Information Security Commons^™

Critical Infrastructure Systems Modelling: Benchmarking Cpntools, Graeme Pye, Matthew J. Warren

Australian Information Warfare and Security Conference

This paper reports on the application of systems modelling benchmarks to determine the viability of systems modelling software and its suitability for modelling critical infrastructure systems. This research applies the earlier research that related to developing benchmarks that when applied to systems modelling software will indicate its likely suitability to modelling critical infrastructure systems. In this context, the systems modeling benchmarks will assess the practicality of CPNTools to the task of modelling critical infrastructure systems.

Managing Analysis, David Shaw

Australian Information Warfare and Security Conference

The Intelligence profession requires effective management to function properly and professional discourse highlights the changing nature of intelligence work. Highlighted “failures” are linked to organizational structures and ethos, and proposals to address the problems include discussion of human and organizational factors with recommendations that address the issues. However, optimising the intelligence process may not be a simple case of applying management techniques as the work relies substantially on individual endeavour. Innovative management techniques are needed and these should be grounded in recognising the peculiar nature of analysis and the skill set required.

Commercial Critical Systems And Critical Infrastructure Protection: A Future Research Agenda, Matthew J. Warren, Shona Leitch

Australian Information Warfare and Security Conference

Secure management of Australia’s commercial critical infrastructure presents ongoing challenges to owners and the government. Although it is currently managed through high-level information sharing via collaboration, but does this suit the commercial sector. One of the issues facing Australia is that the majority of critical infrastructure resides under the control of the business sector and certain aspects such of the critical infrastructure such as Supply Chain Management (SCM) systems are distributed entities and not a single entity. The paper focuses upon the security issues associated with SCM systems and critical infrastructure protection

Space As A New Sphere Of Future Information Warfare, Martti Lehto

Australian Information Warfare and Security Conference

Air power has seen constant development from the Wright Flyer’s first flight at Kitty Hawk on December 17, 1903 via the advent of the jet age with the service entry of the Messerschmitt Me 262 in 1942, to today’s multirole fighters (F-35 Joint Strike Fighter) and stealth aircraft (B-2 Spirit multi-role bomber). As a result of this evolution of one hundred years air power has emerged as a central component in power projection. As General William Mitchell said: ”Neither armies nor navies can exist unless the air is controlled over them.” (Mitchell 1925, xv)We have witnessed a corresponding development in …

Light-Weight Encryption Schemes For Multimedia Data, Feng Bao, Robert H. Deng

Research Collection School Of Computing and Information Systems

Due to the pervasiveness of high-speed networks and multimedia communications and storage, the demand for highspeed cryptosystems is ever increasing. It is widely believed that there is a tradeoff between speed and security in cryptosystem design. No existing encryption algorithms are both fast enough for high-speed operation and sufficiently secure to withstand powerful cryptanalysis. In this paper, we propose and analyze a generic construction of high-speed encryption schemes. Our solution is based on the fact that there exist secure but relatively slow block ciphers, e. g. AES, and super-fast but relatively weaker stream ciphers. We then combine a secure block …

An Information-Sharing Based Anti-Phishing System, Yueqing Cheng, Zhen Yuan, Lei Ma, Robert H. Deng

Research Collection School Of Computing and Information Systems

This paper presents the design of an informationsharing based or server-assisted anti-phishing system. The system follows a client-server architecture and makes decision based on not only client side heuristics but also collective information from multiple clients. When visiting a web site, a client side proxy, installed as a plug-in to a browser, decides on the legitimacy of the web site based on a combination of white list, black list and heuristics. In case the client side proxy does not have sufficient information to make a clear judgment, it reports the suspicious site to a central server which has access to …

Npake+: A Hierarchical Group Password-Authenticated Key Exchange Protocol Using Different Passwords, Zhiguo Wan, Robert H. Deng, Feng Bao, Bart Preneel

