iNetSec 2009 – Open Research Problems in Network Security: IFIP WG 11.4 International Workshop, Zurich, Switzerland, April 23-24, 2009, Revised Selected Papers

177 Pages·2009·3.46 MB·English

by  Raphael C. -W. Phan

IFIP Advances in Information
and Communication Technology 309
Editor-in-Chief
A.JoeTurner,Seneca,SC,USA
EditorialBoard
FoundationsofComputerScience
MikeHinchey,Lero,Limerick,Ireland
Software:TheoryandPractice
BertrandMeyer,ETHZurich,Switzerland
Education
BernardCornu,CNED-EIFAD,Poitiers,France
InformationTechnologyApplications
RonaldWaxman,EDAStandardsConsulting,Beachwood,OH,USA
CommunicationSystems
GuyLeduc,UniversitédeLiège,Belgium
SystemModelingandOptimization
JacquesHenry,UniversitédeBordeaux,France
InformationSystems
BarbaraPernici,PolitecnicodiMilano,Italy
RelationshipbetweenComputersandSociety
ChrisanthiAvgerou,LondonSchoolofEconomics,UK
ComputerSystemsTechnology
PaoloPrinetto,PolitecnicodiTorino,Italy
SecurityandPrivacyProtectioninInformationProcessingSystems
KaiRannenberg,GoetheUniversityFrankfurt,Germany
ArtificialIntelligence
MaxA.Bramer,UniversityofPortsmouth,UK
Human-ComputerInteraction
AnneliseMarkPejtersen,CenterofCognitiveSystemsEngineering,Denmark
EntertainmentComputing
RyoheiNakatsu,NationalUniversityofSingapore
IFIP–TheInternationalFederationforInformationProcessing
IFIPwasfoundedin1960undertheauspicesofUNESCO,followingtheFirst
WorldComputerCongressheldinParisthepreviousyear.Anumbrellaorgani-
zation for societies working in information processing, IFIP’s aim is two-fold:
tosupportinformationprocessingwithinitsmembercountriesandtoencourage
technologytransfertodevelopingnations.Asitsmissionstatementclearlystates,
IFIP’s mission is to be the leading, truly international, apolitical
organizationwhichencouragesandassistsinthedevelopment,ex-
ploitationandapplicationofinformationtechnologyforthebenefit
ofallpeople.
IFIPisanon-profitmakingorganization,runalmostsolelyby2500volunteers.It
operatesthroughanumberoftechnicalcommittees,whichorganizeeventsand
publications.IFIP’seventsrangefromaninternationalcongresstolocalseminars,
butthemostimportantare:
• TheIFIPWorldComputerCongress,heldeverysecondyear;
• Openconferences;
• Workingconferences.
TheflagshipeventistheIFIPWorldComputerCongress,atwhichbothinvited
andcontributedpapersarepresented.Contributedpapersarerigorouslyrefereed
andtherejectionrateishigh.
As with the Congress, participation in the open conferences is open to all and
papersmaybeinvitedorsubmitted.Again,submittedpapersarestringentlyref-
ereed.
The working conferences are structured differently. They are usually run by a
workinggroupandattendanceissmallandbyinvitationonly.Theirpurposeis
tocreateanatmosphereconducivetoinnovationanddevelopment.Refereeingis
lessrigorousandpapersaresubjectedtoextensivegroupdiscussion.
Publications arising from IFIP events vary. The papers presented at the IFIP
WorldComputerCongressandatopenconferencesarepublishedasconference
proceedings,whiletheresultsoftheworkingconferencesareoftenpublishedas
collectionsofselectedandeditedpapers.
Anynationalsocietywhoseprimaryactivityisininformationmayapplytobe-
comeafullmemberofIFIP,althoughfullmembershipisrestrictedtoonesociety
percountry.FullmembersareentitledtovoteattheannualGeneralAssembly,
Nationalsocietiespreferringalesscommittedinvolvementmayapplyforasso-
ciateorcorrespondingmembership.Associatemembersenjoythesamebenefits
asfullmembers,butwithoutvotingrights.Correspondingmembersarenotrep-
resentedinIFIPbodies.Affiliatedmembershipisopentonon-nationalsocieties,
andindividualandhonorarymembershipschemesarealsooffered.
