Title: Computing with private data: Data Processing in the Encrypted Domain
Time: 14:30
Location: Meeting Room B, Building Zeta
Type: Research talk
Speaker: Riccardo Lazzeretti
Abstract:
Processing and encryption of content are generally considered sequential and independent operations. In certain multimedia content processing scenarios, it is, however, desirable to carry out processing directly on encrypted data to preserve the privacy of the data owners. The field of secure signal processing poses significant challenges for both signal processing and cryptography research, and only few ready-to-go fully integrated solutions are available. This talk first concisely summarizes some of the cryptographic primitives used in existing solutions to processing of encrypted signals, and discusses implications of the security requirements on these solutions. The talk then focuses on some application domains in which secure data processing has been taken up as a challenge, namely, analysis of biomedical data, remote biometric recognition and privacy-preserving IoT device coordination. Finally, the talk discusses the challenges and open issues in the field of secure data processing and other research directions recently explored at University of Padua and Sapienza University of Rome.
Short bio:
Riccardo Lazzeretti got the MSc degree (Laurea) in Computer Science Engineering and the Europeaus Ph.D. at the Information Engineering Department of the University of Siena, and during Ph.D. he spent six months in Philips Lab at Eindhoven, The Netherland. He has been a psot-doc researcher at University of Siena until 2015. From 2016 to February 2017 he has been post-doc researcher at the University of Padua, Italy, Department of Mathematics, where he was part of the SPRITZ research group. Riccardo Lazzeretti is currently assistant professor (RTD-A) at Sapienza University of Rome, Italy. He is member of CINI’s Cybersecurity National Laboratory and the Research Center of Cyber Intelligence and Information Security (CIS). His research activities span on the security field, with particular focus on privacy preserving applications based on Homomorphic Encryption and Secure Multi-Party Computation. He is associate editor of Elsevier Journal of Information Security and Applications, regularly serves in the technical program committees of conferences in the field of security. He has been deeply involved in the activities of EU and Italian funded projects in the area of security and privacy.
Tag Archives: Security and Privacy
CISPA – Meeting 10/10/2017, 10:30
CISPA SEMINARS
When: Tuesday 10 October, at 10:30 in the morning
Where: Università Ca’ Foscari, Via Torino, 155 – 30170 Venezia Mestre Sala Conferenze del campus scientifico
First seminar:
Speaker: Dr. Giancarlo Pellegrino, Research Group Leader at CISPA
Title: Automated Vulnerability Analysis for Modern Application Software
Abstract:The complexity and pervasiveness of application software are growing rapidly. Nowadays, application software encompasses multiple devices, e.g., mobile and IoT, and web services to perform operations ranging from online shopping and managing household appliances to controlling manufacturing processes. Like any other programs, application software has vulnerabilities that, when exploited, can be used for financial fraud, stealing confidential data, and industrial espionage. Unfortunately, existing automated vulnerability analysis techniques are inadequate to tackle the complexity reached by these programs, thus leaving them exposed to attackers. My main research topic intends to stop this emerging trend and lay the foundation for the next-generation automated vulnerability analysis techniques. This talk focuses on the detection power and attack surface coverage challenges and presents two recent advances in the field. The first part of the talk presents Deemon, a tool that combines dynamic analysis and property graphs to mine Cross-Site Request Forgery, a long-neglected severe vulnerability. The second part of the talk presents jAEk, a new generation web application crawler that uses JavaScript dynamic analysis to increase the covered attack surface of web applications by 80%.
Short bio: Giancarlo Pellegrino is currently a research group leader at CISPA. His main research interests include all aspects of application security especially web security and automated vulnerability analysis. He has been selected for the CISPA-Stanford Center for Cybersecurity, and he will be soon appointed to a visiting assistant professor at Stanford University. Prior to that, Giancarlo was a postdoctoral researcher at CISPA and TU Darmstadt, Germany. During his doctoral stud- ies, Giancarlo was a member of the S3 group at EURECOM, in France, under the supervision of Prof. Davide Balzarotti. Until August 2013, he was a researcher associate in the “Security and Trust” research group at SAP SE.
Contact: gpellegrino@cispa.saarland
Second seminar:
Speaker: Sandra Strohbach, Dr. Giancarlo Pellegrino
Title: CISPA – One of Europe’s leading research sites of IT security
Abstract: The public presentation offers an overview of the Center for IT security, Privacy, and Accountability – CISPA located on the Saarland Informatics Campus in Saarbrücken, Germany. Founded in 2011, CISPA has become an important address of IT security and privacy.
You can learn more about the different research areas, excellent education programmes, and career opportunities. The examples of current research projects provide an insight into our daily work.
