Anderson and Kuhn (1997) described an attack against tamper-resistant devices wherein a secret key stored in EEPROM is compromised using a simple and low-cost attack. The attack consists of setting bits in the EEPROM using low-cost probes and observing the effect on the output of the device. These attacks are extremely general, as they apply to virtually any cryptosystem. The objective of the present work is to explore cryptographic techniques with the goal of raising the cost (in terms of time and money) of carrying out the EEPROM modification attack by Class I attackers, at least to a point where it is as prohibitive as the cost of purchasing more expensive equipment. We propose the m-permutation protection scheme in which the key will be encoded in a special way and burned into the EEPROM of the device. To attack the scheme, the attacker needs to be able to solve for K in the equation K=/spl oplus//sub i=1//sup m/P/sub i/ in which P/sub i/'s are unknown. It is observed that the m-permutation protection scheme does not distribute the key K uniformly. Analysis shows that m=3 or m=5 are already good enough practically to provide strong security if the encoding is done properly and that m>5 may not give significant improvement to the security of the scheme.

Workflow systems are becoming very popular and are being used to support many of the day to day activities in large organizations. One of the major problems with workflow systems is that they often use heterogeneous and distributed hardware and software systems to execute a given activity. This gives rise to decentralized security policies and mechanisms, which, in order to enable activity execution, give too many privileges (for accessing resources like documents) to the agents (humans or systems) for executing the work. We develop the concept of least priviledge, wherein the set of agents are given just enough privileges to complete the given activities. We develop our concepts in the context of CapBasED-AMS (Capability-based and Event-driven Activity Management System). The CapBasED-AMS deals with the management and execution of activities. An activity consists of multiple inter-dependent tasks (atomic activities, each executed by a single agent) that need to be coordinated, scheduled and executed by a set of agents. We formalize the concept of least privilege security and present algorithms to statically assign least privilege assignment to the agents. Further, we develop the concept of dynamic least privilege enforcement, wherein an agent is given its privileges only during the duration of the task for which those privileges were assigned. We also develop the concept of dynamic evolution of least privileges by taking into consideration the changes in the way resources are accessed by the agents in executing their tasks. Finally, we address the trade-off between resilience to agent failure and least privilege.

Workflow systems are becoming very popular and are being used to support many of the day to day activities in large organizations. One of the major problems with workflow systems is that they often use heterogeneous and distributed hardware and software systems to execute a given activity. This gives rise to decentralized security policies and mechanisms, which, in order to enable activity execution, give too many privileges to agents (humans or systems) for executing the work. We develop the concept of least privilege, wherein the set of agents are given just enough privileges to complete the given activities. We develop our concepts in the context of CapBasED-AMS (Capability-based and Event-driven Activity Management System). CapBasED-AMS deals with the management and execution of activities. An activity consists of multiple inter-dependent tasks (atomic activities, each executed by a single agent) that need to be coordinated, scheduled and executed by a set of agents. We formalize the concept of least privilege and present algorithms to statically assign least privilege assignment to the agents. We develop the concept of dynamic least privilege enforcement, wherein an agent is given its privileges only during the duration of the task for which those privileges were assigned. Finally, we introduce a metric, security risk factor and use it to evaluate the trade-off between least privilege and resilience to agent failure.

We develop an approach to deriving concrete engineering advice for cryptographic protocols from provable-security-style proofs of security. The approach is illustrated with a simple, yet useful protocol. Our main result provides the first published proof of an exact probabilistic relationship betwe en a high-level protocol and multiple cryptographic primitives. This exact relationship enables us to rigorously derive concrete recommendations on the bitlengths of cryptographic keys and on how often principals should rekey. As an additional benefit of our approach, the process of developing our theorem and proof lead us to identify and implement an improvement in our example protocol.

We develop an approach to deriving concrete engineering advice for cryptographic protocols from provable-security-style proofs of security. The approach is illustrated with a simple, yet useful protocol. The proof is novel and is the first published proof that provides an exact relationship between a high level protocol and multiple cryptographic primitives.

We use standard linear-time temporal logic to specify cryptographic protocols, model the system penetrator, and specify correctness requirements. The requirements are specified as standard safety properties, for which standard proof techniques apply. In particular, we are able to prove that the system penetrator cannot obtain a session key by any logical or algebraic techniques. We compare our work to Meadows' method. We argue that using standard temporal logic provides greater flexibility and generality, firmer foundations, easier integration with other formal methods, and greater confidence in the verification results.