Jan Camenisch Dogan Kesdogan (Eds.)
iNetSec 2009 –
Open Research Problems
in Network Security
IFIP WG 11.4 International Workshop
Zurich, Switzerland,April 23-24, 2009
Revised Selected Papers
1 3
VolumeEditors
JanCamenisch
IBMResearch-Zurich
Säumerstr.4,8803Rüschlikon,Switzerland
E-mail:[email protected]
DoganKesdogan
UniversitätSiegen,InstitutfürWirtschaftsinformatik
Hölderlinstr.3,57068Siegen,Germany
E-mail:[email protected]
LibraryofCongressControlNumber:2009937722
CRSubjectClassification(1998):K.6.5,K.4,C.2,E.3,D.4.6
ISSN 1868-4238
ISBN-10 3-642-05436-6SpringerBerlinHeidelbergNewYork
ISBN-13 978-3-642-05436-5SpringerBerlinHeidelbergNewYork
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violationsareliable
toprosecutionundertheGermanCopyrightLaw.
springer.com
©IFIPInternationalFederationforInformationProcessing2009
PrintedinGermany
Typesetting:Camera-readybyauthor,dataconversionbyScientificPublishingServices,Chennai,India
Printedonacid-freepaper SPIN:12780877 06/3180 543210
Preface
The working group WG 11.4 of IFIP ran an iNetSec conference a few times
in the past, sometimes together with IFIP security conference, sometimes as a
stand-alone workshop with a programselected from peer-reviewed submissions.
WhenwewereelectedtochairWG11.4weaskedourselveswhetherthesecurity
and also the computer science community at large benefits from this workshop.
Inparticular,astherearemany(toomany?)securityconferences,ithasbecome
difficult to keep up with the field. After having talked to many colleagues, far
toomanytolistallofthemhere,wedecidedtotryadifferentkindofworkshop:
one where people would attend to discuss open research topics in our field, as
typically only happens during the coffee breaks of ordinary conferences.
Toenablethiswecalledforabstractsof2pageswheretheauthorsoutlinethe
openproblems thatthey wouldlike to discuss atthe workshop,the intent being
that the author would be given 15 minutes to present the topic and another 15
minutes for discussion. These abstracts were then read by all members of the
Program Committee and ranked by them according to whether they thought
this would lead to an interesting talk and discussion. We then simply selected
the abstracts that got the best rankings.
We were happy to see this result in many really interesting talks and discus-
sionsinthecourseoftheworkshop.Ofcourse,theselivelyanddirectdiscussions
arealmostimpossible to achieveina printedtext. Still,we askedthe authorsto
distill the essence of these discussions into full papers. The results are in your
hands.
The participants’ feedback to the workshop was very positive, and conse-
quentlythenextiNetSecworkshopwillbeheldinMarch2010inSofia,Bulgaria.
We thank Helga Steimann and Hanni Ru¨esch for the excellent local organi-
zation and IBM Research – Zurich for hosting the conference. We are grateful
to Franz-StefanPreiss for compiling these proceedings and running after allthe
files needed for this.
