Computer Sciences Commons^™

Authentication Usability Methodology, Jean-Baptiste Subils

USF Tampa Graduate Theses and Dissertations

Nowadays many systems require end users to authenticate themselves. Authentication is one of the security activities that end users perform the most. Thus, the usability of this security feature plays a major role in the proper utilization and adoption of a novel authentication method.

This dissertation presents coauthentication, a novel authentication system. Many authentication methods and protocols exist, but passwords remain the predominant authentication method used. Coauthentication is presented here in detail in several possible variations and their associated protocols, with performance comparisons.

This dissertation also presents a framework to evaluate authentication methods in terms of usability.

A large body …

Proximity Detection With Single-Antenna Iot Devices, Timothy J. Pierson, Travis Peters, Ronald Peterson, David Kotz

Dartmouth Scholarship

Providing secure communications between wireless devices that encounter each other on an ad-hoc basis is a challenge that has not yet been fully addressed. In these cases, close physical proximity among devices that have never shared a secret key is sometimes used as a basis of trust; devices in close proximity are deemed trustworthy while more distant devices are viewed as potential adversaries. Because radio waves are invisible, however, a user may believe a wireless device is communicating with a nearby device when in fact the user’s device is communicating with a distant adversary. Researchers have previously proposed methods for …

Challenges In Large-Scale Machine Learning Systems: Security And Correctness, Emad Alsuwat

Theses and Dissertations

In this research, we address the impact of data integrity on machine learning algorithms. We study how an adversary could corrupt Bayesian network structure learning algorithms by inserting contaminated data items. We investigate the resilience of two commonly used Bayesian network structure learning algorithms, namely the PC and LCD algorithms, against data poisoning attacks that aim to corrupt the learned Bayesian network model.

Data poisoning attacks are one of the most important emerging security threats against machine learning systems. These attacks aim to corrupt machine learning models by con- taminating datasets in the training phase. The lack of resilience of …

Using Vibrations From A Smartring As An Out-Of-Band Channel For Sharing Secret Keys, Sougata Sen, Varun Mishra, David Kotz

Dartmouth Scholarship

With the rapid growth in the number of Internet of Things (IoT) devices with wireless communication capabilities, and sensitive information collection capabilities, it is becoming increasingly necessary to ensure that these devices communicate securely with only authorized devices. A major requirement of this secure communication is to ensure that both the devices share a secret, which can be used for secure pairing and encrypted communication. Manually imparting this secret to these devices becomes an unnecessary overhead, especially when the device interaction is transient. In this work, we empirically investigate the possibility of using an out-of-band communication channel – vibration, generated …

User Syndication Using Speech Rhythm, Faisal Z H Alnahhas

Computer Science and Engineering Theses - Archive

In recent years we have seen a variety of approaches to increase security on computers and mobile devices including fingerprint, and facial recognition. Such techniques while effective are very expensive. Voice biometrics, specifically speech rhythm, is a method that has been drawing attention and growing in recent years. Unlike other methods, it requires little to no additional hardware installed on a device for it to work accurately. Speech rhythm utilizes the device's built-in microphone, and analyzes speakers based on features of their speech. In this work we leverage the existing hardware and simply add an efficient layer of software to …

Closetalker: Secure, Short-Range Ad Hoc Wireless Communication, Timothy J. Pierson, Travis Peters, Ronald Peterson, David Kotz

Dartmouth Scholarship

Secure communication is difficult to arrange between devices that have not previously shared a secret. Previous solutions to the problem are susceptible to man-in-the-middle attacks, require additional hardware for out-of-band communication, or require an extensive public-key infrastructure. Furthermore, as the number of wireless devices explodes with the advent of the Internet of Things, it will be impractical to manually configure each device to communicate with its neighbors. Our system, CloseTalker, allows simple, secure, ad hoc communication between devices in close physical proximity, while jamming the signal so it is unintelligible to any receivers more than a few centimeters away. CloseTalker …

The Performance Cost Of Security, Lucy R. Bowen

Master's Theses

Historically, performance has been the most important feature when optimizing computer hardware. Modern processors are so highly optimized that every cycle of computation time matters. However, this practice of optimizing for performance at all costs has been called into question by new microarchitectural attacks, e.g. Meltdown and Spectre. Microarchitectural attacks exploit the effects of microarchitectural components or optimizations in order to leak data to an attacker. These attacks have caused processor manufacturers to introduce performance impacting mitigations in both software and silicon.

