Projects

Economic Principle Oriented Security Management

Modern security management should be based upon economic principles. For this purpose organisations need data, tools and techniques for the cost-benefit-analysis of security investments as well as methods to integrate the results of that kind of analysis into their overall information security management systems. Our research in this area has three main goals:

1. Identifying methods for providing organisations with accurate data for evaluating security investments and building a system for the sharing of information security relevant data among organisations.
2. Evaluation and development of metrics, tools and techniques for an economically oriented security management.
3. Integrating economic principles into information security management and building a new process model for information security management.

Website Fingerprinting and User Linkability

It is rather easy to protect the confidentiality of the contents of messages using encryption techniques. It is fundamentally more difficult to hide the relationship between sender and receiver of messages, though, because addresses may be required for message routing and thus cannot be encrypted. Protecting communication relationships is especially important on the Internet and similar networks as destination addresses often reveal a lot about the actual contents of the messages.

Our goal is to protect users against traffic analysis attacks infringing users' privacy. Those attacks may allow a passive observer on a network to induce communication relationships and contents of messages via pattern matching and classification techniques from the data mining field. Such attacks may constitute a serious risk for users' privacy as they are difficult to detect and counter. We analyse the extent and risks of two particular attacks, namely website fingerprinting attacks, which allow the identification of websites retrieved over an encrypted line, and user linkability attacks, which enable an attacker to track individual users over multiple sessions solely based on the users' characteristic surfing behaviour. Early results indicate that both attacks can be perpetrated under certain circumstances successfully. We measure the effectiveness of the two attacks for various systems and circumstances using real-life datasets.

Designing and deploying countermeasures that protect users from such attacks is challenging: effective protection usually involves additional traffic or considerably delays, which is inacceptable in many cases. Wide-spread adoption of privacy-enhancing techniques depends on good usability and high efficiency, though. We approach this challenge from two sides: on the one hand we analyse the integration of protective measures like padding and dummy traffic into protocols and systems that already exist today; on the other hand we propose next generation systems that are incompatible with legacy technologies, but may offer superior privacy properties to their users.

gMix: A generic Open Source Framework for Mixes

Mixes are a technique to realize anonymous and unobservable communication. Numerous mixing strategies have been proposed since David Chaum suggested the basic mix concept in 1981. While some practical systems are available, the majority of the proposed mix techniques has never been deployed publically. Our goals are to

1. provide a comprehensive code repository of compatible and easily extensible mix implementations,
2. simplify the process of building new practical mix systems,
3. evaluate existing and new mixing strategies under the same conditions,
4. provide easily accessible solutions for educational purposes.

The implementations are organized in a framework. All source code is released under the GPLv3 on the project website [URL].

Conference: IFIP SEC 2015

We organised the International Conference on ICT Systems Security and Privacy Protection IFIP SEC 2015 in Hamburg.

Security in Vehicular Ad Hoc Networks

Vehicular ad hoc networks (VANETs) have the potential to increase road safety and comfort. Especially because of the road safety functions, there is a strong demand for security in VANETs. Simply using digital signatures and a public key infrastructure (PKI) to protect message integrity is insufficient taking into account multilateral security. Our main goal is to develop a security architecture for VANETs that balances security requirements of all participants. We also try to identify and - if necessary - develop feasible mechanisms that fit in this architecture. Finally, we evaluate the architecture and mechanisms in simulations.

Analysis of Information Security Management Processes within the Telematics system of German Electronic Health Card (2010)

We analysed the Information Security Management Processes for the new German Electronic Health Card. The analysis was conducted based on the international security management standards ISO 27001 and ISO 27002 as well as German Baseline Security protection standards issued by Bundesamt für die Sicherheit in der Informationstechnik. This study was part of a large scale security audit of the telematics system which was bilt up for the Electronic Health Card in Germany.

Conference: Privacy Enhancing Technologies Symposium 2010

We organised the annual conference of the Privacy Enhancing Technologies community in Berlin.

AN.ON: Anonymity.Online (Starke Unbeobachtbarkeit und Anonymität im Internet) sponsored by BMWI

The realization of anonymous and unobservable communication in the Internet is a difficult problem. Most existing systems reduce the security to achieve higher performance. To evaluate the feasibility and costs of anonymity in the Internet and to explore several deployment opportunities we are developing an anonymity system that withstands traffic analysis. Our goal is to develop, implement, evaluate and provide a secure and scaleable technical infrastructure for anonymous communication. [URL]

Visual Cryptography

Visual cryptography was introduced by Moni Naor und Adi Shamir in 1994. In 2005 we dedicated theoretical and practical student projects to this fascinating topic. The projects analysed the underlying mechanisms as well as potential applications for visual cryptography. In addition to that an easy to use GUI-based java program has been developed that can be used to demonstrate the mechanisms behind visual cryptography. The program encrypts and decrypts user-defined images and supports various encryption modes (including threshold schemes as well as encryption of colour and greyscale images) which makes it an ideal choice for teaching and experimenting.

Conference: Sicherheit 2005 sponsored by Gesellschaft für Informatik e.V.(GI) (2005)

We organised the annual meeting and conference of the Gesellschaft für Informatik e.V.(GI) in Regensburg. It included workshops, tutorials, talks and discussions from, with and for IT professionals and was held in the University and in the University Hospital of Regensburg.

Biometric authentication

There have been many years of intensive research on biometric methods that can be used for the purpose of feature-based authentication. A typical application scenario is an access control system that grants access to authorized persons by recognition of their biometric characteristics. This project examined the requirements for biometric authentication, depending on their intended use. Specifically, it was analyzed whether the established methods of face-recognition meet the developed requirements and where the weaknesses of these methods are. For demonstration purposes, a prototype of a face recognition system was developed and tested. In addition, fingerprint systems in the consumer segment were tested regarding their reliability.

Anti Phishing Project

In 2004, a sharp increase in phishing attempts was observed. Therefore this project was initiated to categorize, analyze and evaluate the existing ways to protect against phishing. Based on that a proposal for a new protection mechanism was developed.