The Computer for the 21st Century: Present Security & Privacy Challenges

Leonardo B. Oliveira,Fernando Magno Quintão Pereira,Rafael Misoczki,Diego F. Aranha,Fábio Borges,Michele Nogueira,Michelle Wangham,Min Wu,Jie Liu

DOI: https://doi.org/10.1186/s13174-018-0095-2

2018-01-01

Journal of Internet Services and Applications

Abstract:Software Protection: weakly typed languages, polyglot software, and networked embedded systems.

What problem does this paper attempt to address?

The Computer for the 21st Century: Security & Privacy Challenges after 25 Years

Leonardo B. Oliveira,Fernando Magno Quintao Pereira,Rafael Misoczki,Diego F. Aranha,Fabio Borges,Jie Liu

DOI: https://doi.org/10.1109/icccn.2017.8038394

2017-01-01

Abstract:Decades went by since Mark Weiser published his influential work on how a computer of the 21st century would look like. Over the years, some of the UbiComp features presented in that paper have been gradually adopted by industry players in the technology market. While this technological evolution resulted in many benefits to our society, it has also posed, along the way, countless challenges that we have yet to surpass. In this paper, we address major challenges from two areas that most afflict the UbiComp revolution: security and privacy. We examine open problems on software protection, long-term security, cryptography engineering, and privacy implications. We also point out promising directions towards the solutions of those problems. We claim that if we get all this right, we will turn the science fiction of UbiComp into science fact.
Computer and Network Security

Jaydip Sen,Sidra Mehtab,Michael Ekonde Sone,Veeramreddy Jyothsna,Koneti Munivara Prasad,Rajeev Singh,Teek Parval Sharma,Anton Noskov,Ignacio Velasquez,Angelica Caro,Alfonco Rodriguez,Tamer S. A. Fatayer,Altaf O. Mulani,Pradeep B. Mane,Roshan Chitrakar,Roshan Bhusal,Prajwol Maharjan

DOI: https://doi.org/10.5772/intechopen.78497

2020-07-31

Abstract:In the era of Internet of Things and with the explosive worldwide growth of electronic data volume, and associated need of processing, analysis and storage of such humongous volume of data, several new challenges are faced in protecting privacy of sensitive data and securing systems by designing novel schemes for secure authentication, integrity protection, encryption and non-repudiation. Lightweight symmetric key cryptography and adaptive network security algorithms are in demand for mitigating these challenges. This book presents some of the state-of-the-art research work in the field of cryptography and security in computing and communications. It is a valuable source of knowledge for researchers, engineers, practitioners, graduate and doctoral students who are working in the field of cryptography, network security and security and privacy issues in the Internet of Things (IoT), and machine learning application in security. It will also be useful for faculty members of graduate schools and universities.

Cryptography and Security
Software-based security approach for networked embedded devices

José Ferreira,Alan Oliveira,André Souto,José Cecílio

DOI: https://doi.org/10.48550/arXiv.2303.07975

2023-03-14

Abstract:As the Internet of Things (IoT) continues to expand, data security has become increasingly important for ensuring privacy and safety, especially given the sensitive and, sometimes, critical nature of the data handled by IoT devices. There exist hardware-based trusted execution environments used to protect data, but they are not compatible with low-cost devices that lack hardware-assisted security features. The research in this paper presents software-based protection and encryption mechanisms explicitly designed for embedded devices. The proposed architecture is designed to work with low-cost, low-end devices without requiring the usual changes on the underlying hardware. It protects against hardware attacks and supports runtime updates, enabling devices to write data in protected memory. The proposed solution is an alternative data security approach for low-cost IoT devices without compromising performance or functionality. Our work underscores the importance of developing secure and cost-effective solutions for protecting data in the context of IoT.