To investigate the performance impact of the various mitigations, a test suite of forty-seven different tests was created. …

Hacking The Extended Mind: The Security Implications Of The New Metaphysics, Robin L. Zebrowski

Computer Ethics - Philosophical Enquiry (CEPE) Proceedings

Computer security expert Paul Syverson has argued that there is a computer security equivalent of gaslighting: where a clever adversary could convince some system that some component that is not really a part of the system is in fact a part of the system. If non-biological items from our environments (or even pieces of our environments themselves) can be part of our minds (the standard Extended Mind hypothesis, EM), they are therefore part of our selves, and therefore subject to Syverson’s worry about boundary in a way that has not been explored before. If some version of EM holds, then …

Securing Our Future Homes: Smart Home Security Issues And Solutions, Nicholas Romano

Senior Honors Theses

The Internet of Things, commonly known as IoT, is a new technology transforming businesses, individuals’ daily lives and the operation of entire countries. With more and more devices becoming equipped with IoT technology, smart homes are becoming increasingly popular. The components that make up a smart home are at risk for different types of attacks; therefore, security engineers are developing solutions to current problems and are predicting future types of attacks. This paper will analyze IoT smart home components, explain current security risks, and suggest possible solutions. According to “What is a Smart Home” (n.d.), a smart home is a …

Gpu Acceleration Of Ciphertext-Policy Attribute-Based Encryption, Kai Fan

Student Theses and Dissertations

With the development of cloud computing, data security became popular in recent decades. The public key cryptography has its limitation for a considerable number of receivers, which need encrypt the plaintext several times which based on the receivers' number. Bethencourt. Et al., introduced Ciphertext-policy Attribute-based encryption (ABE) in 2007. CP-ABE became one of the hottest topics in the cryptography system. Because of the advantage of CP-ABE system, which is easy to use for remote storage or distributed data centers. Meanwhile, CP-ABE can provide fine-grain access control, which has the flexibility to send ciphertexts. However, it has such advantages, but the …

The Security Of Big Data In Fog-Enabled Iot Applications Including Blockchain: A Survey, Noshina Tariq, Muhammad Asim, Feras Al-Obeidat, Muhammad Zubair Farooqi, Thar Baker, Mohammad Hammoudeh, Ibrahim Ghafir

All Works

© 2019 by the authors. Licensee MDPI, Basel, Switzerland. The proliferation of inter-connected devices in critical industries, such as healthcare and power grid, is changing the perception of what constitutes critical infrastructure. The rising interconnectedness of new critical industries is driven by the growing demand for seamless access to information as the world becomes more mobile and connected and as the Internet of Things (IoT) grows. Critical industries are essential to the foundation of today’s society, and interruption of service in any of these sectors can reverberate through other sectors and even around the globe. In today’s hyper-connected world, the …

Scalable Containerized Security Training Environment, Robert Sauer

Mahurin Honors College Capstone Experience/Thesis Projects

The purpose of this project is to develop a portable application which is hosted on a server that provides an environment to safely conduct security training procedures and protocols. The project will be scalable to handle from a few to a multitude of users concurrently using a single server. For many users to perform security training simultaneously, each user must be directed to a sandbox environment, a container, where one user’s actions do not affect the website or database of other users. Furthermore, such an application should be readily deployable into any environment to provide the widest range of compatibility. …

Cyber Security- A New Secured Password Generation Algorithm With Graphical Authentication And Alphanumeric Passwords Along With Encryption, Akash Rao

Electrical & Computer Engineering Theses & Dissertations

Graphical passwords are always considered as an alternative of alphanumeric passwords for their better memorability and usability [1]. Alphanumeric passwords provide an adequate amount of satisfaction, but they do not offer better memorability compared to graphical passwords [1].

