Download This Paper Open PDF in Browser Add Paper to My Library Share: Permalink Using these links will ensure access to this page indefinitely Copy URL Copy DOI

This short paper describes the two softwares we developed and used to help us to make our systematic literature review on biometrics authentication using PPG. The first software is an helper to extract, merge and filter all the references in the pdf of papers. The second one helps us to make statistical analysis on the dataset we created for our SLR.

In this paper, we review the latest experiments on continuous biometric authentication using PPG, mainly those carried out by Aly and Di Pietro [2]. In their latest model, they propose a Local Outlier Factor (LOF) [1] binder and continuous training to minimize legitimate user data for training a model that they claim to be capable of self-repair after attacks. Here we delve into the subject of LOF and implement various corruption attacks. With this preliminary study, we show that, on the contrary, the system is not capable of repairing itself. Moreover, continuous blind training is not very effective, and may be counter-productive in some cases. Our first results demonstrate the need for further research into continuous authentication and continuous learning. We show that current metrics and methods are not sufficient to properly assess the relevance of PPG-based continuous authentication systems.

Industry includes more and more IoT components to have a better control on production and logistic processes.Unfortunately, growing network openness in a formerly isolated world induces major security risks which are especially critical in an industrial context. These risks are exacerbated by the highly fragmented nature of the industrial IoT market which imposes interoperability management and challenges security.We propose an approach to enable end-to-end data security within a heterogeneous IoT deployment. Interoperability is ensured by a central network powered by oneM2M interacting with various tier protocols. In this paper, we focus on secure communication with ZigBee and discuss how it can be transposed to other protocols, namely Z-Wave and Thread.

Industry 4.0 proposes the inclusion of IoT components in industrial contexts to have a better control on production and logistic processes.Unfortunately, growing connectivity in a formerly isolated world induces major security risks which are especially critical in an industrial context. Furthermore, the highly fragmented nature of the industrial IoT market imposes interoperability management. Interoperability and heterogeneity generally poses security challenges, exacerbating these risks.oneM2M is a promising standard that can enable interoperability and ensure communication with various tier protocols. The interface between oneM2M and tiers protocols has however to be trusted, which is undesirable. In this paper, we focus on the first phase of an approach to enable end-to-end encryption between oneM2M and Zigbee devices: secure key exchange. We fully define an exchange protocol taking place during the enrolment of a Zigbee device within oneM2M. We provide and discuss an implementation of this protocol, demonstrating its technical feasibility.

The amount of data produced by individuals and corporations has dramatically increased during the last decades. This generalized gathering of data brings opportunities but also new privacy challenges. Nowadays, data are often organized as graphs with an underlying semantic to allow efficient querying and support inference engines. Such is the case in, for example, linked data and semantic web typically relying on RDF. The SEmantic Networks of Data: Utility and Privacy (SEND UP) project focuses on such databases and will follow two main goals: (1) prevent illegitimate use of private data while querying semantic data graphs and (2) publish useful sensitive semantic data graphs while preserving privacy. Context and goals More and more private information collected: threatening privacy yet useful ⇒ needs for privacy guarantees and utility preservation.

At present, computer science studies generally offer courses addressing mobile development and they use mobile technologies for illustrating theoretical concepts such as operating system, design patterns, and compilation because Android and iOS use a large variety of technologies for developing applications. Teaching courses on security is also becoming an important concern for academics, and the use of mobile platforms (such as Android) as supporting material is becoming a reasonable option. In this paper, we intend to bridge a gap in the literature by reversing this paradigm: Android is not only an opportunity to learn security concepts but requires strong pedagogical efforts for covering all the aspects of mobile security. Thus, we propose teaching Android mobile security through a two-dimensional approach. The first dimension addresses the cognitive process of the Bloom taxonomy, and the second dimension addresses the technical layers of the architecture of the Android operating system. We describe a set of comprehensive security laboratory courses covering various concepts, ranging from the application development perspective to a deep investigation of the Android Open Source Project and its interaction with the Linux kernel. We evaluated this approach, and our results verify that the designed security labs impart the required knowledge to the students.

