The fingerprinting game is analysed when the coalition size k is known to the tracer, but the colluders can distribute themselves across L TV channels. The collusion channel is introduced and the extra degrees of freedom for the coalition are made manifest in our formulation. We introduce a payoff functional that is analogous to the single TV channel case, and is conjectured to be closely related to the fingerprinting capacity. For the binary alphabet case under the marking assumption, and the restriction of access to one TV channel per person per segment, we derive the asymptotic behavior of the payoff functional. We find that the value of the maximin game for our payoff is asymptotically equal to L2/k2 2 ln 2, with optimal strategy for the tracer being the arcsine distribution, and for the coalition being the interleaving attack across all TV channels, as well as assigning an equal number of colluders across the L TV channels.

When collecting information, local differential privacy (LDP) relieves the concern of privacy leakage from users' perspective, as user's private information is randomized before sent to the aggregator. We study the problem of recovering the distribution over a numerical domain while satisfying LDP. While one can discretize a numerical domain and then apply the protocols developed for categorical domains, we show that taking advantage of the numerical nature of the domain results in better trade-off of privacy and utility. We introduce a new reporting mechanism, called the square wave (SW) mechanism, which exploits the numerical nature in reporting. We also develop an Expectation Maximization with Smoothing (EMS) algorithm, which is applied to aggregated histograms from the SW mechanism to estimate the original distributions. Extensive experiments demonstrate that our proposed approach, SW with EMS, consistently outperforms other methods in a variety of utility metrics.

Storage of biometric data requires some form of template protection in order to preserve the privacy of people enrolled in a biometric database. One approach is to use a Helper Data System. Here it is necessary to transform the raw biometric measurement into a fixed-length representation. In this paper, we extend the spectral function approach of Stanko and Škorić (IEEE Workshop on Information Forensics and Security (WIFS), 2017) which provides such a fixed-length representation for fingerprints. First, we introduce a new spectral function that captures different information from the minutia orientations. It is complementary to the original spectral function, and we use both of them to extract information from a fingerprint image. Second, we construct a helper data system consisting of zero-leakage quantisation followed by the Code Offset Method. We show empirical data on matching performance and entropy content. On the negative side, transforming a list of minutiae to the spectral representation degrades the matching performance significantly. On the positive side, adding privacy protection to the spectral representation can be done with little loss of performance.

A Physically Unclonable Function (PUF) is a unique and stable physical characteristic of a piece of hardware, which emerges due to variations in the hardware fabrication processes. Prior works have demonstrated that PUFs are a promising cryptographic primitive that can enable secure key storage, hardware-based device authentication and identification. So far, most PUF constructions have required an addition of new hardware or an FPGA implementation for their operation. Recently, intrinsic PUFs, which can be found in commodity devices, have been investigated. Unfortunately, most of them suffer from the drawback that they can only be accessed at boot time. This paper focuses on a new class of run-time accessible, decay-based, intrinsic DRAM PUFs in commercial off-the-shelf systems, which requires no additional hardware or FPGAs. In order to enable secure key storage using DRAM PUFs, this work presents a new Helper Data System (HDS) specifically tailored to the properties of the decay process inherent to DRAM cells. The decay-based DRAM PUF and the new HDS are evaluated on commodity off-the-shelf devices to demonstrate their practicality. Furthermore, a novel lightweight protocol is presented that allows for mutual authentication.

In recent years, physically unclonable functions (PUFs) have been proposed as a promising building block for key storage and device authentication. PUFs are physical systems, and as such, their responses are inherently noisy, precluding a straightforward derivation of cryptographic key material from raw PUF measurements. To overcome this drawback, fuzzy extractors are used to eliminate the noise and guarantee robust outputs. A special type is reverse fuzzy extractors, shifting the computational load of error correction toward a computationally powerful verifier. However, the reverse fuzzy extractor reveals error patterns to any eavesdropper, which may cause privacy issues (due to a systematic drift of the PUF responses, the error pattern is linkable to the identity) and even security problems (if the noise is data-dependent). In this paper, we quantify the issue of leakage due to asymmetry of noise, leveraging the binary asymmetric channel (BAC) model. We further propose to concatenate two BACs to form a symmetric channel, as a solution that is able to eliminate such noise. Finally, we propose a modified reverse fuzzy extractor that does not leak via the error patterns even in the case of systematic drift of the PUF responses.

Helper data systems are a cryptographic primitive that allows for the reproducible extraction of secrets from noisy measurements. Redundancy data called helper data makes it possible to do error correction while leaking little or nothing (Zero Leakage) about the extracted secret string. We study the case of non-discrete measurement outcomes. In this case, a quantization step is required. Recently, de Grootet al.described a generic method to perform the quantization in a Zero Leakage manner. We extend their work and show how the quantization intervals should be set to maximize the amount of extracted secret key material when noise is taken into account.

