Refine
Departments, institutes and facilities
- Institut für Cyber Security & Privacy (ICSP) (307) (remove)
Document Type
- Conference Object (201)
- Article (60)
- Part of a Book (13)
- Book (monograph, edited volume) (7)
- Contribution to a Periodical (7)
- Doctoral Thesis (5)
- Conference Proceedings (4)
- Preprint (4)
- Report (3)
- Lecture (2)
Year of publication
Keywords
- Usable Security (11)
- DPA (6)
- Privacy (6)
- Robotics (6)
- HTTP (5)
- security (5)
- Cloud (4)
- GDPR (4)
- Machine Learning (4)
- Power Analysis (4)
- REST (4)
- Risk-based Authentication (4)
- Usable Privacy (4)
- Web (4)
- Authentication (3)
- Big Data Analysis (3)
- Cooperative Awareness Message (3)
- Fault analysis (3)
- IP protection (3)
- Intelligent Transport System (3)
- Java <Programmiersprache> (3)
- Pseudonym Concept (3)
- Python <Programmiersprache> (3)
- SOA (3)
- Security (3)
- Side Channel Analysis (3)
- Stochastic Model (3)
- Vehicular Ad hoc Networks (3)
- visualization (3)
- web caching (3)
- web services (3)
- Basic Access Control (2)
- Boolean Masking (2)
- Cloud Security (2)
- Computersicherheit (2)
- E-Passport (2)
- Embedded software (2)
- Host-Based Code Injection Attacks (2)
- Human-Centered Design (2)
- LOTUS Sensor Node (2)
- MESD (2)
- MRTD (2)
- Malware (2)
- Malware analysis (2)
- Memory forensics (2)
- Mobility modeling (2)
- Password (2)
- Public Key Infrastructure (2)
- Rapid Prototyping (2)
- Risk-based Authentication (RBA) (2)
- SEMA (2)
- SOAP (2)
- Side Channel Cryptanalysis (2)
- Side-channel analysis (2)
- Smart Card (2)
- Software (2)
- TLS (2)
- Template Attack (2)
- Testing (2)
- TinyECC 2.0 (2)
- Usable Security and Privacy (2)
- User Interface Design (2)
- Vehicle-to-Vehicle Communication (2)
- WS-Security (2)
- Wireless Sensor Network (2)
- XML Signature (2)
- XML Signature Wrapping (2)
- knowledge learning (2)
- neural networks (2)
- usable privacy (2)
- virtual reality (2)
- AES (1)
- AES hardware (1)
- AMD Family 15h (1)
- API Documentation (1)
- API usability (1)
- ARM Cortex M3 Processor (1)
- Account (Datenverarbeitung) (1)
- Account Security (1)
- Adaptive Media Streaming (1)
- Adaptive Streaming (1)
- Advance Encryption Standard (1)
- Adversarial Model (1)
- Affective computing (1)
- Agent-oriented software engineering (1)
- Analysis (1)
- Antifuse memory (1)
- Artificial Intelligence (1)
- Assistive robots (1)
- Attacks and Attack Implementations (1)
- Authentication features (1)
- Authentifikation (1)
- Authorship watermark (1)
- Autonomous Systems (1)
- Bag of Features (1)
- Beacon Chain (1)
- Behaviour-Driven Development (1)
- Benchmarking (1)
- Biometrics (1)
- Black Hole (1)
- Block cipher (1)
- Boolean and arithmetic operations (1)
- Botnet tracking (1)
- Botnets (1)
- Browser cache (1)
- COPACOBANA (1)
- CPA (1)
- CPUID instruction (1)
- CRT (1)
- CUDA (1)
- Cache Poisoning (1)
- Cache line fingerprinting (1)
- Cache-independent (1)
- Certificates (1)
- Chip ID (1)
- Cipher Block Chain (1)
- Cloud Computing security (1)
- Cloud Malware Injection (1)
- Cloud Standards (1)
- CoAP (1)
- Code Generation (1)
- Code similarity analysis (1)
- Common Criteria (1)
- Component Models (1)
- Computer Security (1)
- Conficker (1)
- Conformance Testing (1)
- Content Security Policies (1)
- Conversational Interface (1)
- Cooperative Intelligent Transport Systems (ITS) (1)
- Counterfeit protection (1)
- Countermeasures (1)
- Covert channel (1)
- Cross-core (1)
- Cryptography (1)
- Cyber Attacks (1)
- Cyber Security (1)
- Cybercrime (1)
- Cybercrime Legislation (1)
- Cypher (1)
- D [Software] (1)
- DASH (1)
- DEMA (1)
- DES (1)
- DFA Lab (1)
- DNSSEC (1)