Cryptography and Security
Advanced Software Protection Now

Diego Bendersky,Ariel Futoransky,Luciano Notarfrancesco,Carlos Sarraute,Ariel Waissbein

DOI: https://doi.org/10.48550/arXiv.1006.2356

2010-06-12

Abstract:Software digital rights management is a pressing need for the software development industry which remains, as no practical solutions have been acclamaimed succesful by the industry. We introduce a novel software-protection method, fully implemented with today's technologies, that provides traitor tracing and license enforcement and requires no additional hardware nor inter-connectivity. Our work benefits from the use of secure triggers, a cryptographic primitive that is secure assuming the existence of an ind-cpa secure block cipher. Using our framework, developers may insert license checks and fingerprints, and obfuscate the code using secure triggers. As a result, this rises the cost that software analysis tools have detect and modify protection mechanisms. Thus rising the complexity of cracking this system.

Cryptography and Security
Programmable System Security in a Software Defined World–Research Challenges and Opportunities

Guofei Gu,David Ott,Kun Sun GMU,Ehab Al-Shaer,Alvaro Cardenas,Yan Chen,William Enck,Hongxin Hu,Dennis Moreau,Cristina Nita-Rotaru,Don Porter,Mike Reiter,Sandra Scott-Hayward,Srinivasan Seshan

2018-01-01

Abstract:Recent years have seen a dramatic and rapid paradigm shift in computing from static control systems (often implemented in hardware), to dynamic, easily-reconfigurable, software-defined systems. The researchers and practitioners have just begun to scratch the surface of how the ever-increasing software-defined everything (SD-X) changes the landscape of cybersecurity. On one hand, a software-defined world adds potentially new attack surfaces that deserve new research investigation. On the other hand, considering the fact that everything can be defined by the software, now we can have a new playground to redesign the security mechanisms and services. With programmable security, we can also better embrace the new advances in big data and AI to provide more intelligent and adaptive security for the software-defined world. We believe the opportunity is ripe for academics to make foundational contributions, collaboratively with industry, to shape the next 5 years of research in this new space, SPS (Software-defined Programmable Security). Emerging data centers, cloud networks, IoT and edge computing also provide a fertile playground to consider disruptive software-defined programmable security designs. While many research directions are interesting, this report outlines a few high-priority areas:
Trends on Computer Security: Cryptography, User Authentication, Denial of Service and Intrusion Detection

Pablo Daniel Marcillo Lara,Daniel Alejandro Maldonado-Ruiz,Santiago Daniel Arrais Díaz,Lorena Isabel Barona López,Ángel Leonardo Valdivieso Caraguay

2019-03-19

Abstract:The new generation of security threats has been promoted by digital currencies and real-time applications, where all users develop new ways to communicate on the Internet. Security has evolved in the need of privacy and anonymity for all users and his portable devices. New technologies in every field prove that users need security features integrated into their communication applications, parallel systems for mobile devices, internet, and identity management. This review presents the key concepts of the main areas in computer security and how it has evolved in the last years. This work focuses on cryptography, user authentication, denial of service attacks, intrusion detection and firewalls.

Cryptography and Security
Secure Software Development: Issues and Challenges

Sam Wen Ping,Jeffrey Cheok Jun Wah,Lee Wen Jie,Jeremy Bong Yong Han,Saira Muzafar

2023-11-18

Abstract:In recent years, technology has advanced considerably with the introduction of many systems including advanced robotics, big data analytics, cloud computing, machine learning and many more. The opportunities to exploit the yet to come security that comes with these systems are going toe to toe with new releases of security protocols to combat this exploitation to provide a secure system. The digitization of our lives proves to solve our human problems as well as improve quality of life but because it is digitalized, information and technology could be misused for other malicious gains. Hackers aim to steal the data of innocent people to use it for other causes such as identity fraud, scams and many more. This issue can be corrected during the software development life cycle, integrating security across the development phases, and testing of the software is done early to reduce the number of vulnerabilities that might or might not heavily impact an organisation depending on the range of the attack. The goal of a secured system software is to prevent such exploitations from ever happening by conducting a system life cycle where through planning and testing is done to maximise security while maintaining functionality of the system. In this paper, we are going to discuss the recent trends in security for system development as well as our predictions and suggestions to improve the current security practices in this industry.

