Research onPUFs[5,6] arose from the observation that distinct instances of hardware produce unique behavioral characteristics [11].

each copy of the device, even if designed to be identical, will exhibit slight variations that can be measured only during execution of the circuit.


For instance, even an identifier UID agreed upon between a wallet holder and U, without prior meaning, should not be sent to all destination sites automatically.

a user should be allowed multiple unlinkable roles, and not only in the userunfriendly way of multiple wallets.


Nevertheless, a number of questions are unanswered.

questions relating to the false positive rate, and the willingness of the users to opt into the system, can be answered with a small deployment.


Binary relations, however, are an entirely di.erent breed of animal.


We use can_assign to denote the collection of can_assignaua relations for all atomic-valued attributes.


4.1 Computing Aggregates Using a Singly Homomorphic Encryption Scheme Consider a homomorphic encryption scheme that is IND-CPA secure with key generation algorithm, encryption algorithm and decryption algorithm (Gen, Enc, Dec respectively) and with semigroups of plaintexts and ciphertexts M and C respectively.

the homomorphic property is such that for m1,m2 .


5.1 Pacemaker and ICD Reliability Studies The way in which pacemaker and ICD malfunctions are recorded does not allow for the determination of the frequency of failure of a particular device model.

while there have been studies that attempt to measure the reliability of these devices, the studies are limited by the fact that malfunctions are only included in the records if the malfunction results in a device replacement.


While differential privacy may be introduced only through limited interfaces to data, once introduced it becomes a robust quanti.cation of information .ow.

one can determine the differential privacy parameter of a computation by determining only on which differentially private measurements the computed value depends, and accumulating their privacy costs.


Small, Stupid, and Scalable: Secure Computing with Faerieplay* Alexander Iliev Dartmouth College alex.iliev@gmail.com ABSTRACT How can Agnes trust a computation C occurring at Boris s computer?

how can Agnes can trust that C is occurring without Boris even being able to observe its internal state?


Though the goal of this paper is not to investigate the existing privacy preserving data mining tasks over the encrypted data, we focus on speci.c underlying secure operations used in these tasks.

performing secure comparison on the intermediate encrypted results (i.e., given the encryptions of two integers x and y in the cloud, we need to securely evaluate whether x is greater than or equal to y) is an essential operation in many data analysis tasks such as clustering and classi.cation.


Another possible optimization, which we have not yet implemented, would be to transform calls where no arguments follow the format string into calls with a constant format string.

we can replace calls of the form printf(buf) with printf("%s", buf), as long as no arguments appear after buf.


When a start-point object is a network facing process, its dependency graph is too coarse grained to be used to recognize malicious objects in a cluster fashion since it might contain both benign and malicious objects.

we can not determine that all objects in a graph are malicious even if most of the objects in the graph are recognized as malicious.


In most practical scenarios, n is signi.cantly larger than k; our protocol is optimized for this case.

the size of the securely transformed branching program is independent of n. 4.1 Branching programs In this section, we formally de.ne branching programs, which include binary classi.cation or decision trees as a special case.


However, these performance metrics are only meaningful with respect to the achievable security level (S ).

we are interested in how MA schemes compare with each other in terms of (i) Ls / S , (ii) Cs / S , and (iii) Cv / S .The lower an MA scheme scores in all these metrics, the better the MA scheme.


The number of them is variable and depends on the distribution of the values of the quality parameter.

the only watermarks that are averaged are those with arms of the error smaller than a constant k times the smallest of all the rms of the error.


A TVD Agent manages assurances of all TCs on the same node, and plays the role of a single common contact point that guarantees the integrity of each node communicating with any other nodes.

integrity of a TVD Agent is attested when a node tries to attest integrity of the other node.


An encryption algorithm is called homomorphic for a de.ned operation o, if (Enck(x) o Enck(y)) = Enck(x o y).

with a homomorphic encryption, arithmetic operations can be performed on ciphertexts and the respective result can be retrieved after the decryption.


Second, the returned privileges are not required to have the same time period.

it is possible for a system to require that one privilege is used before another one.


Such considerations are particularly relevant for so-called Moving Target Defense (MTD) approaches that seek to adapt or randomize computer resources in a way to delay or defeat attackers.

we explore tradeo.s between con.dentiality and availability in such systems that suggest improvements in one may come at the expense of the other.


That is, such CAPTCHAs should be segmentation-resistant.

if breaking a (text-based) CAPTCHA can be successfully reduced to a problem of individual character recognition, then this scheme is effectively broken.


We suspect that a number of factors a.ect the incorporation of information into users mental models.

these factors may be important for home computer users decision to incorporate new information into their mental models: -Content: information about threats vs. behaviors [2, 24] -Source: friends, other people like me, experts, or un familiar strangers [5, 16] -Format: stories vs. policies vs. explicit advice [44] -Valence: positive vs. negative cases [5] -Intensity: emotional vs. not [37]  -Style: .gurative vs. literal language [21] we suspect that: a) Stories about threats have a larger in.uence on mental models than behavioral advice; and b) Information from friends and colleagues have a stronger in.uence on mental models than information from strangers or experts.


it is not always certain which system calls should be connected via argument constraints in the system call model.


Both works regard probing/scanning as sampling.

probing a target to .nd an information server or a vulnerable host is equivalent to obtaining a sample in IP address space.


This is more e.cient than searching the  white-list for a speci.c address, and has been su.cient for our purposes.

it is exactly what we need for the automated approach described in Section 3.


the start of our school year features a division-wide barn-raising effort to make sure that all incoming students can connect their computers to the network before classes begin.


In this section, we introduce the analytics to monitor how policy assignments change over time.


Organizing a page in logical sections enhances the blind user s experience when navigating a page in two ways: it provides a page overview and offers the possibility of jumping from section to section.

heading levels may improve navigation since screen readers have special commands for moving from one heading to another.


To compute the public key pk, the CC computes the modular multiplicative inverse of sk by using the extended Euclidean algorithm.

the CC computes d such that sk ·d = 1 (mod .(n)).


In case of req , O behaves as in Game 1 and sends the next ai PP to P. However, when P sends skip then O does not send P ai to P and extends the time-bound by dGen.

at the beginning of the challenge phase, the winning conditions are that (1) all responses (xP1, .


Note that for varying settings of k. this, we merge accesses to resources that are found in di.er ent traces and even on di.erent Windows installations.

we build a virtual .le system and registry that contains the union of the resources accessed in all traces.


The authorization of a requested action by the client agent becomes meaningful if and only if an intention to perform the action and an empowerment to so act exist for a server agent.

a client agent c cannot be authorized by a server agent y to perform an action a unless there is an intention by y to perform the act a for c and y is empowered to perform the act a for c. Intentions and empowerments can be viewed as part of a richer interpretation of the notion of authorization; speci.cally, intentions and empowerments may be interpreted as preconditions for authorization.


Figure 11 shows that both the average and worst authentication accuracy exhibit an increasing trend when more antennas are used.

the authentication accuracy of using single antenna in the apartment and laboratory environments is over 0.95.


The correlation between delay and distance, however, is not always strong due to Internet peering points, topology, and layer-2 tra c engineering [40].

internet delays are known to violate the triangle inequality.


They do not have a means of protecting the data on the system.

the response is invoked after an intrusion is detected, at which point it may be too late to make any guarantees about the security of the system.


Thus, in order to determine whether to grant a data access for a certain access purpose, the system must consider both the intended purpose explicitly associated with the data object and the implicit intended purposes inherited to the data object.

the system accepts a query if and only if the access purpose of the query is compliant to the e.ective intended purpose of the requested data object.


We show that, on real HTTP tra.c, our protomatcher classi.ed more than 99% of the tra.c as benign.

our protomatcher determined that more than 99% of the tra.c was benign without utilizing the expensive analysis-normalizing-matching phases.


However, considering that 300 million ABSTRACT devices were sold during one quarter in 2010 alone, the expected The most popular platforms being developed currently are those penetration rate and number of subscribers are even moreused in mobile devices.


In this section we show that the previous scheme can be modi.ed in order to achieve function privacy.

if we see the polynomial Before the speci.cations of the scheme, we shall make a .nal observation: due to the noise growth of the BGV scheme summarized in lemma 1 (for D = 1), in order to achieve correctness of the result to be decoded by the client, we need q t 1.5 to be larger than 2 · p · x · s · n , where x is the evaluation point of the scheme.


Access control guarantees that only those who have subscribed to the service can au- thenticate the data.

we present two schemes that can be easily in- tegrated into the multicast channel model proposed in [7] and the multicast se~ecy frameworks proposed in [1, 9, 10, 15].


m was not sent to the oracle Alice previously.

eve s goal is to compute a signature s on a new message m without asking Alice about the concrete signature.


For clarity, we describe each privacy speci.cation assertion.

we provide details on the possible instances of the resource privacy policy assertion which may have di.erent meanings based on the set of arguments.


The TVD concept separates data and applications of di.erent security domains and automates the security con.guration on devices.

we build our solution on top of the OKL4 microkernel, which provides the basic isolation properties, and extend it with a framework that realizes the TVD policy enforcement for Android operating systems.


even if all the users in the network collude with a revoked user, the revoked user cannot encrypt messages without receiving new keys from the broadcaster.


Inparticular,if we expectthatthe results ofqueries willgrow approximatelylinearly with the number N of end-users in the database, then we could getuseful resultsevenif thenoisewasproportional tothenumber of end-users.

even if we choose e tobe aslow as 1/N, Theorem 2.1 tells us that the noise s = ./e ~ N. will be acceptablein this model.


In this paper we are interested in the security problems with balanced views from web sites and users.

a web site wants only authorized users to access information and a user wants to protect his individual privacy.


Upon receipt of (NS , Q, D, Z), the client .rst generates a nonce NC , sets M ?

z||NS||NC ||IDS ||IDC and .nds a value X such that H(M, X) mod 2Q : D. client .nds a solution to the associated puzzle.