- DPA Lab (1)
- Data Compression (1)
- Data Generation (1)
- Data Protection Officer (1)
- Data Reduction (1)
- Data Tiles (1)
- Denial of Service (1)
- Design patterns (1)
- Developer Centered Security (1)
- Difference-coding (1)
- Differential Side Channel Cryptanalysis (1)
- Differential analysis (1)
- Differential side-channel analysis (1)
- Differentielle Kryptoanalyse (1)
- Digital Ecosystem (1)
- Digital signatures (1)
- Digital watermarking (1)
- Disaster Area (1)
- Disaster area scenario (1)
- Distance Bounding (1)
- Domain Expert (1)
- Domain-Specific Modeling Languages, (1)
- Domestic service robots (1)
- E-Health (1)
- EM Algorithm (1)
- EM leakage (1)
- Earth Observation (1)
- Eclipse Modeling Framework (1)
- Eingebettetes System (1)
- Electromagnetic Analysis (1)
- Electronic Immobilizer (1)
- Elliptic Curve Cryptography (1)
- Employee Privacy (1)
- Employee data protection (1)
- Ethereum (1)
- Evaluation (1)
- Expert Interviews (1)
- Explainability (1)
- FPGA implementation (1)
- Fake Link (1)
- Fault Channel Watermarking Lab (1)
- Fault-channel watermarks (1)
- Fehlerbehandlung (1)
- File carving (1)
- Fingerprint watermark (1)
- Fragmented files (1)
- Frontend architecture (1)
- Full-text Search (1)
- Gaussian Mixture Models (1)
- Graphics Cards (1)
- HMAC-construction (1)
- HTML5 (1)
- HTTPS (1)
- Hardware Testbed (1)
- Header whitelisting (1)
- High-Order Attacks (1)
- Higher-Order Analysis (1)
- Higher-Order Side Channel Analysis (1)
- Human factors (1)
- Human robot interaction (1)
- Human-Robot Interaction (1)
- Human-Robot-Interaction (HRI) (1)
- Human-agent interaction (1)
- Humanoid Robot (1)
- IC identification (1)
- IDEA (1)
- ISO 27000 (1)
- IT-Sicherheitsanforderungen (1)
- Implementation Attack (1)
- Implementation Challenges (1)
- Information Privacy (1)
- Information hiding (1)
- Informational self-determination (1)
- Informationssicherheit (1)
- Instruction scheduling (1)
- Integrate Development Environment (1)
- Interactive Smart Card Applications (1)
- Intermediaries (1)
- Internet Technology (1)
- IoT services security (1)
- JOSE (1)
- JPEGs (1)
- JSON (1)
- Key Search Machine (1)
- Language Engineering (1)
- Large-Scale Online Services (1)
- Leakage circuits (1)
- Legal metrology (1)
- Live Streaming (1)
- Login (1)
- MRTD Cracker (1)
- Mafia Attack (1)
- Malware Detection (1)
- Manipulation tasks (1)
- Maximum Likelihood Principle (1)
- Mental Models (1)
- Message Authentication (1)
- Microarchitectural Data Sampling (MDS) (1)
- Microservices (1)
- Minimum Principle (1)
- Mobility Model (1)
- Model-Based Software Development (1)
- Model-Driven Engineering (1)
- Model-based Approach (1)
- Model-based engineering approaches to AI safety (1)
- Model-driven Development (1)
- Model-driven engineering (1)
- Motion Generator (1)
- Motor Control Unit (1)
- Multi-hop Net-works (1)
- Multimedia Communication (1)
- Multimedia forensics (1)
- Multithreaded and multicore architecture (1)
- Multivariate Analyse (1)
- Multivariate Side Channel Analysis (1)
- Neural Machine Translation (1)
- Online Services (1)
- OpenStack (1)
- PHR (1)
- Partial Data Protection (1)
- Partial Signature (1)
- PartialEncryption (1)
- Password Masking (1)
- Password Visualization (1)
- Passwords (1)
- Passwort (1)
- People Detection (1)
- Performance (1)
- Performance Analysis (1)
- Performance Evaluation (1)
- Periodic structures (1)
- Personal Health Record (1)
- Phishing (1)
- Physical Security (1)
- Physikalischer Effekt (1)
- Plagiat (1)
- Privacy engineering (1)
- Privacy in the workplace (1)
- Privacy patterns (1)
- Privacy perceptions (1)
- Process Models (1)
- Proof of Stake (1)
