In their work, the authors show that, given z challenge ciphertexts and the smallest possible window size of r =1, the ideal object is able to provide WOW and WDOW.

y for larger windows of size r z/|D|, the ideal ob ject does not achieve WOW or WDOW.


While the mechanisms used in the MSN and the Yahoo (scheme 1) CAPTCHAs were broken by our attacks, it appears that the crowding characters together mechanism advocated by the Google CAPTCHA could provide better security against currently available attacks.


So, node failure will not impose more problems than node failure without using the key establishment protocol would do.

nodes may leave the network voluntarily.


Similar to the attacks on the bitstream encryption of Xilinx and Actel FPGAs, our attack on the targeted Altera FPGA makes use of the physical leakage of the embedded decryption module.

a detailed speci.cation of the design security scheme is not publicly available.


Layer-3 IDSs are likely popular because there is far more data available at Layer-3, making it straightforward to respond to attacks, and because detectionand responseatLayer-3 is independent of theLayer-2 connection medium.

wireless Denial of Service (DoS) attacks are much more dif.cult to deal with at Layer-3 as these attacks occur at Layer-2 and, even if detected, response is limited given that attackers will likely utilize .ctitious or spoofed MACaddressesand may nothaveanIP address toretaliateagainst.


The broad diversity of browser rendering algorithms makes it di.cult for server-side techniques to detect potential scripts within rich user-provided content.

any web browser knows perfectly well what content it considers a script.


In this case, only authorized entities should be aware of those identities.

tra.c information for a particular location could be counted as public information.


The Johns Hopkins Medical Institution requires a parent or legal guardian to consent for care if their child is under the age of 12, so the parent or guardian needs access to the child s record in this case.

a child 12 or older may make their own decisions about healthcare and choose to limit access to their record.


4.1 Effectiveness 4.1.1 Wilander s Benchmark Test-Suite There exists different buffer over.ow attacks in the publicly available Wilander s Benchmark Test-Suite, and we select buffer over.ow bugs aim at stack and bss objects.

wilander s benchmark writes the shellcode in the program, in order to emulate the network application, we modify it to let the user input the shellcode from the network.


Fairthorne [6] discusses how the SESAME mechanism for secure transmission of privilege can be incorporated into an OSF DCE environment.

both SESAME and OSF DCE employ online security servers as a direct result of extending Kerberos.


In other words, there are evidential influence between A and C if the evidential state of B is unknown.

if B s state is known then A and C will be independent to each other.


Doing so would constrain higherdegree design decisions and cut the photographer o. from design options that would improve the result.

a photographer can voluntarily set such constraints as part of his or her personal style, with the consequence of this style working better for some subjects than for others.


The AdHASH updates the hash of a set of b objects by computing h twice.

a standard hash requires re-hashing all b objects at a signi.cant cost for large values of b.


Physical .ngerprints usually  o.er strong protection against duplication attempts.


Given the strict operating requirements and system complexity, such systems are operated through IT infrastructures enabling the timely data .ow between digital controllers, sensors, and actuators.

the use of non-proprietary communication networks and heterogeneous IT components has made these cyber-physical systems vulnerable to cyber threats.


Given the fact that NodeSentry has a programmatic policy, and that policy code can e.ectively modify how the enforcement mechanism functions, it could be possible to introduce new vulnerabilities into the system via a badly written policy.

we consider the production of safe and secure policy code an interesting but orthogonal and thus out-of-scope issue, for which care must be taken by the policy writer to prevent mistakes/misuse.


This is not an issue for persistent components of the module such as its primary text section and global data because these sections are located by LKIM and added to the measurement instructions for future measurement requests.

loadable modules may specify an initialization section which is executed at load time and then released.


This is enough to demonstrate that the BOS construction is not secure.

it may be of interest to see other possible attacks against the BOS scheme.


If thevalue enteredby the user is not in the valid range, the server sends a message to the client to execute line 25, informing the user of the error.

if lines 5 8 execute on both the client and server, no server client message is needed, and the user interface is more responsive.


Some of the objects and functions de.ned by the function authorities such as MATH and BYTES (other than TIME) could be rebuilt within the logic system: for example, numbers can be constructed using Heyting arithmetic [55].

this formally minimalistic approach would add substantial practical complexity and inef.ciency compared with bootstrapping from Python s arithmetic.


Cloud customers can verify that the cloud veri.er satis.es their integrity property requirements and that the properties the cloud veri.er vouches for being enforced on its hosts satis.es the customer s properties for those components as well.

cV can only verify the trustworthiness of the nodes hosting the user VMs, while RepCloud identi.es and dynamically manages the e.ective cloud TCB for the VMs and enables attestations with a higher level of con.dence for trust.


in terms of improved chances for channel access.

an intelligent attacker that knows the detection algorithm attempts to delay this decision as much as possible so as to increase his own bene.t in terms of chances for channel access.


Given that the code segment starts at a relatively low address in the virtual address space of the program, it will most likely contain a NULL character (at least on the ARM R ® architecture), causing the snprinf function to terminate.

leakage of the canary and either the stack or frame pointer is suf.cient to bypass both the canary-based protection and ASLR.


If the entire storage tree can be replayed, then any policy updates or revocation of keys or data performed by the authority could be undone.

since the root hash is stored on-chip, out of reach of any adversaries, this is not possible; previous trees will not be valid.


Note that the sensitivity in the problem setting of [23] is only 1.

our key technical contribution is to achieve a smaller sensitivity in releasing a graph v (i.e., O(log n) as opposed to O(n) and O( n) of our stateof-the-art competitors [21, 24, 25]).


global maximum) can be guaranteed to be found.

the challenge is that an exhaustive search can take too long when dealing with a relatively large quantity of candidate features.


if there exist more than one non-communicating identical databases, the lower bound for communication overhead could be decreased.


Sn with both a and E smaller than 10-10ds 2 (unless C is of constant size).

it does not rule out the possibility of having, for every n .


Note however that, as we do not have the real addresses of the taxis, we were unable to formally validate these statements.

we were able to some public data sources, such as Google Maps and Street View, to validate some of the inferred data.


A node in the Suspicious state moves to the Secure state if its SI decreases due to legitimate behaviors.

if a node in the Suspicious state continues its anomalous behavior, its SI goes above a prede.ned threshold s2 and the node moves to the Malicious state.


This information provides XenAccess a roadmap to strategically navigate through memory.

cMAT-V modifies XenAccess by removing the dependence on these user provided files.


By (3), the link key kI,I' is a function of d- 1 common keys kI,I' ,l. Hence, the adversary has to compromise all these d-1 keys generated by the polynomi ' als fl (I(l), xd-1)and fl (I (l), xd-1)as in (2).

il il these polynomials are stored only in the memories of I and I ' that are unavailable to the adversary.


senders present in contact list) to reach the message inbox.

two applications (SMS Blocker and Numbercop) .ltered few spam messages from known senders as spam.


Flume [18] modi.es Linux to allow similar policies as SilverLine, but it still requires applications trusted and untrusted applications be aware of information-.ow control.

silverLine allows applications to operate without explicit knowledge of information-.ow policies (hence avoiding expensive application rewrites).


Using these as inputs, the sandbox analyzer identi.ed 33 sources of observable artifacts.

retrieving all of them requires plenty of domain-speci.c knowledge for tasks such as enumerating artifacts and constructing valid inputs.


The second goal is to enforce the desired authorization policy.

the minimal placement may not always be capable of enforcing the desired authorization policy.


This could reduce the healthcare costs in the long term as well.

from a technical perspective this model has a great disadvantage regarding patients privacy.


Based on the .nancial implications of the widespread occurrence of security breaches, an in-depth understanding of malware internals is critical for designing and deploying e.ective defensive solutions.

the sheer number of malware samples poses a challenge that cannot be matched by manual reverse engineering e.orts.


Hence, if a password manager only supplies the password to the exact URL it stored the passwords for, the attacker would have to open a popup window or embed a frame to the login page to steal the secret data.

opening a popup window is very suspicious and therefore not desirable.


They used attribute based encryption to achieve access control.

they did not deal with identity concealing and revocation issues.


Although this attack is valid for the Sandia scheme, which employs a .rst step in which one of 25 templates is chosen uniformly at random but the distribution of the number of possible passwords across templates is non-uniform [33], the proposed bucketing for the APG scheme does not produce the same e.ect using the base unit distribution given by Gasser [34].

statistical attacks on pronounceable passwords have not been examined in great detail, leaving many directions open which would be prudent to explore.


In comparison, our Dalvik dynamic instrumentation library provides the capability to perform indepth instrumentation of Dalvik classes as well as the native code of running Android applications as well as the Android system itself.

droidScope only instruments the VM, while our main focus is the instrumentation of the applications (although we can also instrument the VM).


So it has zero false negative, Moreover, the fact that its signatures are derived from the .rst principles of buffer over.ow attacks, rather than any speci.c byte patterns from particular buffer over.ow attacks, means that Nebula can even detect zero-day buffer over.ow attacks.

there is no guarantee that Nebula will never generate false positives, especially when the number of repetition patterns Nis small and when the stack size is large.


By contacting CA_TH number of CAs and obtaining signatures on a fresh key, the legitimate owner can eventually re-gain control.

the adversary will be able to use the key until a valid revocation message arrives.


It shows also that the total processing runtime slightly increases as the number of specializations increases linearly, up to 14.

the total runtime increases from 6.4 sec to 12 sec when the number of specializations increases from 14 to 16.


The users that make less than 10 decisions (18,757) are those who may have installed PMP and subsequently uninstall it after use, or users who turned contribute o. so that we do not get their decisions.

as can be observed from the table, an average user of PMP makes over 66 decisions, while a large number of our user population makes 10 to 100 (44,260 users) and 100 to 363 (16,729 users) decisions.


