Conference Program

DAY 1 Monday, May 18, 2009
8:30 AM	9:00 AM	Registration Room: Akamas
9:00 AM	9:30 AM	Welcome Room: Akamas A
9:30 AM	10:30 AM	Keynote speech: Prof. Bart Preneel, Katholieke Universiteit Leuven, Belgium Research Challenges In Applied Cryptology Room: Akamas A
10:30 AM	11:00 AM	Coffee/Tea
		Session 1A: Identification and Authentication I Room: Akamas A	Session 2A: Threats and Attacks Room: Akamas B	Session 3A (FIDIS): Introduction - What is Identity? Room: Akamas C
11:00 AM	11:30 AM	Flexible and Transparent User Authentication for Mobile Devices N. Clarke, S. Furnell, S. Karatzouni	Roving Bugnet: Distributed Surveillance Threat and Mitigation R. Farley, X. Wang	The Future of Identity in the Information Society (FIDIS) - Challenges and Opportunities Details: summit.fidis.net
11:30 AM	12:00 AM	Combining Authentication, Reputation and Classification to make Phishing Unprofitable A. Herzberg	On Robust Covert Channels Inside DNS L. Nussbaum, P. Neyron, O. Richard
12:00 AM	12:30 AM	Audio CAPTCHA for SIP-based VoIP Y. Soupionis, G. Tountas, D. Gritzalis	Discovering Application-level Insider Attacks using Symbolic Execution K. Pattabiraman, N. Nakka, Z. Kalbarczyk, R. Iyer
12:30 PM	2:00 PM	Lunch
		Session 1B: Identification and Authentication II Room: Akamas A	Session 2B: Applications of Cryptography and Information Hiding Room: Akamas B	Session 3B (FIDIS): Identity in a High-Tech World Room: Akamas C
2:00 PM	2:30 PM	Custom JPEG Quantization for Improved Iris Recognition Accuracy A. Uhl, G. S. Kostmajer, H. Stögner	Media-break resistant eSignatures in eGovernment - An Austrian Experience H. Leitold, R. Posch, T. Roessler	The Future of Identity in the Information Society (FIDIS) - Challenges and Opportunities Details: summit.fidis.net
2:30 PM	3:00 PM	On the IPP Properties of Reed-Solomon Codes M. Fernandez, J. Cotrina, M. Soriano, N. Domingo	How to Bootstrap Security for Ad-hoc Network: Revisited W. Shin, C. Gunter, S. Kiyomoto, K. Fukushima, T. Tanaka
3:00 PM	3:30 PM	A Generic Authentication LOA Derivation Model L. Yao, N. Zhang	Steganalysis of Hydan J. Blasco, J. C. Hernandez, J. Estevez-Tapiador, A. Ribagorda, M. Orellana-Quiros
3:30 PM	4:00 PM	Coffee/Tea
		Session 1C: Trusted Computing Room: Akamas A	Session 2C: Security Policies Room: Akamas B	Session 3C (FIDIS): Profiling & Forensics Room: Akamas C
4:00 PM	4:30 PM	On the Impossibility of Detecting Virtual Machine Monitors J.-P. Seifert, S. Gueron	A Policy-based Approach for the Management of Web Browser Resources to Prevent Anonymity Attacks in Tor G. Navarro-Arribas, J. Garcia-Alfaro	The Future of Identity in the Information Society (FIDIS) - Challenges and Opportunities Details: summit.fidis.net
4:30 PM	5:00 PM	Implementation of a Trusted Ticket System A. Schmidt, N. Kuntze, A. Leicher	A Policy Language for Modeling Recommendations A. Abou El Kalam, P. Balbiani
7:30 PM	09:30 PM	Reception O’ Solomons Irish Pub
DAY 2 Tuesday, May 19, 2009
9:00 AM	9:30 AM	Registration Room: Akamas A
9:30 AM	10:30 AM	Keynote speech: Christos Ellinides, European Commission (DIGIT) E-Signatures: Vision and Orientation of the European Commission Room: Akamas A
10:30 AM	11:00 AM	Coffee/Tea
		Session 1A: Validation, Verification, Evaluation Room: Akamas A	Session 2A: Privacy Protection, Security Assessment Room: Akamas B	Session 3A (FIDIS): Privacy & Mobility Room: Akamas C
11:00 AM	11:30 AM	On the Security Validation of Integrated Security Solutions S. Guergens, A. Fuchs, C. Rudolph	Collaborative Privacy - A Community-based Privacy Infrastructure J. Kolter, T. Kernchen, G. Pernul	The Future of Identity in the Information Society (FIDIS) - Challenges and Opportunities Details: summit.fidis.net
