Skip to main content

Ari Juels

Followers

26

Following

7

Co-authors

7

Public Views

Vanderbilt University

IJSRD - International Journal for Scientific Research and Development

Vanderbilt University

Md. Momin Al Aziz

University of Manitoba

University of Queensland

The University of Queensland, Australia

Harvard Medical School

Interests

Uploads

Papers by Ari Juels

GenoGuard: Protecting Genomic Data Against Brute-Force Attacks

Secure storage of genomic data is of great and increasing importance. The scientific community's ... more Secure storage of genomic data is of great and increasing importance. The scientific community's improving ability to interpret individuals' genetic materials and the growing size of genetic database populations have been aggravating the potential consequences of data breaches. The prevalent use of passwords to generate encryption keys thus poses an especially serious problem when applied to genetic data. Weak passwords can jeopardize genetic data in the short term, but given the multidecade lifespan of genetic data, even the use of strong passwords with conventional encryption can lead to compromise.

Sherlock Holmes and the case of the advanced persistent threat

Proceedings of the 5th Usenix Conference on Large Scale Exploits and Emergent Threats, Apr 24, 2012

ABSTRACT An Advanced Persistent Threat (APT) is a targeted attack against a high-value asset or a... more ABSTRACT An Advanced Persistent Threat (APT) is a targeted attack against a high-value asset or a physical system. Drawing from analogies in the Sherlock Holmes stories of Sir Arthur Conan Doyle, we illustrate potential strategies of deception and evasion available in this setting, and caution against overly narrow characterization of APTs.

Security policy enforcement framework for cloud-based information processing systems

Permacoin: Repurposing Bitcoin Work for Data Preservation

2014 Ieee Symposium on Security and Privacy, May 1, 2014

Funkspiel schemes (an alternative to conventional tamper resistance)

Proceedings of the 7th Acm Conference on Computer and Communications Security, Nov 1, 2000

An Epidemiological Study of Malware Encounters in a Large Enterprise

Proceedings of the 2014 Acm Sigsac Conference, Nov 3, 2014

EPC RFID Tags in Security Applications: Passport Cards, Enhanced Drivers Licenses, and Beyond

Ccs, 2008

EPC (Electronic Product Code) tags are industry-standard RFID devices poised to supplant optical ... more

Key distribution in unidirectional channels with applications to RFID

Cross-Tenant Side-Channel Attacks in PaaS Clouds

Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security - CCS '14, 2014

Two-Party Computing with Encrypted Data

Lecture Notes in Computer Science, 2007

We consider a new model for online secure computation on encrypted inputs in the presence of mali... more We consider a new model for online secure computation on encrypted inputs in the presence of malicious adversaries. The inputs are independent of the circuit computed in the sense that they can be contributed by separate third parties. The model attempts to emulate as closely as possible the model of "Computing with Encrypted Data" that was put forth in 1978 by Rivest, Adleman and Dertouzos which involved a single online message. In our model, two parties publish their public keys in an offline stage, after which any party (i.e., any of the two and any third party) can publish encryption of their local inputs. Then in an on-line stage, given any common input circuit C and its set of inputs from among the published encryptions, the first party sends a single message to the second party, who completes the computation.

GenoGuard: Protecting Genomic Data against Brute-Force Attacks

2015 IEEE Symposium on Security and Privacy, 2015

Secure storage of genomic data is of great and increasing importance. The scientific community's ... more Secure storage of genomic data is of great and increasing importance. The scientific community's improving ability to interpret individuals' genetic materials and the growing size of genetic database populations have been aggravating the potential consequences of data breaches. The prevalent use of passwords to generate encryption keys thus poses an especially serious problem when applied to genetic data. Weak passwords can jeopardize genetic data in the short term, but given the multidecade lifespan of genetic data, even the use of strong passwords with conventional encryption can lead to compromise.

