首页 > 最新文献

Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security最新文献

英文 中文
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX. 黑暗土地上的漏锅:理解SGX的记忆侧通道危险。
Wenhao Wang, Guoxing Chen, Xiaorui Pan, Yinqian Zhang, XiaoFeng Wang, Vincent Bindschaedler, Haixu Tang, Carl A Gunter

Side-channel risks of Intel's SGX have recently attracted great attention. Under the spotlight is the newly discovered page-fault attack, in which an OS-level adversary induces page faults to observe the page-level access patterns of a protected process running in an SGX enclave. With almost all proposed defense focusing on this attack, little is known about whether such efforts indeed raises the bar for the adversary, whether a simple variation of the attack renders all protection ineffective, not to mention an in-depth understanding of other attack surfaces in the SGX system. In the paper, we report the first step toward systematic analyses of side-channel threats that SGX faces, focusing on the risks associated with its memory management. Our research identifies 8 potential attack vectors, ranging from TLB to DRAM modules. More importantly, we highlight the common misunderstandings about SGX memory side channels, demonstrating that high frequent AEXs can be avoided when recovering EdDSA secret key through a new page channel and fine-grained monitoring of enclave programs (at the level of 64B) can be done through combining both cache and cross-enclave DRAM channels. Our findings reveal the gap between the ongoing security research on SGX and its side-channel weaknesses, redefine the side-channel threat model for secure enclaves, and can provoke a discussion on when to use such a system and how to use it securely.

英特尔新加坡交易所的侧通道风险最近引起了人们的极大关注。最近发现的页面错误攻击备受关注,在这种攻击中,操作系统级别的攻击者诱导页面错误来观察在SGX飞地中运行的受保护进程的页面级别访问模式。几乎所有建议的防御都集中在这种攻击上,很少有人知道这种努力是否确实提高了对手的标准,攻击的简单变化是否会使所有保护失效,更不用说对SGX系统中其他攻击面的深入了解了。在本文中,我们报告了SGX面临的侧通道威胁系统分析的第一步,重点关注与其内存管理相关的风险。我们的研究确定了8种潜在的攻击媒介,范围从TLB到DRAM模块。更重要的是,我们强调了关于SGX内存侧通道的常见误解,证明了在通过新的页面通道恢复EdDSA密钥时可以避免频繁的aex,并且可以通过结合缓存和跨enclave DRAM通道来完成对enclave程序(在64B级别)的细粒度监视。我们的研究结果揭示了SGX正在进行的安全研究与其侧通道弱点之间的差距,重新定义了安全飞地的侧通道威胁模型,并可以引发关于何时使用此类系统以及如何安全使用它的讨论。
{"title":"Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX.","authors":"Wenhao Wang,&nbsp;Guoxing Chen,&nbsp;Xiaorui Pan,&nbsp;Yinqian Zhang,&nbsp;XiaoFeng Wang,&nbsp;Vincent Bindschaedler,&nbsp;Haixu Tang,&nbsp;Carl A Gunter","doi":"10.1145/3133956.3134038","DOIUrl":"https://doi.org/10.1145/3133956.3134038","url":null,"abstract":"<p><p>Side-channel risks of Intel's SGX have recently attracted great attention. Under the spotlight is the newly discovered page-fault attack, in which an OS-level adversary induces page faults to observe the page-level access patterns of a protected process running in an SGX enclave. With almost all proposed defense focusing on this attack, little is known about whether such efforts indeed raises the bar for the adversary, whether a simple variation of the attack renders all protection ineffective, not to mention an in-depth understanding of other attack surfaces in the SGX system. In the paper, we report the first step toward systematic analyses of side-channel threats that SGX faces, focusing on the risks associated with its memory management. Our research identifies 8 potential attack vectors, ranging from TLB to DRAM modules. More importantly, we highlight the common misunderstandings about SGX memory side channels, demonstrating that high frequent AEXs can be avoided when recovering EdDSA secret key through a new page channel and fine-grained monitoring of enclave programs (at the level of 64B) can be done through combining both cache and cross-enclave DRAM channels. Our findings reveal the gap between the ongoing security research on SGX and its side-channel weaknesses, redefine the side-channel threat model for secure enclaves, and can provoke a discussion on when to use such a system and how to use it securely.</p>","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"2017 ","pages":"2421-2434"},"PeriodicalIF":0.0,"publicationDate":"2017-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://sci-hub-pdf.com/10.1145/3133956.3134038","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"37041209","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 308
15th Workshop on Privacy in the Electronic Society (WPES 2016) 第十五届电子社会私隐工作坊(WPES 2016)
S. Vimercati
The advancements in the Information and Communication Technologies (ICTs) have introduced new computing paradigms (e.g., cloud computing, pervasive and ubiquitous computing, ambient intelligence and aware-computing) where the techniques for processing, storing, communicating, sharing, and disseminating information have radically changed. These novel computing paradigms bring enormous benefits: the availability of a universal access to data; the reduction in power, storage, hardware, and software costs; and the availability of elastic storage and computation services. While these advantages are appealing, as a side effect there is a tremendous risk of exposure of confidential or sensitive information to privacy breaches. WPES is a yearly forum, this year at its 15th edition, aiming at discussing the open privacy challenges, emerging directions, and original novel approaches for guaranteeing privacy in today's global interconnected society.