11:30 AM	12:00 AM	Verification of Security Policy Enforcement in Enterprise Systems P. Gupta, S. Stoller	Security and Privacy Improvements for the Belgian eID Technology P. Verhaeghe, J. Lapon, B. De Decker, V. Naessens, K. Verslype
12:00 AM	12:30 AM	Optimization of the Controlled Evaluation of Closed Relational Queries J.-H. Lochner, J. Biskup, S. Sonntag	A Structured Security Assessment Methodology for Manufacturers of Critical Infrastructure Components T. Brandstetter, K. Knorr, U. Rosenbaum
12:30 PM	2:00 PM	Lunch
		Session 1B: Role Mining and Content Protection Room: Akamas A	Session 2B: Security Protocols Room: Akamas B	Session 3B (FIDIS): Interoperability & eGovernment Room: Akamas C
2:00 PM	2:30 PM	Mining Stable Roles in RBAC N. V. Verde, A. Colantonio, R. Di Pietro, A. Ocello	NGBPA - Next Generation BotNet Protocol Analysis Felix Leder and Peter Martini	The Future of Identity in the Information Society (FIDIS) - Challenges and Opportunities Details: summit.fidis.net
2:30 PM	3:00 PM	Privacy-Preserving Content-Based Publish/Subscribe Networks A. Shikfa, M. Onen, R. Molva	Non-Repudiation Analysis with LySa A. Cortesi, M. Bruso
3:00 PM	3:30 PM	Broadcast Encryption for Differently Privileged H. Jin, J. Lotspiech	A Provably Secure Secret Handshake with Dynamic Controlled Matching A. Sorniotti, R. Molva
3:30 PM	4:00 PM	Ontology-based Secure XML Content Distribution M. A. Rahaman, Y. Roudier, P. Miseldine, A. Schaad	Towards a Theory of White-Box Security A. Herzberg, H. Shulman, A. Saxena, B. Crispo
4:00 PM	4:30 PM	Coffee/Tea
4:30 PM	5:30 PM	Panel discussion / Round table Trust and security initiatives: The role of the academic and industry sectors Room: Akamas A Moderator: Dimitris Gritzalis, Professor, Athens University of Economics & Business Panelists: Christos Ellinides, Director, Corporate IT Solutions and Services (DIGIT/A), European Commission Jacques Bus, Head, Trust and Security (INFSO/D/F5), European Commission Kyriakos Kokkinos, Managing Director, IBM Italia (Cyprus) Ltd
7:30 PM	10:30 PM	Gala Dinner Metohi Tavern – Polemi Village
DAY 3 Wednesday, May 20, 2009
8:30 AM	9:00 AM	Registration Room: Akamas
9:00 AM	9:30 AM	Best Paper Award Session Room: Akamas A
9:30 AM	10:30 AM	Kristian Beckman Award Session Professor Klaus Brunnstein About ICT Security and Safety in the Banking Industry Room: Akamas A
10:30 AM	11:00 AM	Coffee/Tea
		Session 1A: Access Control Room: Akamas A	Session 2A: Internet and Web Applications Security Room: Akamas B	Session 3A Room: Akamas C
11:00 AM	11:30 AM	On a Taxonomy of Delegation Q. Pham, J. Reid, A. McCullagh, E. Dawson	In Law we Trust? Trusted Computing and Legal Responsibility for Internet Y. Danidou, B. Schafer	WG11.1/WG11.8 Panel: Common Bodies of Knowledge (CBKs) and Security Certifications - do they meet the need?
11:30 AM	12:00 AM	Efficient Key Management for Enforcing Access Control in Outsourced Scenarios C. Blundo, S. Cimato, S. De Capitani di Vimercati, A. De Santis, S. Foresti, S. Paraboschi, P. Samarati	Persona: Network Layer Anonymity and Accountability for Next Generation Internet Y. Mallios, S. Modi, A. Agarwala, C. Johns
12:00 AM	12:30 PM	A Probabilistic Bound on the Basic Role Mining Problem and its Applications N. V. Verde, A. Colantonio, R. Di Pietro, A. Ocello	Jason: A Scalable Reputation System for the Semantic Web S. Steinbrecher, S. Groß, M. Meichau
12:30 PM	1:00 PM	Automating Access Control Logics in Simple Type Theory with LEO-II C. Benzmueller	Which Web Browsers Process SSL Certificates in a Standardized Way? A. S. Wazan, R. Laborde, D. Chadwick,  F. Barrere Abdelmalek Benzekri
1:00 PM	1:30 PM	Closing Plenary Room: Akamas A