We set a polling interval tpoll (10s, in our experiments), after which the browser driver checks whether the instrumented browser has issued any successful HTTP requests since the last poll.

we verify whether during the last polling interval, the browser has loaded any components successfully served from the recorded trace.


As our experiments in Section 5 demonstrate, this assumption is realistic based on empirical measurements.

the majority of the apps we analyzed including highly popular games such as Angry Birds performed on-device signature verification, relied on existing libraries for this task, and were therefore vulnerable.


Overall, the tracing algorithm makes a total of O(f) calls to the pirate decoder PD.Using Tardos s t-collusion resistant code we have f = O(t2 log(n/E)) = O(t2.log n)and therefore the total number of queries to PD is `´ # PD queries = Ot 2.log(n) We note that this tracing algorithm is minimal access as de.ned at the end of appendix A.

the tracing algorithm does not need access to the decrypted message from PD.


As of this writing, all components of the system have been successfully integrated and tested with the exception of the quarantine mechanism.

a wireless system that accesses the network is authenticated, and then scanned and updated automatically.


Using such common language facilitates a better understanding and more in-depth discussions among the various stakeholders involved in Gov-IS initiatives.

since e-Government is a multi-disciplinary area, common concepts and vocabulary play a relevant role in the development of any e-Government-related initiative.


Because the length of the representation of numeric data types has a large in.uence on performance of secure computation, we allow lengths of private variables to be con.gurable, with set default values to aid usability.

the programmer can specify the length of numeric data types in bits and use the default value when the bitlength is not set.


If not, it redirects him to the login Activity before proceeding with its own task.

the Activity creates a new intent instance, in which the current intent, the one it receives from another app, is saved under the key com.dropbox.activity.extra.NEXT_INTENT (called NEXT_INTENT here).


In this section, we will examine the expressiveness of E by identifying what family of relational policies are de.nable in E. We will .rst establish, in Section 4.1, an upper bound of the policies de.nable in  E: i.e., identifying a natural family of ReBAC policies to which every E-de.nable policy belongs.

we will then establish, in Section 4.2, a lower bound of the expressiveness of E. we will identify a natural subclass of relational policies that are de.nable in E. In other words, we establish the representational completeness of E with respect to that subclass of relational policies.


Taking advantage of this SMS spam reporting mechanism, we collect one year of spam reports from a large cellular carrier in the US from June 2011 to May 2012 which contains approximately 543K spam messages  and, together with anonymized SMS network records collected from the same network associated with the reported spam numbers (over 78K), carry out an extensive analysis of SMS spam.

by grouping spam messages using text clustering tools, we identify many large and long-lasting spam campaigns.


Our design aims at fully utilizing the parallelism offered by GPUs.

by mapping multiple input streams to different streaming multiprocessors (SMs) and by splitting the DFA traversal among cores on the same SM, we exploit both the coarse-and the fine-grained parallelism offered by the GPU hardware.


Intuitively, such an adaptive signature-transformation adversary can transform a challenge DCS with respect to given signing key into another DCS with respect to other signing keys such that the resulting signature is valid if and only if the original signature is valid.

this attack relates to the property called invisibility .


0 As already discussed, an access decision is made based on the relationship between the access purpose and the intended purposes of data.

an access is granted if the access purpose is entailed by the allowed intended purposes and not entailed by the prohibited intended purposes; in this case we say the access purpose is compliant to the intended purpose.


A large share of the samples, 44% and 43% respectively for strategies A and B, do not employ a backup strategy at all.

after a C&C endpoint is blocked they show no further network activity.


What makes XACML v3 an interesting access control mechanism to investigate is that it uses two decision sets.

it uses the four-valued decision set of XACML v2 [1] in which indeterminacy is represented using a single decision value; in addition, it introduces an extended set for indeterminacy to represent the potential decision to be returned if there would not have been an error causing the indeterminacy.


A set of policies PL is complete with respect to another set PH if all action sequences allowed by PH are allowed by PL, and all action sequences disallowed by PH are disallowed by PL.

the policies in PL need to be at least as restrictive as the policies in PH .


The second case is when A made signature queries of the form (*,c ' ) to at least t signing ora ' cles and there exists a dimension k such that v ' [k] < vtc [k]. '

vtc [k] is the smallest value in dimension k on which a signature should be possible for context c ' .


The proposed approach provides the additional bene.t of detecting when and to what magnitude a system s energy property is impacted due to the occurrence of an attack.

we focus on dissipative CPS, which include a large class of existing systems.


In this paper we propose an anomaly Intrusion Detection approach that relies on an ID approach initially proposed for sensornets in [9].

our proposal is an energy efficient Multilayer anomaly ID technique that uses the available system information produced by the protocols of different network layers.


The parent node of Ak is the previous node of the .rst node in Ak-1 if Ak is not empty.


Speci.cally, Figure 6(a) shows that the corresponding virtual disk of the honeypot VM is externally interpreted and transparently represented as a local Z: drive; while Figure 6(b) reports 21 infected .les in the VM.

among those infected .les, there is a rootkit named SHv4 [47], which replaces a number of system-wide utility commands (e.g., ps, ls, ifcon.g, netstat, and syslogd etc.)


The mediated Hess identity-based signature scheme must satisfy some security properties in order to qualify as a secure and e.cient scheme.

we are interested in demonstrating that the following notions hold in our context: -Key Secrecy.


Q] < 1/poly(k) where * =0and Q is the set of pairs (m, s) such that A queried Osign (0,m) and obtained s. Bidirectional: Since both parties are delegators, this property does not apply.

3.Delegator Security: If the delegator is honest, then she is safe from a colluding delegatee and proxy.there are distinguishable signatures for a user based on whether she used her strong secret key or her weak secret key.The colluding delegatee and proxy cannot produce strong (a.k.a., .rst-level) signatures on her behalf.


Visualizing Your Key for Secure Phone Calls and Language Independence Michael Oehler Dhananjay Phatak John Krautheim Department of Computer Science and Electrical Engineering University of Maryland Baltimore County, Baltimore, Maryland, USA {michael.oehler, phatak, john.krautheim}@umbc.edu ABSTRACT We present a method to visualize and authenticate a cryptographically negotiated key for a secure phone call.

each caller is presented with a graphical representation of the key and through verbal interaction (i.e., side-channel authentication) they describe what they see.


A SEGMENTATION ATTACK We have developed a low-cost attack that can effectively and efficiently segment challenges generated by the MSN scheme.

our attack achieves the following: Identify and remove random arcs  Identify all character locations in the right order; in other words, divide each challenge into 8 ordered segments, each containing a single character.


Sensitivity: If x is a randomly chosen object and z is a random white noise with variance more than ss 2 , then Detect(x + z, Enc(x)) gives no with probability more than 1 - Es.

if an object is corrupted by some noise with level less than sr, then with high probability, the detector should declare that the object is authentic if it is robust.


The gap between km/q2and km/q(the best one could hope for) is signi.cant when qis large.

it makes Theorem 3.9 totally useless when q>m 112.


ANY STRONGLY SUBLIMINAL-FREE PROTOCOL ACHIEVES GOALS In this section, we observe that any protocol which meets the de.nition of a strongly subliminal-free multi-round zeroknowledge proof of know ledge does in fact achieve our stated system goals.

any protocol meeting this de.nition can be used as part of a biometric-based non-transferable anonymous credential system.


With operational semantics [21], the semantics is speci.ed procedurally.

when one executes a sequence of steps, one is able to derive the precise meaning of something expressed in the syntax.


are close to each other as measured by the set overlap distance metric.

if the message is encrypted with a set of attributes .


Hence, in this paper, we continue the investigation in [12] on the security implications of a generic selective encryption procedure [9].

how entropy and guesswork changes with the number of encrypted units, i.e., the encryption level.


graph G =(V, E) is a model of the IFC system and we call it the IFC graph.

from this graph we derive the binary relation T , read as transmits , where Tt(v1,v2) is true iff edge (v1,v2)t is in E. Tt(v1,v2) is true iff vertex v1 sends data tagged t to vertex v2.


First, like Minos we o.er whole-system protection in software by way of a modi.ed x86 emulator which runs our own version of dynamic taint analysis [31].

we automatically protect any (unmodi.ed) OS and all its processes, drivers, etc.


This case study is smaller, but we note that it shares most of the above characteristics of the university policy.

every can_assign rule has at most one positive precondition, separate administration is not satis.ed, about 1/3 of roles are negative, and problem instances with hierarchical role assignment have at most one irrevocable role.


These include forward-secure group signature schemes [35], key insulated signatures [15, 16], and intrusion resilient signature schemes [22], combining the bene.ts of forward-secure and keyinsulated signatures.

intrusion resilient schemes have the advantage that if the key is exposed for some number of time periods, signatures in all other time periods (not just the past ones) are still valid.


However, the engineering challenges of applying environmental constraints to data protection are substantially di.erent than the work accomplished by Covington et al.

environment role revocation in the Aware Home is viewed as a performance concern, with a tradeo.


In this paper, we make one step towards this direction.

among the many forms of collaborative sharing, we focus on the digital information sharing.


Note also that, in order for the DIC query to be wellformed, l must reference a subpolicy of pol .

if pol is itself a subpolicy of some bigger policy pol ', and l references some subpolicy of pol ' that is not a subpolicy of pol , then the DIC query is not well de.ned.


q is unambiguous if and only if all paths to q have thesamesu.x xq and at least one path to q is speci.ed solely by xq.


This is because that the second (fetching the .eld index into a register) and third instructions (executing VMWRITE) can be separated by an instruction fragment boundary.

vMWRITE is the .rst instruction in an instruction fragment.


Enumerate all absent sets that need to be considered We would like to systematically generate only size-s user sets that we need to consider.

we need to ensure that (1) any size-s user set is dominated by at least one generated user set, and (2) we do not generate two sets such that one of them dominates the other.


for the first tree traversal sequence will be: (H3H5), (H3S2), (H4S5), (S1S2), (S7H9), Default policy.


