Search

Many reader/tag authentication protocols are proposed to effectively authenticate tags and readers. However, we demonstrate with YA-TRAP as an example how false authentications that a legitimate tag could be wrongly rejected by a reader may arise from these protocols when they are applied to C1G2 (class 1 generation 2) passive RFID tags. In this chapter, we identify a protocol pattern of which the implementation on C1G2 passive tags leads to false authentications, and further identify three types of the existing protocols that can bring with false authentications due to containing this pattern. Moreover, we give a necessary and sufficient condition for false authentications prevention, and propose a naive semaphore-based solution which revises the pattern by adding semaphore operations so as to avoid false authentications. Our experiments demonstrate the arising of false authentications and verify the effectiveness of our solution. [ABSTRACT FROM AUTHOR]

˵Symmetric secret″-based RFID systems are widely adopted in supply chains. In such RFID systems, a reader΄s ability to identify a RFID tag relies on the possession of the tag΄s secret which is usually only known by its owner. If a ˵symmetric secret″-based RFID system is deployed in third party logistics (3PL) supply chains, all the three parties (the sender of the goods, the receiver of the goods and the 3PL provider) should have a copy of those tags΄ secrets to access the tags. In case the three parties in 3PL supply chain are not all honest, sharing the secrets among the three parties will cause security and privacy problems. To solve these problems, we firstly formalize the security and privacy requirements of RFID system for 3PL supply considering the existence of the internal adversaries as well as the external adversaries. Then we propose two different protocols which satisfy the requirements, one is based on aggregate massage authentication codes, the other is based on aggregate signature scheme. Based on the comparisons of the two protocols on performance and usability, we get the conclusion that overall the aggregate MAC-based solution is more applicable in 3PL supply chains. [ABSTRACT FROM AUTHOR]

The 2D (two-dimensional) contingency tables have been used in many aspects of our daily life. In practice, errors may be incurred when generating or editing such a table hence the data contained by the table could be inaccurate. Even so, it is still possible for a knowledgeable snooper who may have acquired the information of error distributions to decipher some private information from a released table. This paper investigates the estimation of privacy disclosure probability for contingency tables with inaccurate data based on Fréchet bounds and proposes two optimization solutions for the control of privacy disclosure so as to preserve private information. Our estimation of privacy disclosure probability and the optimization solutions are also applicable to error-free tables which can be regarded as a special case where there are no errors. The effectiveness of the solutions is verified by rigorous experiments. [ABSTRACT FROM AUTHOR]

Recently, there have been several attempts in establishing formal RFID privacy models in the literature. These models mainly fall into two categories: one based on the notion of indistinguishability of two RFID tags, denoted as ind-privacy, and the other based on the unpredictability of the output of an RFID protocol, denoted as unp-privacy. Very recently, at CCS΄09, Ma et al. proposed a modified unp-privacy model, referred to as unp'-privacy. In this paper, we first revisit the existing RFID privacy models and point out their limitations. We then propose a new RFID privacy model, denoted as unp*-privacy, based on the indistinguishability of a real tag and a virtual tag. We provide justification for the new model and formally clarify its relationship with ind-privacy model. Finally, we modify Ma et al.΄s 2-round RFID protocol to a 3-round mutual authentication RFID protocol and prove that it is of unp*-privacy. [ABSTRACT FROM AUTHOR]

Formal RFID security and privacy frameworks are fundamental to the design and analysis of robust RFID systems. In this paper, we develop a new definitional framework for RFID privacy in a rigorous and precise manner. Our framework is based on a zero-knowledge (ZK) formulation [8,6] and incorporates the notions of adaptive completeness and mutual authentication. We provide meticulous justification of the new framework and contrast it with existing ones in the literature. In particular, we prove that our framework is strictly stronger than the ind-privacy model of [18], which answers an open question posed in [18] for developing stronger RFID privacy models. We also clarify certain confusions and rectify several defects in the existing frameworks. Finally, based on the protocol of [20], we propose an efficient RFID mutual authentication protocol and analyze its security and privacy. The methodology used in our analysis can also be applied to analyze other RFID protocols within the new framework. [ABSTRACT FROM AUTHOR]