Flexible and Transparent User Authentication for Mobile Devices

Nathan Clarke, Sevasti Karatzouni and Steven Furnell

Abstract: The mobile device has become a ubiquitous technology that is capable of supporting an increasingly large array of services, applications and information. Given their increasing importance, it is imperative to ensure that such devices are not misused or abused. Unfortunately, a key enabling control to prevent this, user authentication, has not kept up with the advances in device technology. This paper presents the outcomes of a 2 year study that proposes the use of transparent and continuous biometric authentication of the user: providing more comprehensive identity verification; minimizing user inconvenience; and providing security throughout the period of use. A Non-Intrusive and Continuous Authentication (NICA) system is described that maintains a continuous measure of confidence in the identity of the user, removing access to sensitive services and information with low confidence levels and providing automatic access with higher confidence levels. An evaluation of the framework is undertaken from an end-user perspective via a trial involving 27 participants. Whilst the findings raise concerns over education, privacy and intrusiveness, overall 92% of users felt the system offered a more secure environment when compared to existing forms of authentication.

Combining Authentication, Reputation and Classification to make Phishing Unprofitable

Amir Herzberg

Abstract: We present and analyze a design of an filtering system to block email phishing messages, combining reputation, authentication and classification mechanisms. We present simple economical model and analysis, showing sufficient conditions on the precision of the content-classifier, to make phishing unprofitable.

Audio CAPTCHA for SIP-based VoIP

Yannis Soupionis, George Tountas, Dimitris Gritzalis

Abstract: Voice over IP (VoIP) introduces new ways of communication,while utilizing existing data networks to provide inexpensive voice communicationsworldwide as a promising alternative to the traditional PSTN telephony. SPam over Internet Telephony (SPIT) is one potential source of future annoyance in VoIP. A common way to launch a SPIT attack is the use of an automated procedure (bot),which generates calls and produces audio advertisements. In this paper, our goal is to design appropriate CAPTCHA to fight such bots.We focus on and develop audio CAPTCHA, as the audio format is more suitable for VoIP environments and we implement it in a SIP-based VoIP environment. Furthermore, we suggest and evaluate the specific attributes that audio CAPTCHA should incorporate in order to be effective, and test it against an open source bot implementation.

Roving Bugnet: Distributed Surveillance Threat and Mitigation

Ryan Farley and Xinyuan Wang

Abstract: Advanced mobile devices such as laptops and smartphones make convenient hiding places for surveillance spyware. They commonly have a microphone and camera built-in, are increasingly network accessible, frequently within close proximity of their users, and almost always lack mechanisms designed to prevent unauthorized microphone or camera access.
In order to explore surveillance intrusion and detection methods, we present a modernized version of a microphone hijacker for Windows and Mac OS X. This attack can be executed as soon as the target connects to the Internet from anywhere in the world without requiring interaction from victimized users. As the attacker compromises additional machines they are organized into a botnet so the attacker can maintain stealthy control of the systems and launch later surveillance attacks.
We then present a mechanism to detect the threat onWindows, as well as a novel method to deceive an attacker in order to permit traceback. As a result of the detection mechanism we address a missing segment of resource control, decreasing the complexity of privacy concerns as exploitable devices become more pervasive.

On Robust Covert Channels Inside DNS

Lucas Nussbaum, Pierre Neyron and Olivier Richard

Abstract: Covert channels inside DNS allow evasion of networks which only provide a restricted access to the Internet. By encapsulating data inside DNS requests and replies exchanged with a server located outside the restricted network, several existing implementations provide either an IP over DNS tunnel, or a socket-like service (TCP over DNS). This paper contributes a detailed overview of the challenges faced by the design of such tunnels, and describes the existing implementations. Then, it introduces TUNS, our prototype of an IP over DNS tunnel, focused on simplicity and protocol compliance. Comparison of TUNS and the other implementations showed that this approach is successful: TUNS works on all the networks we tested, and provides reasonable performance despite its use of less efficient encapsulation techniques, especially when facing degraded network conditions.

Discovering Application-level Insider Attacks using Symbolic Execution

Karthik Pattabiraman, Nithin Nakka, Zbigniew Kalbarczyk, Ravishankar Iyer

Abstract: This paper presents a technique to systematically discover insider attacks in applications. An attack model where the insider is in the same address space as the process and can corrupt arbitrary data is assumed. A formal technique based on symbolic execution and model-checking is developed to comprehensively enumerate all possible insider attacks corresponding to a given attack goal. The main advantage of the technique is that it operates directly on the program code in assembly language and no manual effort is necessary to translate the program into a formal model. We apply the technique to security-critical segments of the OpenSSH application.