A practical secure physical random bit generator

Proceedings of the 5th ACM conference on Computer and communications security - CCS '98, 1998

Squealing Euros: Privacy Protection in RFID-Enabled Banknotes

Lecture Notes in Computer Science, 2003

Thanks to their broad international acceptance and availability in high denominations, there is w... more Thanks to their broad international acceptance and availability in high denominations, there is widespread concern that Euro banknotes may provide an attractive new currency for criminal transactions. With this in mind, the European Central Bank has proposed to embed small, radio-frequency-emitting identification (RFID) tags in Euro banknotes by 2005 as a tracking mechanism for law enforcement agencies. The ECB has not disclosed technical details regarding its plan. In this paper, we explore some of the risks to individual privacy that RFID tags embedded in currency may pose if improperly deployed. Acknowledging the severe resource constraints of these tags, we propose a simple and practical system that provides a high degree of privacy assurance. Our scheme involves only elementary cryptography. Its effectiveness depends on a careful separation of the privileges offered by optical vs. radio-frequency contact with banknotes, and full exploitation of the limited access-control capabilities of RFID tags.

Error-tolerant password recovery

by Niklas Frykholm and Ari Juels

Proceedings of the 8th ACM conference on Computer and Communications Security - CCS '01, 2001

Many encryption systems require the user to memorize high entropy passwords or passphrases and re... more Many encryption systems require the user to memorize high entropy passwords or passphrases and reproduce them exactly. This is often a difficult task. We propose a more fault-tolerant scheme, where a high entropy key (or password) is derived from a sequence of low entropy passwords. The user is able to recover the correct key if she remembers a certain percentage of the passwords correctly. In contrast to other systems that have been proposed for fault-tolerant passwords, our basic design is provably secure against a computationally unbounded attacker.

Cross-VM side channels and their use to extract private keys

Proceedings of the 2012 ACM conference on Computer and communications security - CCS '12, 2012

ABSTRACT This paper details the construction of an access-driven side-channel attack by which a m... more ABSTRACT This paper details the construction of an access-driven side-channel attack by which a malicious virtual machine (VM) extracts fine-grained information from a victim VM running on the same physical computer. This attack is the first such attack demonstrated on a symmetric multiprocessing system virtualized using a modern VMM (Xen). Such systems are very common today, ranging from desktops that use virtualization to sandbox application or OS compromises, to clouds that co-locate the workloads of mutually distrustful customers. Constructing such a side-channel requires overcoming challenges including core migration, numerous sources of channel noise, and the difficulty of preempting the victim with sufficient frequency to extract fine-grained information from it. This paper addresses these challenges and demonstrates the attack in a lab setting by extracting an ElGamal decryption key from a victim using the most recent version of the libgcrypt cryptographic library.

Cache cookies for browser authentication

2006 IEEE Symposium on Security and Privacy (S&P'06), 2006

Like conventional cookies, cache cookies are data objects that servers store in Web browsers. Cac... more

Drifting Keys: Impersonation detection for constrained devices

2013 Proceedings IEEE INFOCOM, 2013

We introduce Drifting Keys (DKs), a simple new approach to detecting device impersonation. DKs en... more We introduce Drifting Keys (DKs), a simple new approach to detecting device impersonation. DKs enable detection of complete compromise by an attacker of the device and its secret state, e.g., cryptographic keys. A DK evolves within a device randomly over time. Thus a clone device created by the attacker will emit DKs that randomly diverge from those in the original, valid device over time, alerting a trusted verifier to the attack.

Vulnerabilities in First-Generation RFID-enabled Credit Cards

Lecture Notes in Computer Science, 2007

An increasing number of credit cards now contain a tiny wireless computer chip and antenna based ... more An increasing number of credit cards now contain a tiny wireless computer chip and antenna based on RFID (radio frequency identification) and contactless smart card technology. 1 The RFID-enabled credit cards permit contactless payments that are fast, easy, and often more reliable than magnetic stripe card transactions, and only physical proximity (rather than contact) is required between this type of credit card and the reader. An estimated 20 million RFID-enabled credit cards and 150,000 vendor readers are already deployed in the U.S. . According to Visa USA, "This has been the fastest acceptance of new payment technology in the history of the industry" .