The size of the bu.er should be small because the bu.ered packets only gets service once the bu.er is full.

the number of packets stored should be large enough to depict the actual protocol tra.c pattern.


A different approach is to measure how much the adversary learns about the user s location, by comparing his prior and posterior distributions.

since some information is allowed to be revealed by design, these distributions can be far apart.


[7]propose socialgraph monitoring as a means todetect worms that spread through social networks.

as statedin theirpaper, their approachcannotdetectXSS worms, such astheMySpace Samy worm, which do not modify the social graph and generate activities that are passively noticeable by friends .


Since mice and keyboards require constant user involvement to be able to craft entropy, they clearly cannot be used to this end while stowed.

hard drives and radios do not require any user manipulation to function and are thus capable of achieving normal operation when placed in a bag, purse, or wallet.


By using UMLsec in the case study, the conformance of the system models to the security requirements was demonstrated.

this has no implication on the real system, as long as the application code is not generated directly from the model and there is no assurance that the generation process itself is correct.


For instance, the SOP ensures that document data and cookies from one origin cannot be read by scripts belonging to another origin.

the SOP includes some important relaxations with respect to navigation and content inclusion (e.g.


These properties are assessed both in time and number of connections-de.ned windows, to account for slow scanning.

in our implementation, we have simpli.ed the technique considerably to be able to integrate it with the remainder of our solution.


Patrick Tague Carnegie Mellon Univsersity Moffett Field, CA USA tague@cmu.edu from illegal access, Wi-Fi Protected Access 2 (WPA2) enterprise mode [2] can be considered as a solution.

the device might not have a proper user interface to enter the passcode or computing resources processing the available Extensible Authentication Protocols (EAPs) with storing valid certi.cates.


The .rst approach is based on model checking [5], whereas the second is based on logical reasoning [1].

both these approaches are computationally expensive, especially when dealing with large scale heterogeneous distributed environments and time constraints.


This node therefore sends node A the RREP allowing it to join the group.

when node B sends its RREQ, it does not find a node whose role is higher in the hierarchy than its own role.


In anonymous CP-ABE, a user obtains his attribute secret key and if the attribute set associated with the secret key does not satisfy the access policy in the ciphertext, the user cannot decrypt and guess what access policy was speci.ed by the data owner.

in existing anonymous ABE work, the user has to decrypt and decide whether his attributes satisfy the hidden policy in the ciphertext or not.


A cloud server will follow the protocol speci.cation and not intentionally destroy users reminder service in order to maintain its business reputation.

the server may be curious to learn the user s reminder contents and location privacy.


The notion of re.nement is a relation between two speci.cations and it is in general not sub ject for automation.

a transformation takes a speci.cation and delivers another speci.cation as output in the sense of a compiler.


For spill operation, the overhead only accounts memory access latency since the hash operation can be performed with the memory writing operation simultaneously.

the fill operation overhead accounts both memory latency and hash latency since the hash operation can begin only mcf parser # of instruction 7136667402 7908917776 Max call-depth 37 208 #of RAS used 1201289 130794089  IPCMax Spilled chunks#of RAS spills (thousand) 2000 1500 1000 500 0 0.06 0.05 0.04 0.03 0.02 0.01 0 1.25 1 1.75 1.5 0.75 0.5 0.25 0 (a) mcf parser (b) mcf parser 16~4 16~8 32~4 32~8 64~4 64~8 SIZE (RAS - Chunk) (c) mcf parser 16~4 16~8 32~4 32~8 64~4 64~8 SIZE (RAS - Chunk) (d) functions that are known to be vulnerable and substitute them with a safe version of corresponding functions.


Updating the UDP and the IPsec layer together seems to have a greater impact on the QoS then carrying the tunnel overhead and proceeding to a single IPsec tunnel update.

applications like DNS, or Delay Tolerant Network applications or applications based on query responses with short payloads may provide the reverse.


However, the two approaches di.er considerably: [1] uses rules to de.ne which user receives which role.

our rules de.ne which permissions a user receives when he is assigned a role.


The interleaved hop-by-hop scheme .lters injected false data in sensor networks, and assumes that falsi.cation occurs in one direction: sensors to base station (equivalent to falsi.cation of route replies from destination to source in ad hoc networks).

p-hop cross check handles falsi.cation of route requests, which are broadcasted, as well as route replies.


Users can access their VMs through a Secure Shell (SSH) connection, which should be secure enough to avoid most man-in-the-middle attacks.

sSH to a compromised VM might lead to the infection of users machines.


At .rst glance, it seems that these approaches can also defeat the malicious measurements injected by attackers, since such malicious measurements can be considered as interacting bad measurements.

in this paper, we discover that all existing techniques for bad measurement detection and identi.cation can be bypassed if the attacker knows the con.guration of the power system.


This feature can make the navigation easier, especially for users who are unfamiliar with the site.

because this feature maintains persistent client-side state, this single bit of information per link can be used for tracking purposes.


The reason the access matrix is highly space-e.cientfor small numbersof sessionsisthatitisabit matrix.

asthenumberof sessions andpermissions per sessionsgrow, its(quadratic)growthquicklynegates the fact that each entry in the matrix is only a bit.


These mechanisms cannot utilize the process s internal state, such as its stack memory, because a malicious process could forge such state to circumvent con.nement.

the Process Firewall only aims to protect benign processes from accessing resources that are not appropriate for their current state.


Of course a number of users could always deviate from the general trends.

if a trend is seen in a large number of users templates, then a tool that builds  DATE GENDER FIRST LANGUAGE TYPING LANGUAGE HANDEDNESS MALE FEMALE ENGLISH OTHER ENGLISH OTHER LEFT RIGHT AMBIDEXTROUS OCT2009 589412 ------- APRIL 2010 690 488 967 205 1131 43 100 1051 22 OCT 2010 692 507 974 216 1166 31 112 1052 21 Table 1: Summary of Dataset Details on this trend would likely have a very good performance on average.


Secondly, platform-level IA mechanisms would need to be managed by the platform developers or some central authority.

iA is a relatively new area that still experiences radical revisions due to the research .ndings in such areas as the use of novel sensors or wearable devices for IA [28, 35], and the research .ndings on the usability and acceptance of IA schemes.


The safest choice is the former, because the developer has complete control over the code that is served to the users browsers and can inspect it to verify its proper functionality.

this choice comes with a higher maintenance cost, as the library must be updated manually.


New players enter the system with a default rating, and if K is too low, it takes a long time before they reach their true rating.

if K is too high, the system is unstable: ratings .uctuate too much.


Similar systems (that is, machines having the same architecture, running the same OS with the same con.guration and same set of applications) have identical monolithic PAGs to begin with.

depending on how the user uses a system and what the user s security related characteristics are, a PAG becomes more personalized.


In fact, di.erent techniques can be employed to model the sequences of functions.

in this work we show that the HMM is su.cient to characterize the behavior of a web page.


In this section we show that arbitrary precision multiplicative approximation of the mutual information requires O(m) space.

arbitrarily small additive approximation is possible in small space.


The experimental results show that two identical PUF circuits on two di.erent chips have di.erent outputs for the same input with a probability of 23% (interchip variation).

multiple measurements on the same chip are di.erent only with 0.7% probability.


As a practi- cal matter, most attackers will gather privileges sequentially as they explore a system's infras~.ructure, so this is not an unreasonable assumption.

some attacks can be automated and carried out many times in parallel, so in the worst case the attacker can violate an assumption of staging.


Due to the use of the binarization procedure (Algorithm 2), there may exist permissions in the original user clusters that have not been granted to the corresponding virtual users because of low support.

these should still be potentially taken into consideration.


By concatenating two formal contexts (G1,M1,I1) and (G2,M2,I2), we mean mainly to unite the contained sets.

we use disjoint object sets G.i = {i}×Gi and have, therefore, also to adapt the incidence relations Ii before the union: (G1,M1,I1) · (G2,M2,I2)=( G.1 .


When the padding rate is too high, most of the bandwidth will be wasted on dummy packets.

many incoming packets will be dropped when the padding rate is too low.


In a dynamic coalition environment, participants (e.g., users, systems) of an organization may need to gain access to resources (both data and services) of other organizations to accomplish the task at hand.

this should not mean that access to resources is now freely available to everyone across all organizations.


The average false negative rate across all 18 users is 3.06%, which one can argue is acceptably low.

the false positive rate for many users is unacceptably high (the average is 27.5%).


The entire process of key distribution is transparent, as the user simply needed to deploy the sensors, and the key distribution happens automatically, in a plug-n-play manner.

both sensors were required to be located on the user s body, so they could measure the same underlying physiological signal and perform key agreement.


There is only one ID in FPGate, and thus it provides a weaker protection than CFI.

due to the complexity of building a complete control .ow graph, the count of unique IDs introduced by CFI for a given application is also small.


The process P.Q represents internal nondeterministic choice and can choose to behave like P or Q, without in.uence of the environment (e.g., a user or another process).


At a high level, we can do this by sharing not the data itself, but rather aggregate statistics about the data.

it is not obvious a priori how much information a particular statistic reveals about a speci.cindividual.


Hence, attribute-based access control [1, 3] has been adopted for the cloud computing so that the outsourced sensitive data would be encrypted based on access policy on attributes for such data while only authorized users can decrypt and access the data.

prior work could not provide a complete temporal control for cloud applications.


Therefore, this energy consumption is negligible.

computationally more expensive algorithms may be applied within Patrol as well, since we are able to randomize the detection process.


To prevent TPM owners from deleting this state to reset the CRL version state, [12] suggests a protocol performed by the enhanced boot loader ensuring freshness of a newly installed CRL.

[12] only describes the highlevel approach.


