightness, contrast enhancement, rotation, and so on. [ABSTRACT FROM AUTHOR]

String matching algorithm is one of the key technologies in numerous network security applications and systems. Nowadays, the increasing network bandwidth and pattern set size both calls for high speed string matching algorithm for large-scale pattern set. This paper proposes a novel algorithm called Multi-phase Dynamic Hash (MDH), which cut down the memory requirement by multi-phase hash and explore valuable pattern set information to speed up searching procedure by dynamic-cut heuristics. The experimental results demonstrate that MDH can improve matching performance by 100% to 300% comparing with other popular algorithms, whereas the memory requirement stays in a comparatively low level. [ABSTRACT FROM AUTHOR]

In recent years, a privacy model called k-anonymity has gained popularity in the microdata releasing. As the microdata may contain multiple sensitive attributes about an individual, the protection of multiple sensitive attributes has become an important problem. Different from the existing models of single sensitive attribute, extra associations among multiple sensitive attributes should be invested. Two kinds of disclosure scenarios may happen because of logical associations. The Q&SDiversity is checked to prevent the foregoing disclosure risks, with an α Requirement definition used to ensure the diversity requirement. At last, a two-step greedy generalization algorithm is used to carry out the multiple sensitive attributes processing which deal with quasi-identifiers and sensitive attributes respectively. We reduce the overall distortion by the measure of Masking SA. [ABSTRACT FROM AUTHOR]

Digital copies are susceptible to theft and vulnerable to leakage, copying, or manipulation. When someone (or some group), who has stolen, leaked, copied, or manipulated digital documents propagates the documents over the Internet and/or distributes those through physical distribution channels many challenges arise which document holders must overcome in order to mitigate the impact to their privacy or business. This paper focuses on the propagation problem of digital credentials, which may contain sensitive information about a credential holder. Existing work such as access control policies and the Platform for Privacy Preferences (P3P) assumes that qualified or certified credential viewers are honest and reliable. The proposed approach in this paper uses short-lived credentials based on reverse forward secure signatures to remove this assumption and mitigate the damage caused by a dishonest or honest but compromised viewer. [ABSTRACT FROM AUTHOR]

We construct a short group signature which is proven secure without random oracles. By making certain reasonable assumptions and applying the technique of non-interactive proof system, we prove that our scheme is full anonymity and full traceability. Compared with other related works, such as BW06 [9], BW07 [10], ours is more practical due to the short size of both public key and group signature. [ABSTRACT FROM AUTHOR]