Computing the maximum flow value between a pair of nodes in a given network is a classic problem in the context of network flows. Its extension, namely, the multi-terminal maximum flow problem, comprises finding the maximum flow values between all pairs of nodes in a given undirected network. In this work, we provide an overview of the recent theory of sensitivity analysis, which examines the influence of a single edge capacity variation on the multi-terminal maximum flows, and we make remarks about extending some theoretical results to the case where more than one edge has their capacities changed. Based on these extensions, we present algorithms to construct the Gomory and Hu cut-trees dynamically, considering capacity variations in more than one edge in the network. Finally, the presented theory is applied on a clustering problem, in the field of biology, in order to improve an existing algorithm that identifies protein complexes in protein–protein interaction networks. In this application, a new result in the sensitivity analysis theory is introduced.

Cloud Computing has known in the past few years a fast development, leading to a spike in the number of companies competing on providing the best Cloud services. This makes it harder for potential Cloud customers to chose the adequate provider. Despite its wide adoption, many are still hesitant due to the security issues Cloud Computing poses. In this paper, we propose a brokerage solution that formalizes security properties under the form of inter-VM relations, and gives the possibility of setting these security requirements to its customers from the first steps. This solution uses formal methods and the finite model finder KodKod to verify the consistency of the customer's requirements, and to find a placement for his deployment model.

To ensure the privacy of users in transport systems, researchers are working on new protocols providing the best security guarantees while respecting functional requirements of transport operators. In this paper, we design a secure NFC m-ticketing protocol for public transport that preserves users' anonymity and prevents transport operators from tracing their customers' trips. To this end, we introduce a new practical set-membership proof that does not require provers nor verifiers (but in a specific scenario for verifiers) to perform pairing computations. It is therefore particularly suitable for our (ticketing) setting where provers hold SIM/UICC cards that do not support such costly computations. We also propose several optimizations of Boneh-Boyen type signature schemes, which are of independent interest, increasing their performance and efficiency during NFC transactions. Our m-ticketing protocol offers greater flexibility compared to previous solutions as it enables the post-payment and the off-line validation of m-tickets. By implementing a prototype using a standard NFC SIM card, we show that it fulfils the stringent functional requirement imposed by transport operators whilst using strong security parameters. In particular, a validation can be completed in 184.25 ms when the mobile is switched on, and in 266.52 ms when the mobile is switched off or its battery is flat.

It is difficult for customers to select the adequate cloud providers which fit their needs, as the number of cloud offerings increases rapidly. Many works thus focus on the design of cloud brokers. Unfortunately, most of them do not consider precise security requirements of customers. In this paper, we propose a methodology defined to place services in a multi-provider cloud environment, based on functional and non-functional requirements, including security requirements. To eliminate inner conflicts within customers requirements, and to match the cloud providers offers with these customers requirements, we use a formal analysis tool: Alloy. The broker uses a matching algorithm to place the required services in the adequate cloud providers, in a way that fulfills all customer requirements. We finally present a prototype implementation of the proposed broker.

Fault attacks can target smart card programs in order to disrupt an execution and gain an advantage over the data or the embedded functionalities. Among all possible attacks, control flow attacks aim at disrupting the normal execution flow. Identifying harmful control flow attacks as well as designing countermeasures at software level are tedious and tricky for developers. In this paper, we propose a methodology to detect harmful intra-procedural jump attacks at source code level and to automatically inject formally-proven countermeasures. The proposed software countermeasures defeat 100% of attacks that jump over at least two C source code statements or beyond. Experiments show that the resulting code is also hardened against unexpected function calls and jump attacks at assembly level.