信息和通信技术(ict)的进步引入了新的计算范式(例如云计算、普适和无处不在的计算、环境智能和感知计算),其中处理、存储、通信、共享和传播信息的技术发生了根本性的变化。这些新颖的计算范式带来了巨大的好处:数据的通用访问的可用性;电力、存储、硬件和软件成本的降低;以及弹性存储和计算服务的可用性。虽然这些优点很吸引人,但其副作用是机密或敏感信息暴露于隐私泄露的巨大风险。WPES是一个年度论坛,今年是第15届,旨在讨论在当今全球互联社会中保障隐私的公开挑战、新兴方向和新颖的方法。
{"title":"15th Workshop on Privacy in the Electronic Society (WPES 2016)","authors":"S. Vimercati","doi":"10.1145/2976749.2990491","DOIUrl":"https://doi.org/10.1145/2976749.2990491","url":null,"abstract":"The advancements in the Information and Communication Technologies (ICTs) have introduced new computing paradigms (e.g., cloud computing, pervasive and ubiquitous computing, ambient intelligence and aware-computing) where the techniques for processing, storing, communicating, sharing, and disseminating information have radically changed. These novel computing paradigms bring enormous benefits: the availability of a universal access to data; the reduction in power, storage, hardware, and software costs; and the availability of elastic storage and computation services. While these advantages are appealing, as a side effect there is a tremendous risk of exposure of confidential or sensitive information to privacy breaches. WPES is a yearly forum, this year at its 15th edition, aiming at discussing the open privacy challenges, emerging directions, and original novel approaches for guaranteeing privacy in today's global interconnected society.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"423 1","pages":"1879-1880"},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"78174983","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Le rythme et la voix, premiers défis d’un traducteur de Claude Simon 节奏和声音,克劳德·西蒙翻译的第一个挑战
K. Holter
Pour tout lecteur il y a des rencontres textuelles plus decisives que d’autres. A plus forte raison pour un etudiant ou doctorant, puisque cela peut determiner la direction de sa vie professionnelle. Cela a ete mon cas, a ma premiere lecture de la premiere phrase de La Route des Flandres : Il tenait une lettre a la main, il leva les yeux me regarda puis de nouveau la lettre puis de nouveau moi, derriere lui je pouvais voir aller et venir passer les taches rouges acajou ocre des chevaux qu’on ...
对于任何读者来说,有一些文本会议比其他会议更有决定性。对于学生或博士生来说更是如此,因为这可以决定他们职业生涯的方向。这了我的情况,我以前读了弗兰德斯路的第一句:他手里拿着一封信,信再次抬起头来看着我,然后我然后又递给他身后,我会去见未来的桃木红赭色斑点马被...