In this paper, we present new character segmentation techniques of general value to attack a number of text CAPTCHAs, including the schemes designed and deployed by Microsoft, Yahoo and Google.

the Microsoft CAPTCHA has been deployed since 2002 at many of their online services including Hotmail, MSN and Windows Live.


Therefore, in order for an adversary to be successful, capturing a mesh router is a must.

as long as a mesh router is not compromised, no matter how many mesh clients are captured, the resiliency of the network is conserved.


Other items are more mundane, and require only straightforward coding.

we have not yet ported an X.509 certification mechanism to vouch for publishers, so publishers can be named but not certified.


If we consider only recall attempts where participants made no mistakes (correctly entered their password on the .rst attempt), then the difference in entry time is not signi.cant.

during both the Login and Recall-1 steps of Session 1, participants entered PassPoints passwords at least as quickly, or more quickly, than text passwords.


We now investigate the optimality of our protocol in terms of the round and message complexities.

let woptdenote an optimal protocol for GKE and let optdenote an optimal protocol for consensus optimal either in round complexity or in message complexity, respectively, depending on the context.


We note that only a very small subset of the Jess language is needed to specify Clouseau policies.

we use only the language constructs discussed in this section.


From an information theoretical point of view, the information about the injected fault translates in an equivalent amount of information about the secret key.

the smallest the model is (namely, the smallest the set of acceptable faults is), the smallest the set of key candidates is.


To the best of our knowledge, such a fully distributed highly constrained scheme has been an open problem in the area.

and of special interest, is the fact that Pedersen s * This research was done while this author was at Technicolor, France.


Data encryption Publickeycrypto systems PKI ), a traditional credential system would require four attribute bases.

four bases per expertise area the user can realize at the same time.


The translation involves adapting the veri.cation problem to the domain of the respective tool, and property-preserving simpli.cations and abstractions to support the veri.cation.

the translation does not add false positives or false negatives to the model.


To create a grammar for our extension of C, we build on existing source-to-source translators that parse C code.

we build on an open-source OpenMP compiler OMPi [23].


Hence each linear extension allows us to discard either (.i,s,s 1)or (.j ,s 1 ,s) (since exactly one of them will be irrelevant to the schedule de.ned by the linear extension), thus de.ning an instance of WSP that contains fewer constraints than the original problem.

we may consider our instance of OWSP1 to be the disjunction of k!


During this delay, the BMC allows the CPU to query about the periodic SMI status.

the hypervisor has a chance to detect if an SMI is scheduled.


Consequently, gcd(m -X mod N , N ) discloses a factor of N .

the solution is as follows: Solution to Problem 1. f (c1 ) Compute gcd(m - f (Sig)e mod N , N ).


However, as the volume of normal tra.c increases, it adds more noise to the selection algorithm.

the normal tra.c starts forming trees with lengths comparable to those of infection trees.


(4) |S| s The entire procedure repeats the loop r times, and the probability of obtaining 1 every time is r 2 1 Ps |fa) , |S| s in which case the .nal state (on the .rst two registers) is (r 5 r 1 |fa) Ps |S| s (r. 5 r 1 |fa) Ps |S| s To get some intuition about what states might pass even the .rst iteration of this test with reasonable prob 5 ability (4), note that the state 1 P s|fa) can only |S| s have norm close to 1 if most of its terms add coherently.

most of the P s|fa) must be nearly the same (they are all exactly the same for good quantum money).


In the context of public-key cryptography, one could use similar strategies in order to attain the same intuitive form of terrorist-fraud resistance.

the tag would compute a binary truncation of the x-coordinate of r1R3 as 0 10 t, and then set t= t. priv for some the private key priv.


It should also be mentioned that our SMBR implementation doesn t adversely affect the performance of the target system.

from a subjective, user s perspective, our SMBR key logger does not introduce any noticeable slow down or latency in keyboard input at the GUI level.


Physical attacks can be tolerated in a WMN where redundancy design is provided for the wireless backbone.

each area is cover by at least two mesh nodes.


Although there have been some attempts to construct .ne-grained access control systems in clouds, existing work lacks a systematic mechanism to support a complete comparison relation, , =, =, in policy speci.cation.

to realize integer comparisons in ABE, Bethencourt et al.


Microhypervisor-based approaches: We discussed two notable microhypervisors, NOVA [27] and Trustvisor [19], as well as seL4 [15] in the introduction.

seL4 is a promising approach that uses formal veri.cation to introduce a vulnerability-free microkernel, though it cannot be extended to commodity hypervisors due to its restrictions (e.g., it should run with interrupts mostly disabled).


With these (valid but arti.cial) choices of Extract and G, we can keep the same distribution sampler D and the attacker A as in the simpli.ed BH example.

now, however, we observe that the state S always remains equal to 0n, irrespective of whether is it updated with I = or I = , 0p 1p ' = G ' since the new state S (S .Extract(I)) = G ' (0n .0n) = 0n = S. we have not gained even a single bit of entropy into S, which clearly breaks backward security in this case as well!


ATTACKER Our main observation is that, for f0 > f1 and any s, Pr( Ax = s | F(x) = f0) > Pr( Ax = s | F(x) = f1).

(3) for a R randomly generated by online parking, if a point x .


All the functions calling a system call implementation directly or indirectly (through other function) were listed.

a transitive closure was constructed for each system call.


If H is an (t,n)-coding scheme, then g = 12(c21og(c~)) when ln(~) > K. klogc, where k is the expected number of distinct column types and K is some large enough constant.

this means that no secure code has  e = o(e log(A)).


To that end, we formulate the problem of emulating emulationresistant malware in terms of its environment observations, and propose an approach of comparison-based state modi.cation that modi.es the execution state of a malware sample to simulate a different environment and so thwart the sample s anti-emulation techniques.

our approach diagnoses the source of antiemulation behavior by comparing an execution of a sample on an emulation-based analysis tool to its execution on a more transparent reference system that would be impractical to use directly for analysis.


Our access activity model is a single policy derived and abstracted from the observation of how a broad set of diverse applications interact with the operating system in general.

while SELinux-style policies attempt to minimize the damage that a compromised application can cause, our policies attempt to distinguish between malicious and benign applications based on the way they interact with the OS.


In our study, for the purpose of privacy guarantees, zones coresidence is a many to one mapping between an IP address, and the zones that it hosts.

zones hosted on a single machine, which is assigned N network interface cards (NICs), each mapped to a distinct domain name (or a set of domains), e.g., via virtual IP address allocation or by means of multiple NICs, are not considered coresident.


We demonstrate the ef.cacy of our technique by using TAHO E with the implementation of hooks from the LSM implementation of SELinux.

we show how TA H O E precisely recovers the set of operations authorized by each hook from the above implementation, and the set of operations authorized by the Linux kernel.


Accounting Integrity This property ensures that the customer is only charged for chargeable events, such as CPU-cycle utilization, while an instance is running.

the provider cannot charge the customer for spurious events (e.g., for having used a CPU cycle while another instance was using it).


The work [51] was (implicitly) clear of this situation, and such a problem is ruled out, by de.nition, by simply de.ning two sessions ( B, X, Y ) A, and ( A, Y , X ) to be matching, no matter whether the two B, players have matching roles or not.

two sessions with adversary interference under a cross-message attack [25] are de.ned to be matching.


Given any family of collision-resistant hash functions CH and any family of sequential hash functions SH we construct a time-lock puzzle scheme that is secure for a puzzle distribution D assuming that CH and SH are both secure when their index s is sampled from the same distribution D. The veri.cation time for our time-lock puzzle (and the corresponding timestamping scheme) can be poly-logarithmic in the time it takes to solve the puzzle, and the soundness time-gap (the ratio between the running time of the honest solver and that of a successful adversarial solver) is bounded by a constant.

our honest solver evaluates the hash function N times, and any adversary whose solution is accepted by an honest veri.er must have used time proportional to c · N sequential evaluations of the hash function for a constant c. Our construction is fully black box (in the terminology of [RTV04]).


However, in addition to acting as a data structure, the DOM also provides a rich set of behaviors.

several features of the DOM force information-flow models to be non-local, i.e., operations on a certain element in the tree may require updates to the model of other elements in the tree.


Facebook, since all our honey-pro.les were members of a geographic network (as long as these were available), it is also possible that people looking for local friends would have contacted some of our accounts.

we observed that this occurs with more frequency on smaller networks (in particular, some Middle Eastern and African ones).


William s research e.orts centrally focus on systems security, addressing challenges in smartphones and mobile applications, operating systems, cloud services, telecommunications, and hardware architectures.

his work in mobile application security has led to signi.cant consumer awareness and changes within the space.


When a sequence representing an attack is discovered, the problem of re.ning the model is reduced to the problem of re.nement of a predicate abstraction, and can be addressed by several techniques developed in the literature.

the techniques developed in [28]and [29] that de.ne the problem of re.nement of a predicate abstraction as the problem of eliminating nondeterminism in an abstract state graph.


What if information .ow sets were allowed to intersect?

instead of partitioning the subjects into sets with isolated information .ows, some information may .ow between the sets.


Finally, an insider attack necessarily involves misuse of the granted privilege by the insider in order to violate a security policy.


It is possible to treat such a compendium itself as an independent, static .le in a POR system.

pOR techniques may be applied to a full backup .le by means of challenges against individual pieces: There is no need to reencode the full backup or archival repository.


With its movie keys, each device can decrypt a particular variant of each segment in the content.

each device plays back the content through di.erent path.


The recommendation precision (or precision for short) is computed as |AcnAd|+|DcnDd| .

|S| precision is the percentage of requests in S to which the consent manager suggests a decision correctly.


We model both type of compromise in our analysis.

the dashed edges in Figure 2 correspond to the transitions that compromise the policy.


V directly (i.e., without using stepping stones").

the direct attack relation imposes a graph structure G, which can have an arbitrary topology.


