SciTePress - Affiliation Profile

Research.Publish.Connect.

Title:
ISBN:
Year:
Acronym:
Subject:

Advanced Search Proceedings Search

If you're looking for an exact phrase use quotation marks on text fields.

Title:
Author:
Affiliation:
Subject:

Advanced Search Papers Search

If you're looking for an exact phrase use quotation marks on text fields.

Name:
Affiliation:
Country:
Conference:
Subject:

Advanced Search Authors Search

If you're looking for an exact phrase use quotation marks on text fields.

Name:
Country:
Subject:

Advanced Search Affiliations Search

If you're looking for an exact phrase use quotation marks on text fields.

Proceedings

Proceedings Search

Title:
ISBN:
Year:
Acronym:
Subject:

Advanced Search Proceedings Search

If you're looking for an exact phrase use quotation marks on text fields.

Papers

Papers Search

Title:
Author:
Affiliation:
Subject:

Advanced Search Papers Search

If you're looking for an exact phrase use quotation marks on text fields.

Authors

Authors Search

Name:
Affiliation:
Country:
Conference:
Subject:

Advanced Search Authors Search

If you're looking for an exact phrase use quotation marks on text fields.

Advanced Search

Affiliation

Select a Subject
Refine Ontology Subject

University of Luxembourg, Luxembourg

Context (please use complete words only)

Field

Sort by

9 Papers

Authentication and Key Management Automation in Decentralized Secure Email and Messaging via Low-entropy Secrets

Topics: Peer-To-Peer Security; Identification, Authentication and Non-Repudiation; Privacy; Applied Cryptography; Security Protocols

Authors: Itzel Vazquez Sandoval ¹ , Arash Atashpendar ² and Gabriele Lenzini ¹

Affiliations: ¹ SnT, University of Luxembourg, Luxembourg , ² SnT, University of Luxembourg, Luxembourg, itrust Consulting, Luxembourg

Digital Object Identifier: 10.5220/0009834001670179

Proceedings of SECRYPT 2020, ISBN: 978-989-758-446-6

Quick Abstract

We revisit the problem of entity authentication in decentralized end-to-end encrypted email and secure messaging to propose a practical and self-sustaining cryptographic solution based on password-authenticated key exchange (PAKE). This not only allows users to authenticate each other via shared low-entropy secrets, e.g., memorable words, without a public key infrastructure or a trusted third party, but it also paves the way for automation and a series of cryptographic enhancements; improves security by minimizing the impact of human error and potentially improves usability. First, we study a few vulnerabilities in voice-based out-of-band authentication, in particular a combinatorial attack against lazy users, which we analyze in the context of a secure email solution. Next, we propose solving the problem of secure equality test using PAKE to achieve entity authentication and to establish a shared high-entropy secret key. Our solution lends itself to offline settings, compatible with the inherently asynchronous nature of email and modern messaging systems. The suggested approach enables enhancements in key management such as automated key renewal and future key pair authentications, multi-device synchronization, secure secret storage and retrieval, and the possibility of post-quantum security as well as facilitating forward secrecy and deniability in a primarily symmetric-key setting. We also discuss the use of auditable PAKEs for mitigating a class of online guess and abort attacks in authentication protocols.

Dual-use Research in Ransomware Attacks: A Discussion on Ransomware Defence Intelligence

Topics: Malware Detection; Threat Awareness

Authors: Ziya Genç and Gabriele Lenzini

Affiliation: Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0009000505850592

Proceedings of ICISSP 2020, ISBN: 978-989-758-399-5

Quick Abstract

Previous research has shown that developers rely on public platforms and repositories to produce functional but insecure code. We looked into the matter for ransomware, enquiring whether also ransomware engineers re-use the work of others and produce insecure code. By methodically reverse-engineering 128 malware executables, we have found that, out of 21 ransomware samples, 9 contain copy-paste code from public resources. Thanks to this finding, we managed to retrieve the decryption keys with which to nullify the ransomware attacks. From this fact, we recall critical cases of code disclosure in the recent history of ransomware and, arguing that ransomware are components in cyber-weapons, reflect on the dual-use nature of this research. We further discuss benefits and limits of using cyber-intelligence and counter-intelligence strategies that could be used against this threat.

