Covert- and side-channels as well as techniques to establish them in cloud computing are in focus of research for quite some time. However, not many concrete mitigation methods have been developed and even less have been adapted and concretely implemented by cloud providers. Thus, we recently conceptually proposed C3-Sched a CPU scheduling based approach to mitigate L2 cache covert-channels. Instead of flushing the cache on every context switch, we schedule trusted virtual machines to create noise which prevents potential covert-channels. Additionally, our approach aims on preserving performance by utilizing existing instead of artificial workload while reducing covert-channel related cache flushes to cases where not enough noise has been achieved. In this work we evaluate cache covert-channel mitigation and performance impact of our integration of C3-Sched in the XEN credit scheduler. Moreover, we compare it to naive solutions and more competitive approaches.

We provide a privacy-friendly cloud-based smart metering storage architecture which provides few-instance storage on encrypted measurements by at the same time allowing SQL queries on them. Our approach is most flexible with respect to two axes: on the one hand it allows to apply filtering rules on encrypted data with respect to various upcoming business cases; on the other hand it provides means for a storage-efficient handling of encrypted measurements by applying server-side deduplication techniques over all incoming smart meter measurements. Although the work at hand is purely dedicated to a smart metering architecture we believe our approach to have value for a broader class of IoT cloud storage solutions. Moreover, it is an example for Privacy-by-design supporting the positive-sum paradigm.

In this work we describe the implementation details of a protocol suite for a secure and reliable over-the-air reprogramming of wireless restricted devices. Although, recently forward error correction codes aiming at a robust transmission over a noisy wireless medium have extensively been discussed and evaluated, we believe that the clear value of the contribution at hand is to share our experience when it comes to a meaningful combination and implementation of various multihop (broadcast) transmission protocols and custom-fit security building blocks: For a robust and reliable data transmission we make use of fountain codes a.k.a. rateless erasure codes and show how to combine such schemes with an underlying medium access control protocol, namely a distributed low duty cycle medium access control (DLDC-MAC). To handle the well known problem of packet pollution of forward-error-correction approaches where an attacker bogusly modifies or infiltrates some minor number of encoded packets and thus pollutes the whole data stream at the receiver side, we apply homomorphic message authentication codes (HomMAC). We discuss implementation details and the pros and cons of the two currently available HomMAC candidates for our setting. Both require as the core cryptographic primitive a symmetric block cipher for which, as we will argue later, we have opted for the PRESENT, PRIDE and PRINCE (exchangeable) ciphers in our implementation.

In this paper, we provide privacy enhancements for a software agent-based audit system for clouds. We also propose a general privacy enhancing cloud audit concept which, we do present based on a recently proposed framework. This framework introduces the use of audit agents for collecting digital evidence from different sources in cloud environments. Obviously, the elicitation and storage of such evidence leads to new privacy concerns of cloud customers, since it may reveal sensitive information about the utilization of cloud services. We remedy this by applying Somewhat Homomorphic Encryption (SHE) and Public-Key Searchable Encryption (PEKS) to the collection of digital evidence. By considering prominent audit event use cases we show that the amount of cleartext information provided to an evidence storing entity and subsequently to a third-party auditor can be shaped in a good balance taking into account both, i) the customers' privacy and ii) the fact that stored information may need to have probative value. We believe that the administrative domain responsible for an evidence storing database falls under the adversary model "honest-but-curious" and thus should perform query responses from the auditor with respect to a given cloud audit use case by purely performing operations on encrypted digital evidence data.

Recently we presented QuantDroid [7], a quantitative approach towards mitigating privilege escalation attacks on Android. By monitoring all synchronous IPC via overt channels on-the-fly, a so called flow-graph service detects an abnormal amount of traffic exchanged between DVMs running different Apps to indicate a potential horizontal privilege escalation attack. However, although certainly a valuable first step, our initial QuantDroid approach fails when dealing with asynchronous IPC via persistent storage containers on the Android system. To also address this issue, in this work we extend QuantDroid to QuantDroid++by providing i) a central storage of taints when operating on system-internal databases of Android, ii) an extension of the SQL cursor object to preserve taints and link requested data with such taints, and, finally iii) an inspection of the information flow with such newly available taints for all relevant database operations.

This work is dealing with privilege escalation attacks on Android based smartphones. From the conceptual side we revisit information graph based approaches that aim to identify critical shared resources between simultaneously running applications (Apps). The proposed QuantDroid architecture is implemented and flexible enough to handle different known overt channel resources by causing only a moderate performance penalty at runtime. Compared to recently proposed solutions like TaintDroid or XManDroid, our approach QuantDroid models the information flow graph precisely and quantitatively.

It is the objective of this work to propose an extension of the Concealed Data Aggregation (CDA) approach which has originally been invented to allow some forms of in-network processing on encrypted data for reverse multicast traffic a.k.a. convergecast traffic. Extensions have been done with respect to two axes: Our proposed Malleability Resilient Concealed Data Aggregation (MR-CDA) combines recently presented homomorphic MACs with additively homomorphic encryption schemes and thus helps detecting outsider attacks which maliciously add resp. inject encrypted data to an aggregated encrypted data format. In the visionary part of this work with the malleability resilient premium concealed data aggregation (MR-P-CDA) we investigate what cryptographic primitives are in principle available to provide the most flexible form of encrypted in-network processing. Whereas the MR-CDA is in particular optimized with respect to its computational performance, the MR-P-CDA intentionally is not taking into account performance issues. Instead its focus is on the provisioning of an overall system security without any functional restrictions.