Heart-to-heart (H2H)

by Masoud Rostami and Ari Juels

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13, 2013

ABSTRACT We present Heart-to-Heart (H2H), a system to authenticate external medical device contro... more ABSTRACT We present Heart-to-Heart (H2H), a system to authenticate external medical device controllers and programmers to Implantable Medical Devices (IMDs). IMDs, which include pacemakers and cardiac defibrillators, are therapeutic medical devices partially or wholly embedded in the human body. They often have built-in radio communication to facilitate non-invasive reprogramming and data readout. Many IMDs, though, lack well designed authentication protocols, exposing patients to over-the-air attack and physical harm. H2H makes use of ECG (heartbeat data) as an authentication mechanism, ensuring access only by a medical instrument in physical contact with an IMD-bearing patient. Based on statistical analysis of real-world data, we propose and analyze new techniques for extracting time-varying randomness from ECG signals for use in H2H. We introduce a novel cryptographic device pairing protocol that uses this randomness to protect against attacks by active adversaries, while meeting the practical challenges of lightweight implementation and noise tolerance in ECG readings. Finally, we describe an end-to-end implementation in an ARM-Cortex M-3 microcontroller that demonstrates the practicality of H2H in current IMD hardware. Previous schemes have had goals much like those of H2H, but with serious limitations making them unfit for deployment---such as naively designed cryptographic pairing protocols (some of them recently broken). In addition to its novel analysis and use of ECG entropy, H2H is the first physiologically-based IMD device pairing protocol with a rigorous adversarial model and protocol analysis.

Covert channels in privacy-preserving identification systems

Proceedings of the 14th ACM conference on Computer and communications security - CCS '07, 2007

We examine covert channels in privacy-enhanced mobile identification devices where the devices un... more We examine covert channels in privacy-enhanced mobile identification devices where the devices uniquely identify themselves to an authorized verifier. Such devices (e.g. RFID tags) are increasingly commonplace in hospitals and many other environments. For privacy, the device outputs used for identification should "appear random" to any entity other than the verifier, and should not allow physical tracking of device bearers. Worryingly, there already exist privacy breaches for some devices [28] that allow adversaries to physically track users. Ideally, such devices should allow anyone to publicly determine that the device outputs are covert-channel free (CCF); we say that such devices are CCF-checkable. Our main result shows that there is a fundamental tension between identifier privacy and CCFcheckability; we show that the two properties cannot co-exist in a single system. We also develop a weaker privacy model where a continuous observer can correlate appearances of a given tag, but a sporadic observer cannot. We also construct a privacy-preserving tag identification scheme that is CCF-checkable and prove it secure under the weaker privacy model using a new complexity assumption. The main challenge addressed in our construction is the enforcement of public verifiability, which allows a user to verify covert-channel-freeness in her device without managing secret keys external to the device.

GenoGuard: Protecting Genomic Data Against Brute-Force Attacks

Secure storage of genomic data is of great and increasing importance. The scientific community's ... more Secure storage of genomic data is of great and increasing importance. The scientific community's improving ability to interpret individuals' genetic materials and the growing size of genetic database populations have been aggravating the potential consequences of data breaches. The prevalent use of passwords to generate encryption keys thus poses an especially serious problem when applied to genetic data. Weak passwords can jeopardize genetic data in the short term, but given the multidecade lifespan of genetic data, even the use of strong passwords with conventional encryption can lead to compromise.

Sherlock Holmes and the case of the advanced persistent threat

Proceedings of the 5th Usenix Conference on Large Scale Exploits and Emergent Threats, Apr 24, 2012

ABSTRACT An Advanced Persistent Threat (APT) is a targeted attack against a high-value asset or a... more ABSTRACT An Advanced Persistent Threat (APT) is a targeted attack against a high-value asset or a physical system. Drawing from analogies in the Sherlock Holmes stories of Sir Arthur Conan Doyle, we illustrate potential strategies of deception and evasion available in this setting, and caution against overly narrow characterization of APTs.

Security policy enforcement framework for cloud-based information processing systems

Permacoin: Repurposing Bitcoin Work for Data Preservation

2014 Ieee Symposium on Security and Privacy, May 1, 2014

Funkspiel schemes (an alternative to conventional tamper resistance)

Proceedings of the 7th Acm Conference on Computer and Communications Security, Nov 1, 2000

An Epidemiological Study of Malware Encounters in a Large Enterprise

Proceedings of the 2014 Acm Sigsac Conference, Nov 3, 2014

EPC RFID Tags in Security Applications: Passport Cards, Enhanced Drivers Licenses, and Beyond

Ccs, 2008

EPC (Electronic Product Code) tags are industry-standard RFID devices poised to supplant optical ... more

