Visible to the public Biblio

Found 2635 results

Filters: Keyword is Scalability  [Clear All Filters]
2020-03-30
Heigl, Michael, Schramm, Martin, Fiala, Dalibor.  2019.  A Lightweight Quantum-Safe Security Concept for Wireless Sensor Network Communication. 2019 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops). :906–911.
The ubiquitous internetworking of devices in all areas of life is boosted by various trends for instance the Internet of Things. Promising technologies that can be used for such future environments come from Wireless Sensor Networks. It ensures connectivity between distributed, tiny and simple sensor nodes as well as sensor nodes and base stations in order to monitor physical or environmental conditions such as vibrations, temperature or motion. Security plays an increasingly important role in the coming decades in which attacking strategies are becoming more and more sophisticated. Contemporary cryptographic mechanisms face a great threat from quantum computers in the near future and together with Intrusion Detection Systems are hardly applicable on sensors due to strict resource constraints. Thus, in this work a future-proof lightweight and resource-aware security concept for sensor networks with a processing stage permeated filtering mechanism is proposed. A special focus in the concepts evaluation lies on the novel Magic Number filter to mitigate a special kind of Denial-of-Service attack performed on CC1350 LaunchPad ARM Cortex-M3 microcontroller boards.
Vasiliu, Yevhen, Limar, Igor, Gancarczyk, Tomasz, Karpinski, Mikolaj.  2019.  New Quantum Secret Sharing Protocol Using Entangled Qutrits. 2019 10th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS). 1:324–329.
A new quantum secret sharing protocol based on the ping-pong protocol of quantum secure direct communication is proposed. The pairs of entangled qutrits are used in protocol, which allows an increase in the information capacity compared with protocols based on entangled qubits. The detection of channel eavesdropping used in the protocol is being implemented in random moments of time, thereby it is possible do not use the significant amount of quantum memory. The security of the proposed protocol to attacks is considered. A method for additional amplification of the security to an eavesdropping attack in communication channels for the developed protocol is proposed.
Hu, Zhengbing, Vasiliu, Yevhen, Smirnov, Oleksii, Sydorenko, Viktoriia, Polishchuk, Yuliia.  2019.  Abstract Model of Eavesdropper and Overview on Attacks in Quantum Cryptography Systems. 2019 10th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS). 1:399–405.
In today's world, it's almost impossible to find a sphere of human life in which information technologies would not be used. On the one hand, it simplifies human life - virtually everyone carries a mini-computer in his pocket and it allows to perform many operations, that took a lot of time, in minutes. In addition, IT has simplified and promptly developed areas such as medicine, banking, document circulation, military, and many other infrastructures of the state. Nevertheless, even today, privacy remains a major problem in many information transactions. One of the most important directions for ensuring the information confidentiality in open communication networks has been and remains its protection by cryptographic methods. Although it is known that traditional cryptography methods give reasons to doubt in their reliability, quantum cryptography has proven itself as a more reliable information security technology. As far is it quite new direction there is no sufficiently complete classification of attacks on quantum cryptography methods, in view of this new extended classification of attacks on quantum protocols and quantum cryptosystems is proposed in this work. Classification takes into account the newest attacks (which use devices loopholes) on quantum key distribution equipment. These attacks have been named \textbackslashtextless; \textbackslashtextless; quantum hacking\textbackslashtextgreater\textbackslashtextgreater. Such classification may be useful for choosing commercially available quantum key distribution system. Also abstract model of eavesdropper in quantum systems was created and it allows to determine a set of various nature measures that need to be further implemented to provide reliable security with the help of specific quantum systems.
Brito, J. P., López, D. R., Aguado, A., Abellán, C., López, V., Pastor-Perales, A., la Iglesia, F. de, Martín, V..  2019.  Quantum Services Architecture in Softwarized Infrastructures. 2019 21st International Conference on Transparent Optical Networks (ICTON). :1–4.
