Marian Margraf

Bio: Marian Margraf is an academic researcher from Free University of Berlin. The author has contributed to research in topics: Arbiter & Physical unclonable function. The author has an hindex of 8, co-authored 20 publications receiving 141 citations.

Splitting the Interpose PUF: A novel modeling attack strategy

Abstract: We demonstrate that the Interpose PUF proposed at CHES 2019, an Arbiter PUF-based design for so-called Strong Physical Unclonable Functions (PUFs), can be modeled by novel machine learning strategies up to very substantial sizes and complexities. Our attacks require in the most difficult cases considerable, but realistic, numbers of CRPs, while consuming only moderate computation times, ranging from few seconds to few days. The attacks build on a new divide-and-conquer approach that allows us to model the two building blocks of the Interpose PUF separately. For non-reliability based Machine Learning (ML) attacks, this eventually leads to attack times on (kup, kdown)-Interpose PUFs that are comparable to the ones against max{kup, kdown}-XOR Arbiter PUFs, refuting the original claim that Interpose PUFs could provide security similar to (kdown + kup/2)-XOR Arbiter PUFs (CHES 2019). On the technical side, our novel divide-and-conquer technique might also be useful in analyzing other designs, where XOR Arbiter PUF challenge bits are unknown to the attacker.

Enhancing Breeder Document Long-Term Security Using Blockchain Technology

Abstract: In contrast to electronic travel documents (e.g. ePassports), the standardisation of breeder documents (e.g. birth certificates), regarding harmonisation of content and contained security features is in statu nascendi. Due to the fact that breeder documents can be used as an evidence of identity and enable the application for electronic travel documents, they pose the weakest link in the identity life cycle and represent a security gap for identity management. In this work, we present a cost efficient way to enhance the long-term security of breeder documents by utilizing blockchain technology. A conceptual architecture to enhance breeder document long-term security and an introduction of the concept's constituting system components is presented. Our investigations provide evidence that the Bitcoin blockchain is most suitable for breeder document long-term security.

An overview of touchless 2D fingerprint recognition

Abstract: Touchless fingerprint recognition represents a rapidly growing field of research which has been studied for more than a decade Through a touchless acquisition process, many issues of touch-based systems are circumvented, eg, the presence of latent fingerprints or distortions caused by pressing fingers on a sensor surface However, touchless fingerprint recognition systems reveal new challenges In particular, a reliable detection and focusing of a presented finger as well as an appropriate preprocessing of the acquired finger image represent the most crucial tasks Also, further issues, eg, interoperability between touchless and touch-based fingerprints or presentation attack detection, are currently investigated by different research groups Many works have been proposed so far to put touchless fingerprint recognition into practice Published approaches range from self identification scenarios with commodity devices, eg, smartphones, to high performance on-the-move deployments paving the way for new fingerprint recognition application scenariosThis work summarizes the state-of-the-art in the field of touchless 2D fingerprint recognition at each stage of the recognition process Additionally, technical considerations and trade-offs of the presented methods are discussed along with open issues and challenges An overview of available research resources completes the work

Sicherheitsmechanismen für kontaktlose Chips im deutschen elektronischen Personalausweis: Ein Überblick über Sicherheitsmerkmale, Risiken und Gegenmaßnahmen

Abstract: Dieser Artikel gibt einen Uberblick uber die Ziele und die Funktion der Sicherheitsmechanismen, wie sie voraussichtlich im deutschen elektronischen Personalausweis zur Anwendung kommen.

On the Application of Homomorphic Encryption to Face Identification

Abstract: The data security and privacy of enrolled subjects is a critical requirement expected from biometric systems. This paper addresses said topic in facial biometric identification. In order to fulfil the properties of unlinkability, irreversibility, and renewability of the templates required for biometric template protection schemes, homomorphic encryption is utilised. In addition to achieving the aforementioned objectives, the use of homomorphic encryption ensures that the biometric performance remains completely unaffected by the template protection scheme.The main contributions of this paper are: It proposes an architecture of a system capable of performing biometric identification in the encrypted domain, as well as provides and evaluates an implementation using two existing homomorphic encryption schemes. Furthermore, it discusses the pertinent technical considerations and challenges in this context.