Short bio: After her studies in translation science, Sandra Strohbach did her PhD in applied linguistics at Saarland University. At the same time, she worked as research assistant and lecturer in the department of Romanic languages. Since 2010, Sandra Strohbach has worked in the field of science management. She is an expert in the field of funding programmes and international cooperation as well as strategic development. She joined CISPA in 2017 and coordinates na- tional and international projects, among them the CISPA-Stanford Center for Cybersecurity.
Contact: strohbach@cispa.saarland
CISPA MEETING
One of Europe’s leading research sites for IT security
When: Tuesday 10 October, at 12.30 in the afternoon
Where: Università Ca’ Foscari, Via Torino, 155 – 30170 Venezia Mestre Sala Conferenze del campus scientifico
What to expect:
- Insight into the CISPA goals
- High Level Study courses and exchange programmes
- Excellent Research environment
- Various job opportunities for qualified individuals
30/11/2016 – Talk by Moreno Ambrosin (University of Padova)
Title: Secure and Scalable Services for the Internet of Things, and Past and Ongoing Effort in the Security of Software-Defined Networking
Time: 13:00
Location: Meeting room, Building Zeta
Type: Research Result
Speaker: Moreno Ambrosin
Abstract:
In recent years, the advent of Internet of Things (IoT) is populating the world with billions of low cost heterogeneous interconnected devices. IoT devices are quickly penetrating in many aspects of our daily lives, and enabling new innovative services, ranging from fitness tracking, to factory automation. Unfortunately, their wide use, as well as their low-cost nature, make IoT devices also an attractive target for attackers, which may exploit them to perform DoS attacks, or violate the privacy of end users. Furthermore, the potentially very large scale of IoT systems makes the use of existing security solutions unfeasible.
In this talk I will give an overview of our research effort in defining secure and scalable protocols and mechanisms for IoT services, and in particular for: (1) efficient and secure device management at large scale (commands and software distribution, and device sanity check); and (2) privacy-preservation in three representative IoT-enabled services and tasks: location-based services, advanced metering infrastructures, and decentralized consensus in a multi-agent systems. Finally, in the last part of this talk I will briefly introduce past, and ongoing research work of our group in Software-Defined Networking security.
28/10/2016 – Talk by Matteo Maffei
Title: Security and Privacy for Cloud Storage
Time: 13:00
Location: Meeting room
Type: Research Result
Speaker: Matteo Maffei (Saarland University)
Abstract: Cloud storage has rapidly become a cornerstone of many IT infrastructures, constituting a seamless solution for the backup, synchronization, and sharing of large amounts of data. Putting user data in the direct control of cloud service providers, however, raises security and privacy concerns related to the integrity of outsourced data, the accidental or intentional leakage of sensitive information, the profiling of user activities and so on. Furthermore, even if the cloud provider is trusted, users having access to outsourced files might be malicious and misbehave. These concerns are particularly serious in sensitive applications like personal health records and credit score systems.
To tackle this problem, we present GORAM, a cryptographic system that protects the secrecy and integrity of outsourced data with respect to both an untrusted server and malicious clients, guarantees the anonymity and unlinkability of accesses to such data, and allows the data owner to share outsourced data with other clients, selectively granting them read and write permissions. GORAM is the first system to achieve such a wide range of security and privacy properties for outsourced storage. In the process of designing an efficient construction, we developed two new, generally applicable cryptographic schemes, namely, batched zero-knowledge proofs of shuffle and an accountability technique based on chameleon signatures, which we consider of independent interest. We implemented GORAM in Amazon Elastic Compute Cloud (EC2) and ran a performance evaluation demonstrating the scalability and efficiency of our construction.
27/07/2016 – Talk by Marco Squarcina
Title: Relation on ongoing PhD program
Time: 14:00
Location: Acadia Lab
Type: Research Result
Speaker: Marco Squarcina
Abstract:
The aim of this talk is to briefly report on my ongoing research activities. After presenting the accepted and in-progress papers, I will focus on the results achieved during the internship at Cryptosense in Paris where I carried out the analysis of several Java keystores (storage facilities for cryptographic keys and certificates) exposing
design and implementation weaknesses. I am currently investigating on the cracking-resistance of the keystores against brute force attacks and I plan to support my findings by implementing password cracking plugins for popular tools such as jtr or hashcat.
04/11/2015 – Talk by Enrico Steffinlongo
Title: Static Detection of Collusion Attacks in ARBAC-based Workflow Systems
Time: 13:00
Location: Meeting Room, building Zeta
Type: Research result
Speaker: Enrico Steffinlongo
Abstract: Authorization in workflow systems is usually built on top of role-based access control (RBAC); security policies on workflows are then expressed as constraints on the users performing a set of tasks and the roles assigned to them. When the user-to-role assignment can be changed by potentially untrusted users, like in the case of Administrative RBAC (ARBAC), collusions may take place to circumvent the intended security policies. In this paper, we study this problem in a formal model of workflows based on event structures and we define a precise notion of security against collusion. We then propose a static analysis technique based on a reduction to a role reachability problem for ARBAC, which can be used to prove or disprove security for restricted – yet useful – classes of workflow systems. Finally, we implement our analysis in a tool, WARBAC, and we experimentally show its effectiveness on a set of publicly available examples.