The topic of this paper is collusion resistant watermarking, also known as traitor tracing, in particular bias-based traitor tracing codes as introduced by Tardos. The past years have seen an ongoing effort to construct efficient high-performance decoders for these codes. In this paper we construct a score system from the Neyman-Pearson hypothesis test (which is known to be the most powerful test possible) into which we feed more evidence than in previous work, in particular the symbol tallies for all columns of the code matrix. As far as we know, until now simple decoders using Neyman-Pearson have taken into consideration only the codeword of a single user, namely the user under scrutiny. The Neyman-Pearson score needs as input the attack strategy of the colluders, which typically is not known to the tracer. We insert the interleaving attack, which plays a very special role in the theory of bias-based traitor tracing by virtue of being part of the asymptotic (i.e., large coalition size) saddle-point solution. The score system obtained in this way is universal: effective not only against the interleaving attack, but against all other attack strategies as well. Our score function for one user depends on the other users' codewords in a very simple way through the symbol tallies, which are easily computed. We present bounds on the false positive probability and show receiver operating characteristic curves obtained from simulations. We investigate the probability distribution of the score. Finally, we apply our construction to the area of (medical) group testing, which is related to traitor tracing.

We investigate alternative suspicion functions for bias-based traitor tracing schemes, and present a practical construction of a simple decoder that attains capacity in the limit of large coalition size c. We derive optimal suspicion functions in both the restricted-digit model and the combined-digit model. These functions depend on information that is usually not available to the tracer-the attack strategy or the tallies of the symbols received by the colluders. We discuss how such results can be used in realistic contexts. We study several combinations of coalition attack strategy versus suspicion function optimized against some attack (another attack or the same). In many of these combinations, the usual codelength scaling ℓ ∝ c2changes to a lower power of c, e.g., c3/2. We find that the interleaving strategy is an especially powerful attack. The suspicion function tailored against interleaving is the key ingredient of the capacity-achieving construction.

Helper data schemes are a security primitive used for privacy-preserving biometric databases and physical unclonable functions. One of the oldest known helper data schemes is the code offset method (COM). We propose an extension of the COM: the helper data are accompanied by many instances of fake helper data that are drawn from the same distribution as the real one. While the adversary has no way to distinguish between them, the legitimate party has more information and can see the difference. We use a low-density parity check code in order to improve the efficiency of the legitimate party's selection procedure. Our construction provides a new kind of tradeoff: more effective use of the source entropy, at the price of increased helper data storage. We give a security analysis in terms of Shannon entropy and order-2 Rényi entropy. We also propose a variant of our scheme in which the helper data list is not stored but pseudorandomly generated, changing the tradeoff to source entropy utilization versus computation effort.

We investigate alternative suspicion functions for Tardos traitor tracing schemes. In the simple decoder approach (computation of a score for every user independently) we derive suspicion functions that optimize a performance indicator related to the sufficient code length l in the limit of large coalition size c. Our results hold for the Restricted-Digit Model as well as the Combined-Digit Model. The scores depend on information that is usually not available to the tracer -- the attack strategy or the tallies of the symbols received by the colluders. We discuss how such results can be used in realistic contexts.

We construct binary dynamic traitor tracing schemes, where the number of watermark bits needed to trace and disconnect any coalition of pirates is quadratic in the number of pirates, and logarithmic in the total number of users and the error probability. Our results improve upon results of Tassa, and our schemes have several other advantages, such as being able to generate all codewords in advance, a simple accusation method, and flexibility when the feedback from the pirate network is delayed.

We study the probability distribution of user accusations in the q-ary Tardos fingerprinting system under the Marking Assumption, in the restricted digit model. In particular, we look at the applicability of the so-called Gaussian approximation, which states that accusation probabilities tend to the normal distribution when the fingerprinting code is long. We introduce a novel parametrization of the attack strategy which enables a significant speedup of numerical evaluations. We set up a method, based on power series expansions, to systematically compute the probability of accusing innocent users. The ‘small parameter’ in the power series is 1/m, where m is the code length. We use our method to semi-analytically study the performance of the Tardos code against majority voting and interleaving attacks. The bias function ‘shape’ parameter $${{\kappa}}$$ strongly influences the distance between the actual probabilities and the asymptotic Gaussian curve. The impact on the collusion-resilience of the code is shown. For some realistic parameter values, the false accusation probability is even lower than the Gaussian approximation predicts.

We formalize a new attack model for collusion secure codes, incorporating attacks on the underlying watermarking scheme as well as cut-and-paste attacks traditionally considered for collusion secure codes. We use this model to analyze the collusion resistance of two versions of the Tardos code, both for binary and nonbinary alphabets. The model allows us to consider different signal processing attacks on the content, namely the addition of noise and averaging attacks. The latter may result in content segments that have multiple watermarks embedded. We study two versions of the$q$-ary Tardos code in which the accusation method has been modified so as to allow for the detection of multiple symbols in the same content segment. We show that both variants yield efficient codes in the new model, parametrized for realistic attacker strengths.