While the number of possible channels is open-ended, we have opted to focus on L2 cache covert channels as described in prior work [31] for a variety of reasons: (i) it arguably has the highest potential bit rate as the time needed to make a contention measurement with modern L2 cache is on the scale of milliseconds, but the reported rate in prior work was very small, (ii) prior work only discussed such channels in brief and did not provide an in-depth analysis of the mechanisms involved and their e.ects, both qualitative and quantitative, in various settings, (iii) reproducing these results bolsters con.dence in previous experimental results and allows for an exploration of changes to EC2 allocation and placement strategies since the initial work.

the L2 cache-based information encoding scheme proposed by Ristenpart et al.


User Privacy: The database cannot tell which user makes a query, nor can it tell which record is being accessed.

the database only learns that some user accesses some record for which the user priorly obtained the necessary credentials.


Filling the functional insufficiency by profiling and signal processing techniques, the portable setup can perform a real-time EM display stealing comparable to conventional non-portable setups.

we apply a prior course profiling to a target and derive an accurate image by signal processing, which makes the system robust to individual difference, eliminates the time for estimating leakage parameters, and enables to steal information immediately by loading the leakage parameter.


The remote server in DAS model is assumed to be honest but curious .

the server does not deviate from the protocol, however she wants to learn as much knowledge about the encrypted data as possible.


The PDP instantiates A to the smaller of the positive and negative authorization sets.

if P is the set of positive authorizations, then A is instantiated to P if |P |=|U -P | and to U -P otherwise.


Generally, image-based authentication can be divided into three categories based on their input methods: namely clickbased graphical passwords, choice-based graphical passwords and draw-based graphical passwords.

the clickbased schemes require users to click on the provided image(s) (i.e., choosing an object or element of the image), the choicebased schemes require users to select a series of images (i.e., selecting images in an order), and the draw-based schemes require users to draw some secrets to be authenticated (i.e., drawing a user signature).


The remaining four applications in Table 2 result from the lim itations in Kirin s input.

kirin cannot inspect how an ap  Table 2: Applications failing Rule 4 and 5 Application Description AccuTracking Client for real-time GPS tracking service (AccuTracking).


Therefore, at most one new query is added to Qh*-1.


To this end, we adopt secure multiparty computation (SMC) to carry out policy evaluation in a secure manner.

this section focuses on the application of a variant of SMC known as private function evaluation (PFE).


With appropriate selection of Expand and Extract, k should appear pseudorandom.

it should be hard to guess k. We then use k to encrypt our local storage (or as the actual password , if we use the scheme solely for authentication).


To accomplish this, we leverage the tendency of theXen credit scheduler togive the highest run priority to a VCPU that receives an interrupt.

upon receiving an interrupt, the attacker VCPU will preempt another guest VCPU running on the PCPU, provided that it is not also running with that highest priority(as a compute-bound victimwould notbe).


That is, after m appears there is no alternation in the trustworthiness of user.

m is independent of the user's trustworthiness.


To better understand this issue, we computed how the detection rate of Capture-HPC would change on the Wepawet-bad dataset, given different sets of ActiveX controls.

we want to understand what is the minimum number of components that needs to be installed to achieve a given detection rate.


Suppose [[Q]]ss = s ' such that s ' (out)= o.

the ss actual output of the query Q is o.


The tags simply reply with a few random bits signifying the tag has chosen that slot.

instead of the reader receiving { | id1 | 0 |...| collision | 0 | }, where 0 indicates no tag has picked that slot to reply, and collision denotes multiple tags trying to reply in the same slot, the reader will receive { | random bits | 0 | | random bits | 0 | } resources.


The main reason is that most clustering techniques seek to .nd mutually-disjoint groups.

each entity (user or permission) can belong to only one cluster (or appear in only one node in a tree with hierarchical clustering).


6.2 Categorization of Fraud Activities After removing duplicated instances, we match the fraud number candidates from our .ve months of detection results against the online userfeedback to categorize di.erent types of fraud.

we run queries for all fraud number candidates through popular online search engines and extract user comments regarding these numbers based on the search results.


Performance: our solution should incur negligible performance overhead when properly applied.

code running inside the sandbox should have no or minimal overhead when compared to that running natively.


In general, however, the Asbestos design is streamlined for large numbers of non-hierarchical compartments rather than traditional, military-style sensitivity classi.cations.

we believe that scalability to many compartments is a requirement for MAC to protect user data in today s Internet applications.


A preliminary approach could be for the service provider to specify re-authentication policies.

when the user attempts to perform a sensitive actions that change settings, the server could require the user to re-authenticate.


3.2 Features We train a support vector machine with a collection of robust features that discern between good and bad PIPs.

feature Descriptions Population size The number of accounts Request size The number of requests Request per account The number of requests per account New account rate The percentage of accounts appear only in the last x days Account request distribution The distribution of the number of requests per account Account stickiness distribution The distribution of the number of PIPs associated with an account Table 2: Population features we propose three sets of quantitative features that can be automatically derived from online service logs.


Instead, by harnessing existing hardware and .rmware support, HyperSentry introduces a software component properly isolated from the hypervisor to enable the integrity measurement.

hyper-Sentry relies on a Trusted Computing Base (TCB) composed of hardware, .rmware and a software component properly isolated from the highest privileged software.


SYSTEM DESIGN Our general approach is to build RecDroid with four functional processes, of which two are on mobile clients and the remaining two are on remote servers.

recDroid (1) collects users permission-request responses, (2) analyses the responses to eliminate untruthful and bias responses, (3) suggests other users with low-risk responses to permission requests, and (4) ranks apps based on their security and privacy risk level inferred from users responses.


Despite matching some features of SAML and ID-WSF, UMA di.ers from both proposals.

it is independent from identi.er systems and incorporates user-driven policy decisionmaking in addition to consent alone.


In this paper, we describe how kernelSec supports application security, provides support for high level authorization properties such as dynamic separation of duty, dynamic information .ow, and group management.

the kernelSec s group mechanism provides some administrative controls at the operating system level.


Subadditivity: H(X, Y | Z) = H(X | Z)+H(Y | Z), and equality holds if and only if X and Y are independent conditioned on Z.


1.1 The Problem A major obstacle to implementing all these applications, however, is the problem of replay attacks.

in an of.ine context and without some form of trusted component, it is impossible to prevent the holder of a count-limited certi.cate from reverting his machine s state and reusing the certi.cate beyond its limits with different disconnected parties.


As a result, the client is able to to send packets at a faster rate than it does under a Linux router, Second, the CTCP architecture allows the processing of a packet and the transmission of the next packet to proceed simultaneously.

when the client checks the validity of an ACK packet of a previously sent packet, say P., and prepares for the next outgoing packet, say P., the CTCP router could process P. simultaneously.


The set of all voting system insiders is bounded, countable, and well-defined.

there are a limited number of insiders, they are enumerable, and given an arbitrary entity, we can systematically determine if that entity is an insider or not by answering the question: "Does the entity have at least one intended privilege that can impact an electoral outcome?".


The code size of our own implementation is about 9,300 LOC.

for the .rst component, we instrumented the interrupt/exception handler (do_interrupt_all function) and sysenter/sysexit instructions in QEMU to identify the exact syscall execution context.


Instead, A will be inferred from other access control data structures.

r2BAC the role-and-relation-based access control model of Wang and Li [17] introduces a set of roles R, a user-role relation UR .


Since the function allocates memory from the Windows non-paged pool, it is guaranteed by the OS to be never paged out.

the pages are mapped to guest physical frames that are not used until they are freed.


- It would be interesting to use data mining techniques for aggregating existing permissions not only with user/rolefocus as we describe, but first with application/permission focus or in the "privilege plane".

creating aggregates of authorized objects/operations as applications or privileges [18][15][16].


In summary, we propose to use both picture-based warnings and a history view to increase the transparency of the sharing process as well as the associated threats for the users.

we present users with data at the same resolution they are shared, thus making the .ltering process tangible.


Hence, we claim that the problem of specifying an access control policy can be seen as .rst associating utility values with accesses and/or states (instead of simple bad or good values) and then optimizing the decision making process for a sequence of requests while taking into account uncertainty over the next request in the sequence, the effect of each decision and the current state of the system.

the access control decision problem can be reduced to a decision problem, and analysed in a quantitative way.


High-regularity data contains redundancies that help predict the future because the fact that many observations are repeated (or redundant) in the current dataset suggests that they are likely to appear in the future.

for anomaly detection, we need data with low entropy.


This approach simpli.es the administration work, while reducing the threat of a rogue administrator transferringkeys to an untrusteddevice.

one possible criticism to our de.nition is that it does not considerwhathappenstothecontentsof the .leafterdecryption.if the device d is malicious(orisinfected with malicious software),it could simplybroadcastthecontents afterdecryption.


2.1 App Developers Next, we re.ne our model of the spectrum of involvement by the app developers adding support for IA.

we consider two levels of developer interest in IA frameworks: Cursory interest: app developers who only want to add support for IA to their apps without tuning its accuracy or providing any application-speci.c behaviour.


Afewdetails of our experiments cannotbefullydescribed duetolimited space, which couldhinderthereproductionof our work.

the exact waypoints that the game botsfollowed and the monsterstheyfoughtarenotincluded in the paper.


Different from the existing framework that centralizes privacy policy management and enforcement at the DSMS server, our framework leverages the resource at the data provider site for privacy control.

the DSMS server remains the functionality of continuous and analytical query optimization and processing and applies a part of access control to meet system-level requirement, while data providers will f lter their data tuples based on their own privacy requirement and sends only the useful and qualif ed tuples to the server.


The granularity of usage control enforcement is that of trusted applications (as opposed to that of operating system calls or a language API).

once an application is considered trustworthy, it has full access to the data object for which usage control policies are de.ned.


Any attempt of the adversary to subvert the valid execution path can be represented as a deviation from the CFG, which results in a so-called control-.ow or runtime attack.

figure 1 illustrates two typical control-.ow attacks at BBL3: (1) a code injection attack, and (2) a code reuse attack.