We set out a logic for reasoning about multilevel security of probabilistic systems. This logic includes modalities for time, knowledge, and probability. In earlier work we gave syntactic definitions of multilevel security and showed that their semantic interpretations are equivalent to independently motivated information-theoretic definitions. This paper builds on that earlier work in two ways. First, it substantially recasts the language and model of computation into the more standard Halpern-Tuttle framework for reasoning about knowledge and probability. Second, it brings together two distinct characterizations of security from that work. One was equivalent to the information-theoretic security criterion for a system to be free of covert channels but was difficult to prove. The other was a verification condition that implied the first; it was more easily provable but was too strong. This paper presents a characterization that is syntactically very similar to our previous verification condition but is proven to be semantically equivalent to the security criterion. The new characterization also means that our security criterion is expressible in a simpler logic and model.

The bus-contention channel is a covert channel that can be exploited at a rate exceeding 1000 bits per second. Fuzzy time is a countermeasure first described by Wei-Ming Hu (1991). To assess the effectiveness of fuzzy time, it is desirable to have an information-theoretic capacity analysis of the bus-contention channel under fuzzy time. The author points out that the capacity of this channel depends on the assumptions that are held regarding the environment in which the channel is being exploited. He discusses various assumptions that may be held regarding the environment. He argues that a capacity analysis under the weakest of these assumptions (viz. the 'secure environment assumption) provides an upper bound on the capacity under the other assumptions discussed. It has been argued that a capacity analysis under the stronger assumptions is intractable. Therefore, an analysis under the weaker assumption provides the best available upper bound on the capacity of this channel. The author shows how to analyze the capacity of the channel under the weaker environment assumption and carries out such analysis of the channel using realistic system parameters and variety of fuzzy time parameters.>

We explore two approaches to introducing noise into the buscontention channel: an existing approach called fuzzy time, and a novel approach called probabilistic partitioning.We compare the two approaches in terms of the impact on covert channel capacity, the impact on performance, the amount of random data needed, and their suitability for various applications.For probabilistic partitioning, we obtain a precise tradeoff between covert channel capacity and performance.'Actually, this discussion is slightly simplified froin Hu's work.To address all types of clocks, Hu introduces "upticks" (which are used for notification of incoming events) and "downticks" (which are used for notification of outgoing events).However, for the present discussion it is sufficient to consider a single fuzzy reference clock.VAX is a trademark of Digital Equipment Corporation.

A second-order modal logic for reasoning about multilevel security in probabilistic systems is proposed. A possible world semantics is presented, and it is proved that the logic is sound with respect to it. The semantics is novel in treating probability measures themselves as possible worlds. After giving a syntatic definition of security, it is shown that the semantic interpretation of the syntactic definition is equivalent to an earlier independently motivated characterization called probabilistic noninterference due to J. W. Gray, III (1991). The authors examine a syntatic representation of Gray's applied flow model and discuss the relation between these characterizations of security and between their usefulness in security analysis. A syntatic description of a round-robin server and a sketch of the formal proof of its security are also provided.>

We describe a general purpose, probabilistic system model that can be used to model a large class of probabilistic (as well as deterministic) computer systems. We develop the necessary probability theory to rigorously state and reason about propertie

Prior work is discussed and positions are given on the following two questions: (1) What basis should be used to evaluate information flow security models? and (2) What should the scope of an information flow security model be? As part of the position on question (1), a reformulation of McLean's FM (1990) is given.>

A general-purpose, probabilistic state machine model which can be used to model a large class of nondeterministic (as well as deterministic) computer systems is described. The necessary probability theory to rigorously state and prove probabilistic properties of modeled systems is developed. A definition of information flow-security making use of this formalism is given. Intuitively, information flow security is the aspect of computer security concerned with how information is permitted to flow through a computer system. It is proved that the proposed definition of information flow security implies an information-theoretic definition. Finally, the author gives a verification condition for information flow security and proves that it implies the proposed definition of information flow security.>

The author attempts to establish a theoretical foundation for secure information sharing. He proposes a secure system structuring construct, called a secure object manager, as an example of a one-way information sharing mechanism. Secrecy, integrity, and availability requirements for the secure object manager are defined. A formal system model, including a careful treatment of communication via bounded buffers, is developed. Then he formally defines secrecy in terms of the model. This definition of secrecy precludes all covert channels, including storage, probabilistic, and timing channels. An implementation of the secure object manager that satisfies all the requirements considered is presented.>

D. McCullough's (1988) state machine formulism and definition of restrictiveness are restated. An example system is presented which illustrates the problem of probabilistic interference. An extension to McCullough's work that solves the problem of probabilistic interference is developed. A series of examples are presented which are designed to show the application of this extension. An example which is a novel solution to the so-called secure readers-writers problem is also presented.>