Custom JPEG Quantization for Improved Iris Recognition Accuracy

Gerald Stefan Kostmajer, Herbert Stögner, and Andreas Uhl

Abstract: Custom JPEG quantization matrices are proposed to be used in the context of compression within iris recognition. Superior matching results in terms of average Hamming distance and improved ROC is found as compared to the use of the default quantization table especially for low FAR. This leads to improved user convenience in case high security is required.

On the IPP Properties of Reed-Solomon Codes

Marcel Fernandez, Josep Cotrina, Miguel Soriano, and Neus Domingo

Abstract: Codes with traceability properties are used in schemes where the identification of users that illegally redistribute content is required. For any code with traceability properties, the Identifiable Parent Property (c-IPP) seems to be less restrictive than the Traceability (c-TA) property. In this paper, we show that for Reed-Solomon codes both properties are in many cases equivalent. More precisely, we show that for an [n,k,d] Reed-Solomon code, defined over a field that contains the n-d roots of unity, both properties are equivalent. This answers a question posted by Silverberg et al. in [10, 11], for a large family of Reed-Solomon codes.

A GENERIC AUTHENTICATION LOA DERIVATION MODEL

Li Yao, Ning Zhang

Abstract: One way of achieving a more fine-grained access control is to link an authentication level of assurance (LoA) derived from a requesterÂ’s authentication instance to the authorisation decision made to the requester. To realise this vision, there is a need for designing a LoA derivation model that supports the use and quantification of multiple LoA-effecting attributes, and analyse their composite effect on a given authentication instance. This paper reports the design of such a model, namely a generic LoA derivation model (GEA- LoADM). GEA-LoADM takes into account of multiple authentication attributes along with their relationships, abstracts the composite effect by the multiple attributes into a generic value, authentication LoA, and provides algorithms for the run-time derivation of LoA. The algorithms are tailored to reflect the relationships among the attributes involved in an authentication instance. The model has a number of valuable properties, including flexibility and extensibility; it can be applied to different application contexts and support easy addition of new attributes and removal of obsolete ones.

Media-break resistant eSignatures in eGovernment – an Austrian experience

Herbert Leitold, Reinhard Posch, Thomas Rössler

Abstract: Governments and public administrations produce documents – laws, orders, permits, notifications, etc. With the transition from traditional paper-based administration to eGovernment that we have seen in the last decade, authentic electronic documents gain importance. Electronic signatures promise to be a tool of choice. However, given the choice of access channels – electronic or conventional – public administrations offer, eDocuments will have to co-exist with traditional paper documents for several years, if not for decades. In this paper we discuss the Austrian practical experience gained with eSignatures and eDocuments in eGovernment.

How to bootstrap security for ad-hoc network: Revisited

Wook Shin, Carl A. Gunter, Shinsaku Kiyomoto, Kazuhide Fukushima, and Toshiaki Tanaka

Abstract: Abstract There are various network-enabled and embedded computers deployed around us. Although we can get enormous conveniences by connecting them together, it is difficult to securely associate them in an ad-hoc manner. The difficulties originate from authentication and key distribution problems among devices that are strangers to each other. In this paper, we review the existing ways of initiating secure communication for ad-hoc network devices, and propose another solution. Exploiting Pairing-based cryptography and the notion of location-limited channel, the proposed solution bootstraps security conveniently and efficiently. Further, it supports ownership enforcement and key-escrow.

Steganalysis of Hydan

Jorge Blasco, Julio C. Hernandez-Castro, Juan M.E. Tapiador, Arturo Ribagorda and Miguel A. Orellana-Quiros

Abstract: Hydan is a steganographic tool which can be used to hide any kind of information inside executable files. In this work, we present an efficient distinguisher for it:We have developed a system that is able to detect executable files with embedded information through Hydan. Our system uses statistical analysis of instruction set distribution to distinguish between files with no hidden information and files that have been modified with Hydan. We have tested our algorithm against a mix of clean and stego-executable files. The proposed distinguisher is able to tell apart these files with a 0 ratio of false positives and negatives, thus detecting all files with hidden information through Hydan.

On the Impossibility of Detecting Virtual Machine Monitors

Shay Gueron and Jean-Pierre Seifert

Abstract: Virtualization based upon Virtual Machines is a central building block of Trusted Computing, and it is believed to offer isolation and confinement of privileged instructions among other security benefits. However, it is not necessarily bullet-proof — some recent publications have shown that Virtual Machine technology could potentially allow the installation of undetectable malware root kits. As a result, it was suggested that such virtualization attacks could be mitigated by checking if a threatened system runs in a virtualized or in a native environment. This naturally raises the following problem: Can a program determine whether it is running in a virtualized environment, or in a native machine environment? We prove here that, under a classical VM model, this problem is not decidable. Further, although our result seems to be quite theoretic, we also show that it has practical implications on related virtualization problems.

