Safe Passage for Passwords and Other Sensitive Data∗

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2009

Volumn , Issue , 2009, Pages

  McCune, Jonathan M ^a   Perrig, Adrian ^a   Reiter, Michael K ^b  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b UNIVERSITY OF NORTH CAROLINA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

MALWARE; NETWORK SECURITY; SENSITIVE DATA;

CODE MODULES; HYPERVISORS; MALWARES; PROTOTYPE IMPLEMENTATIONS; S-SYSTEMS; SENSITIVE DATAS; SENSITIVE INFORMATIONS; TRUSTED COMPUTING BASE; WEB SERVERS; WEB-PAGE;

WEBSITES;

EID: 85018519069     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (36)

1. Advanced Micro Devices. AMD64 architecture programmer’s manual: Volume 2: System programming. AMD Publication no. 24593 rev. 3.14, Sept. 2007.
2. D. Balfanz and E. W. Felten. Hand-held computers can be better smart cards. In Proccedings of the USENIX Security Symposium, Aug. 1999.
3. D. Balfanz, D. Smetters, P. Stewart, and H. C. Wong. Talking to strangers: Authentication in ad-hoc wireless networks. In Proceedings of the Symposium on Network and Distributed Systems Security (NDSS), Feb. 2002.
4. BeagleBoard.org. BeagleBoard revision B6 system reference manual revision 0.1. BeagleBoard.org, Nov. 2008.
5. K. Borders and A. Prakash. Securing network input via a trusted input proxy. In Proceedings of the USENIX Workshop on Hot Topics in Security (HotSec), Aug. 2007.
6. E. Brickell, J. Camenisch, and L. Chen. Direct anonymous attestation. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), Oct. 2004.
7. S. Chiasson, P. C. van Oorschot, and R. Biddle. A usability study and critique of two password managers. In Proceedings of the USENIX Security Symposium, Aug. 2006.
8. P. England, B. Lampson, J. Manferdelli, M. Peinado, and B. Willman. A trusted open platform. IEEE Computer, 36(7):55–62, July 2003.
9. N. Feske and C. Helmuth. A nitpicker’s guide to a minimal-complexity secure GUI. In Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2005.
10. E. Gabber, P. Gibbons, Y. Matias, and A. Mayer. How to make personalized web browsing simple, secure, and anonymous. In Proceedings of Financial Cryptography, 1997.
11. E. Gabber, P. B. Gibbons, D. M. Kristol, Y. Matias, and A. Mayer. On secure and pseudonymous client-relationships with multiple servers. ACM Trans. Inf. Syst. Secur., 2(4):390–415, 1999.
12. IBM Zurich Research Lab. Security on a stick. Press release, Oct. 2008.
13. Intel Corporation. Trusted execution technology – preliminary architecture specification and enabling considerations. Document number 31516803, Nov. 2006.
14. M. Jakobsson and S. Myers. Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft. Wiley, Dec. 2006.
15. J. Jonsson and B. Kaliski. PKCS #1: RSA cryptography specifications version 2.1. RFC 3447, Feb. 2003.
16. B. Kauer. OSLO: Improving the security of Trusted Computing. In Proceedings of the USENIX Security Symposium, Aug. 2007.
17. K. Kursawe, D. Schellekens, and B. Preneel. Analyzing trusted platform communication. In Proceedings of the Cryptographic Advances in Secure Hardware Workshop (CRASH), Sept. 2005.
18. J. M. McCune, B. Parno, A. Perrig, M. K. Reiter, and H. Isozaki. Flicker: An execution infrastructure for TCB minimization. In Proceedings of the ACM European Conference in Computer Systems (EuroSys), Apr. 2008.
19. J. M. McCune, B. Parno, A. Perrig, M. K. Reiter, and A. Seshadri. Minimal TCB code execution (extended abstract). In Proceedings of the IEEE Symposium on Security and Privacy, May 2007.
20. J. M. McCune, A. Perrig, and M. K. Reiter. Seeing-is-believing: Using camera phones for human-verifiable authentication. In Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
21. J. M. McCune, A. Perrig, and M. K. Reiter. Bump in the ether: A framework for securing sensitive user input. In Proceedings of the USENIX Annual Technical Conference, June 2006.
22. B. Parno. Bootstrapping trust in a “trusted” platform. In Proceedings of the USENIX Workshop on Hot Topics in Security (HotSec), July 2008.
23. M. Peinado, Y. Chen, P. England, and J. Manferdelli. NGSCB: A trusted open system. In Proceedings of the Australasian Conference on Information Security and Privacy (ACISP), July 2004.
24. Prolific Technology Inc. PL-25A1 hi-speed USB host to host bridge controller. PL-25A1 Product Brochure, Oct. 2006.
25. B. Ross, C. Jackson, N. Miyake, D. Boneh, and J. C. Mitchell. Stronger password authentication using browser extensions. In Proceedings of the USENIX Security Symposium, Aug. 2005.
26. A.-R. Sadeghi, M. Selhorst, C. Stüble, C. Wachsmann, and M. Winandy. TCG inside? - A note on TPM specification compliance. In Proceedings of the ACM Workshop on Scalable Trusted Computing (STC), Nov. 2006.
27. R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a TCG-based integrity measurement architecture. In Proceedings of the USENIX Security Symposium, Aug. 2004.
28. J. H. Saltzer and M. D. Schroeder. The protection of information in computer systems. Proceedings of the IEEE, 63(9):1278–1308, Sept. 1975.
29. R. Sharp, A. Madhavapeddy, R. Want, and T. Pering. Enhancing web browsing security on public terminals using mobile composition. In Proceeding of the Conference on Mobile Systems, Applications, and Services (MobiSys), June 2008.
30. R. Sharp, A. Madhavapeddy, R. Want, T. Pering, and J. Light. Fighting crimeware: An architecture for split-trust web applications. Technical Report IRC-TR-06-053, Intel Research Center, Apr. 2006.
31. R. Sharp, J. Scott, and A. Beresford. Secure mobile computing via public terminals. In Proceedings of the International Conference on Pervasive Computing, May 2006.
32. D. X. Song, D. Wagner, and X. Tian. Timing analysis of keystrokes and timing attacks on SSH. In Proceedings of the USENIX Security Symposium, Aug. 2001.
33. F. Stajano and R. Anderson. The resurrecting duckling: Security issues for ad-hoc wireless networks. In Proceedings of the Security Protocols Workshop, 1999.
34. Trusted Computing Group. Trusted platform module main specification, Part 1: Design principles, Part 2: TPM structures, Part 3: Commands. Version 1.2, Revision 103, July 2007.
35. D. Wendlandt, D. G. Andersen, and A. Perrig. Perspectives: Improving SSH-style host authentication with multipath probing. In Proceedings of the USENIX Annual Technical Conference, June 2008.
36. D. A. Wheeler. Linux kernel 2.6: It’s worth more! Available at: http://www.dwheeler.com/essays/linux-kernel-cost.html, Oct. 2004.