On the other hand, graphical passwords are considered less secured and provide better memorability [1]. Therefore many researchers have researched on graphical passwords to overcome the vulnerability. One of the most significant weaknesses of the graphical passwords is "Shoulder Surfing Attack," which means, sneaking into a victim's computer to learn the whole password or part of password or some confidential information. Such …

Feasibility And Security Analysis Of Wideband Ultrasonic Radio For Smart Home Applications, Qi Xia

School of Computing: Dissertations, Theses, and Student Research

Smart home Internet-of-Things (IoT) accompanied by smart home apps has witnessed tremendous growth in the past few years. Yet, the security and privacy of the smart home IoT devices and apps have raised serious concerns, as they are getting increasingly complicated each day, expected to store and exchange extremely sensitive personal data, always on and connected, and commonly exposed to any users in a sensitive environment. Nowadays wireless smart home IoT devices rely on electromagnetic wave-based radio-frequency (RF) technology to establish fast and reliable quality network connections. However, RF has its limitations that can negatively affect the smart home user …

The Ethics Of Cookies: Exploring The Collection Of Big Data And Its Ramifications, Sarah Biely 19

Honor Scholar Theses

Technology is taking over the world. In every aspect of human life, technology has been able to provide some sort of help or solution. At the forefront of this revolution is the Internet and with it, the activity of day-to-day life that now takes place online. This rapid takeover pushes technological innovations to develop quickly, pushing boundaries and creating a new way of life.

Today in the United States, websites are allowed to track user data. When a user clicks on a website that intends on documenting the user's actions, the website installs a tracker, otherwise known as "cookie." Websites …

After Https: Indicating Risk Instead Of Security, Matthew Wayne Holt

Theses and Dissertations

Browser security indicators show warnings when sites load without HTTPS, but more malicious sites are using HTTPS to appear legitimate in browsers and deceive users. We explore a new approach to browser indicators that overcomes several limitations of existing indicators. First, we develop a high-level risk assessment framework to identify risky interactions and evaluate the utility of this approach through a survey. Next, we evaluate potential designs for a new risk indicator to communicate risk rather than security. Finally, we conduct a within-subjects user study to compare the risk indicator to existing security indicators by observing participant behavior and collecting …

Frameup: An Incriminatory Attack On Storj: A Peer To Peer Blockchain Enabled Distributed Storage System, Xiaolu Zhang, Justin Grannis, Ibrahim Baggili, Nicole Lang Beebe

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we present a primary account of frameup, an incriminatory attack made possible because of existing implementations in distributed peer to peer storage. The frameup attack shows that an adversary has the ability to store unencrypted data on the hard drives of people renting out their hard drive space. This is important to forensic examiners as it opens the door for possibly framing an innocent victim. Our work employs Storj as an example technology, due to its popularity and market size. Storj is a blockchain enabled system that allows people to rent out their hard drive space …

Continuous Smartphone Authentication Using Wristbands, Shrirang Mare, Reza Rawassizadeh, Ronald Peterson, David Kotz

Dartmouth Scholarship

Many users find current smartphone authentication methods (PINs, swipe patterns) to be burdensome, leading them to weaken or disable the authentication. Although some phones support methods to ease the burden (such as fingerprint readers), these methods require active participation by the user and do not verify the user’s identity after the phone is unlocked. We propose CSAW, a continuous smartphone authentication method that leverages wristbands to verify that the phone is in the hands of its owner. In CSAW, users wear a wristband (a smartwatch or a fitness band) with built-in motion sensors, and by comparing the wristband’s motion with …