Implementation of a Trusted Ticket System

Andreas Leicher, Nicolai Kuntze, and Andreas U. Schmidt

Abstract: Trusted Computing is a security technology which enables the establishment of trust between multiple parties. Previous work showed that Trusted Computing technology can be used to build tickets, a core concept of Identity Management Systems. Relying solely on the Trusted Platform Module we will demonstrate how this technology can be used in the context of Kerberos for an implementation variant of Identity Management.

A policy based approach for the management of Web browser resources to prevent anonymity attacks in Tor

Guillermo Navarro-Arribas and Joaquin Garcia-Alfaro

Abstract: Web browsers are becoming the universal interface to reach applications and services related with these systems. Different browsing contexts may be required in order to reach them, e.g., use of VPN tunnels, corporate proxies, anonymisers, etc. By browsing context we mean how the user browsers the Web, including mainly the concrete configuration of its browser. When the context of the browser changes, its security requirements also change. In this work, we present the use of authorisation policies to automatise the process of controlling the resources of a Web browser when its context changes. The objective of our proposal is oriented towards easing the adaptation to the security requirements of the new context and enforce them in the browser without the need for user intervention. We present a concrete application of our work as a plug-in for the adaption of security requirements in Mozilla/Firefox browser when a context of anonymous navigation through the Tor network is enabled.

A Policy Language for Modelling Recommendations

Anas ABOU EL KALAM and Philippe BALBIANI

Abstract: While current and emergent applications become more and more complex, most of existing security policies and models only consider a yes/no response to the access requests. Consequently,modelling, formalizing and implementing permissions, obligations and prohibitions do not cover the richness of all the possible scenarios. In fact, several applications have access rules with the recommendation access modality. In this paper we focus on the problem of formalizing security policies with recommendation needs. The aim is to provide a generic domainindependent formal system for modelling not only permissions, prohibitions and obligations, but also recommendations. In this respect, we present our logic-based language, the semantics, the truth conditions, our axiomatic as well as inference rules.We also give a representative use case with our specification of recommendation requirements. Finally, we explain how our logical framework could be used to query the security policy and to check its consistency.

On the Security Validation of Integrated Security Solutions

Andreas Fuchs and Sigrid Gürgens and Carsten Rudolph

Abstract: Combining security solutions in order to achieve stronger (combined) security properties is not straightforward. This paper shows that security-preserving alphabetic language homomorphisms can be used to derive security results for combined security solutions. A relatively simple example of the combination of two different authentication properties (device authentication using a trusted platform module and user authentication using SSL) are integrated. Using security-preserving language homomorphisms it is shown that previously proposed combinations of solutions do not satisfy the desired integrated security properties. Finally, an improved integration of the two solutions is shown to satisfy the desired properties.

Verification of Security Policy Enforcement in Enterprise Systems

Puneet Gupta and Scott D. Stoller

Abstract: Many security requirements for enterprise systems can be expressed in a natural way as high-level access control policies. A high-level policy may refer to abstract information resources, independent of where the information is stored; it controls both direct and indirect accesses to the information; it may refer to the context of a request, i.e., the request’s path through the system; and its enforcement point and enforcementmechanism may be unspecified. Enforcement of a high-level policy may depend on the system architecture and the configurations of a variety of security mechanisms, such as firewalls, host login permissions, file permissions, DBMS access control, and application-specific security mechanisms. This paper presents a framework in which all of these can be conveniently and formally expressed, a method to verify that a high-level policy is enforced, and an algorithm to determine a trusted computing base for each resource.

Optimization of the Controlled Evaluation of Closed Relational Queries

Joachim Biskup, Jan-Hendrik Lochner, and Sebastian Sonntag

Abstract: For relational databases, controlled query evaluation is an effective inference control mechanism preserving confidentiality regarding a previously declared confidentiality policy. Implementations of controlled query evaluation usually lack efficiency due to costly theorem prover calls. Suitably constrained controlled query evaluation can be implemented efficiently, but is not flexible enough from the perspective of database users and security administrators. In this paper, we propose an optimized framework for controlled query evaluation in relational databases, being efficiently implementable on the one hand and relaxing the constraints of previous approaches on the other hand.