A Survey of Blockchain Technology Applied to Smart Cities: Research Issues and Challenges

Abstract: In recent years, the rapid urbanization of world’s population causes many economic, social, and environmental problems, which affect people’s living conditions and quality of life significantly. The concept of “smart city” brings opportunities to solve these urban problems. The objectives of smart cities are to make the best use of public resources, provide high-quality services to the citizens, and improve the people’s quality of life. Information and communication technology plays an important role in the implementation of smart cities. Blockchain as an emerging technology has many good features, such as trust-free, transparency, pseudonymity, democracy, automation, decentralization, and security. These features of blockchain are helpful to improve smart city services and promote the development of smart cities. In this paper, we provide a comprehensive survey on the literature involving blockchain technology applied to smart cities. First, the related works and background knowledge are introduced. Then, we review how blockchain technology is applied in the realm of smart cities, from the perspectives of smart citizen, smart healthcare, smart grid, smart transportation, supply chain management, and others. Finally, some challenges and broader perspectives are discussed.

Efficient U-Prove Implementation for Anonymous Credentials on Smart Cards

Abstract: In this paper we discuss an efficient implementation of anonymous credentials on smart cards. In general, privacy-preserving protocols are computationally intensive and require the use of advanced cryptography. Implementing such protocols for smart cards involves a trade-off between the requirements of the protocol and the capabilities of the smart card. In this context we concentrate on the implementation of Microsoft’s U-Prove technology on the MULTOS smart card platform. Our implementation aims at making the smart card independent of any other resources, either computational or storage. In contrast, Microsoft suggests an alternative approach based on device-protected tokens which only uses the smart card as a security add-on. Given our very good performance results we argue that our approach should be considered in favour of Microsoft’s one. Furthermore we provide a brief comparison between Java Card and MULTOS which illustrates our choice to implement this technology on the latter more flexible and low-level platform rather than the former.

Voltage Over-scaling-based Lightweight Authentication for IoT Security

Abstract: It is a challenging task to deploy lightweight security protocols in resource-constrained IoT applications. A hardware-oriented lightweight authentication protocol based on device signature generated during voltage over-scaling (VOS) was recently proposed to address this issue. VOS-based authentication employs the computation unit such as adders to generate the process variation dependent error which is combined with secret keys to create a two-factor authentication protocol. In this paper, machine learning (ML)-based modeling attacks to break such authentication is presented. We also propose a \underline{c}hallenge \underline{s}elf-\underline{o}bfuscation \underline{s}tructure (CSoS) which employs previous challenges combined with keys or random numbers to obfuscate the current challenge for the VOS-based authentication to resist ML attacks. Experimental results show that ANN, RNN and CMA-ES can clone the challenge-response behavior of VOS-based authentication with up to 99.65% prediction accuracy, while the prediction accuracy is less than 51.2% after deploying our proposed ML resilient technique. In addition, our proposed CSoS also shows good obfuscation ability for strong PUFs. Experimental results show that the modeling accuracies are below 54% when $10^6$ challenge-response pairs (CRPs) are collected to model the CSoS-based Arbiter PUF with ML attacks such as LR, SVM, ANN, RNN and CMA-ES.

Research on the Security Criteria of Hash Functions in the Blockchain

Abstract: The blockchain is an emerging technology. Because of its efficiency and functionality, it is widely considered to have revolutionary application prospects. As a supporting part of the data structure, the hash function is important for ensuring the availability and security of the blockchain. To evaluate the security of blockchain technology it is important to analyze several security criteria of the hash functions used in the blockchain. This paper focuses on two security criteria-hiding and puzzle-friendliness-that the hash function should satisfy in the blockchain proposed by Narayanan et al. (Narayanan A, Bonneau J, Felten E, et al. Bitcoin and Cryptocurrency Technologies: A Comprehensive Introduction. Princeton University Press, 2016). Under the framework of Rogaway?Shrimpton's theory, their definitions are mathematically described and their relation is proved. Also, comparisons between the two criteria and traditional ones in hash functions are made. The conclusions of this paper point out that for hash functions, it is harder to break hiding and puzzle-friendliness than to break preimage resistance, which shows that hash functions proven to be preimage-resistant or tested by preimage cryptanalysis like SHA256 tend to be enough to be used in the corresponding parts of the blockchain design. At the same time, from the attackers' view the conclusions can provide a theoretical basis for studying the potential attacks on and defects that may exist in the structure of the hash functions applied in the blockchain.