Instead, they use the technique of identity-based encryption with wildcards [1] to achieve the accountability of users.

they assume that the decryption key encapsulated in the suspect pirate device is well-formed.


This allowsit topreempt the running VM and respond to anI/O request immediately.

a VM that has run out of credits cannot receive boost.


Similar to other personal devices, personal RFID tags often store valuable information privy to their users, and are likely to get lost or stolen.

unlike other personal wireless devices, such information can be easily subject to eavesdropping, relay attacks and unauthorized reading , and can lead to owner tracking.


More sophisticated price stabilization algorithms could be developed.

our security analysis in Section 5, which is based on our basic control-theoretic algorithm, provides fundamental baselines for understanding the security properties of RTP systems running such sophisticated algorithms.


The above discussion shows that the security of Hyper-Sentry relies on various hardware components (e.g., IPMI, SMI, TPM, IOMMU, APIC).

this should not be a concern to the security of the whole framework because most of these components need to be trusted to preserve the correctness of most, if not all, security systems.


If the computation overhead is significant, CRAFT may not be practical.

a recent software router implementation [5] achieves about 10 Gbps throughput for forwarding 64 byte packets with IPsec operation.


These two models consider l as a fraction of the secret key.

the bounded retrieval model (e.g., [3]) considers l as a system parameter and increases the size of the secret key to accommodate l bits of leakage.


It is unlikely that an adversary will dig up the Internet backbone and splice into the line.

wireless communications are di.cult to protect; they are by nature a broadcast medium.


Actually, by relaxing the model, the number of required pairs of faulty and correct ciphertexts increases and, as a consequence, the probability of picking all good pairs decreases.

given a large number of pairs, the probability that they have a common solution increases, making an exhaustive search infeasible.


It became a de facto codec choice because of its widespread use in telecommunication, low processing overhead, associated licensing cost, and high voice quality.

g.711 requires a relatively high amount of bandwidth.


Hence, our approach is suitable for environments where the .ltering rule sets do not change too frequently, as changes to the source rule set require a recomputation of the modi.ed rule set in order to prevent a degeneration of the embedded decision trees.

during our evaluation we encountered the problem that the transformation process for some very large rule sets (10K or more rules) or rule sets with many large rules (in a geometrical sense) took very long for a given binth parameter and cut heuristic.


This approach can capture one of the duplicated tokens.


Developing models, either theoretical or experimental in nature, to estimate the latency and coverage of such channels (e.g., to determine how many infected devices can get triggered in a given time span) is beyond the scope of this work.

we emphasize that many of our channels naturally provide rapid message delivery guarantees to a huge number of devices.


The knowledge of how many characters can be expected in a challenge was used for locating connected characters and estimating the number of such characters in the challenge, which is a crucial step in our highly successful segmentation attack on the MSN scheme [16].

in this attack, our segmentation success rate was higher than 92%, which could lead to an overall (both segmentation and recognition) success rate of higher than 60%.on the other hand, such a design choice contributes to improving the scheme s usability.


The user might not want the revocation service to know all the web sites that the user is registered with.

if he uses different keys for different sites, and possibly even different revocation servers for the different public keys, this will help.


The findings include that 30% of passwords were symmetric, 80% were composed of 1-3 strokes, and 86% were centred or approximately centred within the grid.

no recall test was conducted in this experiment to check whether the passwords chosen by the users were memorable.


4.6.1 Password  Participants liked the familiarity of password entry, commenting that there was no need to learn new tricks , it was comfortable, easy and familiar , seemed to be the fastest method and easiest to remember the measurements and familiar = easy = like!

they did not like that the input requires many steps (including switching back and forth between alphabet and number input) .


For example, if the health organisation were a medical practitioner registration board, then it could be that its certificates confer the authority to sign e-prescriptions and other transactions under certain legislation (and the Certificate Policy would call out that legislation explicitly and incorporate, probably by reference, all associated rights, responsibilities, terms and conditions).

if the health organisation were a hospital, then its certificates might have a more restricted scope of meaning, such as the authority to admit patients for procedures according to a contract between the hospital and a doctor.


Also, when rolling back, the whole program state is recovered, which is inefficient since in many cases only a few data values are tampered.

our secret sharing scheme is able to recover a tampered data value much faster and only recovers tampered values.


Once the optimal setup was reached, we reused the same values for all the malware samples that used the same protocol.

in one of the experiments, we discovered that the 1Please refer to [20, 19] for a description of the procedure required to set the thresholds malware under analysis implemented a custom binary protocol.


In a preliminary version of this work [22], we targeted missedconnections and utilized similar wireless techniques to prove when an encounter occurred.

this service was prone to linking attacks by malicious servers since users reveal their actual location information to the service provider.


It is possible for an attacker to modify HTTP headers in such a way that the message is interpreted differently by the browser.

if an attacker forces the browser to modify a message, the MAC will be void.


[9] have presented a context-dependent access control forcontext information,which canbecharacterizedbythree basic properties: owner-centric, context-dependent, and individual role model for each user.

this solution has been proposed to control access exclusively on context information, which limits its use in PCE (resources can be data, services, etc).


In our previous work, we have present a formal model for the comprehensive veri.cation of the power system state estimation security with respect to di.erent constraints and requirements [17].

our work in this paper considers the OPF module, a critical component of EMS, which relies on the output of the state estimator.


7.2 Helper Data Manipulation Attack In our system model, we assume that an attacker has no access to the PUF outputs or the key.

the helper data can be stored in an unprotected external memory, so an attacker can arbitrarily read or modify this data.


As another example, the aforementioned broadcast authentication schemes, which are all based on TESLA [32], require loose time synchronization, which itself is a challenging task to achieve in wireless sensor networks.

pKC can address all these problems easily.


Many databases such as Oracle have implemented roles in addition to ACLs to group together common sets of privileges and simplify administration.

in a scenario where each user requires an individually-de.ned view of a table (such as the policy of each employee can view their own data in the table ), it becomes just as tedious to use roles as to use ACLs.


Such databases are extremely valuable and thus there are not sold on a whole, but rather customers are charged per access to the database.

the particular DNA sequences accessed by a customer reveal a lot of information about her interests, e.g., for which disease it is developing medication.


In cryptography, the most relevant line of work is predicate encryption that supports the inner product of two vectors, e.g., [6].

predicate encryption schemes are not designed for our data streaming model in which the document vector d and the query vector q are generated by different parties and must be kept secret from each other.


There is also a rich literature on privacy-preserving comparisons [20, 59] (we compare our tech nique to others [18, 21, 22, 28] in Section 7.7).

to the best of our knowledge, the protocol detailed below is the .rst to build privacy-preserving integer comparisons from hash chains.


For known packing techniques, there exist corresponding unpackers [9].

given an arbitrary packed executable, which unpacker to use is still a problem.


For example, our tool placed a hook at the function FREERESOURCE which frees an resources from the resource table.

the manual hooks were placed at each of the callers instead.


To reduce the cost of a sensor, it is best if the monitor and event handlers are implemented directly in the VMM.

this extra code can increase the complexity of the VMM and thus reduce its level of assurance.


Our current prototype will not detect this kind of malware.

some complementary work has been done to address this problem.


If the host was a legitimate host (Figure 3b), that is, not using decoy routing, then because there is an existing TCP stream, the destination will treat this packet as a duplicate, and, per the TCP RFC [23], send a duplicate acknowledgement.

if the host was actually using decoy routing (Figure 3c) and the destination was simply the overt destination, no TCP connection will exist, and the destination will respond with a TCP reset packet.


Our experiments reveal that the best precision obtained by using Naive Bayes classi.er to classify short text messages is 88 90%.

literature shows that researchers are able to achieve near 100% precision using Naive Bayes classi.ers on email datasets [13, 25].


Using a high-pass .lter, DC offset can be reduced in real-time.

the .lter design and its use is very speci.c to the phone type and its hardware.


This validates the results of TA HO E s analysis because the hook placement in LSM-SELinux has been tested thoroughly, and the errors found by veri.cation tools [10, 23] have been .xed.

in the case of vfs rmdir, LSM-SELinux optimizes hook placement: A closer look at the source code of vfs rmdir reveals that all code paths to line (V5) pass through line (M4) and line (P3) (formally, line (M4) and line (P3) dominate line (V5) [17]).


RELATED WORK In crowdsourced tra.c monitoring systems, smartphone users may upload GPS samples in an anonymous way to protect their location privacy.

anonymization techniques are not su.cient for such a purpose [6 8].


Moreover, we stress that each public value is typically 171 bits long.

each user belonging to a certain class for a time sequence has to store as many secret values as the number of time periods in the sequence.


Since the checks are localized (in the code at the boundary), manual veri.cation e.orts are a possibility.

in a JVM like implementation, each of the individual library classes performs sensitive native operations, and guards these native operations through security checks.


Non-SecurityGoals: As atenant sVMstill uses servicesprovided bytheVMMandits managementVM andtools,CloudVisorcannot guarantee availability and execution correctness of a tenant s VM.

we believe this is not an issue for multi-tenant cloud, as the primary goal of cloud providers is featuring utility-style computingresourcesto users with certain service-level agreement.


Such comparisons are generally based on simulations between different access control schemes.

the de.nitions for simulations that are used in the literature make it impossible to put results and claims about the expressive power of access control models into a single context and to compare such models to one another in a meaningful way.


Indeed, D7 can be safely reduced to D6 with respect to these operators.

if we want to extend XACML with additional operators already de.ned for a larger decision set, it is necessary to determine the safety of the reduction function with respect to the new operators.


The base stations could run access control in a similar way.

since they are typically resource limited, we expect them to be statically con.gured to return information only to the Wi-Fi service.


Thegoal of a malicious(orcorrupted) RsM would be to bind the user s identity to the requests.

the encryption of the CertU ensures that RsM is restricted to only the pseudonymized identi.er IDU .