Collaborative Privacy - A Community-based Privacy Infrastructure

Jan Kolter, Thomas Kernchen and Günther Pernul

Abstract: The landscape of the World Wide Web with all its versatile services heavily relies on the disclosure of private user information. Service providers collecting more and more of these personal user data pose a growing privacy threat for users. Addressing user concerns privacy-enhancing technologies emerged. One goal of these technologies is to enable users to improve the control over their personal data. A famous representative is the PRIME project that aims for a holistic privacyenhancing identity management system. However, approaches like the PRIME privacy architecture require service providers to change their server infrastructure and add specific privacy-enhancing components. In the near future, service providers are not expected to alter internal processes. In this paper, we introduce a collaborative privacy community that allows the open exchange of privacy-related information. We lay out the privacy community’s functions and potentials within a user-centric, provider-independent privacy architecture that will help foster the usage and acceptance of privacy-enhancing technologies.

Security and Privacy Improvements for the Belgian eID Technology

Pieter Verhaeghe, Jorn Lapon, Bart De Decker, Vincent Naessens and Kristof Verslype

Abstract: The Belgian Electronic Identity Card enables Belgian citizens to prove their identity digitally and to sign electronic documents. At the end of 2009, every Belgian citizen older than 12 years will have such an eID card. In the future, usage of the eID card may be mandatory. However, irresponsible use of the card may cause harm to individuals.
Currently, there exist some privacy and security problems related to the use of the eID card. This paper focuses on solutions to tackle these problems. A new authentication protocol is introduced to substantially reduce the risk of abusing the single sign-on authentication and privacy friendly identity files are proposed to improve the citizen’s privacy.

A Structured Security Assessment Methodology for Manufacturers of Critical Infrastructure Components

Thomas Brandstetter, Dr. Konstantin Knorr, Dr. Ute Rosenbaum

Abstract: Protecting our critical infrastructures like energy generation and distribution, telecommunication, production and traffic against cyber attacks is one of the major challenges of the new millennium. However, as security is such a complex and multilayer topic often the necessary structured foundation is missing for a manufacturer to assess the current security level of a system. This paper introduces a methodology for structured security assessments which has been success-fully applied during the development of several products for critical infrastructures. The methodology is described in detail and the lessons learnt are given from applying it to several systems during their development.

Mining Stable Roles in RBAC

Alessandro Colantonio, Roberto Di Pietro, Alberto Ocello, Nino Vincenzo Verde

Abstract: In this paper we address the problem of generating a candidate role-set for an RBAC configuration that enjoys the following two key features: it minimizes the administration cost; and, it is a stable candidate role-set. To achieve these goals, we implement a three steps methodology: first, we associate a weight to roles; second, we identify and remove the user-permission assignments that cannot belong to a role that have a weight exceeding a given threshold; third, we restrict the problem of finding a candidate role-set for the given system configuration using only the user-permission assignments that have not been removed in the second step—that is, user-permission assignments that belong to roles with a weight exceeding the given threshold. We formally show—proof of our results are rooted in graph theory—that this methodology achieves the intended goals. Finally, we discuss practical applications of our approach to the role mining problem.

Privacy-Preserving Content-Based Publish/Subscribe Networks

Abdullatif Shikfa, Melek Önen and Refik Molva

Abstract: Abstract Privacy and confidentiality are crucial issues in content-based publish/ subscribe (CBPS) networks. We tackle the problem of end-user privacy in CBPS. This problem raises a challenging requirement for handling encrypted data for the purpose of routing based on protected content and encrypted subscription information. We suggest a solution based on a commutative multiple encryption scheme in order to allow brokers to operate in-network matching and content based routing without having access to the content of the packets. This is the first solution that avoids key sharing among end-users and targets an enhanced CBPS model where brokers can also be subscribers at the same time.

Broadcast Encryption for Differently Privileged

Hongxia Jin, Jeffery Lotspiech

Abstract: Broadcast encryption is a primary technology that has been used for content protection. It enables a broadcaster to distribute content to a set of users so that only a privileged subset of users can access the content and another subset of revoked users cannot access the content. The main enabling block in a broadcast encryption scheme is the session key block, which each authorized user processes differently, but each gets the same valid session key. Currently all existing broadcast encryption schemes have assumed that the content and authorized users are equally privileged. There are emerging scenarios that demand protection for content with different privileges and for users with different privileges. In this paper we shall present a new broadcast encryption scheme that continues to employ single session key blocks but provides different privileged protections for different content and users. In particular we will expand the elegant subset-cover-based broadcast encryption scheme. We shall introduce a new concept called “security class” into the session key blocks. We use keys derived from a chain of one-way functions. Our approach is simple, efficient and secure.