However, this con.guration is actually less secure because now an attacker has more choices in advancing the intrusion.

in Figure 2 the attacker must succeed in exploiting the vulnerability ftp_rhost at least once, whereas in the new con.guration he/she can choose to exploit two different vulnerabilities.


We verify the correctness of our network-based co-residence checks using as ground truth the ability to send messages over a cross-VM covert channel.

if two instances (under our control) can successfully transmit via the covert channel then they are co-resident, otherwise not.


In this paper, we focus on the application state preserving against the application-target attacks launched from compromised drivers.

the attackers .rst craft exploit code to speci.c driver vulnerability, and then leverage the privilege of the driver to unscrupulously and undetectably manipulate the service application for commercial bene.ts.


Each possible execution set in a non-deterministic work.ow speci.cation gives rise to a di.erent, deterministic work.ow speci.cation.

given a work.ow speci.cation W =(S, E) with execution sets {S1,...,Sm}, we de.ne Wi =(Si,Ei), where  def Ei =(Si ×Si) nE.


Note that it does not imply that user u can acquire y s permissions by merely activating x.

permission-inheritance is not implied in an A-hierarchy.


Figure 2 depicts the design of a PKS responder that allows for integration of existing infrastructures in PKS.

to deploy the services o.ered by a CA, a PKS responder can act as a bridge between the PKS and the deployed PKI services.


[1] have been the .rst to apply clustering algorithms to this information.

they obtain a single-linkage clustering by computing pairwise distances between sequences of host-level events.


The .rst is that formal methods detailed, machine-checked proofs of critical properties have now matured to the point where they can play a key role in the design of serious systems.

we know how to write formal speci.cations of the semantics of full-blown instruction sets and of the higher-level abstractions provided by high-level programming languages and software services, and we can build machine-checkable proofs that each layer is correctly implemented by the software running on the layers beneath it.


We show the utilities of our system through several case studies.

by comparing the collected scenarios with their corresponding ground-truth, we show that WebPatrol can cover much more complete infection trails than state-of-the-art honeypot systems such as PHoneyC [11] and Capture-HPC [1].


1.1 Our Results Our main result is the .rst upper bound on the value of C(E): a t C(E) = 1 - O H(E) .

for small enough E, this gives the .rst separation between interactive and non-interactive channel capacity, answering an open problem by Schulman [6].


the time taken grows at a rate proportional to the number of instances.

if n is the number of instances, the computational complexity of dynamic pre.x analysis is O(n).


In the following theorem, we prove that the above set of operations is complete.

give a key for an access tree T , this set of operations is su.cient to compute a key for ANY access tree T ' which is more restrictive than T .


Also, the work does not discuss the credibilities of the alarms activated.

how the uncertainties in operators normal activities would affect the credibilities of the alarms activated are not addressed.


The natural adaption of revocation and broadcast encryption schemes to our setting leads to high overhead.

if we replace a user in the revocation scheme with a conjunction of attributes, and users store the keys assigned by the revocation scheme to each of their conjunctions, this may lead to high communication overhead (O(2m), where m is the total number of attributes).


That is, even if the same design is used for two devices, it is physicallyimpossibleto maketheirPUFsbehaveidentically.

ourinsightforthedesignofsuch PUFROKs istoincorporate the PUF in a feedback loop for a system-on-chip (SoC)design.1 our design is for the PUF to reside on the same chip as the processor core that performs the encryption.


Traditional attack graph/attack tree models rely solely on network connectivity between di.erent hosts as the enabler of related vulnerability exploitation.

if and only if a vulnerability exists in a host that is connected to another host, traditional models identify a related vulnerability in the second host as exploitable.


This approach has the advantage of leveraging an existing ontology that already models, in a fairly extensive manner, important intelligence and military concepts as well as taking into account the temporal dimension of the modeled data.

it provides, through the use of OWL Time Ontology3 , a vocabulary for expressing relations between instants, intervals, duration and date-time information.


ce, if all strings sanitized with f are guaranteed to parse validly starting in context cs yielding an end context ce according to our canonical grammar, and if the sentential forms generated during such a parse are valid syntactic forms as per the application s intended security policy [47].

sanitized strings can span di.erent contexts, but all the intermediate contexts induceded during parsing untrusted strings should be syntactically con.ned to nonterminals allowed by the application s policy.


However, a basic limitation of the original construction remains: it offers only one-time usage.

providing an encoding of more than one input compromises the secrecy of the circuit.


5.4 Process Characterization In process characterization we aim to .nd out the quanti.ed PV model parameters as discussed in Section 3 for all the manufactured chips.

for the quad-tree model of Leff , we characterize the Gaussian distribution parameters µi and si for all the .Li.


This intuition has not been satisfactorily pinned down, until now.

previous information-theoretic models of programs are imprecise, due to their overly conservative treatment of looping constructs.


The central issue in a risk based access control system is to determine where and how much risk to take.

it is a risk allocation problem where risk is being treated as a limited resource.


For example, if a process of type httpd t created a socket to connect to the Internet, the socket would also be of type httpd t. When checking permissions on a socket, one needs to check the permission on the socket labeled with the process type, and one needs to check the permission on the socket with the port type.

we need to check that the process can access the port for which data is being received and the socket object itself.


While powerful, these techniques are useful only for point-to-point authentication.

intermediate devices can not verify the authenticity or originator of the packet as it traverses the network.


MCBPROBINGEXTRACTION  3.1 ICE:Ef.cientPathExploration As stated earlier, the problem of .nding candidate MCB paths is di.erent from the problem of traditional multipath exploration.

as discussed in previous work [21],pathexploration without any high-level semanticguidance is ine.cient.


To match the well accepted least privilege principle, we consider a closed policy, meaning that an implicit negative authorization applies to the whole document.

the access to every object that is not explicitly authorized is forbidden.


Thisis adirectedgraph whose nodes arepointersin theprogram and edges represent inclusion relationships.

an edge from pointer x to pointer y means that any object pointers that can be derived from y are also derivablefromx.


This is where those reserved bits in an ID help1.

if an indirect branch uses an address that is not four-byte aligned, then the four-byte target ID loaded from the Tary table will not be valid (i.e., it will not have the special bit values 0, 0, 0, and 1 in the least-signi.cant bits).


As an intermediate, we also de.ne a hybrid Game (i + 1 2 ), which lies between Game i and Game (i + 1).

in Game (i + 2 1 ), if the (i + 1)st next query is preserving than the challenger acts as in Game(i + 1) and chooses a ran dom S, R, and otherwise it acts as in Game i and follows the original oracle speci.cation.


We assume that the search algorithm may traverse either along or against the direction of an edge.

a tree edge linking a parent vertex and a child vertex may go in either direction.


Since the bound that we have on ts applies to every protocol .

and every start vertex v, we get by Azuma s inequality, that the depth of the end vertex reached by A is with high probability close to its expectation, and in particular is at least n. except with negligible probability in n, the protocol A retrieves the transcript of .


Many horizontal trust metrics are subjective in nature.

given the same set of feedback reports, a principal may be assigned di.erent trust values by di.erent principals, even if the same trust function is used.


[9] present techniques for visualizing single TCP connections and for clusters of many connections.

they use scatter plots of packet size versus interarrival time for individual connections; our unigram Inter-Packet Delays as (size,time,size)-triples next packet size (bytes) 1500 1000 500 0-500-1000 -1500 0 0.2 0 0.4 -500 IA time (sec) 0.6 0.8 1-1500 -1000 gnutella SMTP HTTP SSH 1500 1000 500 current packet size (bytes) Figure 8: 3D Plot for Gnutella with HTTP, SMTP,and SSH heatmaps in Section 3.1 can be seen as a logical extension of this work to enable the visualization of the overall trends in massive datasets.


To achieve fast and efficient grouping result, we take advantage of the core idea of Spectral Clustering, which is a clustering algorithm based on graph theory and makes use of the similarity relation among sample points to cluster.

for a grouping problem of distributing N regular expressions into k groups, the Spectral Clustering based regular expression grouping algorithm has following four steps.


The major difference from the design illustrated in section 3 is twofold We factored out a separate object store OStore which is added to each machine state, mapping object locations to objects, and objects are now maps from keys to values.

the structure of the object store is Curried: OStore = OLoc -String -D. In addition to factoring OStore out from the original abstract machine [6, 7], we not only add a taint store Taint for tracking taint property of ordinary addresses: Taint = Addr -T , but also an object taint store OTaint to achieve .eld-sensitivity for the taint property.


Most watermark- ing algorithms have this property.

both of our underlying algorithms use correlation- type detection, and different watermark patterns are un-correlated.


Our prototype speci.cally simulates the use of Amazon S3 as the provider of remote storage, based on their current API.

we make use of operations get, put, copy and delete in the Amazon S3 API.


We note it is also possible to create a pseudo RNG using the hardware-oriented block cipher.

a secret key can be used as a seed of the RNG, and encrypting a counter with the secret key based on Katan32 creates a random number.


Here, informally, a party P1 holds a text T and a party P2 holds a pattern p and some additional information y, and P2 wants to learn {f (T, j, y)} for all locations j where p is found as a substring in T .

(this generalizes the basic pattern matching problem.)


Since UAS only consider the role hierarchy, we check each element in UAS against DSoD and cardinality constraints in line 3.

if any two roles in the role set are restricted by a DSoD constraint, the role set is removed from UAS; and if any one of the role in the role set cannot be further activated according to the cardinality constraint, the role set is removed from UAS.


We write :a to denote the re.exive transitive closure of RH a and :u to denote the re.exive transitive closure of RH u.

the usage and activation hierarchies are modeled as two partial orderings on the set of roles R. ERBAC07 does not require that RH u .


The Existence metric is the relative number of network services that are vulnerable, on the standard scale of (0,10).

for vulnerable and non-vulnerable services across the network, the Existence metric is  (  )/.