After successful validation, interrupts are remapped by the hardware module to the corresponding physical interrupt vectors with the proper attributes (e.g., delivery mode).

if Extended Interrupt Mode (x2APIC mode) [27] is disabled, old, compatibility-format MSI interrupts can still be generated if VMM software enables them during runtime.


Rejecting almost all forged documents at the expense of erroneously rejecting a few authentic documents is acceptable since in most cases forged documents can cause a lot more damage.

if we perform another round of validation when a document is rejected, the false alarm rate can be greatly reduced.


The possibility of implementing .ne-grained access and usage control makes ERM the prime candidate for the protection of data in business environments.

the adoption of rights management systems in enterprises makes forensic investigations much more diocult and guidelines on how to mitigate resulting impacts on digital forensics do not exist.


In other words, the location privacy metric should be able to measure the inability of a given adversary in accurately tracking the mobile users over space and time.

existing location privacy metrics in the literature do not completely capture this notion of location privacy and are too speci.c to particular privacy preserving mechanisms.


Setup -This copy of the application is con.gured with the same Remote File Upload vulnerability explained for the previous test.

the vulnerable path for this test is admin/banner_ manager.php/login.php.


HyperLock s paging based memory access control is relatively straightforward to implement.

there is one subtlety related to TLB (translation lookaside buffer) in the x86 paging mechanism.


We presented results for a server-like and desktop-like load, and showed that training on one does not allow us to detect under the other, and that training on both results in decreased detector performance from the case where we train on only one of the loads.

our results are promising in showing that even under a fundamentally di.erent type of load, the detector still provides adequate discrimination between  Figure 7: ROC curve for system under both desktop and web server loads, showing degraded performance clean and infected systems.


First, AKI s setup suggests that validators can be non-pro.t organizations whose only incentive is to check the correctness of ILS operations.

aKI s design implies that if validators are not continuously online or have rooti h13 h14 h9 h10 h11 h12 h1 h2 h3 h4 h5 h6 h7 h8 rooti-1 A.com D.com F.com K.com P.com S.com Z.com  Figure 2: Integrity Tree in i-th ILS_UP period.


We also ran a pairwise comparison and observed no statistical signi.cance between Same-As Subject and Same-As Object.

we do see statistical signi.cance between Grouping Based and Same-As Subject and Grouping Based and Same-As Object.


The security properties required by D are inspired by the security definition in [6], adapted to our setting.

instead of using de.nitions based on computational indistinguishability of the view of the adversary, we provide a rigorous de.nition of (public-key) deniability in terms of interactive experiments.


The TrustBuilder-Relevant Strategy is simple and easy to deploy because it does not maintain any internal structures to trace the dependency relationship between credentials.

a party using this strategy may make unnecessary disclosures.


In addition, antivirus products normally scan the external storage in the device which appears as a .ash drive from the operating system s view.

such scans are based on well-known .le formats and none of them can scan the internal ROM or raw data stored in the hand-held devices, to the best knowledge of the authors.


Other reasons such as the relative frequencies of different key-pairs in natural language are also often cited for the di.erences in typing speeds of the respective key-pairs.

for the design of Master-key, we needed precise distribution information for KHTs and KITs from typing sessions which were designed to closely match password entry in a typical KD authentication environment and thus could not rely on general trends that have been reported from experiments conducted mostly in the .eld of psychology under a wide range of conditions (in terms of sample sizes, keyboard types, type of text typed, key logger clock resolutions, features studied, pre-processing of experimental data (e.g., outlier removal), method of text entry (e.g., we required users to re-enter text if an error was made in the password),etc.,).


We observe that for increased feature space using TF-IDF, TF-IDF-CF, CPD and GSS malware features the accuracy remains constant beyond an increase of small feature length.

in case of benign features larger number of attributes is used to develop the model.


Hence, they are publicly veri.able, scalable for large systems and achieve the non-repudiation.

digital signatures also have limitations (discussed in Section 1.1) that prevent them to be practical for resource-constrained devices.


In such applications, a reverse proxy is con.gured to avoid service delays for DDoS attack detection.

the detection is based on the performance of the Turing machine.


However, this scheme requires the delegatee to possess an additional secret for each delegation from Alice.

the delegatee in proxy re-encryption systems only needs his own private key as in a standard PKE.


3.7 Ring View In targeted attacks, the web server might observe several attempts of one or more attacks from the same remote host.

for newly discovered web vulnerabilities or in case of attacks requiring a campaign of bots (e.g., distributed denial of service attacks), multiple instances of the same attack are launched simultaneously by many remotes.


This also implies that the SP trusts that DS keeps the integrity of the policies.

we do not assume that each SP trusts all possible SR domains explicitly.


Research on graphical password schemes has been ongoing for approximately 15 years, but graphical passwords have yet to see wide deployment.

there are indications that they might become more mainstream.


Reputations are extremely valuable in the context of electronic commerce, for they provide a mechanism to establish trust and reduce the costs and risks involved in transactions.

privacy concerns over inappropriate use of the information make it hard to successfully exploit this knowledge.


Of course, we admit that the memory usage of our scanner is 2.6 to 8.4 times the NFA-based approach.

the largest scanner we created (Linux L7-filter, 3 groups) uses 13.3MB memory, which is well under the memory limit of most modern systems.


Hilbert initially de.ned the problem for an integer solution.

the problem is equivalent for a natural number (zero included) solution.


This likelihood will increase with the wind speed.

di.erent power lines will have different resistance against storms, and the likelihood of breakdown will decrease with the resistance.


More detailed, in the preparation phase, A can be any unrestricted probabilistic algorithm.

a has no in- P .uence anymore once Attest is executed between P and V P in the execution phase.


therequestisauthorizedif: Req<(RUAUBUCUDUEUFUGUHUIUJUKULU ) Determiningtheallowabilityofarequestimpliesalarge searhspaeinthepermissionstree.exploiting thehierarhialnatureoftheXSetstandardallowssearh spaetobelimitedbyeliminatingpartsofthetreethat annotontainmembersoftherequestedset.Nodesanbe eliminatedeitherbytheloationofbranhpointsintheset, asintheaseofFandG,andbythemaximumdepthofa desirednodespeifedbytheXSet,asintheaseofD,E, K,L,andM(seeFigure5).Applyingtheserulesredues theauthorizationfuntionforReqto: Req<(RUAUBUCUHUIUJ)  3.2 Set-Access Control Lists YGuardisbasedonahierarhyofsetaessontrollists.


As such this solution limits the resource owner s policy to be a set of credentials that need to be provided by the requester for gaining access to the resource.

many real world policies are more complex.


4.2 Duration distribution and micro states In the above-mentioned de.nition, the length of a stay in the same state follows a geometric distribution.

when we use HMM to infer a user s presence, it may be unnatural to assume that the probability that will user stay in a room (e.g.


The advantage of IG is its simplicity, however its disadvantage is that combining individually-good features into a subset does not necessarily mean that the features subset are good team-playing members.

one of the questions this evaluation attempts to answer is how likely is it to have such scenarios in real-life datasets where highly predictive individual features are not good team-playing features.


contain many non-transformable parts, which reduces the achievable gain of the transformation process.

even in these cases, the path lengths of the transformed rule sets are still very small when compared to the sizes of the input rule sets.


We had anticipated that the recognition condition would fare best in the memorability related tests.

we acknowledge that while some people may prefer a recognition scenario, others may perform best in a situation involving recall.


The two techniques are complementary: one could use backtracking to identify the source of the intrusion, then use the Repairable File Service s forward tracking to identify the .les that potentially have been contaminated by the intrusion.

we believe that an intruder can hide her actions much more easily from the forward tracking phase, e.g., by simply touching all .les in the system.


A virtual machine provides some of the bene.ts of identity boxing.


Unsafe declarations can cause the client API to propagate exceptions unintentionally.

listing all potential exception types for each method may be cumbersome, and this decision should be based on the visibility of the method to external clients and the ability of the clients to recover from the propagated exceptions.


This method is suitable for scenes with uniform distribution of nodes complexity.

it is not optimized for a scene with the co-existence of complex objects and simple objects.


If they searchedforthekeyword assignment, therewouldbetwo hits,but theymay have noticed only one.

windowshasamuch betterdeveloped search featurefor displaying multiple search hits itshowsall searchhitsinalistwith summary detailsof each hit.


Currently we consider only the maximum number of nodes that get served at a position.

some nodes may need the secure communication between them more urgently than others.


On one hand, this property is helpful in tracing: a judge (given the decryption box and the decryption key of the user) can probe the box exactly on those ciphertexts which the user key should not be able to decrypt.

this does not seem to create a problem for decryption queries since the chance that a malicious PKG will hit such a ciphertext (with a polynomial number of queries) is negligible.


These mechanisms may seem easy to build because the policy appears to be simple and clear.

we studied the SecurityFocus vulnerability repository [16] and the existing literature (see Section 3), and found attacks exploiting residue objects being reported sporadically against leading browser products, including IE, Firefox and Safari.


Especially, medical doctors who run their own small practice do usually not have the competence and time to professionally manage their IT systems to be su.ciently protected against malware threats.

they use their computer systems not only for accessing health records of their patients, but also for other applications, such as billing systems, or Internet browser.


They can help users save energy and increase the comfort.

this increased convenience also comes with new attack vectors.


aformalanalysisoftheomplexityofimplementing RHA4isbeyondthesopeofthispaper.wenote E (d)DeleteEdge(ENG1,PE1) theextendedhierarhy thatthean-modifyrelationisdefnedintermsofenapsu 21R1 latedrangeswhiharesubsetsofR.Therearesubsets ofR.Henethenumberoftuplesinan-modifyisbounded 21R1 bylARl,whereARisthesetofadministrativeroles.5 Thenumberoftuplesinadmin-authorityisboundedby lRl.Itanbeseenfrom(5) (7)thattheomplexityofan algorithmtodeterminewhetherarangeisenapsulatedis ertainlynobetterthanthatofanalgorithmtodetermine whetheraroleisintheadministrativesopeofanotherrole.