- Public Key Infrastructures (1)
- Push-based Streaming (1)
- QoS (1)
- RACS (1)
- RBAR (1)
- RC6 (1)
- REST security (1)
- RF Eavesdropper (1)
- RFID (1)
- RGB-D (1)
- RSA (1)
- Rank correlation (1)
- Re-authentication (1)
- Reference Architectural Model Automotive (RAMA) (1)
- Requirements (1)
- Requirements Engineering (1)
- Restful Web Services (1)
- Reusable Software (1)
- Right to Informational Self-Determination (1)
- Risk-Based Account Recovery (1)
- Robot Perception (1)
- Robot software (1)
- Robotics competitions (1)
- Robots (1)
- Runtime AI safety monitoring (1)
- Runtime Adaptation (1)
- SAML (1)
- SELMA (1)
- SHA-1 (1)
- SQL (1)
- SaaS (1)
- ScalarMultiplication (1)
- Schutzobjekte (1)
- Second-Order DPA (1)
- Secure Cloud Storage (1)
- Secure Coding Practices (1)
- Secure data transfer (1)
- Security APIs (1)
- Security Approaches (1)
- Security Protocol (1)
- Seitenkanalattacke (1)
- Semantic gap (1)
- Semantic scene understanding (1)
- Semi-Virtual Testbed (1)
- Service-Oriented Architecture (1)
- Sichere Kommunikation Kritische Infrastrukturen (1)
- Side Channel Countermeasures (1)
- Side Channel Cryptanalysis, Stochastic Methods (1)
- Side Channel Watermarking Lab (1)
- Side channel attack (1)
- Side channels (1)
- Side-channel watermarking (1)
- Similarity matrix (1)
- Simulator (1)
- Smart Card User Interface Design, Interactive Smart Card Applications (1)
- SmartMANET Jamming (1)
- Software Architectures (1)
- Software Development Process (1)
- Software IP protection (1)
- Software Security (1)
- Software and Architecture (1)
- Software reverse engineering (1)
- Stream cipher (1)
- Stuxnet (1)
- Support Vector Machine (1)
- TOGBAD (1)
- Tactical Wireless Multi-hop Networks (1)
- Tamper-Proof Hardware (1)
- Tampering (1)
- Template Attacks (1)
- Template attacks (1)
- Templates (1)
- Testing Tool (1)
- Thin Client (1)
- Timing analysis (1)
- Timing channel (1)
- Transponder (1)
- Trusted Computing (1)
- Two-factor Authentication (1)
- UAV teleoperation (1)
- UI-Dressing (1)
- URI (1)
- Usability (1)
- User experience design (1)
- User-Centered Design (1)
- User-centered privacy engineering (1)
- VLSI (1)
- Variability Management (1)
- Variability Resolution (1)
- Vehicle-2-Infrastructure Kommunikation (1)
- Vehicle-2-Vehicle Communication (1)
- Vehicle-2-Vehicle Kommunikation (1)
- Vehicle-to- Vehicle Communication (V2V) (1)
- Vehicle-to-Infrastructure Communication (1)
- Vehicle-to-Infrastructure Communication (V2I) (1)
- Vehicle-to-Vehicle Com- munication (1)
- Vehicular Ad hoc Networks (VANETs) (1)
- Video (1)
- Warnings (1)
- Watermarking (1)
- Web Browser (1)
- Web Browser Cache (1)
- Web Information Systems and Technologies (1)
- Web Interfaces and Applications (1)
- Web Portal (1)
- Web Security (1)
- Web Service (1)
- Web Service Security (1)
- Web Services and Web Engineering (1)
- WebSocket (1)
- WebSockets (1)
- Wind Fields (1)
- Wind Flow Visualization (1)
- Wireless multi-hop networks (1)
- Wizard of Oz (1)
- Workflow (1)
- Worm Hole (1)
- XAI (1)
- XML (1)
- XML Security (1)
- XSpRES (1)
- ZombieLoad (1)
- analyses (1)
- analysis (1)
- attacks (1)
- benchmarking (1)
- blockchain (1)
- caching (1)
- classifier combination (1)
- clustering (1)
- cognitive agents (1)
- component based (1)
- cooperation (1)
- crawling (1)
- cryptanalytic attacks (1)
- cryptographic apis (1)
- denial-of-service (1)
- developer console (1)
- distributed systems (1)
- domestic robots (1)
- eavesdropping (1)
- embedded systems (1)
- emotion recognition (1)
- employee privacy (1)
- end-to-end security (1)
- factor analysis (1)
- feature extraction (1)
- focus groups (1)
