| Title | Securing Mobile Data Collectors by Integrating Software Attestation and Encrypted Data Repositories |
| Publication Type | Conference Paper |
| Year of Publication | 2018 |
| Authors | Won, J., Bertino, E. |
| Conference Name | 2018 IEEE 4th International Conference on Collaboration and Internet Computing (CIC) |
| Keywords | attestation, code attestation technique, composability, data encryption, data memory, data privacy, data repositories, drones, Encryption, group attestation scheme, Human Behavior, malicious physical/cyber attacks, Malware, mobile data collectors, privacy-sensitive data, private key cryptography, pubcrawl, Resiliency, secret key protection, secret keys, secure communications, security of data, software attestation, software integrity, software-based attestation, Table lookup, tampered drones, whitebox cryptography |
| Abstract | Drones are increasingly being used as mobile data collectors for various monitoring services. However, since they may move around in unattended hostile areas with valuable data, they can be the targets of malicious physical/cyber attacks. These attacks may aim at stealing privacy-sensitive data, including secret keys, and eavesdropping on communications between the drones and the ground station. To detect tampered drones, a code attestation technique is required. However, since attestation itself does not guarantee that the data in the drones' memory are not leaked, data collected by the drones must be protected and secret keys for secure communications must not be leaked. In this paper, we present a solution integrating techniques for software-based attestation, data encryption and secret key protection. We propose an attestation technique that fills up free memory spaces with data repositories. Data repositories consist of pseudo-random numbers that are also used to encrypt collected data. We also propose a group attestation scheme to efficiently verify the software integrity of multiple drones. Finally, to prevent secret keys from being leaked, we utilize a technique that converts short secret keys into large look-up tables. This technique prevents attackers from abusing free space in the data memory by filling up the space with the look-up tables. To evaluate the integrated solution, we implemented it on AR.Drone and Raspberry Pi. |
| DOI | 10.1109/CIC.2018.00-43 |
| Citation Key | won_securing_2018 |
Securing Mobile Data Collectors by Integrating Software Attestation and Encrypted Data Repositories