[5,41], which matchesthepattern Modal Verb in Main Verb Group.

this sentence describes a requirement on password setting,instead of anACP rule.


Wang and Lakshmanan [31] use OPE in querying encrypted XML database and address the prior-knowledge enhanced attacks on OPE with duplicated fake index entries that point to the same data item in the encrypted data block.

their approach requires the data owner to build indices for the server, which is expensive and not convenient when the database is large and frequently updated.


To compensate for that, we are using an extremely high amount of parity data.

by adding redundancy, we are using a lot of space.


Since y < sj holds, y can not be a member of Ej.

according to the de.nition of x and y, there can be no more data point z .


We show that encryption does not su.ce for guaranteeing the strong de.nition of privacy for DNS.

due to the con.gurations of the DNS servers and zones hosting practices, a weaker (and a more practical) de.nition of privacy for DNS su.ces.


4.1 Convergence Buffering source events helps prevent slowing down the event source and absorbs temporary variations in event rate.

it is undesirable for the buffer to grow too large, because it increases latency.


Also, a recent fully homomorphic encryption scheme [12] enables secure computation of a wide range of functions.

these metho ds are computationally intensive and do not scale for the integration of large data sets [6].


We do not currently express negative ACLs in our system.

matching a negative ACL is not much different from matching a positive one, so there is no reason to expect that negative ACLs would be more difficult in this system than in other implementations of access control.


V EX does not ensure that the auctioned impression is actually delivered to the claimed user: the seller can send the ad to a different user, or even a bot.

based on the HTTP request that fetches the ad, the winning bidder can check that the fetching user matches the original user information (§2.2), in terms of browser, IP pre.x, cookies, etc.


secure key distribution does not require the use of a speci.c routing protocol.for concreteness, in this paper we assume the use of a routing protocol similar to the TinyOS beaconing protocol [12, 17].In this protocol, the nodes in the network are organized into a breadth .rst spanning tree on the basis of routing updates that are periodically broadcast by the base station and recursively propagated to the rest of the network.Each node keeps track of not only its parent and its children in the spanning tree, and also other immediate neighbors.Note that in the TinyOS beaconing protocol a node does not maintain any information regarding any non-parent nodes in the spanning tree; however, this information is necessary for secure key distribution below and for defending against various attacks in Section 5.


We chose the GMW framework of [12] as it is implemented in the same programming language and is also extensively based on OT.

as GSHADE is independent of the generic secure computation protocol, we could alternatively use Yao s garbled circuits protocol, e.g., as implemented in [27].


3.1 Entities in Privilege Federation A privilege federation model is based on an identity federation framework such as SAML and ID-WSF which specifies attributes exchange between WSC and WSP.

the providers in the previous model preserve the same user account, i.e.


The Prefork MPM can be con.gured so that a worker handles exactly one connection (called the Fork MPM).

the Fork-MPM mode incurs frequent worker process creation and destruction, which impacts the performance.


The security manager, which runs as a thin hypervisor on the isolated core, keeps these interrupts disabled.

non-maskable interrupts cannot be blocked.


Fig 2) and hence A can observe the same contextual parameters as d1.

a is not able to follow the user constantly.


It seems closely related to the recent formulationof TheOne-UpProblemfor (EC)DSA [4].

we have not proven that this scheme is as secure as ECDSA so, like the key-dependent encryption scheme from section 4.4, we currently have only heuristic arguments to believe that this scheme is secure.


MAC enforcement may be used to limit the permissions of services to only those resources necessary to implement customers requests.

in OpenStack, each service performs duties for any customer, so a compromised service may maliciously modify or leak the data of a customer when processing the request of another.


Compilers lay out basic blocks on disk via a compiler trace generation algorithm [3].

5 there is no single canonical layout, as any permutation of basic blocks is valid.


In contrast, the network traf.c during key establishment grows linearly and therefore limits the scalability.

this is a general problem of a reactive algorithm that does not use any knowledge about the network: The only way to .nd another device is to query all other devices, i. e. communicate with (n - 1) devices.


This approach appears conceptually simple, but hides complexity in the construction of the argument system: existing schemes all make use of complex Probabilistically Checkable Proofs (PCPs), and this appears to be an inherent property of e.cient argument systems [RV10].

the constants hidden in the asymptotic notation of our constructions are very small (see Theorem 3.7 for the parameters).


The results of security checks must be established before transactions attempt to commit.

tMI-based enforcement should abort a transactionif,andonlyif,a security checkfailsandvalidationof the completeexecution .ndsno con.icts.security checks need not be fully evaluated when the TMI reference monitor is invoked; thebulkof thework can oftenbe performed lazily, oreven overlappedwiththeexecutionofthe transaction.Wehaveusedboth lazy and overlapped enforcement of authorization policies for our experiments in Section5, and found that they can signi.cantly reduce overheads.


This query will be allowed, since tainted characters occur only inside a string literal.

when the malicious user enters their name, the SQL query will be: SELECT * FROM students WHERE name = Bobby ; DROP TABLE students; -- In this case, the infrastructure can recognize that the web application is under attack, since taint is not limited to literals: several SQL keywords (e.g., DROP) and operators (e.g., ;) are partially or wholly tainted.


For instance, until the late 20th century, Polish (a close relative of Russian, with 39 million native speakers) had only a handful of lexical blends, which were not recognized as such by most speakers.

since the 1960s, and especially the 1990s, blending has become a ma jor source of new Polish words under the in.uence of English and other international languages [51].


For example, as in Figure 2, we may want to allow some third-party extensions in Escudo ring 1 to invoke the DeleteFriends function, as long as the user speci.cally grants the permission (i.e., the function will provides extra application-speci.c control to safe-guard the friend list).

because of protection needs, the Friend table is stored in Scuta ring 0, forcing the DeleteFriends function to be put in ring 0 as well, and denying invocation by the third-party JavaScript code (in Escudo ring 1).


Therefore, in order to prevent bots from obtaining new accounts of web services, CAPTCHA has evolved.

it is analyzed by computer software since OCR technology has also evolved.


In particular, we introduced a systematic con.ict detection and resolution approach [21] to cope with privacy con.icts occurring in collaborative management of data sharing in OSNs, balancing the need for privacy protection and the users desire for information sharing by quantitative analysis of privacy risk and sharing loss.

the proposed privacy con.ict resolution mechanism assumes that all controllers are well-behaved to provide their privacy settings for collaborative sharing.


File access: Unlike OAuth, our protocol has no extended message.

for a challenge message, the cryptographic cost at a server is CP-ABE encryption (2|L| +2 exponentiations); and for a response message, the computa n tion cost at a consumer is CP-ABE decryption (2|IL| +1 pairing operations).


Thus an adversary cancommunicatewith anyhost,faketheoriginof messages, deviatefromprotocols,collude,andin.atethe measurement of rtt(n,m) where m is malicious.

the adversary cannot a.ect the rtt betweenhonesthosts.


To simplify the development of context-aware applications typically a dedicated middleware is implemented which reduces the complexity of contextmodeling for developers.

since these frameworks are often di.cult to use or lack certain features like runtime updates or are generally hard to extend, Ambient Dynamix, a plug-and-play context framework has been introduced by Carlson et al.


In particular, several content .ltering techniques have been proposed to used Field Programmable Gate Arrays (FPGAs) for taking advantage of the hardware parallelism and the con.gurable nature of the device [4][5][6].

the FPGA has to be reprogrammed to modify the signature database, which could lead the network infrastructure at stake in the presence of the zero-day attack [7].


PIRS and DVS have comparable CPU overheads for Sign.

pIRS outperforms DVS for Update and Verify because, contrary to DVS, it does not involve HMAC invocations.


Also, reloading the CR3 register .ushes all TLB entries except those for global pages [18], which are being used by Linux to retain TLB entries for kernel memory during the task switching.

global pages could lead to serious security vulnerabilities in HyperLock.


For example, the statement open( javascript: doEvil , frame2 ) will result in an access denied error.

since the javascript-URL is passed from the Windows Explorer, Frame2 receives the script as if it was from the local machine, not from the Internet, which bypasses the same-origin check.


Oblivious transfer has been studied in the context of access control [27, 2].

both [27] and [2] can only be applied to protect against certain collections of inference channels, rather than the more general collections that we consider here (see Section 3 for a precise description).


3.1 Hancke and Kuhn The protocol due to Hancke and Kuhn addresses ma.a and distance fraud, and uses a PRF implemented as HMAC.


Weakest preconditions can be computed directly in HOL4 using the ARMv7 model.

this task requires a signi.cant engineering e.ort.


Traditionally, denial of service is concerned with .lling user-domain and kernel-domain bu.ers [12].

in the wireless domain, the adversary is empowered to launch more fundamentally severe types of denial of service that block the wireless medium and prevents other wireless devices from even communicating.


For example, Swift [18] uses information-.ow analysis to separate an application into the parts that work on the data with different security levels.

such an approach can be less applicable to genome algorithms that intertwine the operations on both public and sensitive data.


For the mobile honeypot, we build our subsequent analysis of monitoring attacks on a Linux-based system that is connected to a mobile operator network for two reasons: First, a major part of currently deployed smartphones runs Android, which makes this platform appropriate for observations.

current OS .ngerprinting tools such as Nmap or Xprobe do not reveal speci.cs of the Android OS, but only report about a Linux system.