- force sensing (1)
- human-centred design (1)
- humanoidrobot (1)
- industrial robots (1)
- informational self-determination (1)
- interactive-learning (1)
- intervention mechanisms (1)
- intrusion detection (1)
- latent class analysis (1)
- link quality (1)
- machine learning (1)
- manipulation (1)
- mental models (1)
- model-driven engineering (1)
- modular reduction (1)
- multi robot systems (1)
- network (1)
- neural-networks (1)
- object categorization (1)
- participatory design (1)
- privacy at work (1)
- privacy by design (1)
- property-based testing for robots (1)
- radio-frequency identification (RFID) systems (1)
- remote-controlled robots (1)
- reproducible node motion (1)
- reverse engineering, malware, machine learning (1)
- robot competitions (1)
- robotics (1)
- routing attacks (1)
- routing metrics (1)
- run-time adaptation (1)
- security and privacy literacy (1)
- security warning design (1)
- sensor fusion (1)
- services (1)
- signature (1)
- simulation (1)
- simulation-based robot testing (1)
- slip detection (1)
- smartcard (1)
- social robots (1)
- software development (1)
- software variability (1)
- structural equation modeling (1)
- tactical environments (1)
- tactical multi-hop networks (1)
- tactile sensing (1)
- transparency-enhancing technologies (1)
- usable privacy controls (1)
- usable secure email (1)
- user interface design (1)
- verification and validation of robot action execution (1)
- virtual-reality (1)
- web (1)
- web services security (1)
- website (1)
- wormhole detection (1)
XML Encryption and XML Signature are fundamental security standards forming the core for many applications which require to process XML-based data. Due to the increased usage of XML in distributed systems and platforms such as in SOA and Cloud settings, the demand for robust and effective security mechanisms increased as well. Recent research work discovered, however, substantial vulnerabilities in these standards as well as in the vast majority of the available implementations. Amongst them, the so-called XML Signature Wrapping attack belongs to the most relevant ones. With the many possible instances of this attack type, it is feasible to annul security systems relying on XML Signature and to gain access to protected resources as has been successfully demonstrated lately for various Cloud infrastructures and services. This paper contributes a comprehensive approach to robust and effective XML Signatures for SOAP-based Web Services. An architecture is proposed, which integrates the r equired enhancements to ensure a fail-safe and robust signature generation and verification. Following this architecture, a hardened XML Signature library has been implemented. The obtained evaluation results show that the developed concept and library provide the targeted robustness against all kinds of known XML Signature Wrapping attacks. Furthermore the empirical results underline, that these security merits are obtained at low efficiency and performance costs as well as remain compliant with the underlying standards.
XML Signature Wrapping (XSW) has been a relevant threat to web services for 15 years until today. Using the Personal Health Record (PHR), which is currently under development in Germany, we investigate a current SOAP-based web services system as a case study. In doing so, we highlight several deficiencies in defending against XSW. Using this real-world contemporary example as motivation, we introduce a guideline for more secure XML signature processing that provides practitioners with easier access to the effective countermeasures identified in the current state of research.
