223 citations · 768 across the 51 of their papers we have counts for
51 papers
PARseL: Towards a Verified Root-of-Trust over seL4
Ivan De Oliveira Nunes, Seoyeon Hwang, Sashidhar Jakkamsetti +2
Widespread adoption and growing popularity of embedded/IoT/CPS devices make them attractive attack targets. On low-to-mid-range devices, security features are typically few or none…
Thermal (and Hybrid Thermal/Audio) Side-Channel Attacks on Keyboard Input
Tyler Kaczmarek, Ercan Ozturk, Pier Paolo Tricomi +1
To date, there has been no systematic investigation of thermal profiles of keyboards, and thus no efforts have been made to secure them. This serves as our main motivation for cons…
CASU: Compromise Avoidance via Secure Update for Low-end Embedded Systems
Ivan De Oliveira Nunes, Sashidhar Jakkamsetti, Youngil Kim +1
Guaranteeing runtime integrity of embedded system software is an open problem. Trade-offs between security and other priorities (e.g., cost or performance) are inherent, and resolv…
Privacy-from-Birth: Protecting Sensed Data from Malicious Sensors with VERSA
Ivan De Oliveira Nunes, Seoyeon Hwang, Sashidhar Jakkamsetti +1
There are many well-known techniques to secure sensed data in IoT/CPS systems, e.g., by authenticating communication end-points, encrypting data before transmission, and obfuscatin…
V'CER: Efficient Certificate Validation in Constrained Networks
David Koisser, Patrick Jauernig, Gene Tsudik +1
We address the challenging problem of efficient trust establishment in constrained networks, i.e., networks that are composed of a large and dynamic set of (possibly heterogeneous)…
Vronicle: A System for Producing Videos with Verifiable Provenance
Yuxin, Liu, Yoshimichi Nakatsuka +3
Demonstrating the veracity of videos is a longstanding problem that has recently become more urgent and acute. It is extremely hard to accurately detect manipulated videos using co…
VICEROY: GDPR-/CCPA-compliant Enforcement of Verifiable Accountless Consumer Requests
Scott Jordan, Yoshimichi Nakatsuka, Ercan Ozturk +2
Recent data protection regulations (such as GDPR and CCPA) grant consumers various rights, including the right to access, modify or delete any personal information collected about…
DIALED: Data Integrity Attestation for Low-end Embedded Devices
Ivan De Oliveira Nunes, Sashidhar Jakkamsetti, Gene Tsudik
Verifying integrity of software execution in low-end micro-controller units (MCUs) is a well-known open problem. The central challenge is how to securely detect software exploits w…
GAROTA: Generalized Active Root-Of-Trust Architecture
Esmerald Aliaj, Ivan De Oliveira Nunes, Gene Tsudik
In this paper, we set out to systematically design a minimal active RoT for tiny low-end MCU-s. We begin with the following questions: (1) What functions and hardware support are r…
Tiny-CFA: A Minimalistic Approach for Control-Flow Attestation Using Verified Proofs of Execution
Ivan De Oliveira Nunes, Sashidhar Jakkamsetti, Gene Tsudik
The design of tiny trust anchors has received significant attention over the past decade, to secure low-end MCU-s that cannot afford expensive security mechanisms. In particular, h…
On the Root of Trust Identification Problem
Ivan De Oliveira Nunes, Xuhua Ding, Gene Tsudik
Root of Trust Identification (RTI) refers to determining whether a given security service or task is being performed by the particular root of trust (e.g., a TEE) within a specific…
CACTI: Captcha Avoidance via Client-side TEE Integration
Yoshimichi Nakatsuka, Ercan Ozturk, Andrew Paverd +1
Preventing abuse of web services by bots is an increasingly important problem, as abusive activities grow in both volume and variety. CAPTCHAs are the most common way for thwarting…
On the TOCTOU Problem in Remote Attestation
Ivan De Oliveira Nunes, Sashidhar Jakkamsetti, Norrathep Rattanavipanon +1
We propose Remote Attestation with TOCTOU Avoidance (RATA): a provably secure approach to address the RA TOCTOU problem. With RATA, even malware that erases itself before execution…
PDoT: Private DNS-over-TLS with TEE Support
Yoshimichi Nakatsuka, Andrew Paverd, Gene Tsudik
Security and privacy of the Internet Domain Name System (DNS) have been longstanding concerns. Recently, there is a trend to protect DNS traffic using Transport Layer Security (TLS…
A Verified Architecture for Proofs of Execution on Remote Devices under Full Software Compromise
Ivan De Oliveira Nunes, Karim Eldefrawy, Norrathep Rattanavipanon +1
Modern society is increasingly surrounded by, and accustomed to, a wide range of Cyber-Physical Systems (CPS), Internet-of-Things (IoT), and smart devices. They often perform safet…
PILOT: Password and PIN Information Leakage from Obfuscated Typing Videos
Kiran Balagani, Matteo Cardaioli, Mauro Conti +10
This paper studies leakage of user passwords and PINs based on observations of typing feedback on screens or from projectors in the form of masked characters that indicate keystrok…
Formally Verified Hardware/Software Co-Design for Remote Attestation
Ivan De Oliveira Nunes, Karim Eldefrawy, Norrathep Rattanavipanon +2
In this work, we take the first step towards formal verification of Remote Attestation (RA) by designing and verifying an architecture called VRASED: Verifiable Remote Attestation…
Thermanator: Thermal Residue-Based Post Factum Attacks On Keyboard Password Entry
Tyler Kaczmarek, Ercan Ozturk, Gene Tsudik
As a warm-blooded mammalian species, we humans routinely leave thermal residues on various objects with which we come in contact. This includes common input devices, such as keyboa…
ASSURED: Architecture for Secure Software Update of Realistic Embedded Devices
N. Asokan, Thomas Nyman, Norrathep Rattanavipanon +2
Secure firmware update is an important stage in the IoT device life-cycle. Prior techniques, designed for other computational settings, are not readily suitable for IoT devices, si…
Assentication: User Deauthentication and Lunchtime Attack Mitigation with Seated Posture Biometric
Tyler Kaczmarek, Ercan Ozturk, Gene Tsudik
Biometric techniques are often used as an extra security factor in authenticating human users. Numerous biometrics have been proposed and evaluated, each with its own set of benefi…
ERASMUS: Efficient Remote Attestation via Self- Measurement for Unattended Settings
Xavier Carpent, Norrathep Rattanavipanon, Gene Tsudik
Remote attestation (RA) is a popular means of detecting malware in embedded and IoT devices. RA is usually realized as an interactive protocol, whereby a trusted party -- verifier…
Lights, Camera, Action! Exploring Effects of Visual Distractions on Completion of Security Tasks
Bruce Berg, Tyler Kaczmarek, Alfred Kobsa +1
Human errors in performing security-critical tasks are typically blamed on the complexity of those tasks. However, such errors can also occur because of (possibly unexpected) senso…
HYDRA: HYbrid Design for Remote Attestation (Using a Formally Verified Microkernel)
Karim ElDefrawy, Norrathep Rattanavipanon, Gene Tsudik
Remote Attestation (RA) allows a trusted entity (verifier) to securely measure internal state of a remote untrusted hardware platform (prover). RA can be used to establish a static…
FADEWICH: Fast Deauthentication over the Wireless Channel
Mauro Conti, Giulio Lovisotto, Ivan Martinovic +1
Both authentication and deauthentication are instrumental for preventing unauthorized access to computer and data assets. While there are obvious motivating factors for using stron…