A New Network Model For Cyber Threat Intelligence Sharing Using Blockchain Technology, Daire Homan, Ian Shiel, Christina Thorpe

Conference Papers

The aim of this research is to propose a new blockchain network model that facilitates the secure dissemination of Cyber Threat Intelligence (CTI) data. The primary motivations for this study are based around the recent changes to information security legislation in the European Union and the challenges that Computer Security and Incident Response Teams (CSIRT) face when trying to share actionable and highly sensitive data within systems where participants do not always share the same interests or motivations. We discuss the common problems within the domain of CTI sharing and we propose a new model, that leverages the security properties …

Analyzing Small Businesses' Adoption Of Big Data Security Analytics, Henry Mathias

Walden Dissertations and Doctoral Studies

Despite the increased cost of data breaches due to advanced, persistent threats from malicious sources, the adoption of big data security analytics among U.S. small businesses has been slow. Anchored in a diffusion of innovation theory, the purpose of this correlational study was to examine ways to increase the adoption of big data security analytics among small businesses in the United States by examining the relationship between small business leaders' perceptions of big data security analytics and their adoption. The research questions were developed to determine how to increase the adoption of big data security analytics, which can be measured …

An Empirical Study On Deterministic Collusive Attack Using Inter Component Communication In Android Applications, Tanzeer Hossain

Wayne State University Theses

Security threats using intent based inter component communication (ICC) channels in Android are under constant scrutiny of software engineering researchers. Though prior research provides empirical evidence on the existence of collusive communication channels in popular android apps, little is known about developers’willful involvement and motivation to exploit these channels.To shed light on this matter, in this paper we devised a novel methodology to deterministically identify developers’ involvement in establishing collusive inter app communication channels. We incorporate static analysis and relational database technology to discover sensitive collusive channels and domain knowledge of the Android SDK to build a model to identify …

Comprehending The Safety Paradox And Privacy Concerns With Medical Device Remote Patient Monitoring, Marc Doyle

CCAC Theses and Dissertations

Medical literature identifies a number of technology-driven improvements in disease management such as implantable medical devices (IMDs) that are a standard treatment for candidates with specific diseases. Among patients using implantable cardiac defibrillators (ICD), for example, problems and issues are being discovered faster compared to patients without monitoring, improving safety. What is not known is why patients report not feeling safer, creating a safety paradox, and why patients identify privacy concerns in ICD monitoring.

There is a major gap in the literature regarding the factors that contribute to perceived safety and privacy in remote patient monitoring (RPM). To address this …

Information Systems Security Leadership: An Empirical Study Of Behavioral Influences Of Leaders On Employees’ Security Compliance, Marcus Alan Winkfield

CCAC Theses and Dissertations

This empirical study examined the behavioral influences of leaders on employees’ security compliance. Organizations can use leadership concepts in the field of Information Systems (IS) security. Despite the adoption of technical and managerial approaches, organizations still face issues motivating employee IS security compliance. This dissertation argued that organizations need strong leadership to encourage employees. Using the expectancy theory, this paper created a theoretical model to help understand the influence of task and relationship-oriented leadership behaviors on nontechnical controls IS security compliance. The conceptual underpinnings translated into perceived security effort, perceived security performance, and expected security outcomes. The theoretical model was …

"Anon What What?": Children's Understanding Of The Language Of Privacy, Stacy Black, Rezvan Joshaghani, Dhanush Kumar Ratakonda, Hoda Mehrpouyan, Jerry Alan Fails

Computer Science Faculty Publications and Presentations

Internet usage continues to increase among children ages 12 and younger. Because their digital interactions can be persistently stored, there is a need for building an understanding and foundational knowledge of privacy. We describe initial investigations into children’s understanding of privacy from a Contextual Integrity (CI) perspective by conducting semi-structured interviews. We share results – that echo what others have shown – that indicate children have limited knowledge and understanding of CI principles. We also share an initial exploration of utilizing participatory design theater as a possible educational mechanism to help children develop a stronger understanding of important privacy principles.