Ontology-based Secure XML Content Distribution

Mohammad Ashiqur Rahaman, Yves Roudier, Philip Miseldine and Andreas Schaad

Abstract: This paper presents an ontology-driven secure XML content distribution scheme. This scheme first relies on a semantic access control model for XML documents that achieves three objectives: (1) representing flexible and evolvable policies, (2) providing a high-level mapping and interoperable interface to documents, and (3) automating the granting of fine-grained access rights by inferring on content semantics. A novel XML document parsing mechanism is defined to delegate document access control enforcement to a third party without leaking the document XML schema to it. The Encrypted Breadth First Order Labels (EBOL) encoding is used to bind semantic concepts with XML document nodes and to check the integrity of a document.

NGBPA Next Generation BotNet Protocol Analysis

Felix S. Leder and Peter Martini

Abstract: The command & control (c&c) protocols of botnets are moving away from plaintext IRC communicationt towards encrypted and obfuscated protocols. In general, these protocols are proprietary. Therefore, standard network monitoring tools are not able to extract the commands from the collected traffic. However, if we want to monitor these new botnets, we need to know how their protocol decryption works. In this paper we present a novel approach in malware analysis for locating the encryption and decryption functions in botnet programs. This information can be used to extract these functions for c&c protocols. We illustrate the applicability of our approach by a sample from the Kraken botnet. Using our approach, we were able to identify the encryption routine within minutes. We then extracted the c&c protocol encryption and decryption. Both are presented in this paper.

Non-Repudiation Analysis with LYSA

Mayla Brus`o and Agostino Cortesi

Abstract: This work introduces a formal analysis of the non-repudiation property for security protocols. Protocols are modelled in the process calculus LYSA, using an extended syntax with annotations. Non-repudiation is verified using a Control Flow Analysis, following the same approach of M. Buchholtz and H. Gao for authentication and freshness analyses.
The result is an analysis that can statically check the protocols to predict if they are secure during their execution and which can be fully automated.

A Provably Secure Secret Handshake with Dynamic Controlled Matching

Alessandro Sorniotti and Refik Molva

Abstract: A Secret Handshake is a protocol that allows two users to mutually verify one another’s properties, and in case of simultaneous matching, to share a key used to secure subsequent communications. In this paper, we present the first Secret Handshake scheme that allows dynamic matching of properties under stringent security requirements: in particular, the right to prove and to verify is strictly under the control of an authority. This work merges characteristics of Secret Handshake with features peculiar to Secure Matchmaking.

Towards a Theory of White-Box Security

Amir Herzberg and Haya Shulman and Amitabh Saxena and Bruno Crispo

Abstract: Program hardening for secure execution in remote untrusted environment is an important yet elusive goal of security, with numerous attempts and efforts of the research community to produce secure solutions. Obfuscation is the prevailing practical technique employed to tackle this issue. Unfortunately, no provably secure obfuscation techniques currently exist. Moreover, Barak et. al., showed that not all programs can be obfuscated. Theoretical research exhibits provably secure albeit inefficient constructions, e.g. using tools from encrypted domain.
We present a rigorous approach to software execution in remote environment based on a new white box primitive, the White Box Remote Program Execution (WBRPE), whose security specifications include confidentiality and integrity of both the local and the remote hosts. WBRPE can be used for many applications, e.g. grid computing, digital rights management, mobile agents.
We then present a construction of a specific program such that if there exists a secure WBRPE for that program, then there is a secure WBRPE for any program, reducing its security to the underlying WBRPE primitive. The security of WBRPE construction is established by reduction among two white box primitives and it introduces new techniques of programs manipulation.

On a Taxonomy of Delegation

Quan Pham, Jason Reid, Adrian McCullagh and Ed Dawson

Abstract: Delegation, from a technical point of view, is widely considered as a potential approach in addressing the problem of providing dynamic access control decisions in activities with a high level of collaboration, either within a single security domain or across multiple security domains. Although delegation continues to attract significant attention from the research community, presently, there is no published work that presents a taxonomy of delegation concepts and models. This paper intends to address this gap.

Efficient Key Management for Enforcing Access Control in Outsourced Scenarios

C. Blundo and S. Cimato and S. De Capitani di Vimercati and A. De Santis and S. Foresti and S. Paraboschi and P. Samarati

Abstract: Data outsourcing is emerging today as a successful paradigm allowing individuals and organizations to exploit external servers for storing and distributing data. While trusted to properly manage the data, external servers are often not authorized to read them, therefore requiring data to be encrypted. In such a context, the application of an access control policy requires different data to be encrypted with different keys so to allow the external server to directly enforce access control and support selective dissemination and access.
The problem therefore emerges of designing solutions for the efficient management of the encryption policy enforcing access control, with the goal of minimizing the number of keys to be maintained by the system and distributed to users. Since such a problem is NP-hard, we propose a heuristic approach to its solution based on a key derivation graph exploiting the relationships among user groups.We experimentally evaluate the performance of our heuristic solution, comparing it with previous approaches.

