Refine
Document Type
- Doctoral Thesis (4)
Language
- English (4)
Has Fulltext
- yes (4)
Keywords
- ASIL (1)
- Adversarial Examples (1)
- Adversarial Machine Learning (1)
- Blockchain (1)
- CVSS (1)
- Cryptocurrencies (1)
- Machine Learning (1)
- Safety (1)
- Security (1)
- Technical Debt (1)
Institute
Cyber-physical systems (CPS) security, as a prevalent concern in all
digital industries, must be implemented on different levels of
abstraction. For example, the development of top-down approaches,
e.g., security models and software architectures is equivalent in
importance to the development of bottom-up solutions like the design
of new protocols and languages. This thesis combines research in the
field of CPS security from both approaches and contributes to the
security models of the two lighthouse examples automotive software
engineering and general password security.
Most existing countermeasures against cyberattacks, e.g., the use of message
cryptography, concentrate on concrete attacks and do not consider the
complexity of the various access options offered by modern cyber-physical systems. This is
mainly due to a solution-oriented approach to security problems. The
model-based technique SAM (Security Abstraction Model) adds to the early
phases of (automotive) software architecture development by explicitly
documenting attacks and managing them with the appropriate security
countermeasures. It additionally establishes the basis for comprehensive
security analysis techniques, e.g., already available attack assessment
methods. SAM thus contributes to an early, problem-oriented and
solution-ignorant understanding combining key stakeholder knowledge. This
thesis provides a detailed overview of SAM and the resulting analyses of our
evaluation show that SAM puts the security-by-design principle into practice
by enabling collaboration between automotive system engineers, system
architects and security experts. The application of SAM aims to reduce costs,
improve overall quality and gain competitive advantages. Based on our
evaluation results, SAM is highly suitable, comprehensible and complete to be
used in the industry.
The bottom-up approach focuses on the area of password hardening encryption
(PHE) services as introduced by Lai et al.~at USENIX 2018. PHE is a password-based
key derivation protocol that involves an oblivious external crypto service
for key derivation. The security of PHE protects against offline brute-force
attacks, even when the attacker has full access to the data server.
The obvious evolution of PHE is the extension of the protocol to use multiple
rate-limiters (guardians) to mitigate the single point of failure introduced by
the original scheme.
In the second part of this thesis, a general overview of the motivation and
use cases of PHE is given, along with a new formalization of the protocol to
help the mentioned scalability and availability issues. Moreover, an implementation
of the resulting threshold-based protocol is briefly explained and evaluated. Our
implementation is furthermore tested and evaluated in a novel use case featuring
password hardened encrypted email.
In this dissertation we study and propose new cryptographic locks, that enable fast, secure and private payments in several settings, that are compatible with a wide class of blockchain based cryptocurrencies. As a first step towards achieving this goal, our cryptographic locks have a minimal dependence on the currency itself and its scripting features. A consequence of this is that, currency developers no longer have to incorporate special scripting features to support such payments, given that our locks facilitate them with significantly better security and privacy.
Specifically, in Chapter 3 we give the first generic protocol for payment channel networks, that does not require any special scripts and only requires a signature verification and transaction timestamp verification capability from the scripts of the underlying blockchains. This lets us achieve cross currency payments across any blockchain based cryptocurrency with the above features. We introduce new techniques both at the cryptographic and the transaction layer: lockable signatures and local 3-party channel, respectively, to resolve challenges pertaining to privacy, compatibility and fairness in payments. We also give a highly optimised protocol for the case of BLS signatures that offers competitive performance compared to state of the art protocols. Our protocol can be practically deployed in currencies that use BLS signatures for transaction authentication.
In Chapter 4 we give new practically efficient constructions of verifiable timed signatures (VTS), a cryptographic tool to verifiably commit to digital signatures such that the commitments can be opened in the future. We formalize VTS by giving formal security definitions and give efficient constructions specifically for three signature schemes, BLS, Schnorr and ECDSA, that are widely deployed in cryptocurrency payments. We realize timed payments using VTS, where the validation of a payment is delayed, without using any scripts (like locktime) from the underlying blockchain. We identify several settings like payment channels, payment channel networks, multisig transactions, claim and refund payments, where we can replace the user of the locktime script with our VTS based timed payments.
In Chapter 5 we propose a generic protocol for atomic exchange of (cryptocurrency) coins among two users. The setting of our interest is that the two users want to swap any number of coins from any blockchain based currency. Our generic protocol achieves this property and does not rely on any script from the underlying blockchain, except signature verification for transaction authentication. In terms of techniques, we introduce a new tool that we refer to as multi-lock signatures which can be viewed as a generalization of lockable signatures. We also give a highly optimised protocol when the currencies use Schnorr or ECDSA signatures for authentication.
Machine learning, also known as artificial intelligence, has become a much-researched topic in recent years. Many everyday life applications in a wide variety of fields make use of these powerful self-learning systems. Among such applications are safety-critical software systems, such as autonomous driving systems. However, like any computer system, machine learning systems are not safe from attacks by organizations with malicious intentions.