We present a runtime integrity measurement for Linux-based smartphones. It is based on a Mobile Trusted Module (MTM) with the objective to prevent running arbitrary third-party applications (Apps) on a smartphone. Only Apps signed by the MTM are allowed to run on the smartphone. Moreover, the proposed architecture inhibits running Apps which are infected with e.g. a mobile virus after their installation. We believe that the proposed approach is useful particularly for company administrators who want to fully control the list of Apps allowed to run on employees' smartphones and to ensure that Apps altered after their installation or installed without company permission are never executed.

Smartphones are popular attack targets, but usually too weak in applying common protection concepts. SKIMS designs and implements a cooperative, cross-layer security system for mobile devices. Detection mechanisms as well as a proactive and reactive defense of attacks are core components of this project. In this demo, we show a comprehensive proof-of-concept of our approaches, which include entropy-based malware detection, a mobile honeypot, and spontaneous, socio-inspired trust establishment.

Unattended wireless sensor networks (WSNs) collect and store sensed data in the absence of a base station (sink). WSN data aggregation is a widely accepted approach to improve storage and communication efficiency. But the vulnerability of low-cost WSN nodes to compromise makes the use of secure protocols mandatory. As most secure data aggregation algorithms use the base station as a trust anchor, unattended WSNs need new solutions for secure data aggregation. We address exactly this problem, proposing a new resilient data aggregation scheme that protects data integrity and remains robust to a wide range of attacks, integrating Quality-of-Information (Qol) as a defense mechanism. We argue that a Qol metric accompanying every aggregation result is necessary for the WSN user, to assess the quality of obtained data and detect errors or attacks. Even with a significant fraction of the WSN nodes controlled by the attacker, our scheme identifies and mitigates the effect of the attacks. This is supported by our analysis, with simulations of realistic strong attacks. The practicality of our scheme is supported by our proof of concept implementation.

We present an overview of end-to-end encryption solutions for convergecast traffic in wireless sensor networks that support in-network processing at forwarding intermediate nodes. Other than hop-by-hop based encryption approaches, aggregator nodes can perform in-network processing on encrypted data. Since it is not required to decrypt the incoming ciphers before aggregating, substantial advantages are 1) neither keys nor plaintext is available at aggregating nodes, 2) the overall energy consumption of the backbone can be reduced, 3) the system is more flexible with respect to changing routes, and finally 4) the overall system security increases. We provide a qualitative comparison of available approaches, point out their strengths, respectively weaknesses, and investigate opportunities for further research.

Due to severe resource restrictions, many established cryptographic schemes are not executable in sensor and actuator networks. Especially for key exchange algorithms (KE), the foundation of many cryptographic protocols, the situation is extremely challenging as most KE rely on elaborate computations and/or huge data. Hence, there is a continuous search for KE with reduced complexity. Observe that most KE burden the same workload on both communication partners. In this paper, we follow a different approach that respects the usually asymmetric capabilities of network nodes and users. We describe a key agreement protocol that allows for pushing the workload almost completely to the stronger device, e.g., the user. This allows to get any desired security level, independent of the capabilities of the weak device.

Recently, several code update approaches for multi-hop sensor networks have been proposed basically addressing two orthogonal problems: security and efficient over the air reprogramming. Unfortunately, the proposed security solutions for code update mechanisms are only considering early proposed over the air reprogramming solutions like e.g. Deluge or MOAP. Therefore, currently available symmetric key based secure code update schemes are not per se suited to support advanced coding techniques such as Fountain Codes. In this work, we provide means to secure this promising technique mainly with efficient symmetric cryptographic primitives and demonstrate its applicability for efficient and robust over the air reprogramming.

This work introduces FAIR, a novel framework for Fuzzy-based Aggregation providing In-network Resilience for Wireless Sensor Networks (WSN). FAIR addresses the possibility of malicious aggregator nodes manipulating data. It provides data-integrity based on a trust level of the WSN response and it tolerates link or node failures. Compared to available solutions, it offers a general aggregation model and makes the trust level visible to the querier. We classify the proposed approach as complementary to protocols ensuring resilience against sensor leaf nodes providing faulty data. Thanks to our flexible resilient framework and due to the use of Fuzzy Inference Schemes, we achieve promising results within a short design cycle.