Research Collection School Of Computing and Information Systems

Although two-party password-authenticated key exchange (PAKE) protocols have been intensively studied in recent years, group PAKE protocols have received little attention. In this paper, we propose a hierarchical group PAKE protocol nPAKE+ protocol under the setting where each party shares an independent password with a trusted server. The nPAKE+ protocol is a novel combination of the hierarchical key tree structure and the password-based Diffie-Hellman exchange, and hence it achieves substantial gain in computation efficiency. In particular, the computation cost for each client in our protocol is only O(logn). Additionally, the hierarchical feature of nPAKE+ enables every subgroup obtains their own …

Flexible Access Control To Jpeg 2000 Image Code-Streams, Yongdong Wu, Di Ma, Robert H. Deng

Research Collection School Of Computing and Information Systems

JPEG 2000 is an international standard for still image compression in the 21st century. Part 8 of the standard, named JPSEC, is concerned with all the security aspects, in particular to access control and authentication. This paper presents a novel access control scheme for JPEG 2000 image code-streams. The proposed scheme is secure against collusion attacks and highly efficient. The scheme is also very flexible, allowing access control to JPEG 2000 image code-streams according to any combination of resolution, quality layer and region of interest. The "encrypt once, decrypt many ways" property of our scheme is designed to work seamlessly …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Collaborative, Trust-Based Security Mechanisms For A National Utility Intranet, Gregory M. Coates

Theses and Dissertations

This thesis investigates security mechanisms for utility control and protection networks using IP-based protocol interaction. It proposes flexible, cost-effective solutions in strategic locations to protect transitioning legacy and full IP-standards architectures. It also demonstrates how operational signatures can be defined to enact organizationally-unique standard operating procedures for zero failure in environments with varying levels of uncertainty and trust. The research evaluates layering encryption, authentication, traffic filtering, content checks, and event correlation mechanisms over time-critical primary and backup control/protection signaling to prevent disruption by internal and external malicious activity or errors. Finally, it shows how a regional/national implementation can protect private …

Anonymous And Authenticated Key Exchange For Roaming Networks, Guomin Yang, Duncan S. Wong, Xiaotie Deng

Research Collection School Of Computing and Information Systems

User privacy is a notable security issue in wireless communications. It concerns about user identities from being exposed and user movements and whereabouts from being tracked. The concern of user privacy is particularly signified in systems which support roaming when users are able to hop across networks administered by different operators. In this paper, we propose a novel construction approach of anonymous and authenticated key exchange protocols for a roaming user and a visiting server to establish a random session key in such a way that the visiting server authenticates the user's home server without knowing exactly who the user …

Enhanced Security By Os-Oriented Encapsulation In Tpm-Enabled Drm, Yongdong Wu, Feng Bao, Robert H. Deng, Marc Mouffron, Frederic Rousseau

Research Collection School Of Computing and Information Systems

The Trusted Computing Group (TCG) defines the specifications for the Trusted Platform Module (TPM) and corresponding trust mechanisms that allow a TPM-enabled platform to run only authenticated software. For example, the operating system (OS) can use the facilities provided by the TPM to authenticate a Digital Rights Management (DRM) application before allowing it to run. However TCG does not provide any clear specification on what kind of software can be regarded as trusted and hence be authenticated. In fact it is unlikely that there will be a clear line between the software that should be authenticated and those should not, …

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

A More Natural Way To Construct Identity-Based Identification Schemes, Guomin Yang, Jing Chen, Duncan S. Wong, Xiaotie Deng, Dongsheng Wang

Research Collection School Of Computing and Information Systems

Constructing identification schemes is one of the fundamental problems in cryptography, and is very useful in practice. An identity-based identification (IBI) scheme allows a prover to identify itself to a public verifier who knows only the claimed identity of the prover and some common information. In this paper, we propose a simple and efficient framework for constructing IBI schemes. Unlike some related framework which constructs IBI schemes from some standard identification schemes, our framework is based on some more fundamental assumptions on intractable problems. Depending on the features of the underlying intractable problems presumed in our framework, we can derive …