Key distribution in unidirectional channels with applications to RFID

Cross-Tenant Side-Channel Attacks in PaaS Clouds

Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security - CCS '14, 2014

Two-Party Computing with Encrypted Data

Lecture Notes in Computer Science, 2007

We consider a new model for online secure computation on encrypted inputs in the presence of mali... more We consider a new model for online secure computation on encrypted inputs in the presence of malicious adversaries. The inputs are independent of the circuit computed in the sense that they can be contributed by separate third parties. The model attempts to emulate as closely as possible the model of "Computing with Encrypted Data" that was put forth in 1978 by Rivest, Adleman and Dertouzos which involved a single online message. In our model, two parties publish their public keys in an offline stage, after which any party (i.e., any of the two and any third party) can publish encryption of their local inputs. Then in an on-line stage, given any common input circuit C and its set of inputs from among the published encryptions, the first party sends a single message to the second party, who completes the computation.

GenoGuard: Protecting Genomic Data against Brute-Force Attacks

2015 IEEE Symposium on Security and Privacy, 2015

Secure storage of genomic data is of great and increasing importance. The scientific community's ... more Secure storage of genomic data is of great and increasing importance. The scientific community's improving ability to interpret individuals' genetic materials and the growing size of genetic database populations have been aggravating the potential consequences of data breaches. The prevalent use of passwords to generate encryption keys thus poses an especially serious problem when applied to genetic data. Weak passwords can jeopardize genetic data in the short term, but given the multidecade lifespan of genetic data, even the use of strong passwords with conventional encryption can lead to compromise.

A practical secure physical random bit generator

Proceedings of the 5th ACM conference on Computer and communications security - CCS '98, 1998

Squealing Euros: Privacy Protection in RFID-Enabled Banknotes

Lecture Notes in Computer Science, 2003

Thanks to their broad international acceptance and availability in high denominations, there is w... more Thanks to their broad international acceptance and availability in high denominations, there is widespread concern that Euro banknotes may provide an attractive new currency for criminal transactions. With this in mind, the European Central Bank has proposed to embed small, radio-frequency-emitting identification (RFID) tags in Euro banknotes by 2005 as a tracking mechanism for law enforcement agencies. The ECB has not disclosed technical details regarding its plan. In this paper, we explore some of the risks to individual privacy that RFID tags embedded in currency may pose if improperly deployed. Acknowledging the severe resource constraints of these tags, we propose a simple and practical system that provides a high degree of privacy assurance. Our scheme involves only elementary cryptography. Its effectiveness depends on a careful separation of the privileges offered by optical vs. radio-frequency contact with banknotes, and full exploitation of the limited access-control capabilities of RFID tags.

Error-tolerant password recovery

by Niklas Frykholm and Ari Juels

Proceedings of the 8th ACM conference on Computer and Communications Security - CCS '01, 2001

Many encryption systems require the user to memorize high entropy passwords or passphrases and re... more Many encryption systems require the user to memorize high entropy passwords or passphrases and reproduce them exactly. This is often a difficult task. We propose a more fault-tolerant scheme, where a high entropy key (or password) is derived from a sequence of low entropy passwords. The user is able to recover the correct key if she remembers a certain percentage of the passwords correctly. In contrast to other systems that have been proposed for fault-tolerant passwords, our basic design is provably secure against a computationally unbounded attacker.

Cross-VM side channels and their use to extract private keys

Proceedings of the 2012 ACM conference on Computer and communications security - CCS '12, 2012

ABSTRACT This paper details the construction of an access-driven side-channel attack by which a m... more ABSTRACT This paper details the construction of an access-driven side-channel attack by which a malicious virtual machine (VM) extracts fine-grained information from a victim VM running on the same physical computer. This attack is the first such attack demonstrated on a symmetric multiprocessing system virtualized using a modern VMM (Xen). Such systems are very common today, ranging from desktops that use virtualization to sandbox application or OS compromises, to clouds that co-locate the workloads of mutually distrustful customers. Constructing such a side-channel requires overcoming challenges including core migration, numerous sources of channel noise, and the difficulty of preempting the victim with sufficient frequency to extract fine-grained information from it. This paper addresses these challenges and demonstrates the attack in a lab setting by extracting an ElGamal decryption key from a victim using the most recent version of the libgcrypt cryptographic library.