To cope with spoo.ng attacks, a message authentication code (MAC) will be added to each TPMS packet.

we adopt a cipher block chaining message authentication code (CBC-MAC) using Katan32.


8.4 Security Analysis Our security analysis presents a new way to analyze the security of pairwise key establishment for large distributed sensor system.

selective attack and node fabrication attack have not been addressed thoroughly in current literatures.


Depending on the de.nition of privacy, on-line credentials may have many advantages.

if we only care about a user s privacy w.r.t.


In the two-party division protocols and the one following them, all of which use homomorphic encryption, we assume that all players prior to protocol initiation agree on a range of possible values.

they de.ne MAXIN T to be a large number, such that all possible (aggregate) values of x and y will be less than MAXINT , but some randomly generated numbers may exceed MAXINT (in which case this is explicitly stated when they are de.ned).


The set Ei includes at least all the edges whose origin is Si (it may also include additional edges, since an individual may be aware of a relationship between two other individuals).

we also assume that |Ei| << |E| for all i.no sub ject knows more than a small fraction of the edges in E. This is a reasonable assumption in our setting: there is no way to reconstruct privately a graph that is already known.


As a sideeffect ofin.atingthe IPDs, the burst size will also be changed.

if the delay induced bya watermark is largeenough,say not less than the round-trip time (RTT), wecan discern twobursts ofpackets: one has three packets andthe other has one.Similarly, if a traf.c watermarkingscheme delays the .rst response packet(e.g., the seconddelay in Figure 3(b)), wecould observe an increased RRT (i.e., denoted by RRT ).


Their expressiveness has made them a well-known tool in many applications, and their power arises in part from providing additional syntactic context with which to sharpen textual searches.

character classes, union, optional elements, and closures prove very useful for specifying attack signatures, as we see in §3.5.1.


(1) Is the POSIX standard indeed broken as prior work suggests?

are the relationships described in the standard unambiguous, and does the standard specify well-formed functions?


They stand alone to assert the Subject s role or responsibilities, and can be processed by conventional software.

relationship Certificates can substitute for conventional X.509 certificates in standard applications without any software modifications; only the business rules for interpreting what a certificate means need updating.


Therefore, the purpose of ACP being discussed here is to prevent improper accesses, not unauthorized accesses.

aCP does not deal with whether or not users have proper privileges to access data, but only deals with whether or not data are properly accessed by authorized users.


Usable security software must therefore offer assistance to legitimate users, without giving assistance to attackers.

this changes the nature of feedback in interaction design, which must inform legitimate users while revealing no useful information to others.


In order to recover s with this di.erent jamming speci.cation, since |A*|is minimum, it must be that some nonempty subset of positions in B*, which we call Ci, are not jammed and become part of A* in lieu of A*.

to recover s, A* i i and Ci are exchangeable regardless of the values taken on the remaining |A*|-1 positions.


To overcome this problem, we propose .ve di.erent ways to recognize variations of destination pages, where all chains that lead to one of these pages should be aggregated.

there are .ve di.erent ways to specify page similarity via R. Domain + page name + parameters: This grouping is the most speci.c one.


The access control policies presented in Table 1 describe three different accesses that a secretary, on the basis of his/her level, is authorized to do on the employee information.

the third access control policy states that all secretaries are authorized to access all information about employees of all the departments, apart from those of employees in Marketing and R&D departments.


The .rst hypothesis assumes that the average user is aware of the di.erence between secure and insecure form submission.

the average user knows that a secure form submission encrypts the form data before sending it over the network.


Furthermore, it administrates access policies for DBUs.

database Admin (DBA) Database User (DBU) Figure 1: The proposed architecture for encrypted databases, consisting of the CS in the outsourced environment and both the DBA and the DBU (clients) and the KMA in the trusted environment it decides who is authorised to access tables in the database.


[27] examined the same problem and improved upon the work of [3].

they showed that using Mel Frequency Cepstrum Coef.cients (MFCC) features [12] yield better classi.cation accuracies compared to the Fast Fourier Transform (FFT) features used in [3].


This task is quite easy if we start from PKE.

it is enough to encrypt a single message using di.erent public keys.


On the Role of Roles: from Role-Based to Role-Sensitive Access Control* Xuhui Ao Naftaly H. Minsky Department of Computer Science Department of Computer Science Rutgers University Rutgers University Piscataway, NJ 08854, USA Piscataway, NJ 08854, USA  ao@cs.rutgers.edu minsky@cs.rutgers.edu ABSTRACT This paper maintains that for an access-control (AC) mechanism to support a wide range of policies, it is best to dispense with any built-in semantics for roles in the mechanism itself be it the semantics of RBAC, or any other leaving such semantics to be de.ned by particular policies.

an AC mechanism should be sensitive to roles,allowing speci.c policies to take roles into account for their authorization decisions.


Roll-back based approaches complement our work.

a complete SRFD system needs to support secure installation of untrusted code, and a technique such as SSI [25] can do this for us.


1 = p = N, set sijp = rip if xij = xpj, and set sijp = 0 otherwise.

the jth share sij consists of all bits of ri except those corresponding to the records where the value of the jth attribute is the same.


And, given a pair of laws N and M in t(L0), we write N.M if N is subordinate to M. Semantically, the most important aspect of this hierarchy is that if N.M then N conforms to M,in the sense that law N satis.es all the stipulations of its superior law M. This concept of conformance hierarchy is related to, but much more general than, the concept of meta policy introduced by some policy mechanisms (see [2, 4], for example.).

the conformance relation under LGI is enforced by its very construction.


In order to implement a blacklist for this constraint, we would assign negative permissions to the role r. Any attempt to invoke a permission p using role r would be denied if the corresponding negative permission (which we denote ¬p) were assigned to r (irrespective of whether p was assigned to r).

negative permissions always take precedence over normal permissions.


Certain applications can truncate the invocation chain.

these applications are sufficiently trusted to act as the head of any invocation chain that contains them.


For example, an email server canbe tested for password-strength, spam, virus-attachment, executablecode contents, and for malicious contents.

an asset may consistof manyitems(atreeoftestobjects) thatare subject to test, e.g., a sample database server and its tested items, as shown in Figure 2, are Malware, Availability &  Figure 2: An EA Screenshot of evaluation results of a database server conducted by a remote EA.


From this perspective, we recognize that this paper just scratches the surface in an attempt to determine the expressibility of HICCUPS.

while throughout this paper we have discussed the various advantages that would result from having a system such as HICCUPS, we have also pointed out that there are essentially two major limitations.


Isolation Process out-grafting should strictly isolate process monitoring tools from the untrusted process.

the untrusted process will be architecturally con.ned without unnecessarily exposing monitoring tools.


In the path key identi.cation phase, if the neighboring nodes i and j in the range rt do not share a key, node i generates a new key and seds this key to j via the already established secure links.

1) node i tries to share a common key with all neighbors in the large disk with radius rf in the key set-up phase, and 2) if it could not connect to node j in the small disk with radius rt, it uses the secure channels in the large disk to set up a common key with the node j.


The only requirement is that the key be blinded or rendered inoperative in such a way that no adversary can gain a non-negligible advantage in the update security game.

the encrypted signing key EncSK should be useless by itself to produce signatures.


Moreover, our intrusion detection method does not need any prior knowledge for attack detection and so can be used to detect novel attacks.

we propose ID methods for the Physical, MAC, Network and Application layers.


We extend the two-party algorithm to the multi-party setting.

given a set of participants P, every pair of users in P runs Algorithm 4.


The visibility of 2D images is greatly diminished by the above distortions.

the distortion by the translational displacement is different for each frame, which makes it difficult to recognize entered keys.


Destabilization selects three markers forming an L shape with sides of length 1 and collapses them into one.

it deletes one row and one column such that all three markers are removed.


First, we do this with simple boolean operations (Section 4.3).

after, we proposeanovelwayof combiningthe basic methods.weleverage the followingfact.


Examples of this include BASE-64 or archive formats such as TAR or ZIP.

some NIDSs neglect to normalize HTTP traf.c and are still vulnerable to the well-known technique of URL-encoding attack strings.


In this paper, we give it an ef.cient and practical system design and implementation that can be easily deployed in today s web.

we tackle several previously-unidenti.ed challenges, such as supporting progressive page loading on the client s browser, designing browsers policies for handling of mixed endto-end secure and insecure content, and de.ning access control policies among HTTP, HTTPi, and HTTPS content from the same domain.


Because extensions are written in JavaScript and no native code is generated, all Mozilla extensions by de.nition are open source .

it is possible to download any Mozilla extension and inspect its source code1 .


This suggests a method of reducing the magnitude of the noise and the modulus by roughly the same factor, thus preserving security while at the same time making homomorphic multiplications easier .

modulus reduction gives us a way to transform a ciphertext c .


the generated heat per switch) for each gate.

the switching power is formulated as follows:  (a) TYPE2 Correlations (b) Number of Switches (c) Characterization Errors Figure 1: Examples of TYPE2 Correlations ((a) in the leakage power model; (b)(c) in the switching power model): (a) shows a subpart of C880 circuit, in which the two outputs of x69 and x70 drive .ve gates: x90, x91, x92, x111, x126.


Next, we show that the protocol is a proof of knowledge.

we show there exists an extractor that can extract ' ' ' a SDH pair from (T, R, c, sx,sd,sß) and (T, R, c ' ,sx,sd,sß), where c = c ' and both transcripts satisfy the verifcation 11111) sx-s(sx-s)(sß -s)-(sd-s)(c-c x xßd equation.


To make the model easy to work with, we simplify away many important facets of the real SAFE system.

