Chosen-Ciphertext Secure Bidirectional Proxy Re-Encryption Schemes Without Pairings,
2010
Singapore Management University
Chosen-Ciphertext Secure Bidirectional Proxy Re-Encryption Schemes Without Pairings, Jian Weng, Huijie, Robert Deng, Shengli Liu, Kefei Chen
Research Collection School Of Computing and Information Systems
Proxy re-encryption realizes delegation of decryption rights, enabling a proxy holding a re-encryption key to convert a ciphertext originally intended for Alice into an encryption of the same message for Bob. Proxy re-encryption is a very useful primitive, having many applications in distributed file systems, outsourced filtering of encrypted spam, access control over network storage, and so on. Lately, Weng et al. proposed the first unidirectional proxy re-encryption scheme without using bilinear pairs. However, Weng et al.'s construction does not possess collusion resilience, in the sense that a coalition of the proxy and the delegatee can recover the delegator's private …
Revisiting Address Space Randomization,
2010
Nankai University
Revisiting Address Space Randomization, Zhi Wang, Renquan Cheng, Debin Gao
Research Collection School Of Computing and Information Systems
Address space randomization is believed to be a strong defense against memory error exploits. Many code and data objects in a potentially vulnerable program and the system could be randomized, including those on the stack and heap, base address of code, order of functions, PLT, GOT, etc. Randomizing these code and data objects is believed to be effective in obfuscating the addresses in memory to obscure locations of code and data objects. However, attacking techniques have advanced since the introduction of address space randomization. In particular, return-oriented programming has made attacks without injected code much more powerful than what they …
Dynamic Group Key Exchange Revisited,
2010
Singapore Management University
Dynamic Group Key Exchange Revisited, Guomin Yang, Chik How Tan
Research Collection School Of Computing and Information Systems
In a dynamic group key exchange protocol, besides the basic group setup protocol, there are also a join protocol and a leave protocol, which allow the membership of an existing group to be changed more efficiently than rerunning the group setup protocol. The join and leave protocols should ensure that the session key is updated upon every membership change so that the subsequent sessions are protected from leaving members (backward security) and the previous sessions are protected from joining members (forward security). In this paper, we present a new security model for dynamic group key exchange. Comparing to existing models, …
A Multi-User Steganographic File System On Untrusted Shared Storage,
2010
Singapore Management University
A Multi-User Steganographic File System On Untrusted Shared Storage, Jin Han, Meng Pan, Debin Gao, Hwee Hwa Pang
Research Collection School Of Computing and Information Systems
Existing steganographic file systems enable a user to hide the existence of his secret data by claiming that they are (static) dummy data created during disk initialization. Such a claim is plausible if the adversary only sees the disk content at the point of attack. In a multi-user computing environment that employs untrusted shared storage, however, the adversary could have taken multiple snapshots of the disk content over time. Since the dummy data are static, the differences across snapshots thus disclose the locations of user data, and could even reveal the user passwords. In this paper, we introduce a Dummy-Relocatable …
Time Cost Evaluation For Executing Rfid Authentication Protocols,
2010
Singapore Management University
Time Cost Evaluation For Executing Rfid Authentication Protocols, Kevin Chiew, Yingjiu Li, Tieyan Li, Robert H. Deng, Manfred Aigner
Research Collection School Of Computing and Information Systems
There are various reader/tag authentication protocols proposed for the security of RFID systems. Such a protocol normally contains several rounds of conversations between a tag and a reader and involves cryptographic operations at both reader and tag sides. Currently there is a lack of benchmarks that provide a fair comparison platform for (a) the time cost of cryptographic operations at the tag side and (b) the time cost of data exchange between a reader and a tag, making it impossible to evaluate the total time cost for executing a protocol. Based on our experiments implemented on IAIK UHF tag emulators …
New Approaches To Mitigation Of Malicious Traffic In Voip Networks,
2010
University of Canterbury
New Approaches To Mitigation Of Malicious Traffic In Voip Networks, Tobi Wulff, Ray Hunt
Australian Information Security Management Conference
Voice over IP (VoIP) telephony is becoming widespread in use, and is often integrated into computer networks. Because of this, malicious software threatens VoIP systems in the same way that traditional computer systems have been attacked by viruses, worms, and other automated agents. VoIP networks are a challenge to secure against such malware as much of the network intelligence is focused on the edge devices and access environment. This paper describes the design and implementation of a novel VoIP security architecture in which evaluation of, and mitigation against, malicious traffic is demonstrated by the use of virtual machines to emulate …
Australian Critical Infrastructure Protection: A Case Of Two Tales,
2010
Deakin University
Australian Critical Infrastructure Protection: A Case Of Two Tales, Matthew Warren, Graeme Pye, William Hutchinson
Australian Information Warfare and Security Conference
The protection of critical infrastructures and the choices made in terms of priorities and cost, all impact upon the planning, precautions and security aspects of protecting these important systems. Often the when choices made is difficult to assess at the time the decision is taken and it is only after an incident that the truth of the choices made become fully evident. The paper focuses on two recent examples of Australian Critical Infrastructure protection and the issues that related to those examples.