Cache cookies for browser authentication

2006 IEEE Symposium on Security and Privacy (S&P'06), 2006

Like conventional cookies, cache cookies are data objects that servers store in Web browsers. Cac... more

Drifting Keys: Impersonation detection for constrained devices

2013 Proceedings IEEE INFOCOM, 2013

We introduce Drifting Keys (DKs), a simple new approach to detecting device impersonation. DKs en... more We introduce Drifting Keys (DKs), a simple new approach to detecting device impersonation. DKs enable detection of complete compromise by an attacker of the device and its secret state, e.g., cryptographic keys. A DK evolves within a device randomly over time. Thus a clone device created by the attacker will emit DKs that randomly diverge from those in the original, valid device over time, alerting a trusted verifier to the attack.

Vulnerabilities in First-Generation RFID-enabled Credit Cards

Lecture Notes in Computer Science, 2007

An increasing number of credit cards now contain a tiny wireless computer chip and antenna based ... more An increasing number of credit cards now contain a tiny wireless computer chip and antenna based on RFID (radio frequency identification) and contactless smart card technology. 1 The RFID-enabled credit cards permit contactless payments that are fast, easy, and often more reliable than magnetic stripe card transactions, and only physical proximity (rather than contact) is required between this type of credit card and the reader. An estimated 20 million RFID-enabled credit cards and 150,000 vendor readers are already deployed in the U.S. . According to Visa USA, "This has been the fastest acceptance of new payment technology in the history of the industry" .

Heart-to-heart (H2H)

by Masoud Rostami and Ari Juels

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13, 2013

ABSTRACT We present Heart-to-Heart (H2H), a system to authenticate external medical device contro... more ABSTRACT We present Heart-to-Heart (H2H), a system to authenticate external medical device controllers and programmers to Implantable Medical Devices (IMDs). IMDs, which include pacemakers and cardiac defibrillators, are therapeutic medical devices partially or wholly embedded in the human body. They often have built-in radio communication to facilitate non-invasive reprogramming and data readout. Many IMDs, though, lack well designed authentication protocols, exposing patients to over-the-air attack and physical harm. H2H makes use of ECG (heartbeat data) as an authentication mechanism, ensuring access only by a medical instrument in physical contact with an IMD-bearing patient. Based on statistical analysis of real-world data, we propose and analyze new techniques for extracting time-varying randomness from ECG signals for use in H2H. We introduce a novel cryptographic device pairing protocol that uses this randomness to protect against attacks by active adversaries, while meeting the practical challenges of lightweight implementation and noise tolerance in ECG readings. Finally, we describe an end-to-end implementation in an ARM-Cortex M-3 microcontroller that demonstrates the practicality of H2H in current IMD hardware. Previous schemes have had goals much like those of H2H, but with serious limitations making them unfit for deployment---such as naively designed cryptographic pairing protocols (some of them recently broken). In addition to its novel analysis and use of ECG entropy, H2H is the first physiologically-based IMD device pairing protocol with a rigorous adversarial model and protocol analysis.

Covert channels in privacy-preserving identification systems

Proceedings of the 14th ACM conference on Computer and communications security - CCS '07, 2007

We examine covert channels in privacy-enhanced mobile identification devices where the devices un... more We examine covert channels in privacy-enhanced mobile identification devices where the devices uniquely identify themselves to an authorized verifier. Such devices (e.g. RFID tags) are increasingly commonplace in hospitals and many other environments. For privacy, the device outputs used for identification should "appear random" to any entity other than the verifier, and should not allow physical tracking of device bearers. Worryingly, there already exist privacy breaches for some devices [28] that allow adversaries to physically track users. Ideally, such devices should allow anyone to publicly determine that the device outputs are covert-channel free (CCF); we say that such devices are CCF-checkable. Our main result shows that there is a fundamental tension between identifier privacy and CCFcheckability; we show that the two properties cannot co-exist in a single system. We also develop a weaker privacy model where a continuous observer can correlate appearances of a given tag, but a sporadic observer cannot. We also construct a privacy-preserving tag identification scheme that is CCF-checkable and prove it secure under the weaker privacy model using a new complexity assumption. The main challenge addressed in our construction is the enforcement of public verifiability, which allows a user to verify covert-channel-freeness in her device without managing secret keys external to the device.