To analyze how dangerous attacks are to safety-critical systems, we estimate the threat that attacks pose to the systems that contain machine learning and humans, such as road users, if the systems are not secured against attacks. We evaluate attacks on machine learning systems and subsystems in autonomous vehicles and combine both evaluations to assess the actual danger that attacks pose to autonomous vehicles. We find that many attacks are already mitigated by the distributed nature of embedded systems and security measures in place as of today. The greatest threat is posed by attacks that require access to only the inputs and outputs of the machine learning system. These include adversarial example attacks that manipulate inputs to provoke false outputs.
We also conduct interviews with industry experts to analyze how machine learning systems are currently developed in practice and identify areas for potential and need for improvement. As a result of this analysis, we set up a list of requirements that can help create more secure machine learning systems.
Machine learning systems are sensitive to small changes in the input data. For example, when images are slightly manipulated in a specific way they are misclassified even though they were classified correctly before the manipulations were applied. These altered images are called adversarial examples and pose a serious threat. This work deals with this form of attack in more detail and analyzes how the computation of manipulated images can be sped up with the help of masks. We propose an algorithm that selects random pixels in the mask, manipulates them and merges the changes that have the biggest influence on the output of the machine learning system regarding the attackers' goal to create the adversarial example.
We run several experiments using different types and sizes of masks and find that masks can indeed have a positive impact on the effectiveness and efficiency of the attack. In addition, it may be possible to add masks to existing adversarial example attack algorithms, which also improves them. We show this by running experiments using other attack algorithms. We also discuss prerequisites under which an improvement of attack algorithms by using masks is possible.
We combine the various small perturbations that turn images into adversarial examples into a universal adversarial perturbation. This is a special modification that does not cause misclassification for only one image, as is the case with adversarial examples but causes misclassification of multiple images. Our experiments show that the universal adversarial perturbations we compute cause misclassification for a large number of images, but the changes in the images need to be very strong, making them easy for a human to detect. Therefore, universal adversarial perturbations need to be obscured differently. For that we use masks, for example, to perturb only the border of the image. These manipulations could be seen as a decorative element. We also see that it is difficult to compute universal adversarial perturbations that cause misclassification for 100% of the images in a dataset.
While the concept of a mathematical proof is fundamental in mathematics and science, to convince others with a concise argument is an art in itself. From a cryptographic point of view, minimising the communication costs of argument systems is of both theoretical and practical interests. Indeed, proving the validity of mathematical statements is often a central task in many complex cryptographic protocols. Improvements of argument systems therefore have far-reaching consequences. In this dissertation, we further our understanding of succinct arguments by proposing new constructions and applications.
Constructions. Our first question is how short an argument can concretely be. Towards answering, we revisit a classic construction of succinct arguments by Kilian [STOC'92] who compiles a probabilistically checkable proof (PCP) using a vector commitment (VC). In Kilian's scheme, the size of λ many VC openings dominates the proof size. To remove this λ factor, we define and construct subvector commitment (SVC), a generalisation of VC which allows to prove many openings at the cost of one. Replacing the VC in Kilian's construction with an SVC yields an argument system with a public-coin setup, 0.7 KB proof size, and 2^{-80} soundness error under best known attacks. Since traditional PCPs are computationally expensive, we are motivated to design compilers which also accept linear PCPs, where the verifier is given an oracle which evaluates given linear functions on the PCP string. For this we define and construct linear map commitments (LMC) which allow the prover to reveal the image of the committed vector under any given linear map, with proof size independent of the dimensions of the map.
When applying general purpose argument systems such as the above, it is often needed to convert the statements to be proven to those supported by the systems. This conversion process often introduces significant overheads. It is therefore desirable to construct argument systems native for the statements to be proven. Of particular interest are cryptographic relations involving elements of prime-order (bilinear-)groups, which arise naturally in (bilinear-)group-based cryptographic protocols. To build a native argument system for these relations, our starting point is the Bulletproof protocol [EUROCRYPT'16, S&P'18] constructed over a cyclic group of prime order q for proving arithmetic relations over Z_q. We observe that their technique of achieving succinctness can in fact be applied not only to Z_q, but any Z_q-modules in general. By viewing (bilinear-)groups of prime order q as Z_q-modules, we successfully generalise the Bulletproof protocol to prove arithmetic relations over these groups.
Applications. A classic theoretical application of succinct arguments is the construction of (multi-key) homomorphic signatures (MHS). We observe that the unforgeability guarantees of existing MHS schemes are weak -- a single corrupt party could forge a signature of a claimed output of a joint computation, even if the output is impossible given the inputs of the honest parties. We therefore introduce the notion of insider unforgeability for (M)HS and prove that the existence of insider unforgeable (M)HS is almost equivalent to that of succinct non-interactive arguments. Since the latter cannot be proven under falsifiable assumptions with black-box reductions, we obtain an analogous impossibility result for insider unforgeable (M)HS.
We conclude with a practical application of succinct arguments in constructing ring confidential transaction (RingCT) schemes. RingCT constructions typically involve expressing transaction instructions as relations among the cryptographic building blocks, and then proving these relations using succinct argument systems. The main challenge for concrete efficiency lies in finding an argument system and other building blocks which are natively compatible. To this end, we present a generic construction of RingCT from argument systems and other basic tools, and show how to instantiate it with group-based building blocks, such that the relations among them can be natively proven by our generalised Bulletproof protocol. During the process, we also present a formal model of RingCT which we view as an independent definitional contribution.