A Probabilistic Bound on the Basic Role Mining Problem and its Applications

Alessandro Colantonio, Roberto Di Pietro, Alberto Ocello, Nino Vincenzo Verde

Abstract: The aim of this paper is to describe a new probabilistic approach to the role engineering process for RBAC. We address the issue of minimizing the number of roles, problem known in literature as the Basic Role Mining Problem (basicRMP). We leverage the equivalence of the above issue with the vertex coloring problem. Our main result is to prove that the minimum number of roles is sharply concentrated around its expected value. A further contribution is to show how this result can be applied as a stop condition when striving to find out an approximation for the basicRMP. The proposal can be also used to decide whether it is advisable to undertake the efforts to renew a RBAC state. Both these applications can result in a substantial saving of resources. A thorough analysis using advanced probabilistic tools supports our results. Finally, further relevant research directions are highlighted.

Automating Access Control Logics in Simple Type Theory with LEO-II

Christoph Benzmüller

Abstract: Garg and Abadi recently proved that prominent access control logics can be translated in a sound and complete way into modal logic S4. We have previously outlined how normal multimodal logics, including monomodal logics K and S4, can be embedded in simple type theory and we have demonstrated that the higher-order theorem prover LEO-II can automate reasoning in and about them. In this paper we combine these results and describe a sound (and complete) embedding of different access control logics in simple type theory. Employing this framework we show that the off the shelf theorem prover LEO-II can be applied to automate reasoning in and about prominent access control logics.

In law we trust? Trusted Computing and legal responsibility for Internet security

Yianna Danidou and Burkhard Schafer

Abstract: This paper analyses potential legal responses and consequences to the anticipated roll out of Trusted Computing (TC). It is argued that TC constitutes such a dramatic shift in power away from users to the software providers, that it is necessary for the legal system to respond. A possible response is to mirror the shift in power by a shift in legal responsibility, creating new legal liabilities and duties for software companies as the new guardians of internet security.

Persona: Network Layer Anonymity and Accountability for Next Generation Internet

Yannis Mallios, Sudeep Modi, Aditya Agarwala, Christina Johns

Abstract: Individual privacy has become a major concern, due to the intrusive nature of the services and websites that collect increasing amounts of private information. One of the notions that can lead towards privacy protection is that of anonymity. Unfortunately, anonymity can also be maliciously exploited by attackers to hide their actions and identity. Thus some sort of accountability is also required. The current Internet has failed to provide both properties, as anonymity techniques are difficult to fully deploy and thus are easily attacked, while the Internet provides limited level of accountability. The Next Generation Internet (NGI) provides us with the opportunity to examine how these conflicting properties could be efficiently applied and thus protect users privacy while holding malicious users accountable. In this paper we present the design of a scheme, called Persona that can provide anonymity and accountability in the network layer of NGI. More specifically, our design requirements are to combine these two conflicting desires in a stateless manner within routers. Persona allows users to choose different levels of anonymity, while it allows the discovery of malicious nodes.

Jason: A Scalable Reputation System for the Semantic Web

Sandra Steinbrecher and Stephan Groß and Markus Meichau

Abstract: The recent development of the Internet, especially the expanding use of social software and dynamic content generation commonly termed as Web 2.0 enables users to find information about almost every possible topic on the Web. On the downside, it becomes more and more difficult to decide which information can be trusted in. In this paper we propose the enhancement of Web 2.0 by a scalable and secure cross-platform reputation system that takes into account a user's social network. Our proposed solution {Jason is based on standard methods of the semantic web and does not need a central entity. It enables the fast and flexible evaluation of arbitrary content on the World Wide Web. In contrast to many other reputation systems it provides mechanisms to ensure the authenticity of web content, thus, enabling the user to explicitely choose information published by trusted authors.

Which web browsers process SSL certificates in a standardized way?

Ahmad Samer Wazan, Romain Laborde, David W Chadwick, François Barrere, AbdelMalek Benzekri

Abstract: SSL is the primary technology used to secure web communications. Before setting up an SSL connection, web browsers have to validate the SSL certificate of the web server in order to ensure that users access the expected web site. We have tested the handling of the main fields in SSL certificates and found that web browsers do not process them in a homogenous way. An SSL certificate can be accepted by some web browsers whereas a message reporting an error can be delivered to users by other web browsers for the same certificate. This diversity of behavior might cause users to believe that SSL certificates are unreliable or error prone, which might lead them to consider that SSL certificates are useless. In this paper, we highlight these different behaviors and we explain the reasons for them which can be either a violation of the standards or ambiguity in the standards themselves. We give our opinion of which it is in our analysis.