Cryptography and Security,Software Engineering
Software and Cyber Security-A Survey

Jian LIU,Pu-Rui SU,Min YANG,Liang HE,Yuan ZHANG,Xue-Yang ZHU,Hui-Min LIN

DOI: https://doi.org/10.13328/j.cnki.jos.005320

2018-01-01

Journal of Software

Abstract:The Internet has penetrated into all aspects of human society and has greatly promoted social progress.At the same time,various forms of cybercrimes and network theft occur frequently,bringing great harm to our society and national security.Cyber security has become a major concern to the public and the government.As a large number of Internet functionalities and applications are implemented by software,software plays a crucial role in cyber security research and practice.In fact,almost all cyberattacks were carried out by exploiting vulnerabilities in system software or application software.It is increasingly urgent to investigate the problems of software security in the new age.This paper reviews the state of the art of malware,software vulnerabilities and software security mechanism,and analyzes the new challenges and trends that the software ecosystem is currently facing.
Information Security and Privacy in the Digital World: Some Selected Topics

Jaydip Sen,Joceli Mayer,Subhasis Dasgupta,Subrata Nandi,Srinivasan Krishnaswamy,Pinaki Mitra,Mahendra Pratap Singh,Naga Prasanthi Kundeti,Chandra Sekhara Rao MVP,Sudha Sree Chekuri,Seshu Babu Pallapothu,Preethi Nanjundan,Jossy P. George,Abdelhadi El Allahi,Ilham Morino,Salma AIT Oussous,Siham Beloualid,Ahmed Tamtaoui,Abderrahim Bajit

DOI: https://doi.org/10.5772/intechopen.100776

2024-03-30

Abstract:In the era of generative artificial intelligence and the Internet of Things, while there is explosive growth in the volume of data and the associated need for processing, analysis, and storage, several new challenges are faced in identifying spurious and fake information and protecting the privacy of sensitive data. This has led to an increasing demand for more robust and resilient schemes for authentication, integrity protection, encryption, non-repudiation, and privacy-preservation of data. The chapters in this book present some of the state-of-the-art research works in the field of cryptography and security in computing and communications.

Cryptography and Security,Machine Learning
Software Security Analysis in 2030 and Beyond: A Research Roadmap

Marcel Böhme,Eric Bodden,Tevfik Bultan,Cristian Cadar,Yang Liu,Giuseppe Scanniello

2024-09-26

Abstract:As our lives, our businesses, and indeed our world economy become increasingly reliant on the secure operation of many interconnected software systems, the software engineering research community is faced with unprecedented research challenges, but also with exciting new opportunities. In this roadmap paper, we outline our vision of Software Security Analysis for the software systems of the future. Given the recent advances in generative AI, we need new methods to evaluate and maximize the security of code co-written by machines. As our software systems become increasingly heterogeneous, we need practical approaches that work even if some functions are automatically generated, e.g., by deep neural networks. As software systems depend evermore on the software supply chain, we need tools that scale to an entire ecosystem. What kind of vulnerabilities exist in future systems and how do we detect them? When all the shallow bugs are found, how do we discover vulnerabilities hidden deeply in the system? Assuming we cannot find all security flaws, how can we nevertheless protect our system? To answer these questions, we start our research roadmap with a survey of recent advances in software security, then discuss open challenges and opportunities, and conclude with a long-term perspective for the field.