01/04/2014 – Talk by M. Squarcina and M. Tempesta
Title: Surviving the Web: A Journey into Web Session Security
Time: 14:00
Location: Meeting Room, building Zeta
Type: Survey of literature
Speaker: Marco Squarcina and Mauro Tempesta
Abstract: In this talk we describe and classify web security properties, attacks and security solutions. We focus on client-side attacks against web sessions, i.e., attacks that target honest user clients establishing a session with a remote web server. We identify general security properties representative of web session security and we highlight the properties violated by the different attacks. We then survey existing security solutions and mechanisms that prevent or mitigate the attacks: for each security solution, we also evaluate the impact on usability, the compatibility with existing web sites and the ease of deployment. Finally, we identify a list of sound principles that, to some extents, have been taken into account by the designers of the surveyed solutions. We believe that these principles could be helpful for the development of innovative solutions approaching web security in a more systematic and comprehensive way.
04/02/2015 – Talk by Wilayat Khan
Title: Web Session Security: Formal Verification, Client-Side Enforcement and Experimental Analysis
Time: 13:00
Location: Meeting room
Type: Research Result
Speaker: Wilayat Khan
Abstract:
Web applications are the dominant means to provide access to millions of on-line services and applications such as banking and e-commerce. To personalize users’ web experience, servers need to authenticate the users and then maintain their authentication state throughout a set of related HTTP requests and responses called a web session. As HTTP is a stateless protocol, the common approach, used by most of the web applications to maintain web session, is to use HTTP cookies. Each request belonging to a web session is authenticated by having the web browser to provide to the server a unique long random string, known as session identifier stored as cookie called session cookie. Taking over the session identifier gives full control over to the attacker and hence is an attractive target of the attacker to attack on the confidentiality and integrity of web sessions. The browser should take care of the web session security: a session cookie belonging to one source should not be corrupted or stolen or forced, to be sent with the requests, by any other source.
This research demonstrates that security policies can in fact be written down for both, confidentiality and integrity, of web sessions and enforced at the client side without getting any support from the servers and without breaking too many web applications. Moreover, the enforcement mechanisms designed can be proved correct within mathematical models of the web browsers. These claims are supported by
1) defining both, end-to-end and access control, security policies to protect web sessions;
2) introducing a new and using exiting mathematical models of the web browser extended with confidentiality and integrity security policies for web sessions;
3) offering mathematical proofs that the security mechanisms do enforce the security policies; and
4) designing and developing prototype browser extensions to test that real-life web applications are supported.
19/03/2014 – Talk by Andriana E. Gkaniatsou
Title: Towards the automated analysis of low-level cryptographic protocols
Time: 13:00
Location: Meeting room
Type: Research Result
Speaker: Andriana E. Gkaniatsou (U. of Edinburgh)
Abstract:
In this talk we discuss the problem of the automated analysis of reversed engineered low-level cryptographic protocols. Such analysis is difficult, as most of such protocol implementations are proprietary and confidential.
Our proposal is to consider the analysis as an inference problem and use knowledge repair techniques to fix possible mismatches. We discuss our thoughts towards this problem, and some working examples based on real card implementations.
24/01/2014 – Talk by Mauro Conti
Title: Future Internet Security and Privacy (challenges)
Time: 14:00
Location: Meeting room
Type: Research Result
Speaker: Mauro conti
Abstract:
The Internet is an amazing success story, connecting hundreds of millions of users. However, in the last decade, there has been a growing realization that the current Internet Protocol is reaching the limits of its senescence. In fact, the way people access and utilize it has changed radically since the 1970-s when its architecture was conceived.
This has prompted several research efforts that aim to design potential next-generation Internet architectures. In particular, Content-Centric Networking (CCN) is an emerging networking paradigm being considered as a possible replacement for the current IP-based host-centric Internet infrastructure. CCN focuses on content distribution, which is arguably not well served by IP. Named-Data Networking (NDN) is an example of CCN.
NDN is also an active research project under the NSF Future Internet Architectures (FIA) program. FIA emphasizes security and privacy from the outset and by design. To be a viable Internet architecture, NDN must be resilient against current and emerging threats.
In this talk, we highlight the main security and privacy issues we identified in NDN. Then, as a representative case, we discuss interest flooding, a possible denial-of-service attack that exploits key architectural features of NDN. We show that an adversary with limited resources can implement such attack, having a significant impact on network performance. We then introduce Poseidon: a framework for detecting and mitigating interest flooding attacks. Finally, we report on results of extensive simulations assessing proposed countermeasure.
