3 research outputs found
Measuring Software Diversity, with Applications to Security
In this work, we briefly introduce and discuss some of the diversity measures
used in Ecology. After a succinct description and analysis of the most relevant
ones, we single out the Shannon-Weiner index. We justify why it is the most
informative and relevant one for measuring software diversity. Then, we show
how it can be used for effectively assessing the diversity of various real
software ecosystems. We discover in the process a frequently overlooked
software monopoly, and its key security implications. We finally extract some
conclusions from the results obtained, focusing mostly on their security
implications.Comment: 10 pages, 5 figure
Malware tolerance: Distributing trust over multiple devices
Current security solutions try to keep the adversary out of the computer infrastructure. However, with zero-day exploits and certain rootkit attacks, the assumption that attacks can be blocked does not hold any more.
This work presents the concept of malware tolerance accepting that every device might be compromised at some point in time. The concept aims to distribute trust over several devices so that no single device is able to compromise security features by itself.
I create three malware-tolerant techniques to demonstrate the feasibility of the concept. This thesis introduces a trusted input system which delivers keystrokes securely from the keyboard to a recipient even if one of its components is compromised. The second approach is the design of a self-healing Industrial Control System, a sensor-actuator network to securely control a physical system. If an adversary manages to compromise one of the components, it remains secure and can even recover from attacks. Lastly, this thesis proposes a mesh network architecture aimed at smart-home networks without assuming any device in the network invulnerable to attacks applying isolation mechanisms to otherwise flat mesh networks.
This thesis gives formal security proofs with protocol verifier ProVerif. The proof scripts are open-source