1 - 10 of 352
-
PublicationCybersecurity risk analysis of an automated driving system( 2023-10-25)
-
PublicationMANTRA: A Graph-based Unified Information Aggregation Foundation for Enhancing Cybersecurity Management in Critical Infrastructures( 2023-06)
-
PublicationCompaSeC: A Compiler-Assisted Security Countermeasure to Address Instruction Skip Fault Attacks on RISC-V( 2023-01-31)
-
PublicationA more User-Friendly Digital Wallet?( 2023)Identity wallets enable the management and use of digital identities and verification documents stored in one app. Users manage their data independently and decide for themselves which data they want to disclose for identification purposes. Recent research shows that current digital wallets face many usability problems, which makes it difficult for users to grasp their concept and how to use them. This paper presents an enhanced concept of a wallet, where its functionality is presented with user scenarios that have a user centric approach. The user scenarios illustrate a variety of possible uses of the wallet. For example, the new wallet concept envisions, how data can be transferred from one wallet to another person's wallet, how data can be managed by different people in one wallet, or how only individual pieces of information from credentials can be shared to maintain greater privacy for users.
-
PublicationCryptSan: Leveraging ARM Pointer Authentication for Memory Safety in C/C++( 2023)Memory safety bugs remain in the top ranks of security vulnerabilities, even after decades of research on their detection and prevention. Various mitigations have been proposed for C/C++, ranging from language dialects to instrumentation. Among these, compiler-based instrumentation is particularly promising, not requiring manual code modifications and being able to achieve precise memory safety. Unfortunately, existing compiler-based solutions compromise in many areas, including performance but also usability and memory safety guarantees. New developments in hardware can help improve performance and security of compiler-based memory safety. ARM Pointer Authentication, added in the ARMv8.3 architecture, is intended to enable hardware-assisted Control Flow Integrity (CFI). But since its operations are generic, it also enables other, more comprehensive hardware-supported runtime integrity approaches. As such, we propose CryptSan, a memory safety approach based on ARM Pointer Authentication. CryptSan uses pointer signatures to retrofit memory safety to C/C++ programs, protecting heap, stack, and globals against temporal and spatial vulnerabilities. We present a full LLVM-based prototype implementation, running on an M1 MacBook Pro, i.e., on actual ARMv8.3 hardware. Our prototype evaluation shows that the system outperforms similar approaches under real-world conditions. This, together with its interoperability with uninstrumented libraries and cryptographic protection against attacks on metadata, makes CryptSan a viable solution for retrofitting memory safety to C/C++ programs.
-
PublicationR2-AD2: Detecting Anomalies by Analysing the Raw Gradient( 2023)Neural networks follow a gradient-based learning scheme, adapting their mapping parameters by back-propagating the output loss. Samples unlike the ones seen during training cause a different gradient distribution. Based on this intuition, we design a novel semi-supervised anomaly detection method called R2-AD2. By analysing the temporal distribution of the gradient over multiple training steps, we reliably detect point anomalies in strict semi-supervised settings. Instead of domain dependent features, we input the raw gradient caused by the sample under test to an end-to-end recurrent neural network architecture. R2-AD2 works in a purely data-driven way, thus is readily applicable in a variety of important use cases of anomaly detection.
-
PublicationHWASanIO: Detecting C/C++ Intra-object Overflows with Memory Shading( 2023)
-
PublicationPost-quantum Security for the Extended Access Control Protocol( 2023)The Extended Access Control (EAC) protocol for authenticated key agreement is mainly used to secure connections between machine-readable travel documents (MRTDs) and inspection terminals, but it can also be adopted as a universal solution for attribute-based access control with smart cards. The security of EAC is currently based on the Diffie-Hellman problem, which may not be hard when considering quantum computers. In this work we present PQ-EAC, a quantum-resistant version of the EAC protocol. We show how to achieve post-quantum confidentiality and authentication without sacrificing real-world usability on smart cards. To ease adoption, we present two main versions of PQ-EAC: One that uses signatures for authentication and one where authentication is facilitated using long-term KEM keys. Both versions can be adapted to achieve forward secrecy and to reduce round complexity. To ensure backwards-compatibility, PQ-EAC can be implemented using only Application Protocol Data Units (APDUs) specified for EAC in standard BSI TR-03110. Merely the protocol messages needed to achieve forward secrecy require an additional APDU not specified in TR-03110. We prove security of all versions in the real-or-random model of Bellare and Rogaway. To show real-world practicality of PQ-EAC we have implemented a version using signatures on an ARM SC300 security controller, which is typically deployed in MRTDs. We also implemented PQ-EAC on a VISOCORE® terminal for border control. We then conducted several experiments to evaluate the performance of PQ-EAC executed between chip and terminal under various real-world conditions. Our results strongly suggest that PQ-EAC is efficient enough for use in border control.
-
PublicationStructured Design and Evaluation of a Resistor-Based PUF Robust Against PVT-Variations( 2023)This paper proposes a new fully CMOS-compatible PUF primitive robust against process variations, supply voltage variations and temperature drift (PVT) based on resistive structures that implements advanced compensation mechanisms already on circuit level. Based on analog simulation data, the PUF is evaluated regarding its unpredictability and its reliability. The results indicate a high quality. Further, a structured approach for designing a suitable error correction is presented to illustrate the whole PUF system.
-
PublicationQuantum-Resistant MACsec and IPsec for Virtual Private Networks( 2023)Despite considerable progress in theoretical post-quantum cryptography we have yet to see significant advances in its practical adoption. The necessary protocol modifications need to be identified, implemented and tested; good solutions need to be standardized and finally adopted in the real world. This work executes the first steps needed to standardize quantum-proof Virtual Private Networks (VPNs) on Layers 2 and 3 of the OSI model employing the MACsec/MKA and IPsec/IKEv2 protocols, respectively. We identify requirements and assemble a list of ideal features, discuss difficulties and possible solutions, point out our standardization efforts, and provide the results of some sample implementations for both layers.