An Efficient Identity-Based Key Exchange Protocol With Kgs Forward Secrecy For Low-Power Devices, Robert W. Zhu, Guomin Yang, Duncan S. Wong

Research Collection School Of Computing and Information Systems

For an ID-based key exchange (KE) protocol, KGS forward secrecy is about the protection of previously established session keys after the master secret key of the Key Generation Server (KGS) is compromised. This is the strongest notion of forward secrecy that one can provide for an ID-based KE protocol. Among all the comparable protocols, there are only a few of them that provide this level of forward secrecy, and all of these protocols require expensive bilinear pairing operations and map-to-point hash operations that may not be suitable for implementation on low-power devices such as sensors. In this paper, we propose …

Time Capsule Signature: Efficient And Provably Secure Constructions, Bessie C. Hu, Duncan S. Wong, Qiong Huang, Guomin Yang, Xiaotie Deng

Research Collection School Of Computing and Information Systems

Time Capsule Signature, first formalized by Dodis and Yum in Financial Cryptography 2005, is a digital signature scheme which allows a signature to bear a (future) time t so that the signature will only be valid at time t or later, when a trusted third party called time server releases time-dependent information for checking the validity of a time capsule signature. Also, the actual signer of a time capsule signature has the privilege to make the signature valid before time t.In this paper, we provide a new security model of time capsule signature such that time server is not required …

Achieving End-To-End Authentication In Intermediary-Enabled Multimedia Delivery Systems, Robert H. Deng, Yanjiang Yang

Research Collection School Of Computing and Information Systems

Considerable research and experiment results in recent years have shown that the server-proxy-user architecture represents an efficient and scalable new paradigm for multimedia content delivery. However, not much effort has been spent on the security issues in such systems. In this paper, we study data authentication in multimedia content delivery, and in particular, we focus on achieving end-to-end authentication from the multimedia server to end users in the server-proxy-user architecture where intermediary proxies transcode multimedia content dynamically. We present a formal model for the end-to-end authentication problem, and propose a basic construction for generic data modality and prove its security. …

Forgery Attack To An Asymptotically Optimal Traitor Tracing Scheme, Yongdong Wu, Feng Bao, Robert H. Deng

Research Collection School Of Computing and Information Systems

In this paper, we present a forgery attack to a black-box traitor tracing scheme [2] called as CPP scheme. CPP scheme has efficient transmission rate and allows the tracer to identify a traitor with just one invalid ciphertext. Since the original CPP scheme is vulnerable to the multi-key attack, we improved CPP to thwart the attack. However, CPP is vulnerable to a fatal forgery attack. In the forgery attack, two traitors can collude to forge all valid decryption keys. The forged keys appear as perfect genuine keys, can decrypt all protected content, but are untraceable by the tracer. Fortunately, we …

Towards Redaction Of Digital Information From Electronic Devices, Gavin W. Manes, Lance Watson, David Greer, Alex Barclay, John Hale

Annual ADFSL Conference on Digital Forensics, Security and Law

In the discovery portion of court proceedings, it is necessary to produce information to opposing counsel. Traditionally, this information is in paper form with all privileged information removed. Increasingly, the information requested during discovery exists in digital form and savvy counsel is requesting direct access to the original digital source: a broad spectrum of additional digital information can be often be extracted using digital forensics. This paper describes the major problems which must be solved to redact digital information from electronic devices. The primary hurdle facing digital redaction is the lack of a rational process for systematically handling encoded, encrypted, …

Do Current Erasure Programs Remove Evidence Of Bittorrent Activity?, Andrew Woodward, Craig Valli