We address the problem of designing optimal schemes for the generation of secure cryptographic keys from continuous noisy data. We argue that, contrary to the discrete case, a universal fuzzy extractor does not exist. This implies that in the continuous case, key extraction schemes have to be designed for particular probability distributions. We extend the known definitions of the correctness and security properties of fuzzy extractors. Our definitions apply to continuous as well as discrete variables. We propose a generic construction for fuzzy extractors from noisy continuous sources, using independent partitions. The extra freedom in the choice of discretization, which does not exist in the discrete case, is advantageously used to give the extracted key a uniform distribution. We analyze the privacy properties of the scheme and the error probabilities in a one-dimensional toy model with simplified noise. Finally, we study the security implications of incomplete knowledge of the source's probability distribution${\BBP }$. We derive a bound on the min-entropy of the extracted key under the worst-case assumption, where the attacker knows${\BBP }$exactly.

Tardos has proposed a randomized fingerprinting code that is provably secure against collusion attacks. We revisit his scheme and show that it has significantly better performance than suggested in the original paper. First, we introduce variables in place of Tardos' hard-coded constants and we allow for an independent choice of the desired false positive (FP) and false negative (FN) error rates. Following through Tardos' proofs with these modifications, we show that the code length can be reduced by more than a factor of two in typical content distribution applications where high FN rates can be tolerated. Second, we study the statistical properties of the code. Under some reasonable assumptions, the accusation sums can be regarded as Gaussian-distributed stochastic variables. In this approximation, the desired error rates are achieved by a code length twice shorter than in the first approach. Overall, typical FP and FN error rates may be achieved with a code length approximately five times shorter than in the original construction.

A fundamental problem in intrusion detection is what metric(s) can be used to objectively evaluate an intrusion detection system (IDS) in terms of its ability to correctly classify events as normal or intrusive. Traditional metrics (e.g., true positive rate and false positive rate) measure different aspects, but no single metric seems sufficient to measure the capability of intrusion detection systems. The lack of a single unified metric makes it difficult to fine-tune and evaluate an IDS. In this paper, we provide an in-depth analysis of existing metrics. Specifically, we analyze a typical cost-based scheme [6], and demonstrate that this approach is very confusing and ineffective when the cost factor is not carefully selected. In addition, we provide a novel information-theoretic analysis of IDS and propose a new metric that highly complements cost-based analysis. When examining the intrusion detection process from an information-theoretic point of view, intuitively, we should have less uncertainty about the input (event data) given the IDS output (alarm data). Thus, our new metric, CI D (Intrusion Detection Capability), is defined as the ratio of the mutual information between the IDS input and output to the entropy of the input. CI D has the desired property that: (1) It takes into account all the important aspects of detection capability naturally, i.e., true positive rate, false positive rate, positive predictive value, negative predictive value, and base rate; (2) it objectively provides an intrinsic measure of intrusion detection capability; and (3) it is sensitive to IDS operation parameters such as true positive rate and false positive rate, which can demonstrate the effect of the subtle changes of intrusion detection systems. We propose CI D as an appropriate performance measure to maximize when fine-tuning an IDS. The obtained operation point is the best that can be achieved by the IDS in terms of its intrinsic ability to classify input data. We use numerical examples as well as experiments of actual IDSs on various data sets to show that by using CI D, we can choose the best (optimal) operating point for an IDS and objectively compare different IDSs.

We propose methods to estimate the secrecy-rate of fuzzy sources (e.g. biometrics and physical unclonable functions (PUFs)) using context-tree weighting. In this paper we focus on PUFs. In order to show that our estimates are realistic we first generalize Maurer's (1993) result to the ergodic case. Then we focus on the fact that the entropy of a stationary two-dimensional structure is a limit of a series of conditional entropies, a result by Anastassiou and Sakrison (1982). We extend this result to the conditional entropy of one two-dimensional structure given another one. Finally we show that the general CTW-method approaches the source entropy also in the two-dimensional stationary case. We further extend this result to the two-dimensional conditional entropy. Based on the obtained results we do several measurements on (our) optical PUFs. These measurements allow us to conclude that a secrecy-rate of 0.3 bit/location is possible

A "physical uncloneable function" (PUF) is a function that is realized by a physical system, such that the function is easy to evaluate but the physical system is hard to characterize. PUFs were introduced as a cost-effective way of generating secure keys for cryptographic purposes. A PUF is a physical system designed such that it interacts in a complicated way with stimuli (challenges) and leads to unique but unpredictable responses. A PUF is similar to a keyed hash function. The key is the physical system consisting of many "random" components.