{"title":"Le rythme et la voix, premiers défis d’un traducteur de Claude Simon","authors":"K. Holter","doi":"10.4000/CCS.940","DOIUrl":"https://doi.org/10.4000/CCS.940","url":null,"abstract":"Pour tout lecteur il y a des rencontres textuelles plus decisives que d’autres. A plus forte raison pour un etudiant ou doctorant, puisque cela peut determiner la direction de sa vie professionnelle. Cela a ete mon cas, a ma premiere lecture de la premiere phrase de La Route des Flandres : Il tenait une lettre a la main, il leva les yeux me regarda puis de nouveau la lettre puis de nouveau moi, derriere lui je pouvais voir aller et venir passer les taches rouges acajou ocre des chevaux qu’on ...","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"12 1","pages":"21-30"},"PeriodicalIF":0.0,"publicationDate":"2015-04-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"89387102","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Simon au pays des soviets. Notes sur la réception de l’œuvre simonienne en Russie 西蒙在苏联国家。关于在俄罗斯接受西蒙尼作品的说明
Alexey Vishnyakov
Quel ecrivain pourrait ignorer un pays avec un heritage litteraire si brillant (Gogol, Tourgueniev, Tolstoi et Dostoievski)et qui ne peut etre nomme autrement que monumental ? Et puis – comment ne pas s’interesser a ce meme pays devenu un polygone pour la doctrine (l’utopie ?) marxiste […],le pays ou sont apparues des personnalites aussi monumentales(dans le mal comme dans le bien) que Lenine, Trotski ou Staline ? La Russie occupe dans l’ethnographie imaginaire de Simon l’une des premieres pl...
有哪个作家能忽视一个拥有如此辉煌文学遗产的国家(果戈理、屠格涅夫、托尔斯泰和陀思妥耶夫斯基),而这个国家只能被称为不朽的?此外,我们怎能不关心这个国家,这个国家已经成为马克思主义(乌托邦?)学说的多边形[…],这个国家出现了像列宁、托洛茨基或斯大林这样伟大的人物(无论好坏)?在西蒙的想象民族志中,俄罗斯占据了第一个pl…
{"title":"Simon au pays des soviets. Notes sur la réception de l’œuvre simonienne en Russie","authors":"Alexey Vishnyakov","doi":"10.4000/CCS.911","DOIUrl":"https://doi.org/10.4000/CCS.911","url":null,"abstract":"Quel ecrivain pourrait ignorer un pays avec un heritage litteraire si brillant (Gogol, Tourgueniev, Tolstoi et Dostoievski)et qui ne peut etre nomme autrement que monumental ? Et puis – comment ne pas s’interesser a ce meme pays devenu un polygone pour la doctrine (l’utopie ?) marxiste […],le pays ou sont apparues des personnalites aussi monumentales(dans le mal comme dans le bien) que Lenine, Trotski ou Staline ? La Russie occupe dans l’ethnographie imaginaire de Simon l’une des premieres pl...","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"74 1","pages":"145-168"},"PeriodicalIF":0.0,"publicationDate":"2014-05-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91396130","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Nonlinear Phenomena and Resonant Parametric Perturbation Control in QR-ZCS Buck DC-DC Converters QR-ZCS降压型DC-DC变换器的非线性现象及共振参数摄动控制
Fei-Hu Hsieh, Fengxia Liu, Hui-Chang Hsieh
{"title":"Nonlinear Phenomena and Resonant Parametric Perturbation Control in QR-ZCS Buck DC-DC Converters","authors":"Fei-Hu Hsieh, Fengxia Liu, Hui-Chang Hsieh","doi":"10.1007/978-3-642-33914-1_13","DOIUrl":"https://doi.org/10.1007/978-3-642-33914-1_13","url":null,"abstract":"","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"3 1","pages":"105-109"},"PeriodicalIF":0.0,"publicationDate":"2013-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"89368682","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Optical Spectrum Analysis of Chaotic Synchronization in a Bidirectional Coupled Semiconductor Laser System 双向耦合半导体激光系统混沌同步的光谱分析
I. Andrei, G. Popescu, C. Ticoș, M. Pascu
{"title":"Optical Spectrum Analysis of Chaotic Synchronization in a Bidirectional Coupled Semiconductor Laser System","authors":"I. Andrei, G. Popescu, C. Ticoș, M. Pascu","doi":"10.1007/978-3-642-33914-1_60","DOIUrl":"https://doi.org/10.1007/978-3-642-33914-1_60","url":null,"abstract":"","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"74 1","pages":"425-429"},"PeriodicalIF":0.0,"publicationDate":"2013-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91396123","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Crouching tiger - hidden payload: security risks of scalable vectors graphics 卧虎藏虎——隐藏载荷:可伸缩矢量图形的安全风险
M. Heiderich, Tilman Frosch, Meiko Jensen, Thorsten Holz