Securing Modern Cyberspace Using A Multi-Faceted Approach, Yu Li

Browse all Theses and Dissertations

Security has become one of the most significant concerns for our cyberspace. Securing the cyberspace, however, becomes increasingly challenging. This can be attributed to the rapidly growing diversities and complexity of the modern cyberspace. Specifically, it is not any more dominated by connected personal computers (PCs); instead, it is greatly characterized by cyber-physical systems (CPS), embedded systems, dynamic services, and human-computer interactions. Securing modern cyberspace therefore calls for a multi-faceted approach capable of systematically integrating these emerging characteristics. This dissertation presents our novel and significant solutions towards this direction. Specifically, we have devised automated, systematic security solutions to three critical …

Understanding The Ntru Cryptosystem, Benjamin Clark

Williams Honors College, Honors Research Projects

In this paper, we will examine the NTRU Public Key Cryptosystem. The NTRU cryptosystem was created by Joseph Silverman, Jeffery Hoffstein, and Jill Pipher in 1996. This system uses truncated polynomial rings to encrypt and decrypt data. It was recently released into the public domain in 2013. This paper will describe how this cryptosystem works and give a basic understanding on how to encrypt and decrypt using this system.

Virtual Environments Testing As A Cloud Service: A Methodology For Protecting And Securing Virtual Infrastructures, Elhadj Benkhelifa, Anoud Bani Hani, Thomas Welsh, Siyakha Mthunzi, Chirine Ghedira Guegan

All Works

© 2013 IEEE. Testing is a vital component of the system development life cycle. As information systems infrastructure move from native computing to cloud-based and virtualized platforms, it becomes necessary to evaluate their effectiveness to ensure completion of organizational goals. However, the complexity and scale of virtualized environments make this process difficult. Additionally, inherited and novel issues further complicate this process, while relatively high costs can be constraining. Enabling service-driven environments to provide this evaluation is therefore beneficial for both providers and users. No such complete service offering currently exists. This paper is therefore aimed to benefit industry and academia …

Security And Accuracy Of Fingerprint-Based Biometrics: A Review, Wencheng Yang, Song Wang, Jiankun Hu, Guanglou Zhang, Craig Valli

Research outputs 2014 to 2021

Biometric systems are increasingly replacing traditional password- and token-based authentication systems. Security and recognition accuracy are the two most important aspects to consider in designing a biometric system. In this paper, a comprehensive review is presented to shed light on the latest developments in the study of fingerprint-based biometrics covering these two aspects with a view to improving system security and recognition accuracy. Based on a thorough analysis and discussion, limitations of existing research work are outlined and suggestions for future work are provided. It is shown in the paper that researchers continue to face challenges in tackling the two …

Inception: Virtual Space In Memory Space In Real Space, Peter Casey, Rebecca Lindsay-Decusati, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

Virtual Reality (VR) has become a reality. With the technology's increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional “dead” analysis. Following the trend of antiforensics, evidence of an attack may only be found in memory, along with many other volatile data points. Our work provides the primary account for the memory forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from memory that are relevant to the VE, and is also capable …

The Security Layer, Mark Thomas O'Neill

Theses and Dissertations

Transport Layer Security (TLS) is a vital component to the security ecosystem and the most popular security protocol used on the Internet today. Despite the strengths of the protocol, numerous vulnerabilities result from its improper use in practice. Some of these vulnerabilities arise from weaknesses in authentication, from the rigidity of the trusted authority system to the complexities of client certificates. Others result from the misuse of TLS by developers, who misuse complicated TLS libraries, improperly validate server certificates, employ outdated cipher suites, or deploy other features insecurely. To make matters worse, system administrators and users are powerless to fix …