Fault attacks can target smart card programs in order to disrupt an execution and gain an advantage over the data or the embedded functionalities. Among all possible attacks, control flow attacks aim at disrupting the normal execution flow. Identifying harmful control flow attacks as well as designing countermeasures at software level are tedious and tricky for developers. In this paper, we propose a methodology to detect harmful intra-procedural jump attacks at source code level and to automatically inject formally-proven countermeasures. The proposed software countermeasures defeat 100

A novel pseudo-random bit generator (PRBG), combining three chaotic logistic maps is proposed. The IEEE 754-2008 standard for floating-point arithmetic is adopted and the binary64 double precision format is used. A more efficient processing is applied to better extract the bits, from outputs of the logistic maps. The algorithm enables to generate at each iteration, a block of 32 random bits by starting from three chosen seed values. The performance of the generator is evaluated through various statistical analyzes. The results show that the output sequences possess high randomness statistical properties for a good security level. The proposed generator lets appear significant cryptographic qualities.

During the last decades, several polynomial-time algorithms have been designed that decide if a graph has treewidth (resp., pathwidth, branchwidth, etc.) at most $k$, where $k$ is a fixed parameter. Amini {\it et al.} (to appear in SIAM J. Discrete Maths.) use the notions of partitioning-trees and partition functions as a generalized view of classical decompositions of graphs, namely tree-decomposition, path-decomposition, branch-decomposition, etc. In this paper, we propose a set of simple sufficient conditions on a partition function $\Phi$, that ensures the existence of a linear-time explicit algorithm deciding if a set $A$ has $\Phi$-width at most $k$ ($k$ fixed). In particular, the algorithm we propose unifies the existing algorithms for treewidth, pathwidth, linearwidth, branchwidth, carvingwidth and cutwidth. It also provides the first Fixed Parameter Tractable linear-time algorithm deciding if the $q$-branched treewidth, defined by Fomin {\it et al.} (Algorithmica 2007), of a graph is at most $k$ ($k$ and $q$ are fixed). Our decision algorithm can be turned into a constructive one by following the ideas of Bodlaender and Kloks (J. of Alg. 1996).

PIGA (Policy Interaction Graph Analysis) is a tool that detects malicious process behaviours by analysing the operating system activities. This tool uses signatures that represent illegal activities of some malicious user. These signatures are generated from a graph that models the performed operations at operating system (OS) level. For usual security properties, the number of signatures is large and they are stored in the memory during the detection process. In this paper, we present a way to reduce the memory required to store the signatures while preserving their quality. The methodology is derived from the modular decomposition of graphs. We investigate the impact of such an approach for the confidentiality property. The efficiency of the methodology is evaluated on interaction graphs of real operating systems. The number of signatures is divided by 20 for the tested confidentiality property

This technical report describes the implementation of exact and parametrized exponential algorithms, developed during the French ANR Agape during 2010-2012. The developed algorithms are distributed under the CeCILL license and have been written in Java using the Jung graph library.

Smart card software has to implement software countermeasures to face attacks. Some of these attacks are physical disruptions of chip components that cause a misbehavior in the code execution. A successful functional attack may reveal a secret or grant an undesired authorization. In this paper, we propose to model fault attacks at source level and then simulate these attacks to find out which ones are harmful. After discussing the effects of physical attacks at assembly level and going back to their consequences at source code level, the paper focuses on control flow attacks. Such attacks are good candidates for the proposed model that can be used to exhaustively test the robustness of the attacked program. On the bzip2 software, the paper's results show that up to 21% of the assembly simulated control flow attacks are covered by the C model with 30 times less test cases.

One of the most important threats for Android users is the collection of private data by malware put on the market. Most of the proposed approaches that help to guarantee the user's privacy rely on modified versions of the Android operating system. In this paper, we propose to automatically detect when an application accesses private data and to log this access in a third-party application. This detection should be performed without any modification to the operating system. The proposed methodology relies on the repackaging of a compiled application and the injection of a reporter at bytecode level. Thus, such a methodology enables the user to audit suspicious applications that ask permissions to access private data and to know if such an access has occurred. We show that the proposed methodology can also be implemented as an IPS, in order to prevent such accesses. Experimental results show the efficiency of the methodology on a set of 18 regular applications of the Android market that deal with contacts. Our prototype detected 66% of the accesses to the user's contacts. We also experimented the detection of privacy violations with 5 known malware that send premium-rate SMS.