Scalable Vector Graphics (SVG) images so far played a rather small role on the Internet, mainly due to the lack of proper browser support. Recently, things have changed: the W3C and WHATWG draft specifications for HTML5 require modern web browsers to support SVG images to be embedded in a multitude of ways. Now SVG images can be embedded through the classical method via specific tags such as or , or in novel ways, such as with tags, CSS or inline in any HTML5 document. SVG files are generally considered to be plain images or animations, and security-wise, they are being treated as such (e.g., when an embedment of local or remote SVG images into websites or uploading these files into rich web applications takes place). Unfortunately, this procedure poses great risks for the web applications and the users utilizing them, as it has been proven that SVG files must be considered fully functional, one-file web applications potentially containing HTML, JavaScript, Flash, and other interactive code structures. We found that even more severe problems have resulted from the often improper handling of complex and maliciously prepared SVG files by the browsers. In this paper, we introduce several novel attack techniques targeted at major websites, as well as modern browsers, email clients and other comparable tools. In particular, we illustrate that SVG images embedded via tag and CSS can execute arbitrary JavaScript code. We examine and present how current filtering techniques are circumventable by using SVG files and subsequently propose an approach to mitigate these risks. The paper showcases our research into the usage of SVG images as attack tools, and determines its impact on state-of-the-art web browsers such as Firefox 4, Internet Explorer 9, and Opera 11.
迄今为止,可缩放矢量图形(SVG)图像在Internet上的作用相当小,这主要是由于缺乏适当的浏览器支持。最近,情况发生了变化:W3C和WHATWG的HTML5规范草案要求现代web浏览器支持以多种方式嵌入SVG图像。现在,SVG图像可以通过传统方法通过特定的标记(如或)嵌入,或者以新颖的方式嵌入,例如在任何HTML5文档中使用标记、CSS或内联。SVG文件通常被认为是纯图像或动画,并且从安全角度来看,它们被视为纯图像或动画(例如,当将本地或远程SVG图像嵌入到网站中或将这些文件上传到富web应用程序中时)。不幸的是,这个过程给web应用程序和使用它们的用户带来了很大的风险,因为已经证明SVG文件必须被认为是功能齐全的、单文件的web应用程序,可能包含HTML、JavaScript、Flash和其他交互式代码结构。我们发现,更严重的问题是由于浏览器对复杂和恶意准备的SVG文件的处理不当造成的。在本文中,我们介绍了几种针对主要网站,以及现代浏览器,电子邮件客户端和其他类似工具的新型攻击技术。特别地,我们说明了通过标记和CSS嵌入的SVG图像可以执行任意JavaScript代码。我们将研究并展示如何通过使用SVG文件规避当前的过滤技术,并随后提出一种减轻这些风险的方法。本文展示了我们对使用SVG图像作为攻击工具的研究,并确定了它对最先进的web浏览器(如Firefox 4、Internet Explorer 9和Opera 11)的影响。
{"title":"Crouching tiger - hidden payload: security risks of scalable vectors graphics","authors":"M. Heiderich, Tilman Frosch, Meiko Jensen, Thorsten Holz","doi":"10.1145/2046707.2046735","DOIUrl":"https://doi.org/10.1145/2046707.2046735","url":null,"abstract":"Scalable Vector Graphics (SVG) images so far played a rather small role on the Internet, mainly due to the lack of proper browser support. Recently, things have changed: the W3C and WHATWG draft specifications for HTML5 require modern web browsers to support SVG images to be embedded in a multitude of ways. Now SVG images can be embedded through the classical method via specific tags such as or , or in novel ways, such as with tags, CSS or inline in any HTML5 document. SVG files are generally considered to be plain images or animations, and security-wise, they are being treated as such (e.g., when an embedment of local or remote SVG images into websites or uploading these files into rich web applications takes place). Unfortunately, this procedure poses great risks for the web applications and the users utilizing them, as it has been proven that SVG files must be considered fully functional, one-file web applications potentially containing HTML, JavaScript, Flash, and other interactive code structures. We found that even more severe problems have resulted from the often improper handling of complex and maliciously prepared SVG files by the browsers.\u0000 In this paper, we introduce several novel attack techniques targeted at major websites, as well as modern browsers, email clients and other comparable tools. In particular, we illustrate that SVG images embedded via tag and CSS can execute arbitrary JavaScript code. We examine and present how current filtering techniques are circumventable by using SVG files and subsequently propose an approach to mitigate these risks. The paper showcases our research into the usage of SVG images as attack tools, and determines its impact on state-of-the-art web browsers such as Firefox 4, Internet Explorer 9, and Opera 11.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"88 1","pages":"239-250"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74882847","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 21