Software Engineering,Cryptography and Security
Template for Preparation of Manuscripts for Tsinghua Science and Technology

Rui Chang,Liehui Jiang,Wenzhi Chen,Yaobin Xie,Zhongyong Lu

2016-01-01

Abstract:The run-time security guarantee is a hotspot in current cyberspace security research, especially on embedded terminals, e.g., smart hardware, wearable devices, mobile devices. Typically, these devices use universal hardware and software to connect with public network by internet, and are probably open to security threats from Trojan, virus and other malware. As a result, not only personal sensitive data is threatened, economic interests in industry are also compromised. To address the run-time security problems efficiently, first a TrustEnclave-based secure architecture is proposed, and the trusted execution environment is constructed by hardware isolation technology. Then the prototype system is implemented on real TrustZone-enabled hardware devices. Last, both analytical and experimental evaluations are given in the end. The experimental results demonstrate that the proposed security scheme is effective and feasible.
Analysis of Human Awareness of Security and Privacy Threats in Smart Environments

Luca Caviglione,Jean-Francois Lalande,Wojciech Mazurczyk,Steffen Wendzel

DOI: https://doi.org/10.48550/arXiv.1502.00868

2015-02-03

Abstract:Smart environments integrate Information and Communication Technologies (ICT) into devices, vehicles, buildings and cities to offer an increased quality of life, energy efficiency and economical sustainability. In this perspective, the individual has a core role and so has networking, which enables such entities to cooperate. However, the huge amount of sensitive data, social aspects and the mixed set of protocols offer many opportunities to inject hazards, exfiltrate information, mass profiling of citizens, or produce a new wave of attacks. This work reviews the major risks arising from the usage of ICT-techniques for smart environments, with emphasis on networking. Its main contribution is to explain the role of different stakeholders for causing a lack of security and to envision future threats by considering human aspects.

Computers and Society,Cryptography and Security
Inter-Disciplinary Research Challenges in Computer Systems for the 2020S

Albert Cohen,Xipeng Shen,Josep Torrellas,James Tuck,Yirui Zhou,Sarita V. Adve,İsmail Aktürk,Saurabh Bagchi,Rajeev Balasubramonian,Rajkishore Barik,Micah Beck,Ras Bodik,Ali R. Butt,Luís Ceze,Haibo Chen,Yiran Chen,Trishul Chilimbi,Mihai Christodorescu,John Criswell,Chen Ding,Yufei Ding,Sandhya Dwarkadas,Erik Elmroth,Phil Gibbons,Xiaochen Guo,Rajesh K. Gupta,Gernot Heiser,Hank Hoffman,Jian Huang,Hillery C. Hunter,John Kim,Serina King,James R. Larus,Chen Liu,Shan Lu,Brandon Lucia,Saeed Maleki,Somnath Mazumdar,Iulian Neamtiu,Keshav Pingali,Paolo Rech,Michael L. Scott,Yan Solihin,Dawn Song,Jakub Szefer,Dan Tsafrir,Bhuvan Urgaonkar,Marilyn Wolf,Yuan Xie,Jishen Zhao,Lin Zhong,Yuhao Zhu

2018-01-01

Abstract:The broad landscape of new technologies currently being explored makes the current times very exciting for computer systems research. The community is actively researching an extensive set of topics, ranging from the small (e.g., energy-independent embedded devices) to the large (e.g., brain-scale deep learning), simultaneously addressing technology discontinuities (End of Moore's Law and EnergyWall), new challenges in security and privacy, and the rise of artificial intelligence (AI). While industry is applying some of these technologies, its efforts are necessarily focused on only a few areas, and on relatively short-term horizons. This offers academic researchers the opportunity to attack the problems with a broader and longer-term view. Further, in recent times, the computer systems community has started to pay increasing attention to non-performance measures, such as security, complexity, and power. To make progress in this multi-objective world, the composition of research teams needs to change. Teams have to become inter-disciplinary, enabling the flow of ideas across computing fields. While many research directions are interesting, this report outlines a few high-priority areas where inter-disciplinary research is likely to have a high payoff: a) Developing the components for a usable planet-scale Internet of Things (IoT), with provably energy-efficient devices. This report envisions a highly-available, geographically distributed, heterogeneous large-scale IoT system with the same efficiency, maintainability, and usability as today's data centers. This planet-scale IoT will be populated by many computationally-sophisticated IoT devices that are ultra-low power and operate energy-independently. b) Rethinking the hardware-software security contract in the age of AI. In light of the recent security vulnerabilities, this report argues for building hardware abstractions that communicate security guarantees, and for allowing software to communicate its security and privacy requirements to the hardware. Further, security and privacy mechanisms should be integrated into the disruptive emerging technologies that support AI. c) Making AI a truly dependable technology that is usable by all the citizens in all settings. As AI frameworks automate an increasing number of critical operations, this report argues for end-to-end dependable AI, where both the hardware and the software are understood and verified. Further, AI needs to turn from a centralized tool into a capability easily usable by all the citizens in all settings to meet an ever expanding range of needs. d) Developing solutions to tackle extreme complexity, possibly based on formal methods. This report argues for the need to tame the explosion of system complexity and heterogeneity by creating new abstractions and complexity-management solutions. Such solutions need to be accessible to domain experts. An important step towards this goal is to scale out and extend formal methods for the real world. This report also describes other, related research challenges.
Information Security Underlying Transparent Computing: Impacts, Visions and Challenges.