This almost immediately leads to a VSS protocol.

apart from the fact that this may result in a huge loss of efficiency compared to the underlying SS scheme, it would also give a protocol whose actions depends heavily on which particular secret sharing scheme is used.


For example, Google s crawler uses Mozilla/5.0 (compatible; Googlebot/2.1;+http://www.google.com/bot.html) as its user agent.


One way to decrease the SRK size requirement is to use a more size-e.cient asymmetric primitive like Elliptic Curve Cryptography.

in the absence of such alternatives it is possible to implement the SRK of an MRTM as a symmetric key with a su.cient key strength, e.g.


We propose the Secure Deep Throat (SDT) protocol to provide anonymity for witnesses of malicious or sel.sh behavior to enable such peers to report on this behavior without fear of retaliation.

in SDT the misuse of anonymity is restrained in such a way that any malicious peer that attempts to send multiple claims against the same innocent peer for the same reason (i.e., the same misbehavior type) can be identi.ed.


To be fair, the CVSS speci.cation does not state how to interpret the Exploitability score; its intended purpose may not have been to represent the likelihood that a vulnerability is exploited.

given its name and the factors that determine the score e.g., dif.culty and complexity of programmatically accessing the vulnerability in an exploit attempt it seems reasonable to expect that the score correlates with exploit likelihood.


Studies such as [46 48] found incentive messages to be e.ective in promoting safe security behaviors.

researchers in [49] found that incentive messages did not signi.cantly increase security compliance amongst users.


Users who are concerned about higher online privacy, tend to install a number of add-ons.

this in turn may lead to conflicts and likely slow loading as the browser loads and interacts with multiple add-ons.


This motivates a market for valid consumer IMEIs.

many legitimate applications and advertising libraries already collect IMEIs [25].


GENERALIZED HYPERGRAPH MODEL In a simple graph model, actors usually correspond to nodes in a graph while relations between actors correspond to directed arcs or undirected edges.

this approach does not cover all the variety of user activities in the network today.


Such testbeds are often used for applications other than eHealth often with stationary sensor nodes.

single-PC based testbed design is relatively easy setup but limited to scale up.


At the end of the key generation phase, each player only needs to store a private key share SK i = {(Ak(i), Bk(i))}2 k=1 of constant-size whereas solutions like [4] incur the storage of O(n) elements at each player and can erase all intermediate values, including the polynomials Aik[X] and Bik[X].

we insist that the security analysis does not require reliable erasures.


The overhead is pretty signi.cant because of the large amount of TPM extend operations and low computation capability of TPM.

the cost is still acceptable in practice, as TBS is only executed once for each build immediately before the certi.cation.


Thus, these intervals take care of the signatures separated by distances >d and =d(1+ß) s( t2,M2 must use the same public key SI .PK .

sI .SK was not created and thus was not known at the time of the latest exposure te.Thus F cannot generate the SI -signature for SI .PK (i.e., we could reduce forging S signatures to F success).


(2) The victim s browser then visits https://secure.gmail.com, the pharmer tries to return over HTTPS some HTML containing trojan Javascript (JS) and an iframe referencing Gmail s home page.

(3) since the pharmer s certificate is invalid, a certificate warning is prompted and bypassed by the victim allowing the HTML to reach the browser.


Threshold alerting is easy to accomplish with state-of-the-art technologies.

to .nd correlations and similar behaviors between the di.erent devices is challenging.


There are also new instructions Eq, for comparing two values (including pointers) for equality, and GetO., for extracting the offset .eld of a pointer into an integer.

frame ids are intuitively abstract: the concrete representation of frame ids is not accessible, and pointers cannot be forged or output.


Clearly, after receiving R s policy from Bob, we can see that Alice will not be able to gain access to R since she does not possess credential A2.

by using the TrustBuilder-Relevant Strategy, Alice will disclose A1 .


To insert booby traps in positions which an attacker will likely execute, we can .nd all possible ROP gadget locations and insert traps at these locations, displacing the existing gadgets.

this assumes a known attack model, which is generally not the case.


As presented in Figure 5, TP and FP rates did vary when URL class ratios varied in the dataset, which is expected due to the nature of this statistical classi.er.

it is interesting that TP and FP rates did not vary noticeably considering the noticeable variation in the datasets (i.e variations in TP and FP rates are around 1% and 3% respectively).


The proposed policy model associates program entrypoints, the instructions that invoke the system call library with whether the expected resource retrieved should be adversary-accessible or not.

the entrypoint may be invoked in multiple contexts, some of which may access di.erent resources, or use name values derived from multiple data .ows, only some of which may be under adversary control.


In an IPv6 Internet, the address space is so much bigger that randomization could be even more e.ective.

we need to also consider worms that use higher-level addressing schemes, such as DNS or DHT identi.ers.


The security features of Joelsson s scheme depend on MIDlet.

joelsson s proposal does not consider local Web server security itself.


To do so, we should predict the nine external entropy sources of the PRNG.

we show that these sources can be obtained in practice if the device is .xed.


Based on our testing, we knew that the application was vulnerable.

we discovered that the on-device signature was never triggered during these tests.


At .rst this may seem to be a severe de.ciency.

when di.erent images were presented, people were able to detect the ruse nearly immediately even if they abbreviated the description.


In a smart grid, the number of packets transmitted to IEDs per second is typically in hundreds, and so in the data injection attack, it is conceivable that the AMS may converge to an optimal strategy in matter of minutes.

other types of attacks that are less frequent (e.g., where an attacker s action involves physical hampering), a dynamic technique such as the AMS might not be suitable.


The SIP proxy and the registrar could be either hosted locally or could be provided by a service provider.

this gives a user the power of calling anybody and everybody in the network without any restriction whatsoever.


sibanc(i, j), the third property above cannot hold.

by the invariant mentioned above, if U * substitutes K(w, z)for K(w, fw)for some z = fw for some w,then z is necessarily less than fw so properties (1) and (2) cannot hold simultaneously.


It relies on extracting the exploitation paths of an application, and then it represents the path as a Finite State Automata (FSA) that can be used as rule-based signatures to detect exploitations.

the approach does not address the issue of dealing with subjective terms.


A number of the issues we described in the previous sections could potentially be exploited by an attacker (or a malicious image provider) to obtain unauthorized remote access to any running machine that adopted a certain vulnerable AMI.

.nding the right target is not necessarily an easy task.


Each level is unaware of how the next level structures itself, only that it provides an interface to read and write, and that it can do so securely.

we cannot treat the map as a simple associative array now because the recursive ORAM will need to store more than one address per block in order to guarantee that we have only O(log n) levels of recursion.


The former approaches detect worm intrusions by comparing the normal and abnormal network traces.

modeling normal and abnormal network tra.c is hard because of the diversity of the tra.c.


To protect Tripwire s database, Tripwire encrypts its database with a passphrase speci.ed by the user, which reduces the risk of using a bad database.

when users install new security-sensitive applications or apply patches, they must update their database with new hash values.


Sometimes there will be no satisfactory solution, as when a key employee leaves the company.

to assist Joan in managing the situation when a solution exists, we provide the designs of tools that support .nding such a solution.


RDBAC aids the management of database access controls by improving the expressiveness of policies.

such policies introduce new interactions between data managedbydi.erentusers,and canlead tounexpected resultsif not carefully written and analyzed.


The alternative constructions do produce strengthened passwords which are more resistant to a PCFG-based attack.

the di.erential in the percent of recoverable passwords is slight, particularly if two edits are used.


Motivation for outsider cybersecurity attacks are very varied, from activist groups, to criminals, to state-affiliated organizations.

insider threats are seen also as a major issue for all organizations, sometimes even more severe than damage from outsiders, as seen in the WikiLeaks and NSA surveillance incidents [17].


In this case, if our scheme precomputes (uj , rj ) , the timing of signing will be much shorter for two scalar multiplication operations reduced.

our scheme uses the Tate pairing instead of Weil pairing because the Weil pairing takes longer than twice the running time of the Tate pairing for the cryptographic applications [10].


For example, one common strategy consisted of checking whether the web site was designed professionally.

this is not a useful strategy as many phishing sites are exact replicas of professionally designed legitimate sites.


Especially, the level-free advertisement shows the most rapid ad-coverage rate (100% ad-coverage within 15 min).

in real-world scenario, the rate of such ad-coverage slows down for the reasons described earlier (e.g.


Backwardsecrecy means that when a new user joins a group, he should not be able to read data created in the past.

sIS is not limited to forward and backward secrecy of information.


The pro- tocol itself is relatively simple ~md computationally efficient.

maintaining a TTP that needs to be on-line con- stantly can be expensive.


INTRODUCTION Applicationsin sensor networkshavebeenresearched and developedforyears.

mostsecurity workfocused on threatstonetworking and communicationprotocols.


As we can see, slight o.sets of request time will not immediately a.ect the risk assessment.

clear unusual patterns (starting at time 90) are e.ectively detected.


doesn t help much because the AP is already spending more power for rx2.

if the SNR gap ranges from 5 to 10dB, implying that the channel condition of rx2 is much better and the AP intentionally reserves more power for rx1.


The test application had 162 unique gadgets and was successfully attacked using this attack tool.

this attack failed after shu.ing the binary.


Naturally, PINs are a candidate tool for authenticating users in mobile banking as well and in fact, most existing mobile banking services use them, too [6-9].

to guarantee secrecy of PINs, they need to be suitably protected when transmitted by banking applications over the mobile network.


The memory we used for SnoopMon was su.cient for SnapMon since the size of immutable region in kernel was less than 1MB.

the processing time was longer than we had expected; it took about 5 seconds to hash them using the processor on Veri.er.


The execution ofthedeliverysection relates to code execution done by the S machine of Giotto [15]and the reception section to code interpreted by the E machine.

as we are not aiming at hard-realtime systems, we can allow arbitrary code in the delivery section.


