Research Experience for Undergraduates 2016

Jack Billings, North Central College

Implementing a Trust Profile for Adaptive Trust Negotiation in Mobile Devices

Erica Blum, Haverford College
Madeleine Rhee, Simmons College

A Linux Container-Based Approach to File Provenance

Linux containers allow developers to create well controlled yet lightweight envi- ronments within a host machine, and as such could provide an interesting foundation for secure, provenanced file storage. The provenance of a file describes the file‘s history, including which users have accessed it and what changes they made. This information can be invaluable if a file contains sensitive information, such as medical records or legal files. Prior research has sought to implement file storage with complete and verifiable records of file access; our research expands on these concepts and uses Linux containers to manage processes’ access to system resources. Linux containers are a lightweight alternative to virtual machines, as they share a kernel with the host machine rather than simulating an independent kernel. A FUSE (filesystem in userspace) interface mounted inside the container allows us to implement custom system calls that log provenance information. Linux containers have some security limitations, especially in the case that a user has root privileges on the machine, though these could potentially be addressed by introducing sections of memory not even root users can access.

Jason Corriveau, Bucknell University

Spatio-Situation-Based Access Control Model for Dynamic Permission on Mobile Applications

Alaina Doehrmann, University of St. Thomas

This goal of this project was to investigate the software and hardware vulnerabilities of a network gateway. This was done by looking at the gateway from the perspective of an attacker in order to accurately follow the steps that would be taken to gain access to the gateway. There were found to be several vulnerabilities, such as a code injection vulnerability in the webfront and open serial ports, that could be used to gain access to the gateway.

Lukas Gnirke, Oberlin College

Server Side Framework for Role-Based Access Control in Mobile Applications

The use of mobile devices is rapidly replacing the role that desktop computers play in our daily lives. While their mobility allows for information to be more easily accessible through one of the many mobile applications available, it also poses a security risk in that any security based on physical location that a desktop computer may provide is no longer feasible. Because many of these applications handle highly sensitive data such as banking, social, or health information, ensuring that only authorized users can access the information is extremely important. To secure sensitive information stored in mobile applications, Lukas utilized role-based access control (RBAC) to create permissions defining the information accessible to each user, and based on these permissions, present a different version of the app to each user, displaying only the information they are authorized to see. Lukas implemented this RBAC security approach by using an intercepting server to intercept API calls made by the application, checking role-based permissions for each API call before allowing the API request to proceed to the original server. If the user does not have permission to be executing the API request, the intercepting server returns NULL to the application. For additional security, the user’s role is stored in a Java Web Token, which is then verified in each of the intercepting API calls.

Luke Johnson, Gonzaga University

Cryptography in Electronic Poll Book Systems: Trying is Not Good Enough

Poll books are a way of verifying that each registered voter gets a single ballot. Poll station workers check in registered voters by finding their names in a printed paper list and crossing them out. Relying on humans makes this system slow, inaccurate and cumbersome. Moving paper processes like this to digital systems could improve speed, accuracy, and convenience. This switch would also remove the guaranteed reliability of the process given by the physical list. These sensitive digital systems require intelligent design and strong cryptography in order to maintain the integrity of election processes. This paper evaluates an electronic poll book system which has the illusion of security but fails to properly deploy cryptographic schemes. These failures allow attackers to completely disrupt the operations of a poll station. Luke developed an attack demonstrating that the individual failures at each security layer align to compromise the system as a whole. He also offered solutions to the attacks in an attempt to help future developers secure high value systems.

Kolby Lacy, Howard University
Mohamed Rilvan, Southern Connecticut State University

Smart phones, while providing users ease of access to sensitive information on the go, also present severe security risks if an attacker is able to gain access to them. Conventional authentication techniques such as 4-digit PIN and the pattern lock are prone to a user fault of predictable passwords due to necessity to remember the PIN/pattern, known as security fatigue. Biometric authentication has been introduced in order to lessen security fatigue. A form of biometric authentication for mobile phones that is currently deployed is the fingerprint scanner. These show a higher accuracy in authentication but require additional sensors. To strengthen the user authentication in a smartphone, Kolby and Mohamed developed a biometric authentication system which uses the capacitive sensors of the touchscreen, that are featured in all current smartphones. Their methodology focused on using the touchscreen as a image sensor to capture users’ body parts, such as ears and fingers. They extracted the capacitive raw data from the touched body part to obtain a 15 × 27 capacitive image. This image was used to capture geometric features (e.g., widths of fingers) and capacitive features (e.g., range of capacitive values). Machine learning classifiers (SVM classifier) recognized genuine and impostor touched body part placements.
Paper was published in 2016 International Performance Computing and Communications Conference

James Palmer, University of Central Arkansas

Oblivious SSSP Algorithm for Graph Processing

Graph algorithms, such as single source shortest path (SSSP), make memory accesses in a predictable and highly input dependent way. Thus, even if memory is encrypted, the memory access pattern will leak information. This vulnerability may be exploited on shared systems in the cloud. We present a single source shortest path algorithm which has an oblivious, or input independent, memory access pattern. The oblivious algorithm has a constant time performance penalty compared to the non oblivious algorithm for the same graph. This constant increases logarithmically as a function of the graph’s degree.

Emanuel Correa Rivera, University of Puerto Rico at Bayaman

Jesse Stern, University of Rochester

Fully-Stateless Steganography

The study of steganography has been around for a long time, but was only recently formalized in a complexity-theoretic manner by Hopper, Langford and von Ahn. One variant of the universal stateful steganographic protocol is that of a stateless protocol. In a stateful steganographic protocol, the two parties wishing to communicate, call them Alice and Bob, have access to a synchronized counter which is often used to refresh a pseudo-random function or draw a psudorandom predicate from a distribution. In the stateless case, no such counter is permitted and Alice and Bob are unable to trivially synchronize such actions. The capabilities of the protocol is further restricted by initiating the study of fully-stateless steganography, where not only is there no access to a synchronized counter, but Alice has no memory between communications of stegotext, repeating the application of the same algorithm repeatedly.