Several mechanisms have been proposed to efficiently authenticate multicast of finite data streams as needed for code image updates in wireless sensor networks (WSNs). They involve either a public-key digital signature or loose time synchronization between the sender and the receivers. What usually does not get any attention is the program memory (ROM) occupied by these mechanisms which do not fulfill the primary task of a sensor network.An optimized implementation of the elliptic curve digital signature scheme occupies up to 25% of the ROM of a TelosB node; the same or even more is needed for time synchronization schemes. Therefore, if sensor networks do not need public-key operations or time synchronization for their primary task, these SCU mechanism are not suitable for coexistence with the application code on the sensor nodes. This work contributes in two directions. Firstly, we propose a stateful-verifier T-time signature scheme based on Merkle's one-time signature. Secondly, we propose a protocol exploiting our signature scheme for securing existing code image update protocols for WSNs minimizing ROM overhead to 1% on TelosB motes.

We propose a secure and resilient WSN roadside architecture for intelligent transport systems which supports the two complementary services accident prevention and post-accident investigation. Our WSN security architecture is stimulated by the understanding that WSN roadside islands will only be rolled-out and used when hardware costs are close to the minimum. We provide a purely software based security solution which does not rely on costly HW components like road side units (RSU) or tamper resistant modules on sensor nodes. We use existing components, but also describe protocols that may be of independent interest.

In-network data aggregation is a popular technique for reducing the energy consumption tied to data transmission in a multi-hop wireless sensor network. However, data aggregation in untrusted or even hostile environments becomes problematic when end-to-end privacy between sensors and the sink is desired. In this paper we revisit and investigate the applicability of additively homomorphic public-key encryption algorithms for certain classes of wireless sensor networks. Finally, we provide recommendations for selecting the most suitable public key schemes for different topologies and wireless sensor network scenarios.

Routing in wireless sensor networks is different from that in commonsense mobile ad-hoc networks. It mainly needs to support reverse multicast traffic to one particular destination in a multihop manner. For such a communication pattern, end-to-end encryption is a challenging problem. To save the overall energy resources of the network, sensed data needs to be consolidated and aggregated on its way to the final destination. We present an approach that 1) conceals sensed data end-to-end by 2) still providing efficient and flexible in-network data aggregation. The aggregating intermediate nodes are not required to operate on the sensed plaintext data. We apply a particular class of encryption transformations and discuss techniques for computing the aggregation functions "average" and "movement detection." We show that the approach is feasible for the class of "going down" routing protocols. We consider the risk of corrupted sensor nodes by proposing a key predistribution algorithm that limits an attacker's gain and show how key predistribution and a key-ID sensitive "going down" routing protocol help increase the robustness and reliability of the connected backbone

End-to-end encryption for wireless sensor networks is a challenging problem. To save the overall energy resources of the network, it is agreed that sensed data need to be consolidated and aggregated on their way to the final destination. We present an approach that (1) conceals sensed data end-to-end, by (2) still providing efficient in-network data aggregation. The aggregating intermediate nodes are not required to operate on the sensed plaintext data. We apply a particular class of encryption transformation and exemplarily discuss the approach on the basis of two aggregation functions. We use actual implementation to show that the approach is feasible and flexible and frequently even more energy efficient than hop-by-hop encryption.

End-to-end encryption schemes that support operations over ciphertext are of utmost importance for commercial private party wireless sensor network implementations to become meaningful and profitable. For wireless sensor networks, we demonstrated in our previous work that privacy homomorphisms, when used for this purpose, offer two striking advantages apart from end-to-end concealment of data and ability to operate on ciphertexts: flexibility by keyless aggregation and conservation and balancing of aggregator backbone energy. We offered proof of concept by applying a certain privacy homomorphism for sensor network applications that rely on the addition operation. But a large class of aggregator functions like median computation or finding maximum/minimum rely exclusively on comparison operations. Unfortunately, as shown by Rivest, et al., any privacy homomorphism is insecure even against ciphertext that only attacks if they support comparison operations. In this paper we show that a particular order preserving encryption scheme achieves the above mentioned energy benefits and flexibility when used to support comparison operations over encrypted texts for wireless sensor networks, while also managing to hide the plaintext distribution and being secure against ciphertext only attacks. The scheme is shown to have reasonable memory and computation overhead when applied for wireless sensor networks.

There can be several sophisticated attacks motivated by selfish, resource saving nature of nodes in a civilian co-operation based ad-hoc network. Distributed rating model based castigation can be useful to discourage selfish nodes from performing these attacks. Even if an attacker is detected, it is hard to charge an accused node in a dynamic environment of adhoc network In this paper we detect a large range of attacks on Dynamic Source Routing (DSR) protocol and the originator of the attack We provide mechanism to inform other nodes of the system about the accused, provide a context aware inference scheme to blame the accused and malicious accuser without doubt. We achieve this with minimal extension of DSR and in a cost effective manner.

In the world of mobile agents, security aspects are being discussed extensively, with strong emphasis on how agents can be protected against malicious hosts and vice versa. While in recent years many research groups presented solutions offering protection schemes for hosts that receive and run un-trusted, possibly malicious agents, in the field of protecting the agent against malicious hosts, development seems to grow very slowly. This paper discusses a protocol for detecting modifications at the agent's binary code that, for a particular class of modifications, undoubtedly unmasks the attacking host. Furthermore, it is shown that in co-operation with a special kind of route protection in a lot of scenarios the protocol resists attacks from coaliting malicious hosts as well as from a single malicious host.