No description available.

No description available.

No description available.

As the practice of renting remote computing resources from a cloud computing platform becomes increasingly popular, the security of such systems is a subject of continued scrutiny. This thesis explores the current state of cloud computing security along with critical components of the cloud computing model. It identifies the need to trust a third party with sensitive information as a substantial obstacle for cloud computing customers. It then proposes a new model, Host-Obscure Computing, for a cloud computing service using secure enclaves and encryption that allows a customer to execute code remotely without exposing sensitive information, including program flow control logic. It presents a proof of concept for a secure cloud computing service using confidential computing technology, cryptography, and an emulator that runs in a secure memory space. It then provides an analysis of its effectiveness at reducing data exposure and its performance impact. Finally, it analyzes this model's advantages and its potential impact on the cloud computing industry. / Master of Science / The use of public cloud computing services continues to rise as a solution to many of the problems associated with on-premises data centers. Customers who would otherwise move to the cloud have resisted this change for security reasons. This research investigates what these security barriers are. Then, it proposes a novel model for a cloud computing service, referred to as Host-Obscure Computing, that is designed to mitigate these issues. Specifically, it addresses the need of a customer to share their program code and working data with the cloud provider. It outlines the development of a prototype implementation of this model. It then presents an analysis of this new service model from both a performance and security perspective. Finally, it suggests how the adoption of a service model similar to Host-Obscure Computing could improve the state of the cloud computing industry.

Dynamic Searchable Symmetric Encryption (DSSE) provides efficient techniques for securely searching and updating an encrypted database. However, efficient DSSE schemes leak some sensitive information to the server. Recent works have implemented forward and backward privacy as security properties to reduce the amount of information leaked during update operations. Many attacks have shown that leakage from search operations can be abused to compromise the privacy of client queries. However, the attack literature has not rigorously investigated techniques to abuse update leakage. In this work, we investigate update leakage under DSSE schemes with forward and backward privacy from the perspective of a passive adversary. We propose two attacks based on a maximum likelihood estimation approach, the UFID Attack and the UF Attack, which target forward-private DSSE schemes with no backward privacy and Level 2 backward privacy, respectively. These are the first attacks to show that it is possible to leverage the frequency and contents of updates to recover client queries. We propose a variant of each attack which allows the update leakage to be combined with search pattern leakage to achieve higher accuracy. We evaluate our attacks against a real-world dataset and show that using update leakage can improve the accuracy of attacks against DSSE schemes, especially those without backward privacy. / Master of Science / Remote data storage is a ubiquitous application made possible by the prevalence of cloud computing. Dynamic Symmetric Searchable Encryption (DSSE) is a privacy-preserving technique that allows a client to search and update a remote encrypted database while greatly restricting the information the server can learn about the client's data and queries. However, all efficient DSSE schemes have some information leakage that can allow an adversarial server to infringe upon the privacy of clients. Many prior works have studied the dangers of leakage caused by the search operation, but have neglected the leakage from update operations. As such, researchers have been unsure about whether update leakage poses a threat to user privacy. To address this research gap, we propose two new attacks which exploit leakage from DSSE update operations. Our attacks are aimed at learning what keywords a client is searching and updating, even in DSSE schemes with forward and backward privacy, two security properties implemented by the strongest DSSE schemes. Our UFID Attack compromises forward-private schemes while our UF Attack targets schemes with both forward privacy and Level 2 backward privacy. We evaluate our attacks on a real-world dataset and show that they efficiently compromise client query privacy under realistic conditions.

Software protection is increasingly necessary for a number of applications, ranging from commercial systems and digital content distributors, to military systems exposed in the field of operations. As computing devices become more pervasive, and software more complex, insufficiencies with current software protection mechanisms have arisen. Software--only and data--only protection systems have resulted in broken systems that are vulnerable to loss of software confidentiality and integrity. A growing number of researchers have suggested that hardware encryption mechanisms be employed to enforce software protection. Although there are several competing architectures, few offer the necessary protection while remaining compatible with modern computing systems and models. The Virginia Tech Secure Software Platform is the first architecture to achieve both increased protection and usability. This thesis presents the design and implementation of a fast, flexible Encryption Management Unit (EMU) for Virginia Tech Secure Software and compatible platforms. The design is capable of providing decryption of program instructions residing in page--sized sections of memory, without modification to the core processor. The effect of the EMU is modeled with varying application types and system loads. Lastly, a benchmark designed to measure actual performance was created to measure the actual performance of the EMU and validate the models. / Master of Science

