Research Experience for Undergraduates 2014
- NSF Summer Research Experience for Undergraduates in Trustable Embedded Systems Security Research
- Departments of Electrical and Computer Engineering and Computer Science and Engineering
The 2014 REU class included the following students:
Israel Bonello, Eastern Connecticut State University Physical ROM Security Security is a vital part of today’s technology concerns. This is because of the growing issue about how secure our computing devices really are. In the past few years there have been many worries about information privacy to financial safekeeping. Mainly these concerns all try to solve the problem of security by better improving the software end of technology. However, todays hackers are more sophisticated cyber thefts that are not just attacking computers at the software level but also at the physical level.Israel worked a new idea on how to better protect a Read Only Memory Chip at the physical level from potential security threats of an attacker trying to steal important security keys, programs and data. This is usually done in a process where the attacker has to physically expose the chip’s internal layout by removing its cover. Therefore, in order to prevent this we have explored the idea of a chip that would be made sealed from air with magnesium interconnections that can be programmable for information to be stored on the chip. Magnesium was chosen because of its property to quickly oxidize when exposed to air. Hence, when the attacker tries to remove information from the chip it will oxidize and erase the information on it. In the paper we will discuss the benefits of this security method along with how magnesium affects the chips power consumption, resistance, delay and capacitance as well as other ways of better improving the security of a ROM chip on a circuit board.
|
Stephen Feldman, University of Virginia Manilyzer: Automated Android Malware Detection through Manifest Analysis As the world's most popular mobile operating system, Google's Android OS is the principal target of an ever increasing mobile malware threat. To counter this emerging menace, many malware detection techniques have been proposed for Android. A key aspect of many static detection techniques is their reliance on the permissions requested in the AndroidMan- ifest.xml file. Although these permissions are very important, the manifest also holds additional information that can be valuable in identifying malware. This data is found by analyzing manifest, receiver, and service tags, in addition to permission requests. Stephen and Dillon worked on Manilyzer, a system which statically analyzes AndroidManifest.xml files – exploiting the aforementioned characteristics and producing a feature vector used to classify applications as malicious or benign. They applied various machine learning algorithms to evaluate the effectiveness of Manilyzer on 617 applications; the approach yielded up to a 90% accuracy. In addition to classifying applications, Manilyzer is used to study the trends of permission requests in malicious applications. Through this evaluation and further analysis, it is clear that not all malware can be detected through static analysis of AndroidManifest.xml files. To address this issue, Stephen and Dillon also briefly explored a dynamic analysis technique which monitors network traffic using a packet sniffer.
Paper was published in 2014 Workshop for REU Research in Networking and Systems |
Vika Grindle, Clark University The Virtual User Fingerprint as a Secondary User Authentication Method Each individual possesses a unique set of character- istics and
personality traits that are distinguishable from another
individual. These traits, as we would expect, tend to influence our
every day decisions. Current secondary user authentication methods
either rely heavily on a user’s ability to remember key preferences,
phrases, and events, or they involve providing authentication on
multiple devices. They also operate under the assumption that only
the correct user has knowledge of this information and access to the
device which is being used to input the information. However, this
unfortunately is not always the case as malicious attacks that
compromise a user’s device or discover personal information about
the user are becoming more sophisticated and increasing in
number. Vika proposed an authentication method which uses a user’s
personality characteristics to determine if he is truly who he is
claiming to be. In particular, she proposed a way of quantifying a
user’s traits by observing his selection of images. This method
would not be as vulnerable to malicious attacks as current methods
are because the method is based on psychological observations that
can not be replicated by anyone other than the correct user. Even if
the device is compromised and a malicious attacker can observe a
user’s input he would not be able to replicate it because he is not
that user. Using this method, a user would first log in normally to
his account. He would then proceed through a series of slides where
his only instruction is to click on an image on each slide. His
selections are recorded and analyzed based on particular
predetermined techniques. This pattern is then compared to the
pattern of the true owner of the account and the system determines
if it’s a close enough match to authenticate the user. To test this
out, Vika created a survey consisting of slides of images and asked
participants to click through them. There were two particular types
of patterns we tested for that will be explained in depth later on
in this paper. A linear regression model of these results was
created and ran them back through the model to determine how
accurately one could authenticate a user. The results pointed to
this authentication method having very clear potential to be used as
a secondary user authentication method.
Paper was published in 2015 International Conference on Universal Access in Human-Computer Interaction |
Alison Hosey, University of Connecticut
Advanced Analysis of SRAM cell stability for Reliable SRAM PUFs
Paper was published in 2014 IEEE Asian Test Symposium |
Ethan Johnson, Grove City College Guaranteeing Spatial Memory Safety with Capability Systems |
Milod Kazerounian, University of Connecticut
Assessing Cryptographic Schemes Implemented on Diebold AccuVote Voting Machines
Recent years have seen electronic voting technology grow to near-ubiquitous usage in elections across the United States. Along with the efficiency benefits brought by this technological diffusion come serious concerns regarding the security and reliability of such systems. Currently, the state of Connecticut uses Diebold AccuVote Optical Scan voting machines running firmware version 1.96.6; this firmware has been proven susceptible to potentially election-compromising vulnerabilities should an adversary gain access to the memory cards used by the machine. More recent versions, beginning with firmware 1.96.8, have introduced cryptographic schemes such as RSA signature verification of the memory card, in an attempt to prevent the aforementioned vulnerabilities. However, experimentation with the firmware source code has revealed persisting weaknesses resulting from poor implementation of these cryptographic tools. The goal of Milod’s research is to assess the feasibility of exploiting these vulnerabilities without access to the 1.96.8 firmware source code, and to study subsequent versions of the firmware in order to determine whether such vulnerabilities persist. The outcome of this project includes a significantly better understanding of the actual use of cryptography within the firmware and brought us closer to an attack on the signature flaw. |
Jacquelyn Khadijah-Hajdu, University of Connecticut Analysis of S-box Optimization for AES using FPGA |
Spencer Newsom, Elon University Authorization Techniques for Active Storage Devices |
Matthew Seita, Rochester Institute of Technology A Software-Based Merkle Tree Memory Integrity Verification Scheme |