For this example a synthesized reference implementation was available and therefore could be used to produce the needed gate counts.

in actual usage, gate count estimates would be obtained from functional information such as VHDL RTL descriptions or data flow graphs.


Computing and verifying these zero-knowledge proofs seems at .rst as a computationally expensive task.

performance can be greatly improved, and be quite reasonable, based on two observations: Since all encryptions are based on the El Gamal scheme, all proofs can be translated to proofs that a certain tuple is a Di.e-Hellman tuple.


Països Catalans 26 E-43007 Tarragona, Catalonia ABSTRACT The usual approach to location privacy is to cloak and/or perturb the positions or trajectories of the mobile objects.

if unlinkability of the various interactions between a mobile object and the service/control system can be afforded and achieved, neither cloaking nor perturbation are necessary.


As in Figures 6(c) and 6(d), while there exist none or a small number of packet-dropping nodes on the way, our scheme works almost like the single-path forwarding with the help of a few additional relaying nodes.

when confronting a large number of packet-dropping nodes, our scheme makes full use of the help from additional relaying nodes, in order to successfully deliver the packet to the base station at any cost to the best e.orts.


CT-KIP provides a mechanism to transfer secret data to a token securely.

if credential programs from di.erent providers are executed within the same token, CT-KIP does not enable the provisioner to control which programs are allowed to access the provisioned secret data.


With end-to-end security, path prediction or prefetching can be implemented as in OAA.

caching content does not bene.t from centralizing multiple end users.


A set of such attributes is used to map the requestor to principals in the relevant authorisation policy.

there still remains the di.cult problem of interpreting the requestor s attributes in the context of a di.erent domain s authorization policy.


This means that signing (and verifying) is much more ef.cient, as log T hashes (private key operations) are extremely fast to compute, compared with log T signatures, which are slow.

key update is much slower here, since the signer must generate all the public keys in a bottom-up fashion, in order to compute their hash which is the public key; since the signer does not keep all keys (or else the key size would be very large), regeneration of keys is necessary during the life time of the scheme, resulting in (amortized) log T key generations per update.


The domain builder code is dynamically linked into the Python interpreter that runs xend,so xend and the interpreter must be included in the TCB.

the domain builder accesses the guest address space using the privileged command driver, which is exposed to all processes that run with administrator privileges in Dom0.


Certi.cate chains of size 13 are probably going to be rare in real environments.

the cost of security also depends on the depth of the tree of contacted services, k. When taking this value into account, we get a cost of k* l* 16ms for the no delegation case and a cost of l* 16ms + 180ms + (k-1) * 16ms for the delegation case.


Proposalshavebeen made for discovery servers that contain an index over all repositories[3,1].

they do notprovidethe appropriate level of security.


The gate count of low-cost tags is 5, 000-10, 000 [8].

no research has been conducted on the minimal computation power that should be endowed on tags to ensure privacy.


John Linwood Grif.n Department of Computer Science The Johns Hopkins University Baltimore, Maryland, United States jlg@cs.jhu.edu a community.

a person s reputation may be quite di.erent between communities; people prized for their programming prowess may be vili.ed as griefers in computer gaming circles, or people known in one town for their kindness and generosity may in fact be escaped convicts known to the law enforcement of another.


In this case, the original main entry point class is kept and malicious classes can hide themselves without being declared in manifest .le.

the inheritance relationship of main entry point class is modi.ed.


Compared to a normal password, the usage and duration of exposure are extremely low because the PIN is only used to setup a shared key.

we recommend that the PIN should be changed after each key setup phase.


Hence treating personal data as private property and having control of this property by being cognizant of the processing used by second and third parties is one of the legal avenues that is being used by certain legislative bodies.

such an approach has issues in marketing such data, providing a framework its legal use and handling of shared data.


In this way, price factor will become too weak to disturb the normal operations of the device.

fake user input will be detected by RRA-UCC.


Each Java thread needs a native stack in the sandbox.

not all Java threads use native methods.


In particular, they demand for session keys to be indistinguishable from a random string.

whenever practical protocols implement explicit key con.rmation, then key indistinguishability is violated.


If there were no cost to this then all sites would choose very complex password policies.

sites also desire usability for their users, which exerts downward pressure.


F0 f(r ): Ask(H,mIr) To prove the .rst premise, observe that any adversary that asks r '' to G, can be used to invert f on its k1 most signi.cant bits.

before applying rule OW, we must .rst apply [Merge] to replace r '' I r ' by a fresh random variable r,so that the judgment has the appropriate form.


{any, max}.When obj = min, there is a degradation in performance since, while the time taken for the generation of the clauses remains the same, the time taken for the solution of the generated PMAX-SAT problem increases signi.cantly, as expected.

we observe that the timings in this case are still below 1 second.


One might imagine learning algorithms that observe similar behavior across a family of malware.

with repackaging, the shared behavior may be the legitimate traf.c from the original application or it may indicate the same malicious software was injected into several different applications.


An intuitive approach would be to for the browsers to employ similar content-sni.ng for content rendered in plugins, as is already done with content native to the browser.

this intuition fails to take into account that the very reason for using plug-ins is that the format is unknown to the browser.


The PUF circuits can also be used as hardware random number generators [11].

this paper only focuses on device authentication and key generation.


In that sense, NOTAMPER is similar to these approaches as it generates hostile inputs to discover vulnerabilities.

our formulation of the parameter tampering problem as one checking the consistency of the server and the client code bases and development of methods specialized to this problem makes it different from these approaches.


Liu et al [9] have presented algorithms that re-write transaction history by moving the attacking transaction and all affected transactions beyond non-afffected transactions.

this process requires significant page I/O since all transactions after and including the malicious transaction have to be read.


Simple variables, such as cloud ceiling and visibility, can be directly compared between those reported by an MCIS and those obtained from a weather observation recording.

spatial weather information, as obtained from a graphical weather overlay, cannot be directly compared to information received during a pre-.ight brie.ng or from direct visual observation.


A virtual machine (VM) achieves strong isolation and con.nes processes running inside the VM such that, even if they are compromised by malware, it will be hard, if not impossible, to compromise systems outside of the VM.

a dilemma exists in switching from the in the box approach to the out of the box approach: It is well-known that there exists a semantic gap [29] between the view of the VM from the outside and the view from the inside the latter being seen by the traditional, in the box anti-malware systems.


Compared with the .ve phases of attack scenarios [25], it is easy to see that Figure 4(c) reveals most of the adversary s strategy.

figure 4(d) reveals two steps fewer than Figure 4(c).


One authority will only manage user real identity and will not contain any information with respect to the user s pseudonyms.

another authority will be responsible for managing the user s pseudonyms and will not contain any information about the user s real identity.


Being controlled by the host, the device is more prone to be taken over by a compromised computer.

the potential attack surface is much wider: the USB creates a bidirectional communication channel, permitting, in theory, exploits to traverse both directions.


Since either the user or key generation authority is assumed honest in all security games for standard Worry-Free Encryption, the CRS will always be correctly generated and we will be able to set the CRS in each security experiment.

this will be incompatible with the ideas in the following section in constructing a minimally-vulnerable scheme and we leave the problem of constructing a CCA2 secure Worry-Free encryption scheme that is minimally-vulnerable open.


is {0,1}n, and that for every .xed key s.{0,1}n the function .s(·) is injective.

consider now a set of functions {gi,g':1 =i =n}with the property that for every i i 1the exact security language may be somewhat more natural when talking about block ciphers and tweakable block ciphers. '


suggested to use other channel characteristics than RSSIs in static settings, such as phase.

this solution requires special hardware.


In order to do this, we need to add a depth constraint; this can be seen in our recent delegation paper [14].

the liberal DAC used in current commercial operating systems and database systems does not control the level of granting.


Certainly, such benefits differ from one organization to another depending on the local context and the type of initiatives implemented.

certain types of benefits can usually be expected.


There couldbe other notions ofdependency, such asfunctionaldependenciesthatexpresses requirements on thetemporal ordering of obligations.


It involves not only giving the IP reassembly code hints about preferred addresses, but actual code for verifying cookies.

it is more resilient against the guessed-IP-address attack described in Section 3.1.2.


If we use the smartphone when standing or sitting, it is So far we have discussed how to quickly differentiate most likely that the gravity only affects y axis (Figure 5a).

if a user plays with his phone on bed or lying a real 3D face from a 2D photo (or video) with the help of motion sensors.


If the implementation of other components is tightened up to eliminate features unneeded for MCC, then the size of security-critical components of MCC can be brought down to below 10 KLOC.

it should be noted that safety depends on many non-MCC components, including the underlying OS, the gcc compiler and related tools, and the XSB system.


our approach does not prevent a senior role having access to all possible permissions because we have not placed any restrictions on the roles that a user can activate.


For instance, in a social network with millions of users with hundreds of contacts each, utilizing private sharing could need extensive resources because of the server load.

by eliminating the encryption load on the server, VPET gives an e.cient solution for private equality sharing.VPET increases the size of the location data slightly (see Table 2) as the vector components have to be transmitted by Bob (in each of three steps, FPET transmits (4 + 4 + 4) = 12 bytes in total, where VPET transmits (4+4+8) = 16 bytes in total).


Each variation, for example a 5-second scene of a movie, contains di.erently watermarked but otherwise identical content.

each variation is encrypted with a di.erent set of keys such that any given device out of the player population has access to only one particular variation for each segment.


Reconstruction techniques adopted in network-based intrusion detection systems will be useful to support network devices [6].

supporting USB storage devices is likely to be easier because these are block devices and categorized into the same device family as ATA devices.


All of the above papers provide reasonably strong security.

they assumed that the underlying physical network is dense enough to enable their key pre-distribution to be e.ective.