In ASIACCS΄08, Burmester, Medeiros and Motta proposed an anonymous RFID authentication protocol (BMM protocol [2]) that preserves the security and privacy properties, and achieves better scalability compared with other contemporary approaches. We analyze BMM protocol and find that some of security properties (especial untraceability) are not fulfilled as originally claimed. We consider a subtle attack, in which an adversary can manipulate the messages transmitted between a tag and a reader for several continuous protocol runs, and can successfully trace the tag after these interactions. Our attack works under a weak adversary model, in which an adversary can eavesdrop, intercept and replay the protocol messages, while stronger assumptions such as physically compromising of the secret on a tag, are not necessary. Based on our attack, more advanced attacking strategy can be designed on cracking a whole RFID-enabled supply chain if BMM protocol is implemented. To counteract such flaw, we improve the BMM protocol so that it maintains all the security and efficiency properties as claimed in [2]. [ABSTRACT FROM AUTHOR]

An intrusion tolerant database uses damage assessment techniques to detect damage propagation scales in a corrupted database system. Traditional damage assessment approaches in a intrusion tolerant database system can only locate damages which are caused by reading corrupted data. In fact, there are many other damage spreading patterns that have not been considered in traditional damage assessment model. In this paper, we systematically analyze inter-transaction dependency relationships that have been neglected in the previous research and propose four different dependency relationships between transactions which may cause damage propagation. We extend existing damage assessment model based on the four novel dependency relationships. The essential properties of our model is also discussed. [ABSTRACT FROM AUTHOR]

Private inference control enables simultaneous enforcement of inference control and protection of users΄ query privacy. Private inference control is a useful tool for database applications, especially when users are increasingly concerned about individual privacy nowadays. However, protection of query privacy on top of inference control is a double-edged sword: without letting the database server know the content of user queries, users can easily launch DoS attacks. To assuage DoS attacks in private inference control, we propose the concept of self-enforcing private inference control, whose intuition is to force users to only make inference-free queries by enforcing inference control themselves; otherwise, penalty will inflict upon the violating users. Towards instantiating the concept, we formalize a model on self- enforcing private inference control, and propose a concrete provably secure scheme, based on Woodruff and Staddon΄s work. In our construction, ˵penalty″ is instantiated to be a deprivation of users΄ access privilege: so long as a user makes an inference-enabling query, his access privilege is forfeited and he is rejected to query the database any further. We also discuss several important issues that complement and enhance the basic scheme. [ABSTRACT FROM AUTHOR]

In this paper, we perform a security and performance evaluation on the various hash-based RFID identification and authentication protocols that have been proposed in the research literature. We compare the level of security offered by each of the schemes by examining whether they satisfy a set of security properties under a multi-level adversarial model. The security properties examined include tag anonymity, tag authenticity, reader authenticity, session unlinkability, forward secrecy, and desynchronization resilience. Furthermore, we also evaluate the performance of the schemes by examining the overhead, namely computational costs, storage memory requirements, and communication costs, incurred under the schemes. Finally, we provide a discussion on the insights gathered from our evaluation. [ABSTRACT FROM AUTHOR]

While RFID technology has greatly facilitated the supply chain management, designing a secure, visible, and efficient RFID- enabled supply chain system is still a challenge since the three equally important requirements (i.e., security, visibility, and efficiency) may conflict to each other. Few research works have been conducted to address these issues simultaneously. In this paper, we observe the different security requirements in RFID-enabled supply chain environments and differentiate the simplified model into two security levels. Accordingly, dual security modes are properly defined in our RFID setting. In the relatively secure environment, our system is set to the weak security mode, the tagged products can be processed in a highly efficient way. When in the strong security mode, our system guarantees a high level of security, while its efficiency is lower than that in the weak security mode. A set of RFID tag/reader protocols to facilitate the duel security modes are presented. Their security, visibility and efficiency are analyzed and compared with the relevant works. [ABSTRACT FROM AUTHOR]

The malware threat for mobile phones is expected to increase with the functionality enhancement of mobile phones. This threat is exacerbated with the surge in population of smart phones instilled with stable Internet access which provides attractive targets for malware developers. Prior research on malware protection has focused on avoiding the negative impact of the functionality limitations of mobile phones to keep the performance cost within the limitations of mobile phones. Being different, this paper investigates the positive impact of these limitations on suppressing the development of mobile malware. We study the state-of-the-art mobile malware, as well as the progress of academic research and industrial effort against mobile malware. Our study shows that the functionality limitations of mobile phones should be considered as advantages as they have significant impact on shrinking the living space of mobile malware. From this perspective, we propose and analyze three potential directions for effective malware detection and prevention on mobile phones. [ABSTRACT FROM AUTHOR]