(i) we focus only on IFC and noninterference, although the tagging facilities of the SAFE machine are generic and can be applied to other policies (we return to this point in §13); (ii) we ignore the Breeze and Tempest programming languages and concentrate on the hardware and runtime services; (iii) we use a stack instead of registers, and we distill the instruction set to just a handful of opcodes; (iv) we drop SAFE s .ne-grained privilege separation in favor of a more conventional user-mode / kernel-mode dichotomy; (v) we shrink the rule cache to a single entry (avoiding issues of replacement and eviction) and maintain it in kernel memory, accessed by ordinary loads and stores, rather than in specialized cache hardware; (vi) we omit a large number of IFC-related concepts (dynamic principals, downgrading, public labels, integrity, clearance, etc.


Due to this property, OOB communication naturally provides (source) authentication and integrity, unlike radio communication.

a user can validate the intended source of an OOB message and an adversary can not manipulate the OOB messages in transit (although he can eavesdrop).


Re-randomization Issues For performance reasons, the Update procedure does not fully re-randomize the encrypted key EncSKID upon all invocations.

running a zero-step update of the form Update(EncSKID,ID " ,VK)with ID " = ID simply outputs the given key, unaltered.


s·Vdd-Vth Pleakage =2 · n · µ · Cox · W · ( kT )2 · D · Vdd · e n·(kT/q) (1) Lq We observe from Equation (1) that the leakage power of a logic gate depends on the threshold voltage (Vth) in a nonlinear manner.

if one can increase the Vth, either in the pre-silicon or post-silicon stage, the leakage power would decrease exponentially.


As discussed earlier, degraded service takes the form of a delay in a user s ability to access the content (decrypt a session).

before each session, a degraded user has to expend operations, thus consuming time, computing the hard function and decrypting the header.


The former, retrieved during discovery, are used to establish the latter for authorization inference steps.

credentials may be used multiple times to establish a role membership, as the credential E.r3 .- D must be used twice to establish that D .


3.3 Emulation To deal with exploits that heavily rely on dynamic JavaScript features and sophisticated browser functionality, we visit web pages with a customized browser, which loads the page, executes its dynamic content, and records the events used by the anomaly detection system.

in our system, a full browser environment is emulated by HtmlUnit, a Java-based framework for testing web-based applications [9].


Unlike existing approaches, Morpheus retrieves and analyzes Android system artifacts observable by Android applications in their sandboxes, called observable artifacts.

morpheus starts from an analysis of the current Android application sandbox to identify sources of observable artifacts.


Certificate-less User Authentication with Consent Shingo Orihara NTT Information Sharing Platform Laboratories 3-9-11 Midori-cho, Musashino-shi, Tokyo 180-8585 Japan orihara.shingo@lab.ntt.co.jp Yukio Tsuruoka NTT Information Sharing Platform Laboratories 3-9-11 Midori-cho, Musashino-shi, Tokyo 180-8585 Japan tsuruoka.yukio@lab.ntt.co.jp Kenji Takahashi NTT Information Sharing Platform Laboratories 3-9-11 Midori-cho, Musashino-shi, Tokyo 180-8585 Japan takahashi.kenji@lab.ntt.co.jp  ABSTRACT We introduce a new authentication scheme that is intended to be used on electronic commerce (EC) sites, which do not require strict user authentication but need user identification.

the EC sites judge whether a user is the same person who visited the site before.


and the description of a family of functions F, the setup algorithm generates a pair of public and private parameters PK, SK.

we assume that F speci.es the domain Dom of the functions f .F.


Removable property is used to indicate that a rule subspace is removable.

removing such a rule subspace does not make any impact on the original authorization space of an associated policy.


Du and Joshi [14] have presented the solution to assign roles to users from di.erent domains and consider issues with role hierarchies.

they have discussed the possibility of exchange of role model among domains.


Then, the parties follow the protocol in Figure 2 for x ' = m - x, and q ' = m - q.

the prover commits to x ', the querier issues q ' , etc., and the statement to be proved is x ' = q ', which is equivalent to m - x = m - q, which is equivalent to x = q.


3.2.2 Eliminating Information Leakage The values dx and dy sent to the entropy authority in Step 3 of the protocol leak some information about p and q to the entropy authority.

the authority learns that the prime gap before p (resp.


Data: (a) can be collected by guest VM processes or (b) can be collected exclusively by processes located on the host side.

(a) allows to collect more accurate and complete guest data, but can be easier to detect.


This idea also extends to exploited protocols.

the end point of an insecure protocol should not be within the isonet.


STRONG1-OUT-OF-2SIGNATURE 5.1 De.nitionforStrong1-out-of-2Signature  In some cases, it is desired to protect rights of the signer and the proxy even in an extremely aggressive environment, i.e., the adversary has the unlimited computational power while the signer or the proxy only has the polynomially bounded power.

1) the signer and the proxy can show the existence of the forgery, and 2) the proxy can prove his/her innocence if he hasn t transformed any two partial signatures that are output from PreSign together.


Bidirectional: Since both parties mutually delegate, the set Q includes all messages associated with any Osign query.

2.Delegatee Security: If the delegatee is honest, then he is safe from a colluding delegator and proxy.they cannot produce any signatures on his behalf.We associate the index 0 to the delegatee.


TEMU extracts the names of processes, modules, and exported symbols from a running Windows system.

it keeps track of which processes have which modules loaded at which address, and it enumerates the exported symbols from each module.


In current practice, the system uses a cryptographic hash function H and stores hashes of passwords rather than raw passwords.

the system maintains a .le F listing username / password-hash pairs of the form (ui ,H(pi)) for i =1, 2,. .


The recent definition of the Web Service Resource Framework (WSRF) specification and other elements of the Open Grid Services Architecture (OGSA) within OASIS and the Global Grid Forum (GGF) introduce new challenges and opportunities for Grid security [21, 24].

integration with Web services and hosting environment technologies introduces opportunities to leverage emerging security technologies such as described in the WS-Security, WS-Trust and WS-Secure-Conversation specifications [18, 22, 23].


In addition, observe that if i,s is large, it follows that pairs (0.1 i,s) (0.1)2 pairs ( i,s) .

a calculation shows that if i,s > 100 then pairs (0.1 i,s) > 0.009pairs ( i,s) .


This approach is motivated by the existing research that human trajectories are regular in space and time, with each individual having a high probability of returning to a few preferred locations according to Zipf s law [29].

it is more likely for a user to be at the restaurant at 6 pm in the afternoon rather than at of.ce.


Since the view-generating function is internal, it maymake use of the guest OS s inherent knowledge of the software architecture.

semantic knowledge is being delivered in an in-band manner.


One of the most striking consequences of our analysis is to reveal a fundamental and hitherto unexpected connection between RHA and ARBAC97.

we .nd that RHA is the most permissive of administrative models, whereas ARBAC97 is among the most restrictive.


This approach, however, cannot express PCAs that consider the combination of sub-policies as a whole, rather than through a step-by-step process of combining two results.

this approach cannot express counting-based strategies such as weak-majority or strong-majority.


We then focused the central part of the paper on how it is possible to enhance the usability of PKIs from a di.erent point of view.

we advocate that by adopting a more dynamic approach to PKI services in particular within browsers both PKI and Application vendors can bene.t from easier to use services and more .exible infrastructure.


When computing false positives, we used the number of di.erent applications as a basis, and not the number of processes.

when the detector raises alerts for ten processes, but all these processes were running the same application, we count this as a single false positive.


We have not, however, explored the operational semantics of larger languages.

we have not attempted to address delegation, and we have not attempted to associate semantics with very high-level constraints such as ODRL s purpose constraint.


We claim that Pr[wj qj] must be negligible at all critical positions.


However, least privilege cannot address threats to the building security functions, and thus we use redundant authentication as a core strategy to mitigate them.

it is important to specify the type of policy that the gateway applies to requests.


Figure 4: Inferred interests of the users using SPM Note that although SPM might not be accurate in .nding the true sentiment orientation of the user over an interest, the numbers presented here is not a.ected by this inaccuracy.

results presented in Figure 4 actually applies to SOM as well.


6.3 Protection Against Hit-List Worms Awelldesigned wormcouldpropagatemuch morequickly than Slammer.

a hit-list worm contains a hitlist of vulnerable machines.


In comparison, dual core tags (one read-only and killable core, the other many-writable) in combination with insubvertible encryption schemes would achieve many of these desirable features while requiring minimum capabilities of the tags.

they would enable post-sale applications of RFIDs with consumer privacy protection.


l Then a .ow sending .h(t2 - t1)+ ßh + 1 over [t1, t2) will violate the high bandwidth threshold over [t1, t2) but comply with .l' t2 +ßl ' over [0, t2).

no algorithm can satisfy (A2, L2, L3) and (A1, L1) at the same time.


SMILE presents itself as a secure system.

sMILE claims to provide unlinkability to the two parties involved in an encounter from both the server and other users.


In this paper, we continue to investigate the security implications of a generic selective encryption procedure.

how entropy and guesswork changes with the number of encrypted units, i.e., the encryption level.


In particular we want to argue that, in the honest-but-curious setting, no party should be able to get any information about the other party s input.

this means that the client C should not be able to get anything about the database held by S (beyond what revealed by the functionality implemented by the protocol) whereas S should not get anything about the .ngercode and outcome of the authentication process.


Table 1 shows that there exists no tools for cataloging, con- trol, record, release, and response.

once in- formation has left the hands of the consumer, it is no longer protected by any appropriate technology.


This position wasn t taken because they were trying to avoid work or responsibility, but because they were used to such decisions being made by management, the clients, or other external agents.

they were unfairly being asked What rather than How questions.


These communication channels can be used to quickly reach out to a large number of infected devices, while offering a high degree of undetectability.

unlike traditional network-based communication, the proposed sensing-enabled channels cannot be detected by monitoring the cellular or wireless communication networks.


Q64mult |) The precondition Q64xy eqns memorizes the limbs of the inputs X and Y in logical variables xi s and yi s. The formula Q64s eqns records the limbs si s after the qhasm fragment P 64M in logical variables si s. Q64mult ensures that the limbs si s are computed according to (1).

the Hoare triple speci.es the multiply phase of Fp multiplication in the radix-264 representation.