Quantum computing is posing new threats on our security infrastructure. This has triggered a new research field on quantum-safe methods, and those that rely on the application of quantum principles are commonly referred as quantum cryptography. The most mature development in the field of quantum cryptography is called Quantum Key Distribution (QKD). QKD is a key exchange primitive that can replace existing mechanisms that can become obsolete in the near future. Although QKD has reached a high level of maturity, there is still a long path for a mass market implementation. QKD shall overcome issues such as miniaturization, network integration and the reduction of production costs to make the technology affordable. In this direction, we foresee that QKD systems will evolve following the same path as other networking technologies, where systems will run on specific network cards, integrable in commodity chassis. This work describes part of our activity in the EU H2020 project CiViQ in which quantum technologies, as QKD systems or quantum random number generators (QRNG), will become a single network element that we define as Quantum Switch. This allows for quantum resources (keys or random numbers) to be provided as a service, while the different components are integrated to cooperate for providing the most random and secure bit streams. Furthermore, with the purpose of making our proposal closer to current networking technology, this work also proposes an abstraction logic for making our Quantum Switch suitable to become part of software-defined networking (SDN) architectures. The model fits in the architecture of the SDN quantum node architecture, that is being under standardization by the European Telecommunications Standards Institute. It permits to operate an entire quantum network using a logically centralized SDN controller, and quantum switches to generate and to forward key material and random numbers across the entire network. This scheme, demonstrated for the first time at the Madrid Quantum Network, will allow for a faster and seamless integration of quantum technologies in the telecommunications infrastructure.
Dreher, Patrick, Ramasami, Madhuvanti.  2019.  Prototype Container-Based Platform for Extreme Quantum Computing Algorithm Development. 2019 IEEE High Performance Extreme Computing Conference (HPEC). :1–7.
Recent advances in the development of the first generation of quantum computing devices have provided researchers with computational platforms to explore new ideas and reformulate conventional computational codes suitable for a quantum computer. Developers can now implement these reformulations on both quantum simulators and hardware platforms through a cloud computing software environment. For example, the IBM Q Experience provides the direct access to their quantum simulators and quantum computing hardware platforms. However these current access options may not be an optimal environment for developers needing to download and modify the source codes and libraries. This paper focuses on the construction of a Docker container environment with Qiskit source codes and libraries running on a local cloud computing system that can directly access the IBM Q Experience. This prototype container based system allows single user and small project groups to do rapid prototype development, testing and implementation of extreme capability algorithms with more agility and flexibility than can be provided through the IBM Q Experience website. This prototype environment also provides an excellent teaching environment for labs and project assignments within graduate courses in cloud computing and quantum computing. The paper also discusses computer security challenges for expanding this prototype container system to larger groups of quantum computing researchers.
Diamanti, Eleni.  2019.  Demonstrating Quantum Advantage in Security and Efficiency with Practical Photonic Systems. 2019 21st International Conference on Transparent Optical Networks (ICTON). :1–2.
We discuss the current landscape in quantum communication and cryptography, and focus in particular on recent photonic implementations, using encoding in discrete or continuous properties of light, of central quantum network protocols, enabling secret key distribution, verification of entangled resources and transactions of quantum money, with maximal security guarantees. We also describe current challenges in this field and our efforts towards the miniaturization of the developed photonic systems, their integration into telecommunication network infrastructures, including with satellite links, as well as the practical demonstration of novel protocols featuring a quantum advantage in communication efficiency for a wide range of useful tasks in a network environment. These advances enrich the resources and applications of the emerging quantum networks that will play a central role in the context of future quantum-safe communications.
2020-03-23
Lee, Hyungyu, Pyo, Changwoo, Lee, Gyungho.  2019.  Dynamic reencryption of return addresses. IET Information Security. 13:76–85.
The authors present dynamic reencryption of return addresses to mitigate their leakage. The authors' method enforces programs to save return addresses as encrypted and renew the encryption states with fresh keys before or after vulnerable operations. When a function returns, it should restore the return address from its encryption using the most recent key not to cause a crash. Under the protection of their method, return addresses and keys may leak, but the disclosed bits become garbage because keys govern all return addresses through encryption, while changing before control-flow proceeds into a vulnerable region. As a result, it becomes probabilistically infeasible to build exploits for intercepting control-flow by using leaked return addresses or keys. They implemented the proposed method as an extension of the LLVM compiler that inserts reencryption code where necessary. They also have confirmed its effectiveness against information leak attacks carried out in the early stage of blind return-oriented programming (BROP). The performance overhead ranges below 11.6% for processor-intensive programs and 4.12% or less for web servers.