Annual ADFSL Conference on Digital Forensics, Security and Law

This research in progress aims to evaluate the effectiveness of commercial programs to erase traces of the use of BitTorrent software. The erasure programs MaxErase, P2PDoctor, Privacy Suite, Window Washer and R-Clean and Wipe were used on a machine that had used the BitTorrent client Azureus to download two torrent files. The drive was imaged and then searched for torrent files. The registry was also examined on the source machine. The program R-Clean and Wipe left evidence in both the registry and the image of the name and type of files that had been downloaded with this software. Of greater …

The Case For Teaching Network Protocols To Computer Forensics Examiners, Gary C. Kessler, Matt Fasulo

Annual ADFSL Conference on Digital Forensics, Security and Law

Most computer forensics experts are well-versed in basic computer hardware technology, operating systems, common software applications, and computer forensics tools. And while many have rudimentary knowledge about the Internet and simple network-lookup tools, they are not trained in the analysis of network communication protocols and the use of packet sniffers. This paper describes digital forensics applications for network analysis and includes four case studies.

Keywords: computer forensics education, network forensics, protocol analysis

Textbooks For Computer Forensic Courses: A Preliminary Study, Jigang Liu, Larry Gottschalk, Kuodi Jian

Annual ADFSL Conference on Digital Forensics, Security and Law

As computer forensics develops into one of the fastest-growing areas in the computer related fields, many universities and colleges are offering or are planning to offer a course in computer forensics. When instructors begin to develop a new course in the area, one of critical questions they would ask is what textbook should be used. To better answer the question, we conducted a study in which we tried to find which textbooks are being used in computer forensic courses. We believe that the results and analysis of our study will help instructors in choosing adequate textbooks for their new course …

Education For Cyber Crime Investigators, David Greer, Joe Mulenex, John Hale, Gavin W. Manes

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital forensics and cyber crime investigations are continually growing, rapidly changing fields requiring law enforcement agencies to meet very rigorous training requirements. New opportunities for committing criminal activity against persons, organization or property are presented every day with the proliferation of personal digital devices, computers, the internet, computer networks, and automated data systems. Whether the crime involves attacks against computer systems, electronic information, or more traditional crimes such as murder, money laundering or fraud, electronic evidence is becoming more prevalent. It is no surprise that law enforcement and criminal justice officials are being overwhelmed by the volume of investigations and …

Computer Geolocation Using Extracted Features, Chad M.S. Steel

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper compares the extracted feature data from a sample set of hard drive images in an effort to relate the features to the physical location of the drive. A list of probable zip codes, phone numbers, place names, and IP addresses are extracted from raw drive images and compared to manually identified geolocation data. The results of the individual extractions are then analyzed to determine the feasibility in using automated extraction and analysis techniques for geolocating hard drives.

Keywords: hard disk forensics, geocoding, geolocation

Defending Against Insider Use Of Digital Steganography, James E. Wingate, Glenn D. Watt, Marc Kurtz, Chad W. Davis, Robert Lipscomb

Annual ADFSL Conference on Digital Forensics, Security and Law

The trusted insider is among the most harmful and difficult to detect threats to information security, according to the Federal Plan for Information Assurance and Cyber Security Research and Development released in April 2006. By default, employees become trusted insiders when granted the set of privileges needed to do their jobs, which typically includes access to the Internet. It is generally presumed the insiders are loyally working to achieve the organization’s goals and objectives and would not abuse the privileges given to them. However, some insiders will inevitably abuse some of their privileges. For example, a trusted insider might abuse …

Investigating Information Structure Of Phishing Emails Based On Persuasive Communication Perspective, Ki Jung Lee, Il-Yeol Song

Annual ADFSL Conference on Digital Forensics, Security and Law

Current approaches of phishing filters depend on classifying messages based on textually discernable features such as IP-based URLs or domain names as those features that can be easily extracted from a given phishing message. However, in the same sense, those easily perceptible features can be easily manipulated by sophisticated phishers. Therefore, it is important that universal patterns of phishing messages should be identified for feature extraction to serve as a basis for text classification. In this paper, we demonstrate that user perception regarding phishing message can be identified in central and peripheral routes of information processing. We also present a …