Routing Attacks are a serious threat to communication in tactical MANETs. TOGBAD is a centralised approach, using topology graphs to detect such attacks. In this paper, we present TOGBAD's newly added wormhole detection capability. It is an adaptation of a wormhole detection method developed by Hu et al. This method is based on nodes' positions. We adapted it to the specific properties of tactical environments. Furthermore, we present simulation results which show TOGBAD's performance regarding the detection of wormhole attacks.
Der Arbeitskreis Usable Security & Privacy bietet ein Forum für den Gedankenaustausch und die interdisziplinäre Zusammenarbeit rund um das Thema benutzerfreundliche Informationssicherheit und privatheitsfördernde Technologien. Sicherheit ist bei der Anschaffung von Software und Technikprodukten zwar eines der zentralen Auswahlkriterien – aufgrund mangelnder Gebrauchstauglichkeit werden die vorhandenen Sicherheitsfunktionen und -mechanismen von den Nutzern jedoch oft falsch oder überhaupt nicht bedient. Im alltäglichen Gebrauch ergeben sich hierdurch Sicherheitsgefährdungen beim Umgang mit IKT-Systemen bzw. -Produkten und den darin enthaltenen sensiblen Daten. Im Workshop werden mit den Teilnehmern Beispiele diskutiert und es wird gemeinsam ein Stimmungsbild zum Verständnis, zum Stellenwert und zum aktuellen Grad der Umsetzung von Usable Security & Privacy erhoben. Ergebnis des Workshops ist ein Positionspapier, in dem die aktuellen Problemfelder und die wichtigsten Herausforderungen aus Sicht der Usability und UX Professionals beschrieben sind.
In education, finding the appropriate learning pace that fits to the members of a large group is a challenging task. This becomes especially evident when teaching multidisciplinary subjects such as epidemiology in medicine or computer science in most study programs, since lecturers have to face a very heterogeneous state of previous knowledge. Approaching this issue requires an individual supervision of each and every student, which is obviously bounded by the available resources. Moreover, when referring back to the second example, writing computer programs requires a complex installation and configuration of development tools. Many beginning programmers already become stuck at this entry stage. This paper introduces WHELP, a Web-based Holistic E-Learning Platform, which provides an integrated environment enabling the learning and teaching of computer science topics without the need to install any software. Moreover, WHELP includes an interactive feedback system for each programming exercise, where lecturers or tutors can supply comments, improvements, code assistance or tips helping the students to accomplish their tasks. Furthermore, WHELP offers a statistical analysis module as well as a real-time classroom polling system both promoting an overview of the state of knowledge of a course. In addition to that, WHELP enables collaborative working including code-sharing and peer-to-peer learning. This feature enables students to work on exercises simultaneously at distinct places. WHELP has been successfully deployed in the winter term 2013 at the Cologne University of Applied Sciences supporting the 120 students and 3 lecturers to learn and teach basic topics of computer science in an engineering study program.
Risk-based authentication (RBA) aims to strengthen password-based authentication rather than replacing it. RBA does this by monitoring and recording additional features during the login process. If feature values at login time differ significantly from those observed before, RBA requests an additional proof of identification. Although RBA is recommended in the NIST digital identity guidelines, it has so far been used almost exclusively by major online services. This is partly due to a lack of open knowledge and implementations that would allow any service provider to roll out RBA protection to its users.
To close this gap, we provide a first in-depth analysis of RBA characteristics in a practical deployment. We observed N=780 users with 247 unique features on a real-world online service for over 1.8 years. Based on our collected data set, we provide (i) a behavior analysis of two RBA implementations that were apparently used by major online services in the wild, (ii) a benchmark of the features to extract a subset that is most suitable for RBA use, (iii) a new feature that has not been used in RBA before, and (iv) factors which have a significant effect on RBA performance. Our results show that RBA needs to be carefully tailored to each online service, as even small configuration adjustments can greatly impact RBA's security and usability properties. We provide insights on the selection of features, their weightings, and the risk classification in order to benefit from RBA after a minimum number of login attempts.
Dieses Buch führt Sie umfassend in die WebSocket-Technik und die damit einhergehenden neuen Entwicklungsmöglichkeiten ein. Unter den zahlreichen exemplarischen Anwendungen finden sich Beispiele auf Basis von Node.js, Vert.x, und JSR 356, als Programmiersprachen werden Java und JavaScript eingesetzt.