Accomplishing Transparency within the General Data Protection Regulation

Topics: Privacy Enhancing Technologies; Legal and Regulatory Issues; Security Awareness and Education; Privacy, Security and Trust in Social Media

Authors: Dayana Spagnuelo ¹ , Ana Ferreira ² and Gabriele Lenzini ¹

Affiliations: ¹ SnT - University of Luxembourg and Luxembourg , ² CINTESIS - University of Porto and Portugal

Digital Object Identifier: 10.5220/0007366501140125

Proceedings of ICISSP 2019, ISBN: 978-989-758-359-9

Quick Abstract

Transparency is a user-centric principle proposed to empower users to hold data processors accountable for the usage and the processing of the user’s personal data. Accomplishing transparency may come with some resistance because it requires significant architectural changes, but it is mandatory by law under the recently approved General Data Protection Regulation. To help the transition, we systematically review what Transparency Enhancing Technologies can help to accomplish transparency in agreement with technical requirements that we elicited from the Regulation’s articles. We discuss our findings in the domain of medical data systems, where accomplishing transparency looks particularly controversial due to sensitivity of the personal medical data.

Related Ontology Subjects/Areas/Topics (2)

Information and Systems Security

Privacy Enhancing Technologies

Towards a Lawful Authorized Access: A Preliminary GDPR-based Authorized Access

Topics: Requirements Engineering; Data-driven Software Engineering; Software and Systems Modeling; Software Development Lifecycle

Authors: Cesare Bartolini ¹ , Said Daoudagh ² , Gabriele Lenzini ¹ and Eda Marchetti ³

Affiliations: ¹ Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg and Luxembourg , ² Istituto di Scienza e Tecnologie dell’Informazione “A. Faedo”, CNR, via G. Moruzzi 1, 56124, Pisa, Italy, Computer Science Department, University of Pisa, Pisa and Italy , ³ Istituto di Scienza e Tecnologie dell’Informazione “A. Faedo”, CNR, via G. Moruzzi 1, 56124, Pisa and Italy

Digital Object Identifier: 10.5220/0007978703310338

Proceedings of ICSOFT 2019, ISBN: 978-989-758-379-7

Quick Abstract

The General Data Protection Regulation (GDPR)’s sixth principle, Integrity and Confidentiality, dictates that personal data must be protected from unauthorised or unlawful processing. To this aim, we propose a systematic approach for authoring access control policies that are by-design aligned with the provisions of the GDPR. We exemplify it by considering realistic use cases.

Related Ontology Subjects/Areas/Topics (5)

Artificial Intelligence		Knowledge-Based Systems		Symbolic Systems
Knowledge Management and Information Sharing		Requirements Engineering

A Security Analysis, and a Fix, of a Code-Corrupted Honeywords System

Topics: Security Frameworks, Architectures and Protocols; Security Architecture and Design Analysis; Authentication, Privacy and Security Models; Threat Awareness

Authors: Ziya Alper Genç , Gabriele Lenzini , Peter Y. A. Ryan and Itzel Vazquez Sandoval

Affiliation: University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0006609100830095

Proceedings of ICISSP 2018, ISBN: 978-989-758-282-0

Quick Abstract

In 2013 Juels and Rivest introduced the Honeywords System, a password-based authentication system designed to detect when a password file has been stolen. A Honeywords System stores passwords together with indistinguishable decoy words so when an intruder steals the file, retrieves the words, and tries to log-in, he does not know which one is the password. By guessing one from the decoy words, he may not be lucky and reveal the leak. Juels and Rivest left a problem open: how to make the system secure even when the intruder corrupted the login server’s code. In this paper we study and solve the problem. However, since “code corruption” is a powerful attack, we first define rigorously the threat and set a few assumptions under which the problem is still solvable, before showing meaningful attacks against the original Honeywords System. Then we elicit a fundamental security requirement, implementing which, we are able to restore the Honeywords System’s security despite a corrupted login service. We verify the new protocol’s security formally, using ProVerif for this task. We also implement the protocol and test its performance. Finally, at the light of our findings, we discuss whether it is still worth using a fixed honeywords-based system against such a powerful threat, or whether it is better, in order to be resilient against code corruption attacks, to design afresh a completely different password-based authentication solution.

From Situation Awareness to Action: An Information Security Management Toolkit for Socio-technical Security Retrospective and Prospective Analysis

Topics: Security Frameworks, Architectures and Protocols; Vulnerability Analysis and Countermeasures

Authors: Jean-Louis Huynen and Gabriele Lenzini

Affiliation: University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0006211302130224

Proceedings of ICISSP 2017, ISBN: 978-989-758-209-7

Quick Abstract

Inspired by the root cause analysis procedures common in safety, we propose a methodology for a prospective and a retrospective analysis of security and a tool that implements it. When applied prospectively, the methodology guides analysts to assess socio-technical vulnerabilities in a system, helping them to evaluate their choices in designing security policies and controls. But the methodology works also retrospectively. It assists analysts in retrieving the causes of an observed socio-technical attack, guiding them to understand where the information security management of the system has failed. The methodology is tuned to find causes that root in the human-related factors that an attacher can exploit to execute its intrusion.