The idea of IP-layer puzzles is not new[8], but our architecture provides the right framework to make puzzle deployment safe and effective.

the state-setup bit would provide an appropriate signal to issue a puzzle, and the addressing architecture makes it hard to use malicious puzzle requests or spoofed responses as a DoS attack in their own right.


5.1 Treating Clinicians Suppose the National Health Authority is to mandate a default access control policy for patient records.

for each patient record r, we are to come up with a reasonable policy formula f so that we can set policy(r)to[[f]].


Which common design tasks can computers execute faster, more accurately or less expensively?

this work investigates tools for programmatically altering existing cryptographic constructions in order to enhance e.ciency or security design goals.


The length of RL can be modeled as the M/G/1 queueing system.

if the DRL is sent periodically, we use M/D/1 to model the length of RL.= The stationary length of RL is: = (.2 DRLds2 + 1)(.DRLa/.DRLd)2 LRL = , (10) 2(1 - .DRLa/.DRLd) where s is the standard deviation of arrival time of DRL packet for revival.


For example, we would like a system to help the dean to learn that she can modify the policy state in this case, membership of the admission committee to access the application.

our interest is not in reachability per se, but in the synthesis of plans that can help users achieve permissions they desire.


[1, m]) represents the comparison result of attributes Ai and A'i.

bi = fi(Ai, Ai'), where fi() is a comparison function (e.g., isEqual, isGreaterThan, isWithinThreshold, isSubstring, etc.)


Afterwards, the untrusted module is instrumented to ensure that the code cannot jump or reference data beyond its fault domain.

nativeClient [31, 27] builds upon SFI and enables a sandboxed environment for native code plugins in web browsers.


(o) to denote the security level of o. Auser u can only use permission pr if u can activate a session containing a role r ' ,where r ' ?

r.u can use permission pr only if R(u) ?


Special care must be taken however in responding F s random oracle queries so that the above relations between ci and c 1 i are ensured.

f may not ask the queries de.ning ci and ci 1 until after thefork, wherethe twoexecutions of F have already diverged.


Next, we discuss the experimental results on various algorithms of Figure 2 for both instantiations.

we present the empirical performance of veri.cation, update and range search query by the two instantiations.


Since the cloud has both Td and Epka (d ),and Bob (an authorized user of d)has prb, a collusion between the two can revealtheactual attribute values of d. Therefore, to prevent the information leakage due to the above collusion, we distribute the outsourced data.

instead of ' storingthedata(Td,Epka (d ))ofeachdatarecord dononecloud, we distribute the data between two clouds (resulting in a federated cloud).


As no other principal has knowledge of the mapping between users and spatial roles, we do not see a defense against a corrupted RoM.

if a corrupted RoM reports false ActivatedRoles,theattack maybedetected,but there is no mechanism for correction.


Di.erent levels usually also imply di.erent throughput and stealth.

we notice that throughput is usu Overt Channel Throughput (kbps) Nexus One Samsung Galaxy S UNIX Socket Communication 340.45 (± 154.02) 34.78 (± 11.39) Internal Storage 292.03 (± 50.06) 32.60 (± 8.47) Shared Preferences 75.81 (± 6.83) 31.00 (± 2.75) Broadcast Intents 40.58 (± 8.41) 26.74 (± 4.88) External Storage 11.55 (± 1.10) 6.12 (± 3.95) System Log 2.94 (± 0.03) 2.14 (± 0.11) Requires extra WRITE_EXTERNAL_STORAGE permission.


A large drawback of using them to realize anonymous subscriptions is that there is no convenient way to terminate group membership.

in group signature schemes that support revocation (e.g., [1, 4, 9, 13, 11, 37]), a member is revoked by (i) using a list of revoked users (every time a signature is veri.ed, it is checked against the list of revoked users); or (ii) updating the secret key every time a user is revoked.


The results indicate that the two plug-ins raised atotal of672(137forClickIDS and535forNoScript) alerts.

on average, one alert was raised every 1,470 pages.


To make it suitable to exchange larger vectors we allow the protocol to use a heuristic search in order to .nd a match.

we use a function to evaluate the probability that a particular value was recorded by both parts.


and all honest but curious servers S * , S * can distinguish user query sequence T1 from sequence T2 with only negligible probability.

for all e.cient (in n,1k) algorithms A, |Pr[A(VS* (U,x,.,.))


However, albeit the paper considers the presence of an active adversary, the chosen error probability of the Bloom .lter does not re.ect this.

the error probability is speci.ed at a level that is appropriate for accidental errors but not for an adversary that may compute a matching Bloom .lter entry by brute force.


While a variety of methods have been proposed, this is the .rst method to make explicit all aspects of resource retrieval: adversaries, using adversary roles; adversary control of the names used in resource retrieval, using name controls; the adversary control of the bindings used in name resolution; and adversary access to the resource retrieved.

we focus on the challenges of adversary roles and name control via program .ows, de.ning simple models for expressing each that leverages a variety of prior work.


Having 15 critical scenes with missing .ve-second gaps is probably above the threshold of annoyance.

our approach allows the illegally redistributed movies to be substantially disrupted or else the attackers have to broadcast some of their variations, allowing us to trace them.


The .eld DNS Ans contains the answer to U s query in accordance with the DNS protocol.

dNS Ans contains information that undeniably identi.es it as the answer to the original query DNS Req (e.g., DNS Ans may simply include DNS Req).


* the resilience is the weakest of the above four notions.

all our provable constructions will satisfy the robustness notion, but we will use the weaker notions to better pinpoint some of our attacks.


This is because the new Pout satis.es Cout (Duser , Dkernel ) = Cin (Duser , D ' kernel ) by reusing the legacy binary code Cin of Pout .

pout can use all the syscall, APIs invoked by itself in SVM, and it transparently updates the state of D ' of GVM and achieves the same effect of running the kernel corresponding Pin in GVM, but with higher trustworthiness.


It provides properties like unforgeability and non-repudiation; it also provides information theoretic security.

if Signer and INT are honest, then at the end of the signature generation phase, s remains secure in the information theoretic sense.


Typing For a successful typing attack to occur, there mustbe morethanonepieceofdataof thesametype.

the attacker tries to get the victim to accept one piece of data as another based on the two pieces having the same format.


At a high level, a system using PCE allows the patient to use her decryption key to generate subkeys which will allow her delegates to search and access only certain parts of her record.

the goals of PCE are: Guarantee Strong Security PCE will (1) guarantee the patient s privacy: the patient should have con.dence that the administrators of the health data server will not learn anything about the patient s record7 , (2) guarantee security in the case of server compromise: even if the server is compromised or stolen, the patient should be certain that his data has not been 7with the exception of trivial information like the existence and size of the record.


P6 used Twitter as an example for limiting the location access to only the application s current session saying every time I booted up Twitter to like create a tweet, I would want to be asked whether they can use my location in the tweet .

8 participants called out their contacts as the most sensitive and therefore would want to review each permission request.


However, we believe many of the techniques we employ to accomplish this e.ectively and with high .delity in a virtualized SMP environment are novel.

we provide an account of how to overcome three classes of signi.cant challenges in this environment: (i) inducing regular and frequent attacker-VM execution despite the coarse scheduling quanta used by VMM schedulers; (ii) overcoming sources of noise in the information available via the cache timing channel, both due to hardwarefeatures(e.g.,CPUpower saving) andduetosoftware ones(e.g.,VMM execution); and(iii) dealing with core migrations, which give rise to cache readings with no information of interest to the attacker (i.e., the victim was migrated to a core not shared by the attacker).


First we handle the case that (x2(t), y2(t)) = (x2, y2).

plr1 s message does not change the probabilities involving plr2.


In general, an attack pattern is de.ned by the deriving rules involved and the structure of the deriving rules.

since all the deriving rules currently considered in our model has exactly one ability in the pre-conditions, an attack pattern can be represented as a sequence of deriving rules.


We would like to emphasize the di.erence between information disclosure and cryptographic aggregation.

in the scenario portrayed in this paper, medical telemetry should remain private across caregiver institutions, and therefore approaches like the ones cited above may not be appropriate for this application.


In this paper, we take a .rst step towards a systematic black-box approach to identifying a broad range of logic .aws within web applications.

we model the logic of a web application using a .nite state machine (FSM) and formalize logic vulnerabilities as the discrepancies between the intended FSM and the implementation FSM.


First, trusted systems allow the seller ability to prevent (or limit) arbitrage.

the seller can prevent buyers from reselling the information or entertainment to someone who would otherwise be willing to pay the content provider the higher price.


If we have created a signature for detecting confused deputy attack , we can check internally the name of the applications trying to obtain IMEI information from other applications.

if an application sends an RPC code to get IMEI information and the application is not one of the legal applications that can request IMEI information to other legal applications, we can identify the application as a malicious one.


However, telling whether C was generated as a re-encryption of C * may be problematic, especially when the re-encryption algorithm is randomized.

requiring that C is not the result of running the re-encryption algorithm on the challenge ciphertext C * , for any randomness, would result in an overly weak de.nition, since a re-encryption algorithm could arti.cially output any string in {0, 1} * with negligible but positive probability.


Instead, A will be inferred from other access control data structures.

r2BAC the role-and-relation-based access control model of Wang and Li [21] introduces a set of roles R, a user-role relation UR .U ×R and a role-step relation SA .R ×S from which it is possible to derive the steps for which users are authorized.


The .le M is uploaded to the server S. Auditor-controlled parameters: The auditor A also samples secret values to verify a POR in PSW.


However, the inherent interactive requirement makes HIP-based approaches inadequate to apply in MMOGs.

multipletests are needed throughout agamesessiontoblock theloginofbots; otherwise,a maliciousplayer can pass the one-time test and log a bot into the game.


To verify a signature, 3 exponentiations modulo n and 1 exponentiation modulo G.  4.10.4 Experimental Results A prototype of direct anonymous attestation has been implemented at IBM Research in Zurich in the JAVA programming language.

all the parties, in particular also the TPM, were implemented in software.