Hao, Xiaochen, Lv, Mingsong, Zheng, Jiesheng, Zhang, Zhengkui, Yi, Wang.  2019.  Integrating Cyber-Attack Defense Techniques into Real-Time Cyber-Physical Systems. 2019 IEEE 37th International Conference on Computer Design (ICCD). :237–245.
With the rapid deployment of Cyber-Physical Systems (CPS), security has become a more critical problem than ever before, as such devices are interconnected and have access to a broad range of critical data. A well-known attack is ReturnOriented Programming (ROP) which can diverge the control flow of a program by exploiting the buffer overflow vulnerability. To protect a program from ROP attacks, a useful method is to instrument code into the protected program to do runtime control flow checking (known as Control Flow Integrity, CFI). However, instrumented code brings extra execution time, which has to be properly handled, as most CPS systems need to behave in a real-time manner. In this paper, we present a technique to efficiently compute an execution plan, which maximizes the number of executions of instrumented code to achieve maximal defense effect, and at the same time guarantees real-time schedulability of the protected task system with a new response time analysis. Simulation-based experimental results show that the proposed method can yield good quality execution plans, but performs orders of magnitude faster than exhaustive search. We also built a prototype in which a small auto-drive car is defended against ROP attacks by the proposed method implemented in FreeRTOS. The prototype demonstrates the effectiveness of our method in real-life scenarios.
Xuewei, Feng, Dongxia, Wang, Zhechao, Lin.  2019.  An Approach of Code Pointer Hiding Based on a Resilient Area. 2019 Seventh International Conference on Advanced Cloud and Big Data (CBD). :204–209.
Code reuse attacks can bypass the DEP mechanism effectively. Meanwhile, because of the stealthy of the operation, it becomes one of the most intractable threats while securing the information system. Although the security solutions of code randomization and diversity can mitigate the threat at a certain extent, attackers can bypass these solutions due to the high cost and coarsely granularity, and the memory disclosure vulnerability is another magic weapon which can be used by attackers to bypass these solutions. After analyzing the principle of memory disclosure vulnerability, we propose a novel code pointer hiding method based on a resilient area. We expatiate how to create the resilient area and achieve code pointer hiding from four aspects, namely hiding return addresses in data pages, hiding function pointers in data pages, hiding target pointers of instruction JUMP in code pages, and hiding target pointers of instruction CALL in code pages. This method can stop attackers from reading and analyzing pages in memory, which is a critical stage in finding and creating ROP chains while executing a code reuse attack. Lastly, we test the method contrastively, and the results show that the method is feasible and effective while defending against ROP attacks.
Pewny, Jannik, Koppe, Philipp, Holz, Thorsten.  2019.  STEROIDS for DOPed Applications: A Compiler for Automated Data-Oriented Programming. 2019 IEEE European Symposium on Security and Privacy (EuroS P). :111–126.
The wide-spread adoption of system defenses such as the randomization of code, stack, and heap raises the bar for code-reuse attacks. Thus, attackers utilize a scripting engine in target programs like a web browser to prepare the code-reuse chain, e.g., relocate gadget addresses or perform a just-in-time gadget search. However, many types of programs do not provide such an execution context that an attacker can use. Recent advances in data-oriented programming (DOP) explored an orthogonal way to abuse memory corruption vulnerabilities and demonstrated that an attacker can achieve Turing-complete computations without modifying code pointers in applications. As of now, constructing DOP exploits requires a lot of manual work-for every combination of application and payload anew. In this paper, we present novel techniques to automate the process of generating DOP exploits. We implemented a compiler called STEROIDS that leverages these techniques and compiles our high-level language SLANG into low-level DOP data structures driving malicious computations at run time. This enables an attacker to specify her intent in an application-and vulnerability-independent manner to maximize reusability. We demonstrate the effectiveness of our techniques and prototype implementation by specifying four programs of varying complexity in SLANG that calculate the Levenshtein distance, traverse a pointer chain to steal a private key, relocate a ROP chain, and perform a JIT-ROP attack. STEROIDS compiles each of those programs to low-level DOP data structures targeted at five different applications including GStreamer, Wireshark and ProFTPd, which have vastly different vulnerabilities and DOP instances. Ultimately, this shows that our compiler is versatile, can be used for both 32-bit and 64-bit applications, works across bug classes, and enables highly expressive attacks without conventional code-injection or code-reuse techniques in applications lacking a scripting engine.