PaperSpeckle: microscopic fingerprinting of paper 纸斑:纸张的显微指纹
Ashlesh Sharma, L. Subramanian, E. Brewer
Paper forgery is among the leading causes of corruption in many developing regions. In this paper, we introduce PaperSpeckle, a robust system that leverages the natural randomness property present in paper to generate a fingerprint for any piece of paper. Our goal in developing PaperSpeckle is to build a low-cost paper based authentication mechanism for applications in rural regions such as microfinance, healthcare, land ownership records, supply chain services and education which heavily rely on paper based records. Unlike prior paper fingerprinting techniques that have extracted fingerprints based on the fiber structure of paper, PaperSpeckle uses the texture speckle pattern, a random bright/dark region formation at the microscopic level when light falls on to the paper, to extract a unique fingerprint to identify paper. In PaperSpeckle, we show how to extract a "repeatable" texture speckle pattern of a microscopic region of a paper using low-cost machinery involving paper, pen and a cheap microscope. Using extensive testing on different types of paper, we show that PaperSpeckle can produce a robust repeatable fingerprint even if paper is damaged due to crumpling, printing or scribbling, soaking in water or aging with time.
纸张伪造是许多发展中地区腐败的主要原因之一。在本文中,我们介绍了PaperSpeckle,这是一个强大的系统,它利用纸张中存在的自然随机性属性为任何一张纸生成指纹。我们开发PaperSpeckle的目标是为农村地区的小额信贷、医疗保健、土地所有权记录、供应链服务和教育等严重依赖纸质记录的应用建立一种低成本的基于纸张的认证机制。与之前基于纸张纤维结构提取指纹的纸张指纹技术不同,PaperSpeckle利用纹理斑点模式,即当光线照射到纸张上时,在微观水平上随机形成的亮/暗区域,来提取独特的指纹来识别纸张。在PaperSpeckle中,我们展示了如何使用低成本的机器(包括纸、笔和廉价的显微镜)提取纸张微观区域的“可重复”纹理斑点图案。通过对不同类型纸张的广泛测试,我们表明,即使纸张因皱缩、印刷或涂鸦、浸泡在水中或随着时间的推移而损坏,PaperSpeckle也能产生强大的可重复指纹。
{"title":"PaperSpeckle: microscopic fingerprinting of paper","authors":"Ashlesh Sharma, L. Subramanian, E. Brewer","doi":"10.1145/2046707.2046721","DOIUrl":"https://doi.org/10.1145/2046707.2046721","url":null,"abstract":"Paper forgery is among the leading causes of corruption in many developing regions. In this paper, we introduce PaperSpeckle, a robust system that leverages the natural randomness property present in paper to generate a fingerprint for any piece of paper. Our goal in developing PaperSpeckle is to build a low-cost paper based authentication mechanism for applications in rural regions such as microfinance, healthcare, land ownership records, supply chain services and education which heavily rely on paper based records. Unlike prior paper fingerprinting techniques that have extracted fingerprints based on the fiber structure of paper, PaperSpeckle uses the texture speckle pattern, a random bright/dark region formation at the microscopic level when light falls on to the paper, to extract a unique fingerprint to identify paper. In PaperSpeckle, we show how to extract a \"repeatable\" texture speckle pattern of a microscopic region of a paper using low-cost machinery involving paper, pen and a cheap microscope. Using extensive testing on different types of paper, we show that PaperSpeckle can produce a robust repeatable fingerprint even if paper is damaged due to crumpling, printing or scribbling, soaking in water or aging with time.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"106 1","pages":"99-110"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"75297430","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 55
Poster: shaping network topology for privacy and performance 海报:塑造网络拓扑的隐私和性能
Nayantara Mallesh, M. Wright
While it is important to design anonymity systems to be robust against attacks, it is also important to provide good performance to users. We explore ways to improve the security and performance of anonymity systems by building both security and performance properties into the network topology. In particular, we study an expander graph based network topology and apply link-based performance metrics in order to build the topology graph. Such a network can be constructed to have enhanced performance and similar security properties to restricted route topologies with random links. Results show that a sparse, D-regular expander graph topology provides nearly the same security, as measured by the likelihood of an incoming stream exiting through any node in the network, as with a fully-connected graph. Further, when the expander graph is constructed with a bias towards faster links, there is a considerable gain in performance without much loss of security.