Yaoxue Zhang,Laurence Tianruo Yang,Yuezhi Zhou,Wenyuan Kuang

DOI: https://doi.org/10.3233/wia-2010-0187

2010-01-01

Abstract:The rapid development of computer network technologies and social informationalization has brought many new opportunities and challenges in information security. With improved information and service sharing enjoyed by more and more people, how to strengthen the information security has become an increasingly critical issue. In this paper, we propose a new network security mechanism based on a novel computing paradigm, i.e., transparent computing, which is based on the extended von Neumann architecture. This paradigm separates the program storage and execution, which is implemented in the network environment. It is realized by a new generation server and client BIOS, namely EFI BIOS, and coordinated with the MetaOS management platform and related switching and input/ouput devices of transparent computing. Through the interface between hardware and software, it conducts effective control, monitoring and management of data and instructions in a block-streaming way for the operating system and the application programs above it. At the same time, it adopts a security protection mechanism to prevent and remove prevalent malicious software such as worm and Trojan horse. Several demonstrated examples are described in detail to illustrate the attractive and promising security features and advantages.
SoK: Eternal War in Memory

Laszlo Szekeres,Mathias Payer,Tao Wei,Dawn Song

DOI: https://doi.org/10.1109/sp.2013.13

2013-01-01

Abstract:Memory corruption bugs in software written in low-level languages like C or C++ are one of the oldest problems in computer security. The lack of safety in these languages allows attackers to alter the program's behavior or take full control over it by hijacking its control flow. This problem has existed for more than 30 years and a vast number of potential solutions have been proposed, yet memory corruption attacks continue to pose a serious threat. Real world exploits show that all currently deployed protections can be defeated. This paper sheds light on the primary reasons for this by describing attacks that succeed on today's systems. We systematize the current knowledge about various protection techniques by setting up a general model for memory corruption attacks. Using this model we show what policies can stop which attacks. The model identifies weaknesses of currently deployed techniques, as well as other proposed protections enforcing stricter policies. We analyze the reasons why protection mechanisms implementing stricter polices are not deployed. To achieve wide adoption, protection mechanisms must support a multitude of features and must satisfy a host of requirements. Especially important is performance, as experience shows that only solutions whose overhead is in reasonable bounds get deployed. A comparison of different enforceable policies helps designers of new protection mechanisms in finding the balance between effectiveness (security) and efficiency. We identify some open research problems, and provide suggestions on improving the adoption of newer techniques.
Advances in Security in Computing and Communications

Jaydip Sen,Javier Franco-Contreras,Gouenou Coatrieux,Nilay K Sangani,Haroot Zarger,Faouzi Jaidi,Bob Duncan,Alfred Bratterud,Andreas Happe,Chin-Feng Lin,Che-Wei Liu,Walid Elgeanidi,Muftah Fraifer,Thomas Newe,Eoin OConnell,Avijit Mathur,Ruolin Zhang,Eric Filiol