In USENIX Security 08, Juels, Pappu and Parno proposed a secret sharing based mechanism to alleviate the key distribution problem in RFID-enabled supply chains. Compared to existing pseudonym based RFID protocols, the secret sharing based solution is more suitable for RFID-enabled supply chains since it does not require a database of keys be distributed among supply chain parties for secure ownership transfer of RFID tags. However, this mechanism cannot resist tag tracking and tag counterfeiting attacks in supply chain systems. It is also not convenient for downstream supply chain parties to adjust the size of RFID tag collections in recovering tag keys. To address these problems, we propose a flexible and secure secret update protocol which enables each supply chain party to update tag keys in a secure and efficient manner. Our proposal enhances the previous secret sharing based mechanism in that it not only solves the flexibility problem in unidirectional key distribution, but also ensures the security for ownership transfer of tags in RFID-enabled supply chains. [ABSTRACT FROM AUTHOR]

In this chapter, a systematic review of database watermarking is provided. The existing database watermarking approaches are classified along six dimensions: data type, distortion to underlying data, sensitivity to database attacks, watermark information, verifiability, and data structure. At the end of this chapter, some open issues are discussed. [ABSTRACT FROM AUTHOR]

Disclosure analysis and control are critical to protect sensitive information in statistical databases when some statistical moments are released. A generic question in disclosure analysis is whether a data snooper can deduce any sensitive information from available statistical moments. To address this question, we consider various types of possible disclosure based on the exact bounds that a snooper can infer about any protected moments from available statistical moments. We focus on protecting static moments in two-dimensional tables and obtain the following results. For each type of disclosure, we reveal the distribution patterns of protected moments that are subject to disclosure. Based on the disclosure patterns, we design efficient algorithms to discover all protected moments that are subject to disclosure. Also based on the disclosure patterns, we propose efficient algorithms to eliminate all possible disclosures by combining a minimum number of available moments. We also discuss the difficulties of executing disclosure analysis and control in high-dimensional tables. [ABSTRACT FROM AUTHOR]

The database server is a crucial bottleneck in traditional inference control architecture, as it enforces highly computation-intensive auditing for all users who query the protected database. As a result, most auditing methods, though rigorously studied, can never be implemented in practice for protecting largescale real-world database systems. To shift this paradigm, we propose a new inference control architecture that will entrust inference control to each users platform, provided that the platform is equipped with trusted computing technology. The trusted computing technology is designed to attest the state of a users platform to the database server, so as to assure the server that inference control could be enforced as expected. A generic protocol is proposed to formalize the interactions between the users platform and database server. Any existing inference control technique can work with our protocol, for which the security properties are formally proven. Since each user's platform enforces inference control for its own queries, our solution avoids the bottleneck. [ABSTRACT FROM AUTHOR]

Two-dimensional contingency tables are central products of many information organizations such as statistical agencies, census bureaus, and health insurance information agencies. In a contingency table, any sensitive information about individuals must be protected, while some aggregated information can be released. The disclosure risk is that the aggregated information can be used to infer some sensitive information about individuals. Since the disclosure of sensitive information may compromise privacy, confidentiality, and national interests, one needs to carefully assess the latent risk of disclosure and take effective methods to protect the data. [ABSTRACT FROM AUTHOR]

In this paper we study the feasibility of auditing interval-based inference. Sensitive information about individuals is said to be compromised if an accurate enough interval, called inference interval, is obtained into which the value of the sensitive information must fall. Compared with auditing exact inference that is traditionally studied, auditing interval-based inference is more complicated. Existing auditing methods such as audit expert do not apply to this case. Our result shows that it is intractable to audit interval-based inference for bounded integer values; while for bounded real values, the auditing problem is polynomial yet involves complicated computation of mathematical programming. To further examine the practicability of auditing interval-based inference, we classify various auditing methods into three categories: exact auditing, optimistic auditing, and pessimistic auditing. We analyze the trade-offs that can be achieved by these methods among various auditing objectives: inference security, database usability, and auditing complexity. [ABSTRACT FROM AUTHOR]

Disclosure analysis in two-way contingency tables is important in categorical data analysis. The disclosure analysis concerns whether a data snooper can infer any protected cell values, which contain privacy sensitive information, from available marginal totals (i.e., row sums and column sums) in a two-way contingency table. Previous research has been targeted on this problem from various perspectives. However, there is a lack of systematic definitions on the disclosure of cell values. Also, no previous study has been focused on the distribution of the cells that are subject to various types of disclosure. In this paper, we define four types of possible disclosure based on the exact upper bound and/or the lower bound of each cell that can be computed from the marginal totals. For each type of disclosure, we discover the distribution pattern of the cells subject to disclosure. Based on the distribution patterns discovered, we can speed up the search for all cells subject to disclosure. [ABSTRACT FROM AUTHOR]