In this paper, we review the latest experiments on continuous biometric authentication using PPG, mainly those carried out by Aly and Di Pietro [2]. In their latest model, they propose a Local Outlier Factor (LOF) [1] binder and continuous training to minimize legitimate user data for training a model that they claim to be capable of self-repair after attacks. Here we delve into the subject of LOF and implement various corruption attacks. With this preliminary study, we show that, on the contrary, the system is not capable of repairing itself. Moreover, continuous blind training is not very effective, and may be counter-productive in some cases. Our first results demonstrate the need for further research into continuous authentication and continuous learning. We show that current metrics and methods are not sufficient to properly assess the relevance of PPG-based continuous authentication systems.

Industry 4.0 proposes the inclusion of IoT components in industrial contexts to have a better control on production and logistic processes.Unfortunately, growing connectivity in a formerly isolated world induces major security risks which are especially critical in an industrial context. Furthermore, the highly fragmented nature of the industrial IoT market imposes interoperability management. Interoperability and heterogeneity generally poses security challenges, exacerbating these risks.oneM2M is a promising standard that can enable interoperability and ensure communication with various tier protocols. The interface between oneM2M and tiers protocols has however to be trusted, which is undesirable. In this paper, we focus on the first phase of an approach to enable end-to-end encryption between oneM2M and Zigbee devices: secure key exchange. We fully define an exchange protocol taking place during the enrolment of a Zigbee device within oneM2M. We provide and discuss an implementation of this protocol, demonstrating its technical feasibility.

Industry includes more and more IoT components to have a better control on production and logistic processes.Unfortunately, growing network openness in a formerly isolated world induces major security risks which are especially critical in an industrial context. These risks are exacerbated by the highly fragmented nature of the industrial IoT market which imposes interoperability management and challenges security.We propose an approach to enable end-to-end data security within a heterogeneous IoT deployment. Interoperability is ensured by a central network powered by oneM2M interacting with various tier protocols. In this paper, we focus on secure communication with ZigBee and discuss how it can be transposed to other protocols, namely Z-Wave and Thread.

At present, computer science studies generally offer courses addressing mobile development and they use mobile technologies for illustrating theoretical concepts such as operating system, design patterns, and compilation because Android and iOS use a large variety of technologies for developing applications. Teaching courses on security is also becoming an important concern for academics, and the use of mobile platforms (such as Android) as supporting material is becoming a reasonable option. In this paper, we intend to bridge a gap in the literature by reversing this paradigm: Android is not only an opportunity to learn security concepts but requires strong pedagogical efforts for covering all the aspects of mobile security. Thus, we propose teaching Android mobile security through a two-dimensional approach. The first dimension addresses the cognitive process of the Bloom taxonomy, and the second dimension addresses the technical layers of the architecture of the Android operating system. We describe a set of comprehensive security laboratory courses covering various concepts, ranging from the application development perspective to a deep investigation of the Android Open Source Project and its interaction with the Linux kernel. We evaluated this approach, and our results verify that the designed security labs impart the required knowledge to the students.

It is difficult for customers to select the adequate cloud providers which fit their needs, as the number of cloud offerings increases rapidly. Many works thus focus on the design of cloud brokers. Unfortunately, most of them do not consider precise security requirements of customers. In this paper, we propose a methodology defined to place services in a multi-provider cloud environment, based on functional and non-functional requirements, including security requirements. To eliminate inner conflicts within customers requirements, and to match the cloud providers offers with these customers requirements, we use a formal analysis tool: Alloy. The broker uses a matching algorithm to place the required services in the adequate cloud providers, in a way that fulfills all customer requirements. We finally present a prototype implementation of the proposed broker.

Abstract To ensure the privacy of users in transport systems, researchers are working on new protocols providing the best security guarantees while respecting functional requirements of transport operators. In this paper1, we design a secure NFC m-ticketing protocol for public transport that preserves users’ anonymity and prevents transport operators from tracing their customers’ trips. To this end, we introduce a new practical set-membership proof that does not require provers nor verifiers (but in a specific scenario for verifiers) to perform pairing computations. It is therefore particularly suitable for our (ticketing) setting where provers hold SIM/UICC cards that do not support such costly computations. We also propose several optimizations of Boneh-Boyen type signature schemes, which are of independent interest, increasing their performance and efficiency during NFC transactions. Our m-ticketing protocol offers greater flexibility compared to previous solutions as it enables the post-payment and the off-line validation of m-tickets. By implementing a prototype using a standard NFC SIM card, we show that it fulfils the stringent functional requirement imposed by transport operators whilst using strong security parameters. In particular, a validation can be completed in 184.25ms when the mobile is switched on, and in 266.52ms when the mobile is switched off or its battery is flat.

One of the most important threats for Android users is the collection of private data by malware put on the market. Most of the proposed approaches that help to guarantee the user's privacy rely on modified versions of the Android operating system. In this paper, we propose to automatically detect when an application accesses private data and to log this access in a third-party application. This detection should be performed without any modification to the operating system. The proposed methodology relies on the repackaging of a compiled application and the injection of a reporter at bytecode level. Thus, such a methodology enables the user to audit suspicious applications that ask permissions to access private data and to know if such an access has occurred. We show that the proposed methodology can also be implemented as an IPS, in order to prevent such accesses. Experimental results show the efficiency of the methodology on a set of 18 regular applications of the Android market that deal with contacts. Our prototype detected 66% of the accesses to the user's contacts. We also experimented the detection of privacy violations with 5 known malware that send premium-rate SMS.

Smart card software has to implement software countermeasures to face attacks. Some of these attacks are physical disruptions of chip components that cause a misbehavior in the code execution. A successful functional attack may reveal a secret or grant an undesired authorization. In this paper, we propose to model fault attacks at source level and then simulate these attacks to find out which ones are harmful. After discussing the effects of physical attacks at assembly level and going back to their consequences at source code level, the paper focuses on control flow attacks. Such attacks are good candidates for the proposed model that can be used to exhaustively test the robustness of the attacked program. On the bzip2 software, the paper's results show that up to 21% of the assembly simulated control flow attacks are covered by the C model with 30 times less test cases.

This paper presents a new decomposition technique for hierarchical Cayley graphs. This technique yields a very easy implementation of the divide and conquer paradigm for some problems on very complex architectures as the star graph or the pancake. As applications, we introduce algorithms for broadcasting and prefix-like operations that improve the best known bounds for these problems. We also give the first nontrivial optimal gossiping algorithms for these networks. In star-graphs and pancakes with N=n! processors, our algorithms take less than [log N]+1.5n steps.