Qin, Peng, Tan, Cheng, Zhao, Lei, Cheng, Yueqiang.  2019.  Defending against ROP Attacks with Nearly Zero Overhead. 2019 IEEE Global Communications Conference (GLOBECOM). :1–6.
Return-Oriented Programming (ROP) is a sophisticated exploitation technique that is able to drive target applications to perform arbitrary unintended operations by constructing a gadget chain reusing existing small code sequences (gadgets) collected across the entire code space. In this paper, we propose to address ROP attacks from a different angle-shrinking available code space at runtime. We present ROPStarvation , a generic and transparent ROP countermeasure that defend against all types of ROP attacks with almost zero run-time overhead. ROPStarvation does not aim to completely stop ROP attacks, instead it attempts to significantly increase the bar by decreasing the possibility of launching a successful ROP exploit in reality. Moreover, shrinking available code space at runtime is lightweight that makes ROPStarvation practical for being deployed with high performance requirement. Results show that ROPStarvation successfully reduces the code space of target applications by 85%. With the reduced code segments, ROPStarvation decreases the probability of building a valid ROP gadget chain by 100% and 83% respectively, with the assumptions that whether the adversary knows the vulnerable applications are protected by ROPStarvation . Evaluations on the SPEC CPU2006 benchmark show that ROPStarvation introduces nearly zero (0.2% on average) run-time performance overhead.
Hu, Rui, Guo, Yuanxiong, Pan, Miao, Gong, Yanmin.  2019.  Targeted Poisoning Attacks on Social Recommender Systems. 2019 IEEE Global Communications Conference (GLOBECOM). :1–6.
With the popularity of online social networks, social recommendations that rely on one’s social connections to make personalized recommendations have become possible. This introduces vulnerabilities for an adversarial party to compromise the recommendations for users by utilizing their social connections. In this paper, we propose the targeted poisoning attack on the factorization-based social recommender system in which the attacker aims to promote an item to a group of target users by injecting fake ratings and social connections. We formulate the optimal poisoning attack as a bi-level program and develop an efficient algorithm to find the optimal attacking strategy. We then evaluate the proposed attacking strategy on real-world dataset and demonstrate that the social recommender system is sensitive to the targeted poisoning attack. We find that users in the social recommender system can be attacked even if they do not have direct social connections with the attacker.
Nakayama, Johannes, Plettenberg, Nils, Halbach, Patrick, Burbach, Laura, Ziefle, Martina, Calero Valdez, André.  2019.  Trust in Cyber Security Recommendations. 2019 IEEE International Professional Communication Conference (ProComm). :48–55.
Over the last two decades, the Internet has established itself as part of everyday life. With the recent invention of Social Media, the advent of the Internet of Things as well as trends like "bring your own device" (BYOD), the needs for connectivity rise exponentially and so does the need for proper cyber security. However, human factors research of cyber security in private contexts comprises only a small fraction of the research in the field. In this study, we investigated adoption behaviours and trust in cyber security in private contexts by measuring - among other trust measures - disposition to trust and providing five cyber security scenarios. In each, a person/agent recommends the use of a cyber security tool. Trust is then measured regarding the recommending agent. We compare personal, expert, institutional, and magazine recommendations along with manufacturer information in an exploratory study of sixty participants. We found that personal, expert and institutional recommendations were trusted significantly more than manufacturer information and magazine reports. The highest trust scores were produced by the expert and the personal recommendation scenarios. We argue that technical and professional communicators should aim for cyber security knowledge permeation through personal relations, educating people with high technology self-efficacy beliefs who then disperse the acquired knowledge.