DOI: https://doi.org/10.5772/65228

2017-07-29

Abstract:In the era of Internet of Things (IoT) and with the explosive worldwide growth of electronic data volume, and associated need of processing, analysis, and storage of such humongous volume of data, several new challenges are faced in protect-ing privacy of sensitive data and securing systems by designing novel schemes for secure authentication, integrity protection, encryption, and non-repudiation. Lightweight symmetric key cryptography and adaptive network security algo-rithms are in demand for mitigating these challenges. This book presents some of the state-of-the-art research work in the field of cryptography and security in computing and communications. It is a valuable source of knowledge for re-searchers, engineers, practitioners, graduates, and doctoral students who are working in the field of cryptography, network security, and security and privacy issues in the Internet of Things (IoT). It will also be useful for faculty members of graduate schools and universities.

Cryptography and Security
Future Scenarios and Challenges for Security and Privacy

Meredydd Williams,Louise Axon,Jason R. C. Nurse,Sadie Creese

DOI: https://doi.org/10.48550/arXiv.1807.05746

2018-07-16

Computers and Society

Abstract:Over the past half-century, technology has evolved beyond our wildest dreams. However, while the benefits of technological growth are undeniable, the nascent Internet did not anticipate the online threats we routinely encounter and the harms which can result. As our world becomes increasingly connected, it is critical we consider what implications current and future technologies have for security and privacy. We approach this challenge by surveying 30 predictions across industry, academia and international organisations to extract a number of common themes. Through this, we distill 10 emerging scenarios and reflect on the impact these might have on a range of stakeholders. Considering gaps in best practice and requirements for further research, we explore how security and privacy might evolve over the next decade. We find that existing guidelines both fail to consider the relationships between stakeholders and do not address the novel risks from wearable devices and insider threats. Our approach rigorously analyses emerging scenarios and suggests future improvements, of crucial importance as we look to pre-empt new technological threats.
Software Vulnerabilities, Banking Threats, Botnets and Malware Self-Protection Technologies

Wajeb Gharibi,Abdulrahman Mirza

DOI: https://doi.org/10.48550/arXiv.1105.1720

2011-05-09

Networking and Internet Architecture

Abstract:Information security is the protection of information from a wide range of threats in order to ensure success business continuity by minimizing risks and maximizing the return of investments and business opportunities. In this paper, we study and discuss the software vulnerabilities, banking threats, botnets and propose the malware self-protection technologies.
The computer for the 21 st century

Mark Weiser

DOI: https://doi.org/10.1145/329124.329126

1999-07-01

ACM SIGMOBILE Mobile Computing and Communications Review

Abstract:Specialized elements of hardware and software, connected by wires, radio waves and infrared, will be so ubiquitous that no one will notice their presence.

English Else

The Computer for the 21st Century: Present Security & Privacy Challenges

The Computer for the 21st Century: Security & Privacy Challenges after 25 Years

Computer and Network Security

Software-based security approach for networked embedded devices

Advanced Software Protection Now

Programmable System Security in a Software Defined World–Research Challenges and Opportunities

Trends on Computer Security: Cryptography, User Authentication, Denial of Service and Intrusion Detection

Secure Software Development: Issues and Challenges

Software and Cyber Security-A Survey

Information Security and Privacy in the Digital World: Some Selected Topics

Software Security Analysis in 2030 and Beyond: A Research Roadmap

Template for Preparation of Manuscripts for Tsinghua Science and Technology

Analysis of Human Awareness of Security and Privacy Threats in Smart Environments

Inter-Disciplinary Research Challenges in Computer Systems for the 2020S

Information Security Underlying Transparent Computing: Impacts, Visions and Challenges.

SoK: Eternal War in Memory

Advances in Security in Computing and Communications

Future Scenarios and Challenges for Security and Privacy

Software Vulnerabilities, Banking Threats, Botnets and Malware Self-Protection Technologies

The computer for the 21 st century