Untrusted Users Research Articles

Researchers outline cybersecurity vulnerabilities of biometric systems

Major concerns for biometric system integrators will increasingly include incorporating data security protocols, monitoring for incoming threats and establishing the physical and logical integrity of the system, according to research findings. ABI Research has exposed the cybersecurity vulnerabilities of biometric systems including untrusted user interfaces and malware in the consumer segment and compromised USB peripherals and encryption for the enterprise sector.

Selecting Optimal Meeting Point with SecurityMeasures

Protecting privacy in location based services is an important requirement in wireless communication. Many privacy preserving approaches exist that allow protecting privacy in location based services. These applications often rely on current (or preferred) locations of individual users or a group of users to provide the desired service, which jeopardizes their privacy users do not necessarily want to reveal their current (or preferred) locations to the service provider or to other, possibly un-trusted users. The main aim of privacy-preserving algorithms is determining an optimal meeting location for a group of users.Privacy evaluation is performed by formally quantifying privacy-loss of the proposed approaches.The performance of privacy preserving algorithms is determined by implementing and testing their execution efficiency on Nokia smart phones. Further study is carried out to get an insight into the privacyawareness of users in location based services and the usability of the proposed solutions.

Location Privacy Preserving of Mobile Users using Secured Homomorphism

In today’s highly interconnected world users are increasingly dependent on high end smartphones and mobile devices. Users arrange and plan their daily routines using such high end devices. These applications often rely on current locations of individual users or a group of users to provide the desired service. By means of such applications and services, majority of such user population reveal their current location details to the third party service providers. Knowingly or unknowingly mobile users compromise their privacy. Without efficient protection, even sharing location information has been shown to provide reliable information about a users’ private globe, which could have severe consequences on the users’ personal, social, and financial life Users, who are cautious about their whereabouts, do not necessarily want to reveal their current locations to the service provider or to untrusted users. This paper, proposes algorithms for location privacy preserving of mobile users. This is to provide practical privacy-preserving techniques to solve this problem, such that neither an untrusted user, nor participating users, can learn other users’ locations, legitimate users only learn the optimal location.

History Aware Anomaly Based IDS for Cloud IaaS

Cloud Computing provides different types of services such as SaaS, PaaS, IaaS. Each of them have their own security challenges, but IaaS undertakes all types of challenges viz., network attack ,behaviour based attack, request based attacks i.e handling the requests from untrusted users, XSS (cross site scripting attack), DDOS and many more. These attacks are independent of each other and consequently the QoS provided by cloud is compromised. This paper proposes a History aware Behaviour based IDS (Intrusion Detection System) BIDS. BIDS provides detection of untrusted users, false requests that may lead to spoofing, XSS or DOS attack and many more such attacks. In addition, certain cases where user login or password is compromised. History aware BIDs can be helpful in detecting such attacks and maintaining the QoS provided to the user in cloud IaaS ( Infrastructure as a service).

Participatory networking

We present the design, implementation, and evaluation of an API for applications to control a software-defined network (SDN). Our API is implemented by an OpenFlow controller that delegates read and write authority from the network's administrators to end users, or applications and devices acting on their behalf. Users can then work with the network, rather than around it, to achieve better performance, security, or predictable behavior. Our API serves well as the next layer atop current SDN stacks. Our design addresses the two key challenges: how to safely decompose control and visibility of the network, and how to resolve conflicts between untrusted users and across requests, while maintaining baseline levels of fairness and security. Using a real OpenFlow testbed, we demonstrate our API's feasibility through microbenchmarks, and its usefulness by experiments with four real applications modified to take advantage of it.

Secure communication between grid domains based on trust relationships and group keys

The grid facilitates coordinated resource sharing and problem solving in dynamic, multi-institutional virtual organisation (VO). Groups within the VO communicate efficiently by multicasting the shared information. Groups within a VO can be dynamic, because users, resources or sites can join or leave a group at any time. In addition, one member may belong to multiple groups simultaneously. In this context, maintaining data privacy against untrusted users is of utmost importance in the grid environment. This necessitates the encryption of information that is transmitted among the grid entities. To preserve security in communication, the multicast information should be encrypted using a group key. The challenges faced in maintaining security in a VO includes dynamic authentication of group members, dynamic creation, updation and distribution of group keys. In view of the challenges, this paper proposes an efficient approach for dynamic group key generation and distribution. This paper also proposes a novel approach for establishing domain to domain communication using trust relationship among the entities. The proposed approaches were implemented, tested and evaluated on GridSim.

Dynamic taint propagation: Finding vulnerabilities without attacking

We apply dynamic taint propagation to find input validation bugs using less effort than typical security testing. We monitor a target program as it executes in order to track untrusted user input. Our system works in conjunction with normal functional testing, so effort devoted to functional testing can be directly leveraged to uncover vulnerabilities. The result is that we achieve higher test coverage (and therefore find more bugs) than typical security testing techniques and make it practical for quality assurance organizations with no security experience to test the security of the software they examine.

Notes from the field: Implementing a security solution for Web Services

There are many articles explaining why it is necessary to limit access to sensitive resources that are exposed to traffic originating from untrusted users and networks. Generally, such articles will also describe generic security solutions that address these issues. In this article we go one step further and describe the installation of security technology designed to protect extranet web pages and Web Services of a telecommunications company. We give a brief overview of the PEP-PDP architecture described in RFC 2753 which provides a reference model for the products used in the deployment.

Programming Internet telephony services

Internet telephony enables a wealth of new service possibilities. Traditional telephony services such as call forwarding, transfer, and 800 number services, can be enhanced by interaction with e-mail, Web, and directory services. Additional media types, like video and interactive chat, can be added as well. One of the challenges in providing these services is how to effectively program them. Programming these services requires decisions regarding where the code executes, how it interfaces with the protocols that deliver the services, and what level of control the code has. In this article we consider this problem in detail. We develop requirements for programming Internet telephony services, and we show that at least two solutions are required-one geared for service creation by trusted users (such as administrators), and one geared for service creation by untrusted users (such as consumers). We review existing techniques for service programmability in the Internet and in the telephone network, and extract the best components of both. The result is a common gateway interface that allows trusted users to develop services, and the call processing language that allows untrusted users to develop services.

A secure networked laboratory for kernel programming

Recently, several flavours of UNIX have appeared which run on inexpensive personal computers. Further, the source code for these operating systems is freely available. This makes offering courses that include realistic kernel programming feasible in an academic environment. However, root access is required in order to modify a system's kernel. This poses a potential security threat both to other systems on the network and to other users of a single machine. This paper presents a lab design which securely integrates machines with untrusted users acting as root into a secured network, and which securely allows multiple users root access to the same machine.

Safety and security of programmable network infrastructures

Safety and security are two reliability properties of a system. A safe system provides protection against errors of trusted users, while a secure system protects against errors introduced by untrusted users. There is considerable overlap between mechanisms to support each property. Requirements for rapid service creation have stimulated the development of programmable network infrastructures, where end users or service providers can customize the properties of a network infrastructure while it continues to operate. A central concern of potential users of such systems is their reliability and, most specifically, their safety and security. In this article we explain the impact the network service model and architecture have on safety and security, and provide a model with which policies can be translated into restrictions of a general system. We illustrate these ideas with the Secure Active Network Environment (SANE) architecture, which provides a means of controlling access to the functions provided by any programmable infrastructure.