Kim, MinJu, Dey, Sangeeta, Lee, Seok-Won.  2019.  Ontology-Driven Security Requirements Recommendation for APT Attack. 2019 IEEE 27th International Requirements Engineering Conference Workshops (REW). :150–156.
Advanced Persistent Threat (APT) is one of the cyber threats that continuously attack specific targets exfiltrate information or destroy the system [1]. Because the attackers use various tools and methods according to the target, it is difficult to describe APT attack in a single pattern. Therefore, APT attacks are difficult to defend against with general countermeasures. In these days, systems consist of various components and related stakeholders, which makes it difficult to consider all the security concerns. In this paper, we propose an ontology knowledge base and its design process to recommend security requirements based on APT attack cases and system domain knowledge. The proposed knowledge base is divided into three parts; APT ontology, general security knowledge ontology, and domain-specific knowledge ontology. Each ontology can help to understand the security concerns in their knowledge. While integrating three ontologies into the problem domain ontology, the appropriate security requirements can be derived with the security requirements recommendation process. The proposed knowledge base and process can help to derive the security requirements while considering both real attacks and systems.
Rustgi, Pulkit, Fung, Carol.  2019.  Demo: DroidNet - An Android Permission Control Recommendation System Based on Crowdsourcing. 2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM). :737–738.
Mobile and web application security, particularly the areas of data privacy, has raised much concerns from the public in recent years. Most applications, or apps for short, are installed without disclosing full information to users and clearly stating what the application has access to, which often raises concern when users become aware of unnecessary information being collected. Unfortunately, most users have little to no technical expertise in regards to what permissions should be turned on and can only rely on their intuition and past experiences to make relatively uninformed decisions. To solve this problem, we developed DroidNet, which is a crowd-sourced Android recommendation tool and framework. DroidNet alleviates privacy concerns and presents users with high confidence permission control recommendations based on the decision from expert users who are using the same apps. This paper explains the general framework, principles, and model behind DroidNet while also providing an experimental setup design which shows the effectiveness and necessity for such a tool.
Tu, Qingqing, Jing, Yulin, Zhu, Weiwei.  2019.  Research on Privacy Security Risk Evaluation of Intelligent Recommendation Mobile Applications Based on a Hierarchical Risk Factor Set. 2019 4th International Conference on Mechanical, Control and Computer Engineering (ICMCCE). :638–6384.
Intelligent recommendation applications based on data mining have appeared as prospective solution for consumer's demand recognition in large-scale data, and it has contained a great deal of consumer data, which become the most valuable wealth of application providers. However, the increasing threat to consumer privacy security in intelligent recommendation mobile application (IR App) makes it necessary to have a risk evaluation to narrow the gap between consumers' need for convenience with efficiency and need for privacy security. For the previous risk evaluation researches mainly focus on the network security or information security for a single work, few of which consider the whole data lifecycle oriented privacy security risk evaluation, especially for IR App. In this paper, we analyze the IR App's features based on the survey on both algorithm research and market prospect, then provide a hierarchical factor set based privacy security risk evaluation method, which includes whole data lifecycle factors in different layers.
Xu, Yilin, Ge, Weimin, Li, Xiaohong, Feng, Zhiyong, Xie, Xiaofei, Bai, Yude.  2019.  A Co-Occurrence Recommendation Model of Software Security Requirement. 2019 International Symposium on Theoretical Aspects of Software Engineering (TASE). :41–48.
To guarantee the quality of software, specifying security requirements (SRs) is essential for developing systems, especially for security-critical software systems. However, using security threat to determine detailed SR is quite difficult according to Common Criteria (CC), which is too confusing and technical for non-security specialists. In this paper, we propose a Co-occurrence Recommend Model (CoRM) to automatically recommend software SRs. In this model, the security threats of product are extracted from security target documents of software, in which the related security requirements are tagged. In order to establish relationships between software security threat and security requirement, semantic similarities between different security threat is calculated by Skip-thoughts Model. To evaluate our CoRM model, over 1000 security target documents of 9 types software products are exploited. The results suggest that building a CoRM model via semantic similarity is feasible and reliable.
