Today’s smartphone operating systems frequently fail to provide users with visibility into how third-party applications collect and share their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid enables realtime analysis by leveraging Android’s virtualized execution environment. TaintDroid incurs only 32p performance overhead on a CPU-bound microbenchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, in our 2010 study we found 20 applications potentially misused users’ private information; so did a similar fraction of the tested applications in our 2012 study. Monitoring the flow of privacy-sensitive data with TaintDroid provides valuable input for smartphone users and security service firms seeking to identify misbehaving applications.

/pdf/taintdroid-an-information-flow-tracking-system-for-realtime-5d8smsr0iy.pdf

TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones

Today's smartphone operating systems frequently fail to provide users with adequate control over and visibility into how third-party applications use their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid provides realtime analysis by leveraging Android's virtualized execution environment. TaintDroid incurs only 14% performance overhead on a CPU-bound micro-benchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, we found 68 instances of potential misuse of users' private information across 20 applications. Monitoring sensitive data with TaintDroid provides informed use of third-party applications for phone users and valuable input for smartphone security service firms seeking to identify misbehaving applications.

/pdf/taintdroid-an-information-flow-tracking-system-for-realtime-3fnz9lwdso.pdf

TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones

Ordered Binary-Decision Diagrams (OBDDs) represent Boolean functions as directed acyclic graphs. They form a canonical representation, making testing of functional properties such as satisfiability and equivalence straightforward. A number of operations on Boolean functions can be implemented as graph algorithms on OBDD data structures. Using OBDDs, a wide variety of problems can be solved through symbolic analysis. First, the possible variations in system parameters and operating conditions are encoded with Boolean variables. Then the system is evaluated for all variations by a sequence of OBDD operations. Researchers have thus solved a number of problems in digital-system design, finite-state system analysis, artificial intelligence, and mathematical logic. This paper describes the OBDD data structure and surveys a number of applications that have been solved by OBDD-based symbolic analysis.

/pdf/symbolic-boolean-manipulation-with-ordered-binary-decision-cpwxp0mluy.pdf

Symbolic Boolean manipulation with ordered binary-decision diagrams

Physical Unclonable Functions (PUFs) are innovative circuit primitives that extract secrets from physical characteristics of integrated circuits (ICs). We present PUF designs that exploit inherent delay characteristics of wires and transistors that differ from chip to chip, and describe how PUFs can enable low-cost authentication of individual ICs and generate volatile secret keys for cryptographic operations.

/pdf/physical-unclonable-functions-for-device-authentication-and-4tsc0jtbn3.pdf

Physical unclonable functions for device authentication and secret key generation

Physical Unclonable Functions for Device Authentication and Secret Key Generation

National Science Foundation (U.S.). Graduate Research Fellowship Program (Grant DGE-0946797)

Path ORAM: An Extremely Simple Oblivious RAM Protocol

Identification, authentication, and integrity checking are important tasks for ensuring the security and protection of valuable objects, devices, programs, and data. The utilization of the microscopic, random, and unclonable disorder of physical media for such security tasks has recently gained increasing attention. Wherever applicable, the harnessing of disorder can lead to intriguing advantages: First, it can avoid the permanent storage of digital secret keys in vulnerable hardware, promising to make the resulting systems more resilient against invasive and malware attacks. Second, random physical disorder has the natural feature of being very hard to clone and to forge: Fully controlling the micro- and nanoscale fabrication variations in physical media is extremely difficult and, even if possible, prohibitively expensive. Third, utilization of the natural disorder and entropy in physical systems can sometimes enable cryptographic protocols whose security does not rest on the usual unproven number-theoretic assumptions like factoring and discrete log, creating an alternate foundation for cryptography. Physical Unclonable Functions or PUFs are perhaps the best known representative of this new class of “disordered” cryptoprimitives, but there are also others. In this chapter, we provide a classification for past and ongoing work in physical disorder based security alongside with security analyses and implementation examples. We will also outline some open problems and future research opportunities in the area.

Security Based on Physical Unclonability and Disorder

A key is determined from a volatile response using circuitry on the device. The volatile response depend on process variation in fabrication of the device. Error control data that depends on the first volatile response can be computed, stored externally to the device, and then used to generate the key using a volatile response using the circuit. Applications of volatile keys include authentication and rights management for content and software.

Volatile device keys and applications thereof

This paper proposes a novel approach for efficient implementation of a real-valued arbiter-based physical unclon-able function (PUF) on FPGA. We introduce a high resolution programmable delay logic (PDL) implemented by lookup table (LUT) internal structure. Using the PDL, we perform fine tuning to cancel out delay skews caused by asymmetries in routing and systematic variations. We devise a symmetric switch structure that can be easily implemented on FPGA. To mitigate the arbiter metastability problem, we present and analyze methods for majority voting of responses. Lastly, a method to classify and group challenges into different robustness sets is introduced, to further increase the corresponding responses' stability in the face of environmental variations. Experimental evaluations show that the responses to robust challenges have an average error rate of less than 2% under temperature variations from −10°C to 75°C.

/pdf/fpga-puf-using-programmable-delay-lines-5gugxp3pjt.pdf

FPGA PUF using programmable delay lines

DSP architectures typically provide indirect addressing modes with autoincrement and decrement. In addition, indexing mode is generally not available, and there are usually few, if any, general-purpose registers. Hence, it is necessary to use address registers and perform address arithmetic to access automatic variables. Subsuming the address arithmetic into autoincrement and decrement modes improves the size of the generated code. In this article we present a formulation of the problem of optimal storage assignment such that explicit instructions for address arithmetic are minimized. We prove that for the case of a single address register the decision problem is NP-complete, even for a single basic block. We then generalize the problem to multiple address registers. For both cases heuristic algorithms are given, and experimental results are presented.

Srinivas Devadas

Papers

Path ORAM: An Extremely Simple Oblivious RAM Protocol

Security Based on Physical Unclonability and Disorder

Volatile device keys and applications thereof

FPGA PUF using programmable delay lines

Storage assignment to decrease code size