Hardware devices implementing cryptographic algorithms are finding their way into many applications. As this happens, the ability to keep the data being processed or stored on the device secure grows more important. Power analysis attacks involve cryptographic hardware leaking information during encryption because power consumption is correlated to the key used for encryption. Power analysis attacks have proven successful against public and private key cryptosystems in a variety of form factors. The majority of the countermeasures that have been proposed for this attack are intended for software implementations on a microcontroller. This project focuses on the development of a VHDL tool for investigating power analysis attacks on FPGAs and exploring countermeasures that might be used. The tool developed here counted the transitions of CLB output signals to estimate power and was used to explore the impact of possible gate-level countermeasures to differential power analysis. Using this tool, it was found that only a few nodes in the circuit have a high correlation to bits of the key. This means that modifying only a small portion of the circuit could dramatically increase the difficulty of mounting a differential power analysis attack on the hardware. Further investigation of the correlation between CLB outputs and the key showed that a tradeoff exists between the amount of space required for decorrelation versus the amount of decorrelation that is desired, allowing a designer to determine the amount of correlation that can be removed for available space. Filtering of glitches on CLB output signals slightly reduced the amount of correlation each CLB had. Finally, a decorrelation circuit was proposed and shown capable of decorrelating flip-flop outputs of a CLB, which account for less than 10% of the CLB outputs signals. / Master of Science

In two-way radio systems, talk groups are used to organize communication. Some situations may call for creating a temporary talk group, but there are no straightforward ways to do this. Making a new talk group requires programming radios off-line. Temporary groups can be created, but this requires inputting radio IDs which is tedious on a radio's limited controls. By describing group members using attributes, ciphertext-policy attribute-based encryption (CP-ABE) can be used to quickly create sub-groups of a talk group. This scheme requires fewer button presses and messages sent in the new talk group are kept secret. CP-ABE can be used on deployed hardware, but performance varies with the type of embedded processor and the number of attributes used. Because radio communication is time-critical, care must be taken not to introduce too much audio delay. By using benchmark programs on a variety of single-board computers, we explore the limits of using CP-ABE on a two-way radio.

We live in an age where we willingly provide our social security number, credit card information, home address and countless other sensitive information over the Internet. Whether you are buying a phone case from Amazon, sending in an on-line job application, or logging into your on-line bank account, you trust that the sensitive data you enter is secure. As our technology and computing power become more sophisticated, so do the tools used by potential hackers to our information. In this paper, the underlying mathematics within ciphers will be looked at to understand the security of modern ciphers. An extremely important algorithm in today's practice is the Advanced Encryption Standard (AES), which is used by our very own National Security Agency (NSA) for data up to TOP SECRET. Another frequently used cipher is the RSA cryptosystem. Its security is based on the concept of prime factorization, and the fact that it is a hard problem to prime factorize huge numbers, numbers on the scale of 2^{2048} or larger. Cryptanalysis, the study of breaking ciphers, will also be studied in this paper. Understanding effective attacks leads to understanding the construction of these very secure ciphers.

Video Encryption is nearly the best method for blocking unwanted seizures and viewing of any transmitted video or information. There are several useful techniques that are available for encryping videos. However, one of the unique speciality for human eye is spotting the irregularity in videos due to weak video decoding or weak choice of video encryption hardware. Because of this situation, it is very important to select the right hardware or else our video transmissions may not be secured or our decoded video may be un-watchable. Every technique has advantages and disadvantages over other technical methods.   Line-cut and rotate video encryption method is maybe the best way of acquiring safe, secured and good quality encypted videos. In this method, every line in the video frame cuts and rotates from different points and these cut points are created from a random matrix. The advantage of this method is to supply a coherent video signal, gives an excellent amount of darkness, as well as good decode quality and stableness. On the other hand it’s disadvantages is to have complex timing control and needs specialized encryption equipment.