虽然设计匿名系统以抵御攻击很重要,但为用户提供良好的性能也很重要。我们探索通过在网络拓扑中构建安全和性能属性来提高匿名系统的安全性和性能的方法。特别地,我们研究了一个基于扩展图的网络拓扑,并应用基于链路的性能指标来构建拓扑图。这样的网络可以被构建为具有增强的性能和类似的安全属性,具有随机链路的受限路由拓扑。结果表明,稀疏的d规则扩展图拓扑提供了几乎相同的安全性,通过通过网络中任何节点的传入流的可能性来衡量,与全连接图。此外,当扩展图的构造偏向于更快的链接时,可以在不损失太多安全性的情况下获得相当大的性能增益。
{"title":"Poster: shaping network topology for privacy and performance","authors":"Nayantara Mallesh, M. Wright","doi":"10.1145/2046707.2093500","DOIUrl":"https://doi.org/10.1145/2046707.2093500","url":null,"abstract":"While it is important to design anonymity systems to be robust against attacks, it is also important to provide good performance to users. We explore ways to improve the security and performance of anonymity systems by building both security and performance properties into the network topology. In particular, we study an expander graph based network topology and apply link-based performance metrics in order to build the topology graph. Such a network can be constructed to have enhanced performance and similar security properties to restricted route topologies with random links. Results show that a sparse, D-regular expander graph topology provides nearly the same security, as measured by the likelihood of an incoming stream exiting through any node in the network, as with a fully-connected graph. Further, when the expander graph is constructed with a bias towards faster links, there is a considerable gain in performance without much loss of security.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"186 1","pages":"813-816"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"73941447","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Automatically optimizing secure computation 自动优化安全计算
F. Kerschbaum
On the one hand, compilers for secure computation protocols, such as FairPlay or FairPlayMP, have significantly simplified the development of such protocols. On the other hand, optimized protocols with high performance for special problems demand manual development and security verification. The question considered in this paper is: Can we construct a compiler that produces optimized protocols? We present an optimization technique based on logic inference about what is known from input and output. Using the example of median computation we can show that our program analysis and rewriting technique translates a FairPlay program into an equivalent -- in functionality and security -- program that corresponds to the protocol by Aggarwal et al. Nevertheless our technique is general and can be applied to optimize a wide variety of secure computation protocols.
一方面,安全计算协议的编译器,如FairPlay或FairPlayMP,大大简化了这些协议的开发。另一方面,针对特殊问题的高性能优化协议需要人工开发和安全验证。本文考虑的问题是:我们能否构建一个生成优化协议的编译器?我们提出了一种基于从输入和输出中已知的逻辑推理的优化技术。使用中值计算的例子,我们可以展示我们的程序分析和重写技术将FairPlay程序转换为与Aggarwal等人的协议相对应的等效程序(在功能和安全性方面)。然而,我们的技术是通用的,可以应用于优化各种安全计算协议。
{"title":"Automatically optimizing secure computation","authors":"F. Kerschbaum","doi":"10.1145/2046707.2046786","DOIUrl":"https://doi.org/10.1145/2046707.2046786","url":null,"abstract":"On the one hand, compilers for secure computation protocols, such as FairPlay or FairPlayMP, have significantly simplified the development of such protocols. On the other hand, optimized protocols with high performance for special problems demand manual development and security verification. The question considered in this paper is: Can we construct a compiler that produces optimized protocols? We present an optimization technique based on logic inference about what is known from input and output. Using the example of median computation we can show that our program analysis and rewriting technique translates a FairPlay program into an equivalent -- in functionality and security -- program that corresponds to the protocol by Aggarwal et al. Nevertheless our technique is general and can be applied to optimize a wide variety of secure computation protocols.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"90 23","pages":"703-714"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://sci-hub-pdf.com/10.1145/2046707.2046786","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"72375197","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 51
期刊
Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1