August 2009 Jan Camenisch
Dogan Kesdogan
iNetSec 2009
Open Research Problems in Network Security
IBM Research, Zurich, Switzerland
April 23–24,2009
Organized in cooperation with IFIP WG 11.4
Program and General Chair
Jan Camenisch IBM Research
Dogan Kesdogan University of Siegen
Program Committee
David Basin ETH Zurich
Jan Camenisch IBM Research
George Danezis Microsoft Research
Stefan Fischer University Lu¨beck
Simone Fischer-Hu¨bner Karlstad University
Felix Freiling Universita¨t Mannheim
Virgil Gligor Carnegie Mellon Univsersity
Jean-Pierre Hubaux EPF Lausanne
Dogan Kesdogan University of Siegen
Albert Levi Sabanci University
Javier Lopez University of Malaga
Refik Molva Eurecom
Victor Shoup New York University
Gene Tsudik UC Irvine
External Reviewers
Claudia Becker Daniela Kru¨ger Axel Wegener
Carsten Buschmann Dennis Pfisterer Berrin Yanikoglu
Maick Danckwardt Stefan Ransom Maick Danckwardt
Nils Glombitza Peter Rothenpieler
Table of Contents
Involving Humans
On the Design of Forgiving Biometric Security Systems ............... 1
Raphael C.-W. Phan, John N. Whitley, and David J. Parish
Remotely Telling Humans and Computers Apart: An Unsolved
Problem ........................................................ 9
Carlos Javier Hernandez-Castro and Arturo Ribagorda
Web 2.0
Leveraging Social Links for Trust and Privacy in Networks ............ 27
Leucio Antonio Cutillo, Refik Molva, and Thorsten Strufe
Open Problems in Web 2.0 User Content Sharing .................... 37
San-Tsai Sun and Konstantin Beznosov
Protecting Resources
Mitigating Drive-By Download Attacks: Challenges and Open
Problems ....................................................... 52
Manuel Egele, Engin Kirda, and Christopher Kruegel
Context-Dependent Authentication and Access Control ............... 63
Michael Kirkpatrick and Elisa Bertino
Pervasive Devices
New Directions in RFID Security .................................. 76
Erik-Oliver Blass and Refik Molva
Tailored Security and Safety for Pervasive Computing ................ 85
Erik-Oliver Blass and Martina Zitterbart
Protocol Security
Rational Protocols ............................................... 93
Christian Cachin
Security Issues for P2P-Based Voice- and Video-Streaming
Applications..................................................... 95
Jan Seedorf
VIII Table of Contents
Threshold Things That Think: Authorisation for Resharing ........... 111
Roel Peeters, Markulf Kohlweiss, and Bart Preneel
Privacy
Privacy Policies, Tools and Mechanisms of the Future ................ 125
Vincent Naessens, Mehmet Tahir Sandikkaya, Jorn Lapon,
Kristof Verslype, Pieter Verhaeghe, Girma Nigusse, and
Bart De Decker
Security and Privacy Preservationin Human-Involved Networks........ 139
Craig Asher, Jean-Philippe Aumasson, and Raphael C.-W. Phan
Discussing Anonymity Metrics for Mix Based Anonymity Approaches... 149
Dang Vinh Pham and Joss Wright
Author Index.................................................. 169
On the Design of Forgiving Biometric Security
Systems
Raphael C.-W. Phan, John N. Whitley, and David J. Parish
High Speed Networks Research Group(cid:2),
Departmentof Electronic and Electrical Engineering,
Loughborough University,
LE11 3TU, UK
{R.Phan,J.N.Whitley,D.J.Parish}@lboro.ac.uk
Abstract. Thisworkaimstohighlightthefundamentalissuesurround-
ing biometric security systems: it’s all very nice until a biometric is
forged,butwhatdowedoafterthat?Granted,biometricsystemsareby
physicalnaturesupposedlymuchhardertoforgethanotherfactorsofau-
thenticationsincebiometricsonahumanbodyarebyrightuniquetothe
particular human person. Yet it is also due to this physical nature that
makes it much more catastrophic when a forgery does occur, because it
impliesthatthisuniquenesshasbeenforgedaswell,threateningthehu-
manindividuality;andsincecrimehasbyconventionreliedonidentifying
suspects by biometric characteristics, loss of this biometric uniqueness
has devastatingconsequences on thefreedom and basic humanrights of
thevictimizedindividual.Thisuniquenessforgeryimplicationalsoraises
themotivation on theadversary toforge since asuccessful forgery leads
tomuchmoreimpersonationsituationswhenbiometricsystemsareused
i.e.physicalpresenceatcrimescenes,identificationandaccesstosecurity
systemsand premises, access tofinancialaccountsandhencetheability
tousethevictim’s finances.Dependingon thegains, adesperate highly
motivated adversary may even resort to directly obtaining the victim’s
biometric parts by force e.g. severing the parts from the victim’s body;
thisposesariskandthreatnotjusttotheindividual’suniquenessclaim
but also to personal safety and well being. One may then wonder if it
is worth puttingone’s assets, property and safety intothehandsof bio-
metrics based systems when the consequences of biometric forgery far
outweigh the consequences of system compromises when no biometrics
are used.