Karlsson, Linus, Paladi, Nicolae.  2019.  Privacy-Enabled Recommendations for Software Vulnerabilities. 2019 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech). :564–571.
New software vulnerabilities are published daily. Prioritizing vulnerabilities according to their relevance to the collection of software an organization uses is a costly and slow process. While recommender systems were earlier proposed to address this issue, they ignore the security of the vulnerability prioritization data. As a result, a malicious operator or a third party adversary can collect vulnerability prioritization data to identify the security assets in the enterprise deployments of client organizations. To address this, we propose a solution that leverages isolated execution to protect the privacy of vulnerability profiles without compromising data integrity. To validate an implementation of the proposed solution we integrated it with an existing recommender system for software vulnerabilities. The evaluation of our implementation shows that the proposed solution can effectively complement existing recommender systems for software vulnerabilities.
Unnikrishnan, Grieshma, Mathew, Deepa, Jose, Bijoy A., Arvind, Raju.  2019.  Hybrid Route Recommender System for Smarter Logistics. 2019 IEEE 5th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing, (HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS). :239–244.
The condition of road surface has a significant role in land transportation. Due to poor road conditions, the logistics and supply chain industry face a drastic loss in their business. Unmaintained roads can cause damage to goods and accidents. The existing routing techniques do not consider factors like shock, temperature and tilt of goods etc. but these factors have to be considered for the logistics and supply chain industry. This paper proposes a recommender system which target management of goods in logistics. A 3 axis accelerometer is used to measure the road surface conditions. The pothole location is obtained using Global Positioning System (GPS). Using these details a hybrid recommender system is built. Hybrid recommender system combines multiple recommendation techniques to develop an effective recommender system. Here content-based and collaborative-based techniques is combined to build a hybrid recommender system. One of the popular Multiple Criteria Decision Making (MCDM) method, The Technique for Order Preference by Similarity to Ideal Solution (TOPSIS) is used for content based filtering and normalised Euclidean distance and KNN algorithm is used for collaborative filtering. The best route recommended by the system will be displayed to the user using a map application.
Bansal, Saumya, Baliyan, Niyati.  2019.  Evaluation of Collaborative Filtering Based Recommender Systems against Segment-Based Shilling Attacks. 2019 International Conference on Computing, Power and Communication Technologies (GUCON). :110–114.
Collaborative filtering (CF) is a successful and hence most widely used technique for recommender systems. However, it is vulnerable to shilling attack due to its open nature, which results in generating biased or false recommendations for users. In literature, segment attack (push attack) has been widely studied and investigated while rare studies have been performed on nuke attack, to the best of our knowledge. Further, the robustness of binary collaborative filtering and hybrid approach has not been investigated against segment-focused attack. In this paper, from the perspective of robustness, binary collaborative filtering, hybrid approach, stand-alone rating user-based, and stand-alone rating item- based recommendation have been evaluated against segment attack on a large dataset (100K ratings) which is found to be more successful as it attacks target set of items. With an aim to find an approach which reflects a higher accuracy in recommending items and is less vulnerable to segment-based attack, the possibility of any relationship between accuracy and vulnerability of six CF approaches were studied. Such an approach needs to be re-examined by the researchers marking the future of recommender system (RS). Experimental results show negligible positive correlation between accuracy and vulnerability of techniques. Publicly available dataset namely MovieLens was used for conducting experiments. Robustness and accuracy of CF techniques were calculated using prediction shift and F-measure, respectively.
Arul, Tolga, Anagnostopoulos, Nikolaos Athanasios, Katzenbeisser, Stefan.  2019.  Privacy Usability of IPTV Recommender Systems. 2019 IEEE International Conference on Consumer Electronics (ICCE). :1–2.
IPTV is capable of providing recommendations for upcoming TV programs based on consumer feedback. With the increasing popularity and performance of recommender systems, risks of user privacy breach emerge. Although several works about privacy-preserving designs of recommender systems exist in the literature, a detailed analysis of the current state-of-the-art regarding privacy as well as an investigation of the usability aspects of such systems, so far, have not received consideration. In this paper, we survey current approaches for recommender systems by studying their privacy and usability properties in the context of IPTV.