Influence Operations: Action And Attitude,
2010
Edith Cowan University
Influence Operations: Action And Attitude, William Hutchinson
Australian Information Warfare and Security Conference
This paper investigates the relationships between attitudes, behaviour and influence. The major objective of influence operations is predominantly to exert soft power and in doing this there is an assumption that it will change attitudes. It is assumed that by changing attitudes favourable to the influencer that behaviours will be changed. However, this is a problematic assumption. Influence operations whose messages seem to contradict the real behaviour of the influencer tends to nullify the message; and, in fact, might reinforce the attitudes and behaviours of the foe and begin to alienate friends. Messages should be based on a credible reality; …
Threat Modelling With Stride And Uml,
2010
Edith Cowan University
Threat Modelling With Stride And Uml, Michael N. Johnstone
Australian Information Security Management Conference
Threat modelling as part of risk analysis is seen as an essential part of secure systems development. Microsoft’s Security Development Lifecycle (SDL) is a well-known software development method that places security at the forefront of product initiation, design and implementation. As part of SDL, threat modelling produces data flow diagrams (DFDs) as key artefacts and uses those diagrams as mappings with STRIDE to identify threats. This paper uses a standard case study to illustrate the effects of using an alternative process model (UML activity diagrams) with STRIDE and suggests that using a more modern process diagram can generate a more …
A Proposed Policy-Based Management Architecture For Wireless Clients Operating In A Heterogeneous Mobile Environment,
2010
University of Canterbury
A Proposed Policy-Based Management Architecture For Wireless Clients Operating In A Heterogeneous Mobile Environment, Mayank Keshariya, Ray Hunt
Australian Information Security Management Conference
The objective of this paper is to provide a managed always best connected service to mobile entities over underlying heterogeneous wireless and mobile platforms while maintaining negotiated security and quality of service (QoS). This paper proposes a new model and its architecture which is based upon Policy-based Management but provides a new framework based on layered-approach for the centralised management of mobile clients. In particular, we propose and implement a new model of a policy-managed mobile client and its architecture to support seamless handoff across multiple access networks. The proposed mobile client supports multi-domain authentication, authorisation and security based on …
Micro-Blogging In The Workplace,
2010
Deakin University
Micro-Blogging In The Workplace, Chia Yao Lee, Matthew Warren
Australian Information Security Management Conference
Micro-blogging services such as Twitter, Yammer, Plurk and Google Buzz have generated substantial interest among members of the business community in recent years. Many CEOs, managers and front-line employees have embraced micro-blogs as a tool for interacting with colleagues, employees, customers, suppliers and investors. Micro-blogs are considered a more informal channel than emails and official websites, and thus present a different set of challenges to businesses. As a positional paper, this paper uses a case study of a bogus Twitter account to emphasise security and ethical issues relating to (i) Trust, Accuracy and Authenticity of Information, (ii) Privacy and Confidentiality, …
A Novel Design And Implementation Of Dos-Resistant Authentication And Seamless Handoff Scheme For Enterprise Wlans,
2010
University of Canterbury,
A Novel Design And Implementation Of Dos-Resistant Authentication And Seamless Handoff Scheme For Enterprise Wlans, Isaac Lee, Ray Hunt
Australian Information Security Management Conference
With the advance of wireless access technologies, the IEEE 802.11 wireless local area network (WLAN) has gained significant increase in popularity and deployment due to the substantially improved transmission rate and decreased deployment costs. However, this same widespread deployment makes WLANs an attractive target for network attacks. Several vulnerabilities have been identified and reported regarding the security of the current 802.11 standards. To address those security weaknesses, IEEE standard committees proposed the 802.11i amendment to enhance WLAN security. The 802.11i standard has demonstrated the capability of providing satisfactory mutual authentication, better data confidentiality, and key management support, however, the design …
An Information Security Governance Framework For Australian Primary Care Health Providers,
2010
Edith Cowan University
An Information Security Governance Framework For Australian Primary Care Health Providers, Donald C. Mcdermid, Rachel J. Mahncke, Patricia A H Williams
Australian Information Security Management Conference
The competitive nature of business and society means that the protection of information, and governance of the information security function, is increasingly important. This paper introduces the notion of a governance framework for information security for health providers. It refines the idea of an IT Balanced Scorecard into a scorecard process for use in governing information security for primary care health providers, where IT and security skills may be limited. The approach amends and justifies the four main elements of the scorecard process. The existence of a governance framework specifically tailored for the needs of primary care practice is a …
Information Leakage Through Online Social Networking: Opening The Doorway For Advanced Persistence Threats,
2010
University of Melbourne
Information Leakage Through Online Social Networking: Opening The Doorway For Advanced Persistence Threats, Nurul Nuha Abdul Molok, Shanton Chang, Atif Ahmad
Australian Information Security Management Conference
The explosion of online social networking (OSN) in recent years has caused damages to organisations due to leakage of information by their employees. Employees’ social networking behaviour, whether accidental or intentional, provides an opportunity for advanced persistent threats (APT) attackers to realise their social engineering techniques and undetectable zero-day exploits. APT attackers use a spear-phishing method that targeted on key employees of victim organisations through social media in order to conduct reconnaissance and theft of confidential proprietary information. This conceptual paper posits OSN as the most challenging channel of information leakage and provides an explanation about the underlying factors of …
Yet Another Symbian Vulnerability Update,
2010
Edith Cowan University
Yet Another Symbian Vulnerability Update, Nizam Uddin Bhuiyan
Australian Information Security Management Conference
The more the mobile devices are approaching to advance their security, the numbers of vulnerabilities are also becoming more astonishing. The number of mobile phones including smart phones is rising vertically, and so has the amount of malware activity. This report documents the latest threats in Symbian mobile industry and analyses the consequence. In addition, it will suggest the possible solution that may help individuals to protect their device & ultimately maintain the privacy.
