1,914 research outputs found
Device-Based Isolation for Securing Cryptographic Keys
In this work, we describe an eective device-based isolation
approach for achieving data security. Device-based isolation
leverages the proliferation of personal computing devices to
provide strong run-time guarantees for the condentiality of
secrets. To demonstrate our isolation approach, we show its
use in protecting the secrecy of highly sensitive data that
is crucial to security operations, such as cryptographic keys
used for decrypting ciphertext or signing digital signatures.
Private key is usually encrypted when not used, however,
when being used, the plaintext key is loaded into the memory
of the host for access. In our threat model, the host may
be compromised by attackers, and thus the condentiality of
the host memory cannot be preserved. We present a novel
and practical solution and its prototype called DataGuard to
protect the secrecy of the highly sensitive data through the
storage isolation and secure tunneling enabled by a mobile
handheld device. DataGuard can be deployed for the key
protection of individuals or organizations
Towards Secure and Safe Appified Automated Vehicles
The advancement in Autonomous Vehicles (AVs) has created an enormous market
for the development of self-driving functionalities,raising the question of how
it will transform the traditional vehicle development process. One adventurous
proposal is to open the AV platform to third-party developers, so that AV
functionalities can be developed in a crowd-sourcing way, which could provide
tangible benefits to both automakers and end users. Some pioneering companies
in the automotive industry have made the move to open the platform so that
developers are allowed to test their code on the road. Such openness, however,
brings serious security and safety issues by allowing untrusted code to run on
the vehicle. In this paper, we introduce the concept of an Appified AV platform
that opens the development framework to third-party developers. To further
address the safety challenges, we propose an enhanced appified AV design schema
called AVGuard, which focuses primarily on mitigating the threats brought about
by untrusted code, leveraging theory in the vehicle evaluation field, and
conducting program analysis techniques in the cybersecurity area. Our study
provides guidelines and suggested practice for the future design of open AV
platforms
Performance assessment of security mechanisms for cooperative mobile health applications
Mobile health (m-Health) applications aim to deliver healthcare services through mobile applications regardless of time and place. An mHealth application makes use of wireless communications to sustain its health services and often providing a patient-doctor interaction. Therefore, m-Health applications present several challenging issues and constraints, such as, mobile devices battery and storage capacity, broadcast constraints, interferences, disconnections, noises, limited bandwidths, network delays, and of most importance, privacy and security concerns. In a typical m-Health system, information transmitted through wireless channels may contain sensitive information such as patient’s clinic history, patient’s personal diseases information (e.g. infectious disease as HIV - human immunodeficiency virus). Carrying such type of information presents many issues related to its privacy and protection. In this work, a cryptographic solution for m-Health applications under a cooperative environment is proposed in order to approach two common drawbacks in mobile health systems: the data privacy and protection. Two different approaches were proposed: i) DE4MHA that aims to guarantee the best confidentiality, integrity, and authenticity of mhealth systems users data and ii) eC4MHA that also focuses on assuring and guarantying the m-Health application data confidentiality, integrity, and authenticity, although with a different paradigm. While DE4MHA considers a peer-to-peer node message forward, with encryption/decryption tasks on each node, eC4MHA focuses on simply encrypting data at the requester node and decrypting it when it reaches the Web service. It relays information through cooperative mobile nodes, giving them the only strictly required information, in order to be able to forward a request, until it reaches the Web service responsible to manage the request, and possibly answer to that same request. In this sense, the referred solutions aim any mobile health application with cooperation mechanism embedded. For test purposes a specific mobile health application, namely SapoFit, was used. Cryptographic mechanisms were created and integrated in SapoFit application with built in cooperation mechanisms. A performance evaluation of both approaches in a real scenario with different mobile devices is performed and presented in this work. A comparison with the performance evaluations of both solutions is also presented.Fundação para a Ciência e a Tecnologia (FCT)European Community Fund FEDER through COMPETE – Programa Operacional Factores de Competitividad
BenchPress: Analyzing Android App Vulnerability Benchmark Suites
In recent years, various benchmark suites have been developed to evaluate the
efficacy of Android security analysis tools. The choice of such benchmark
suites used in tool evaluations is often based on the availability and
popularity of suites and not on their characteristics and relevance. One of the
reasons for such choices is the lack of information about the characteristics
and relevance of benchmarks suites.
In this context, we empirically evaluated four Android specific benchmark
suites: DroidBench, Ghera, IccBench, and UBCBench. For each benchmark suite, we
identified the APIs used by the suite that were discussed on Stack Overflow in
the context of Android app development and measured the usage of these APIs in
a sample of 227K real world apps (coverage). We also compared each pair of
benchmark suites to identify the differences between them in terms of API
usage. Finally, we identified security-related APIs used in real-world apps but
not in any of the above benchmark suites to assess the opportunities to extend
benchmark suites (gaps).
The findings in this paper can help 1) Android security analysis tool
developers choose benchmark suites that are best suited to evaluate their tools
(informed by coverage and pairwise comparison) and 2) Android app vulnerability
benchmark creators develop and extend benchmark suites (informed by gaps).Comment: Updates based on AMobile 2019 review
- …