We can expect their sum to 50 55 bits on a .xed device.

zygote Time is close to a system boot time.


In this case, we can observe that the most interesting for the system to allow this access, even though interesting policy is for the AC-DP to make an autonomous decision, that is to start mitigation techniques, before allowthe access itself has a negative reward.

with the state s2 =(reg, cf, {(s1,o1)}, (s2,o1)), that is, the state ing a bad access.


These responses belong to di.erent states in the model since size was used as a variable in the tuple (s)used for the state de.nition.

none of the meter generated a response of size more than 30 or less than 26KB which was set as a variance boundary.


TrustZone Technology provides hardware features to create a secure environment separated from the normal execution environment.

the hardware features that are provided do not implement or ensure a secure environment.


The table shows that calls to the basic libraries of the kernel (Kernel / Base, I / O and Executive) are most common within the API spectrae of all drivers.

the distribution of calls amongst the different libraries/semantic classes differs considerably.


al[16] introduces inter-module communication monitoring for web browser plugin vulnerabilities, which shares a similar feature with our plugin simulation in JavaScript context.

their system is based on a real browser, while we implement a simulated plugin module within a low-interaction honeypot.


Nevertheless, it is applicable to map between both classi.cations as following: values high to low to the value medium (potential security risks-requires security guarantees from the cloud provider)  values negligible to the value low (does not have security requirements), due to the absence of security risks associated with this type of data.

further requirements can be de.ned like costs or availability.


The result shows the con.ict resolution time is quadratically dependent on the number of policy rules.

the ACL implementation model extraction and service .ow graph construction times are dependent on both the network size and the policy rules.


Indeed, WSP(=) can be solved in polynomial time [17] for constraints of Crampton s form.

the equality relation does have a signi.cant impact on the complexity when the constraints may include non-singleton sets.


This approach may reduce the amount of storage and computational power required by the importing terminals as compared to use of a certi.cate chain.

if a large number of devices have the power to translate contracts for example, in the terminal translation architecture  the proxy signature scheme would need to support a very large number of proxy signers.


Long tails were cropped for clarity and the longest block was 1029 bytes long.

a winnowing method results in quite uniform distribution where the block sizes are bounded by the winnowing window size plus the overlap.


The extension provides a language for the speci.cation of application-level access rights.

the proposed method combines the identity of the application (using application name) with the user s access rights and does not provide an explicit application identi.cation model.


All custodians should be debriefed, because they sign an informed consent at the beginning of the test.

to preserve the trust between the custodian and the employees, the custodian should not know which employee contributed to the attack.


It may seem somewhat unusual to compare these traditional access control mechanisms to the use of mailing lists.

given the overwhelming tendency of users to share documents by email [16, 17], email mailing lists (and the dynamic groups generated in the To and CC lists of each message) are in fact the most commonly used access control lists encountered by users.


[5] proposed an accountable wiretapping architecture that enhances wiretapping systems by adding tamper-evident records of wiretap events.

our proposed work demonstrates that an attack can work in a very stealthy manner and then circumvent the existing accountable wiretapping infrastructure.


Performing user-space stack unwinding from the kernel is one option to understand program components on the call path.

such backtrace information resides in the user-space and therefore, needs to be well protected.


Times for password creation, con.rmation and login are comparable in T&C and PCCP.

text passwords perform signi.cantly better than both of these schemes.


In the previous two constructions, the hierarchy was .xed from the beginning.

there are potentially many di.erent ways to organize health data in a hierarchy.


Attacks will be less successful when, say, the user is playing music while typing.

there is research in the signal processing area that separates voice from other sound in the same channel.


We hypothesized that passphrases would be easier to remember if they were sentence-like, and that passphrases composed of nouns would be easier to visualize than passphrases composed of random words.

we found that pp-sentence and pp-nouns resulted in slightly longer passphrases than pp-small (which contained short words such as: the, be, and, a, to), but otherwise performed similarly.


Other hosting types like Usenet newsgroups or P2P networking do not directly generate revenue through cracks and keygens.

through combinations with other hosting types like PPD hosting, the uploader can still make money.


Instead, we use the data structures that summarized the event history information to make an authorization decision.

stateless speci.cation contains no such data structures to provide summarized event history information, every action in the history need to be kept track of.


Privilege is also required to modify the properties of a DD, such as the types of events that are being monitored and the parties that will be noti.ed when such events are triggered (the owner of the DD, the sender of the message that triggered the event, the recipient of the message, or any combination of the three).

processes that receive messages sent to listening ports need not have privilege for the DDs to which those ports are connected.


For the other rounds, the adversary can guess the response; thus the overall winning probability is roughly 3 per time-critical round.

once the prover with 4 draws its support, the adversary (more formally a simulator having access to the adversary s view) is unable to use the information learned during the prover-aided phase of the attack.


The reason for this is that in the second strategy, the invocation to ConstructCascadeBF receives a smaller upper bound value for the space dedicated to counters than the .rst strategy.

the approach of severely limiting the space allocated for counters leads to more frequent re-allocations (invocations to ConstructCascadeBF) of the cascade Bloom .lter.


An expert user can successfully distinguish attacks from legitimate tra.c by expanding and manipulating the P3D environment.

the ability to successfully and e.ciently expand this visualization requires the user to possess an advanced background in network security and experience with the P3D visualization system.


Stacks are not currently checked to determine if they represent a valid call stack, so a suf.ciently advanced attacker could construct a return-oriented program [28].

oSck could be extended to add this property, by including information on the valid kernel call graph in its analysis.


In fact, none of the examined countermeasures were perfect: IBS, cache colouring, constant-time implementations and scheduled delivery all leave residual channels, a depressing realisation.

we note that our local exploits were performed under the most pessimistic assumption of a malicious agent exploiting a covert channel.


Since the activity and the role concepts are similar in that they both group permissions, one might think that there is no di.erence between them.

they have completely di.erent meanings and characteristics.


Thus, secure multi-party computation methods can be applied to any protocol to avoid unnecessary disclosure.

such generic techniques are usually too resourceconsuming in practice.


However, if technical features are an important factor for the choice of the smartphone, the person is signi.cantly more likely to have an Android phone (variable Technical features, p < 0.001).

the variable Interest in Technology has a negative e.ect.


If these controllers are apathetic toward the shared data item, Facebook solution will be preferable.

it should be noted that Facebook solution had very high extrema.


As Hammitt puts it, Reno urged agencies to maximize disclosure of internal memos by withholding information only when there was a foreseeable harm that would flow from disclosure.

the Ashcroft memo states that when agencies decide to withhold records, in whole or in part .


uses deployment knowledge to improve the performance and security of sensor networks.

this scheme assumes group-based deployment in which groups of nodes are deployed from horizontal grid points.


In our approach,the credentials(e.g., username-password combinations) arestoredinaseparateDB and are hence decoupled from the RBAC model.

the username in the DB equals the subject name in the RBAC model.


Burst mode achieves 15 Hz on both the Nexus S and Galaxy S3, so the attack remains possible.

the time between two consecutive pictures is not always constant, so greater care must be taken to select the correct pictures for each touch event.


At the same time, the tags might be little expensive to be used for very cheap items but as the usage increases the cost may come down.

customers will have to use a universal customer card and remember the PIN while the smart appliances need to consist of an input method.


properties of all the program executions that follow the same control .ow path, and has been successfully applied to a wide range ofdifferentapplicationsinsoftware engineering and security[7, 10,14,26,41,46].

this approachgeneralizes an execution onlyto a set of executionsthatfollow exactlythe same control-.ow path.


The system is still a new service and is under development.

it could only be tested from two locations in the same area and it may behave di.erently in the future as they expand the network.


As noted above, in deterministic systems, this is equivalent to the statement that the history viewL(r) of everything that is observable to L in the run should depend only on purgeL(Act(r)).

as the following example shows, a similar equivalence between de.nitions stated in terms of observations in the .nal state of a run and de.nitions stated in terms of the view on the run does not hold in nondeterministic systems.


Many of them rely on a trusted third party (TTP) who can deanonymize or link users accesses, such as [20, 13, 15].

having a trusted third party is dangerous and users can never be sure of their anonymity.


Public key cryptography has traditionally been overlooked as a solution for sensor networks because of the computational overhead.

preliminary work has shown they may be a more viable option because the message complexity, memory usage, and security resilience are more beneficial than symmetric-key schemes for some environments [9].


The user equipment (UE) proves its identity to an radio network controller (RNC) by replying to the challenge from the RNC.

since the UE does not send the challenge to the RNC, the RNC can prove itself only by computing the MAC of the authentication vector.


Commercial eye-trackers are currently very expensive, varying in price from US $5,000 to US $40,000.

the underlying technology is straightforward [7, 8, 11, 15, 28-30, 41] and other than recovering the cost of research and development, there is no reason why an eye tracker should be so expensive.


Under the decisional Di.e-Hellman assumption, it is relatively straightforward to implement the above framework for constructing lossy and all-but-one TDFs (see Section 3).

when working with lattice-based cryptosystems [1, 36, 37], many additional technical di.culties arise.


AVM [11] provides auditable virtual ma chines to clients.

these virtual machines do not guarantee correctness; instead, their mistakes can be proven to others.


However, one distinction is that these techniques all look essentially like current technology, and as such, all have similar weaknesses to current pathologies as existing systems.

we advocate a computing system that is designed from the ground up to be incapable of revealing any meaningful data in a way that con.icts with its policy.


ACQUISITION OF CREDENTIALS In this section we use an insider attack example, more appropriate for illustrating the acquisition of credentials in MsAMS.

.rst we introduce the concept of exposure.


We have suggested the possible countermeasures that can be implemented to raise the complexity of attacks.

these countermeasures do not prevent the attacks completely and decrease performance.