Development And Evaluation Of A Secure Web Gateway Using Existing Icap Open Source Tools,
2010
University of Canterbury
Development And Evaluation Of A Secure Web Gateway Using Existing Icap Open Source Tools, Michael Pearce, Ray Hunt
Australian Information Security Management Conference
This work in progress paper discusses the development and evaluation of an open source secure web gateway. The proof of concept system uses a combination of open source software (including the Greasyspoon ICAP Server, Squid HTTP proxy, and Clam Antivirus) to perform the various security tasks that range from simple (such as passive content insertion) to more advanced (such as active content alteration) by modules installed on the server. After discussing the makeup of the proof of concept system we discuss our evaluation methodology for both effectiveness and performance. The effectiveness was tested using comparative analysis of groups of self-browsing …
Success Of Agile Environment In Complex Projects,
2010
Consensus
Success Of Agile Environment In Complex Projects, Abbass Ghanbary, Julian Day
Australian Information Warfare and Security Conference
This paper discusses the impact of agile methodology in complex and modular interrelated projects based on the authors’ practical experience and observations. With the advancement of Web technologies and complex computer systems, business applications are able to transcend boundaries in order to fully meet business requirements and comply with the legislation, policies and procedures. The success of software development as well as software deployment of these complex applications is dependent upon the employed methodology and project management. This is so because employed methodology plays an important position in capturing and modeling of business requirements and project management helps to ensure …
An Analytical Study Of It Security Governance And Its Adoption On Australian Organisations,
2010
Charles Sturt University
An Analytical Study Of It Security Governance And Its Adoption On Australian Organisations, Tanveer A. Zia
Australian Information Security Management Conference
Contemporary organisations are at infancy stages of adopting IT governance processes in Australia. Organisations who have adopted these processes underestimate the security processes within the governance framework. If the security processes are designed, they are often flawed with operational level implementation. This study investigates IT security governance broadly and in Australian organisations specifically. The objective of this study is to bring the local organisations in alignment with international standards and frameworks in terms of integration of information security, IT audits, risks and control measures. A survey of selected organisations is completed and results are presented in this paper identifying the …
Security Information Supplied By Australian Internet Service Providers,
2010
Edith Cowan University
Security Information Supplied By Australian Internet Service Providers, Patryk Szewczyk
Australian Information Security Management Conference
Results from previous studies indicate that numerous Internet Service Providers within Australia either have inadequately trained staff, or refuse to provide security support to end-users. This paper examines the security information supplied by Internet Service Providers on their website. Specifically content relating to securing; a wireless network, an ADSL router, and a Microsoft Windows based workstation. A further examination looked at the accuracy, currency, and accessibility of information provided. Results indicate that the information supplied by Internet Service Providers is either inadequate or may in fact further deter the end-user from appropriately securing their computer and networking devices.
The Economics Of Developing Security Embedded Software,
2010
Charles Sturt University
The Economics Of Developing Security Embedded Software, Craig S. Wright, Tanveer A. Zia
Australian Information Security Management Conference
Market models for software vulnerabilities have been disparaged in the past citing how these do little to lower the risk of insecure software. In this paper we argue that the market models proposed are flawed and not the concept of a market itself. A well-defined software risk derivative market would improve the information exchange for both the software user and vendor removing the often touted imperfect information state that is said to believe the software industry. In this way, users could have a rational means of accurately judging software risks and costs and as such the vendor could optimally apply …