WebSocket - WS^2 2.0
(2015)
Das Websocket-Protokoll hat sich derzeit zu einer wichtigen Technologie für die Entwicklung moderner Webanwendungen durchgesetzt. Mit der Möglichkeit eine dauerhafte bidirektionale Verbindung zwischen Client und Server aufzubauen, ergeben sich neue Anwendungsszenarien, die vorher mit dem reinen HTTP nicht realisierbar waren. Die Einsatzgebiete reichen hier von einfachen Chats bis hin zu komplexen Systemen wie das kollaborative Arbeiten an Dokumenten in Echtzeit. Mittlerweile hat sogar der Instant Messaging-Dienst WhatsApp die Vorteile der WebSocket-Technologie für sich entdeckt und erlaubt Benutzern ihre Nachrichten nun auch über den Webbrowser auszutauschen.
Dieser Workshop soll den Teilnehmern zeigen wie sie die oben genannten oder andere Echzeitwebanwendungen mit der WebSocket-Technologie implementieren können. Nach einer kurzen Einführung wird gezeigt wie es in einfachen Schritten möglich ist, mehr als nur simple Chat-Anwendungen mit den WebSocket-Protokoll zu realisieren. Zudem stellt der Workshop nach Möglichkeit auch die Verwendung von Subprotokollen vor, wodurch auch RPC- sowie Publish and Subscribe-Anwendungen mit WebSockets umgesetzt werden können.
Web of Services Security
(2015)
Software development is a complex task. Merely focussing on functional requirements is not sufficient any more. Developers are responsible to take many non-functional requirements carefully into account. Security is amongst the most challenging, as getting it wrong will result in a large user-base being potentially at risk. A similar situation exists for administrators. Security defaults have been put into place here to encounter lacking security controls. As first attempts to establish security by default in software development are flourishing, the question on their usability for developers arises.
In this paper we study the effectiveness and efficiency of Content Security Policy (CSP) enforced as security default in a web framework. When deployed correctly, CSP is a valid protection mean in a defence-in-depth strategy against code injection attacks. In this paper we present a first qualitative laboratory study with 30 participants to discover how developers deal with CSP when deployed as security default. Our results emphasize that the deployment as security default has its benefits but requires careful consideration of a comprehensive information flow in order to improve and not weaken security. We provide first insights to inform research about aiding developers in the creation of secure web applications with usable security by default.
Echtzeit-orientierte Multimedia-Kommunikation im Internet eröffnet eine Vielzahl neuer Anwendungen. Diese innovative Kommunikationsplattform ist gerade für weltweit operierende Unternehmen von Interesse. So können z.B. durch die Verwendung von VoIP-Lösungen oder Groupware-Applikationen Kosten gesenkt und gleichzeitig die Zusammenarbeit der Mitarbeiter optimiert werden. Dies trifft auch für Video-Konferenzsysteme zu. Anstelle regelmäßiger Meetings, die meist mit Dienstreisen eines Großteils der Teilnehmer verbunden sind, können Konferenzen virtuell durch die Übertragung von Sprachund Videodaten über das Internet abgehalten werden. Die Akzeptanz der beschriebenen Kommunikationsanwendungen hängt stark von den Faktoren Dienstgüte und Sicherheit ab. Die Übertragung der echtzeit-orientierten Mediendaten muss möglichst kontinuierlich erfolgen, so dass sowohl eine ruckelfreie Wiedergabe der Sprache als auch der Bewegtbilder möglich ist. Da Konferenzen firmenintern und vertraulich sind, werden sie hinter verschlossener Tür abgehalten. Das Pendant in der elektronischen Welt muss eine Entsprechung anbieten. Se- curity-Mechanismen haben allerdings einen Einfluss auf Dienstgüteparameter. Dies muss bei der Entwicklung von Techniken zum Schutz multimedialer Kommunikation berücksichtigt und abgestimmt werden. Dieser Beitrag zeigt anhand des Beispiels eines Video-Konferenzsystems für das Internet, wie Sicherheitsmechanismen in echtzeit-orientierte Multimedia-Kommunikationsanwendungen unter Berücksichtigung von Quality of Service (QoS) integriert werden können.