Privacy-Preserving Verifiability - A Case for an Electronic Exam Protocol

Topics: Security Requirements; Security Verification and Validation; Formal Methods for Security; Security Protocols

Authors: Rosario Giustolisi ¹ , Vincenzo Iovino ² and Gabriele Lenzini ²

Affiliations: ¹ IT University of Copenhagen, Denmark , ² University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0006429101390150

Proceedings of SECRYPT 2017/ICETE, ISBN: 978-989-758-259-2

Quick Abstract

We introduce the notion of privacy-preserving verifiability for security protocols. It holds when a protocol admits a verifiability test that does not reveal, to the verifier that runs it, more pieces of information about the protocol’s execution than those required to run the test. Our definition of privacy-preserving verifiability is general and applies to cryptographic protocols as well as to human security protocols. In this paper we exemplify it in the domain of e-exams. We prove that the notion is meaningful by studying an existing exam protocol that is verifiable but whose verifiability tests are not privacy-preserving. We prove that the notion is applicable: we review the protocol using functional encryption so that it admits a verifiability test that preserves privacy according to our definition. We analyse, in ProVerif, that the verifiability holds despite malicious parties and that the new protocol maintains all the security properties of the original protocol, so proving that our privacy-preserving verifiability can be achieved starting from existing security.

Related Ontology Subjects/Areas/Topics (6)

Formal Methods for Security		Security in Information Systems		Security Requirements
Information and Systems Security		Security Protocols		Security Verification and Validation

Comparing and Integrating Break-the-Glass and Delegation in Role-based Access Control for Healthcare

Topic: Access Control

Authors: Ana Ferreira ¹ and Gabriele Lenzini ²

Affiliations: ¹ University of Porto, Portugal , ² University of Luxembourg, Luxembourg

Digital Object Identifier: 10.5220/0005683600630073

Proceedings of ICISSP 2016, ISBN: 978-989-758-167-0

Quick Abstract

In healthcare security, Role-based Access Control (RBAC) should be flexible and include capabilities such as Break-the-Glass and Delegation. The former is useful in emergencies to overcome otherwise a denial of access, the latter to transfer rights temporarily, for example, to substitute doctors. Current research studies these policies separately, but it is unclear whether they are different and independent capabilities. Motivated to look into this matter, we present a formal characterization of Break-the-Glass and Delegation in the RBAC model and we inquire on how these two policies relate. After giving arguments in favour of keeping them apart as different policies, we propose an RBAC model that includes them.

Related Ontology Subjects/Areas/Topics (6)

Access Control		Databases and Data Security		Internet Technology
Data Engineering		Information and Systems Security		Web Information Systems and Technologies

Formal Analysis of Electronic Exams

Topics: Security Requirements; Security Verification and Validation; Identification, Authentication and Non-Repudiation; Privacy; Formal Methods for Security; Security Protocols

Authors: Jannik Dreier ¹ , Rosario Giustolisi ² , Ali Kassem ³ , Pascal Lafourcade ⁴ , Gabriele Lenzini ² and Peter Y. A. Ryan ²

Affiliations: ¹ ETH Zurich, Switzerland , ² SnT/University of Luxembourg, Luxembourg , ³ Université Grenoble Alpes, France , ⁴ University d'Auvergne, France

Digital Object Identifier: 10.5220/0005050901010112

Proceedings of SECRYPT 2014/ICETE, ISBN: 978-989-758-045-1

Quick Abstract

Universities and other educational organizations are adopting computer and Internet-based assessment tools (herein called e-exams) to reach widespread audiences. While this makes examination tests more accessible, it exposes them to new threats. At present, there are very few strategies to check such systems for security, also there is a lack of formal security definitions in this domain. This paper fills this gap: in the formal framework of the applied pi-calculus, we define several fundamental authentication and privacy properties and establish the first theoretical framework for the security analysis of e-exam protocols. As proof of concept we analyze two of such protocols with ProVerif. The first “secure electronic exam system” proposed in the literature turns out to have several severe problems. The second protocol, called Remark!, is proved to satisfy all the security properties assuming access control on the bulletin board. We propose a simple protocol modification that removes the need of such assumption though guaranteeing all the security properties.

Related Ontology Subjects/Areas/Topics (9)

Data and Application Security and Privacy	Information and Systems Security	Security Protocols
Formal Methods for Security	Privacy	Security Requirements
Identification, Authentication and Non-Repudiation	Security in Information Systems	Security Verification and Validation