1 The Case
The aim of this work is to put forth the case of explicitly designing biometric
security systems with a forgiving feature; i.e. to be forge-resilient. To be more
precise, we feel that biometric systems need to be able to recover from the in-
cident that the underlying biometric characteristic type (e.g. fingerprint, face)
(cid:2) Part of this work doneover coffee.
J.CamenischandD.Kesdogan(Eds.):iNetSec2009,IFIPAICT309,pp.1–8,2009.
(cid:2)c IFIPInternationalFederationforInformationProcessing2009
2 R.C.-W. Phan, J.N. Whitley,and D.J. Parish
becomes forgeable; or “cloneable” in biometric speak. Current biometric sys-
temsaredesignedwithoutresiliencetotheseincidents,i.e.securitybreaksdown
entirely when a characteristic becomes forgeable, with no option for incident
recovery.
While compromise-resilient systems exist in cryptographic literature, e.g.
intrusion-resilience[13,10],key-insulation[11],leakage-resilience[21],keycompro-
mise-resilience,forwardsecurity[6,7],orevenfault-tolerance,webelieveitmakes
senseevenmoresointhecontextofbiometricsystemstoconsiderthisresilience
issue. The reason is this. It is common knowledge that biometrics while similar
to more conventionalauthenticationfactors like passwordsor chipcards,are ir-
replaceable andirrevocable.Thus,whenabiometriccharacteristicofalegitimate
partyfallsintothehandsofanadversaryintheforgeablesense,thelegitimateparty
permanentlylosesthe abilitytousethatcharacteristicinanybiometricsecurity
system that authenticates using that type of characteristic.One may suggestto
thenreplacetheunderlyingcharacteristictypewithanother,e.g.usinghandge-
ometryinsteadoffingerprints;yetthereisonlyafinitespaceofpossiblecharacter-
istictypesonahumanpersonthatcanbeused.Whatismore,anyevidenceofthe
forgedcharacteristicbeingfoundwouldnon-repudiablybindtothatparty.
2 Setting the Stage
2.1 Question Marks
Motivated by the case above, we feel therefore that one should treat forge-
resilience from two perspectives: forward security and convertibility. This leads
to the following questions.
Q1. ForwardSecurity:Istherestillanysecuritythatcanbesalvagedintheevent
that a characteristic type becomes forgeable with technology advances? If
so, how can this remnant security be quantified?
Q2. Convertibility: Can biometric systems be designed such that the irrevo-
cable feature is removed at the point when a characteristic type becomes
forgeable? This notion could be compared with that of convertible digital
signatures.
Thinking beyond forge-resilience towards a longer term goal of forge-resistance,
we pose the following question that would be interesting to solve.
Q3. Ageing:canwedesignbiometricsystemswithanageing feature?i.e.where
each subsequent sensing of a real (non-forged) biometric characteristic can
be shown to be a more recent one comparedto a previously sensed charac-
teristic. In some sense, though not exactly identical, this feature could be
compared to the notion of hash chains. Certainly, answering this question
wouldmakebiometricsystemsresilienttocharacteristicforgerysinceareal
one would then naturally post-date a forged one. In essence, an answer is
not impossible because even if a forged characteristic appears identical to
the real one, it is still an analog duplication (rather than digital) since it