Park, Jungmin, Cho, Seongjoon, Lim, Taejin, Bhunia, Swarup, Tehranipoor, Mark.  2019.  SCR-QRNG: Side-Channel Resistant Design using Quantum Random Number Generator. 2019 IEEE/ACM International Conference on Computer-Aided Design (ICCAD). :1–8.
Random number generators play a pivotal role in generating security primitives, e.g., encryption keys, nonces, initial vectors, and random masking for side-channel countermeasures. A quantum entropy source based on radioactive isotope decay can be exploited to generate random numbers with sufficient entropy. If a deterministic random bit generator (DRBG) is combined for post-processing, throughput of the quantum random number generator (QRNG) can be improved. However, general DRBGs are susceptible to side-channel attacks. In this paper, we propose a framework called SCR-QRNG framework, which offers Side-Channel Resistant primitives using QRNG. The QRNG provides sources of randomness for modulating the clock frequency of a DRBG to obfuscate side-channel leakages, and to generate unbiased random numbers for security primitives. The QRNG has robustness against power side-channel attacks and is in compliance with NIST SP 800-22/90B and BSI AIS 31. We fabricate a quantum entropy chip, and implement a PCB module for a random frequency clock generator and a side-channel resistant QRNG on an FPGA.
Korenda, Ashwija Reddy, Afghah, Fatemeh, Cambou, Bertrand, Philabaum, Christopher.  2019.  A Proof of Concept SRAM-based Physically Unclonable Function (PUF) Key Generation Mechanism for IoT Devices. 2019 16th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON). :1–8.
This paper provides a proof of concept for using SRAM based Physically Unclonable Functions (PUFs) to generate private keys for IoT devices. PUFs are utilized, as there is inadequate protection for secret keys stored in the memory of the IoT devices. We utilize a custom-made Arduino mega shield to extract the fingerprint from SRAM chip on demand. We utilize the concepts of ternary states to exclude the cells which are easily prone to flip, allowing us to extract stable bits from the fingerprint of the SRAM. Using the custom-made software for our SRAM device, we can control the error rate of the PUF to achieve an adjustable memory-based PUF for key generation. We utilize several fuzzy extractor techniques based on using different error correction coding methods to generate secret keys from the SRAM PUF, and study the trade-off between the false authentication rate and false rejection rate of the PUF.
Zhuang, Ziyi, Jiang, Shengming, Xu, Yanli, Luo, Xiang, Cheng, Xin.  2019.  A Physical Layer Key Generation Scheme Based on Full-duplex Mode in Wireless Networks without Fixed Infrastructure. 2019 International Conference on Computer, Information and Telecommunication Systems (CITS). :1–5.
Encryption schemes for network security usually require a key distribution center to share or distribute the secret keys, which is difficult to deploy in wireless networks without fixed infrastructure. A novel key generation scheme based on the physical layer can generate a shared key between a pair of correlated parties by sharing random sources. The existing physical layer key generation scheme is based on the half-duplex mode with time division duplex (TDD) mode, which makes it impossible for the correlated communication parties to detect the channel simultaneously in order to improve the channel coherence. In this paper, we propose a full-duplex physical layer key generation scheme, which allows each legal communication nodes to transmit and receive signals at the same time, in order to reduce channel probing time and increase channel coherence performance. The simulation experiments show that the proposed scheme can much outperform some typical existing schemes in terms of the key performance evaluation indicators, key disagreement rate, key generation rate, entropy of the scheme improved, and the randomness of generated keys passed the National Institute of Standards and Technology (NIST) test.
Hayashi, Masahito.  2019.  Semi-Finite Length Analysis for Secure Random Number Generation. 2019 IEEE International Symposium on Information Theory (ISIT). :952–956.
To discuss secure key generation from imperfect random numbers, we address the secure key generation length. There are several studies for its asymptotic expansion up to the order √n or log n. However, these expansions have errors of the order o(√n) or o(log n), which does not go to zero asymptotically. To resolve this problem, we derive the asymptotic expansion up to the constant order for upper and lower bounds of these optimal values. While the expansions of upper and lower bonds do not match, they clarify the ranges of these optimal values, whose errors go to zero asymptotically.