The Experts below are selected from a list of 123 Experts worldwide ranked by ideXlab platform

Deren Chen - One of the best experts on this subject based on the ideXlab platform.

  • Grid authorization management oriented to large-scale collaborative computing
    Lecture Notes in Computer Science, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

  • CSCWD (Selected papers) - Grid authorization management oriented to large-scale collaborative computing
    Computer Supported Cooperative Work in Design I, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

  • Supporting secure collaborative computing in grid environments
    8th International Conference on Computer Supported Cooperative Work in Design, 1
    Co-Authors: Qinghuai Zeng, Changqin Huang, Deren Chen, Hualiang Hu Hunan
    Abstract:

    In grid environments, the dynamic and multi-institutional nature introduces challenging security issues. In this paper, we propose subtask-based authorization service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus' gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

Changqin Huang - One of the best experts on this subject based on the ideXlab platform.

  • Grid authorization management oriented to large-scale collaborative computing
    Lecture Notes in Computer Science, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

  • CSCWD (Selected papers) - Grid authorization management oriented to large-scale collaborative computing
    Computer Supported Cooperative Work in Design I, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

  • Supporting secure collaborative computing in grid environments
    8th International Conference on Computer Supported Cooperative Work in Design, 1
    Co-Authors: Qinghuai Zeng, Changqin Huang, Deren Chen, Hualiang Hu Hunan
    Abstract:

    In grid environments, the dynamic and multi-institutional nature introduces challenging security issues. In this paper, we propose subtask-based authorization service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus' gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

Debdeep Mukhopadhyay - One of the best experts on this subject based on the ideXlab platform.

  • DATE - ExplFrame: Exploiting Page Frame Cache for Fault Analysis of Block Ciphers
    2020 Design Automation & Test in Europe Conference & Exhibition (DATE), 2020
    Co-Authors: Anirban Chakraborty, Sarani Bhattacharya, Sayandeep Saha, Debdeep Mukhopadhyay
    Abstract:

    Page Frame Cache (PFC) is a purely software cache, present in modern Linux based operating systems (OS), which stores the page frames that were recently released by the processes running on a particular CPU. In this paper, we show that the page frame cache can be maliciously exploited by an adversary to steer the pages of a victim process to some pre-decided attacker-chosen locations in the memory. We practically demonstrate an end-to-end attack, ExplFrame, where an attacker having only user-Level Privilege is able to force a victim process’s memory pages to vulnerable locations in DRAM and deterministically conduct Rowhammer to induce faults. As a case study, we induce single bit faults in the T-tables on OpenSSL (v1.1.1) AES using our proposed attack ExplFrame. We also propose an improvised fault analysis technique which can exploit any Rowhammer-induced bit-flips in the AES T-tables.

  • FRAMER: Using page frame cache to exploit DRAM Vulnerability
    arXiv: Cryptography and Security, 2019
    Co-Authors: Anirban Chakraborty, Sarani Bhattacharya, Sayandeep Saha, Debdeep Mukhopadhyay
    Abstract:

    Modern operating systems use a number of different techniques and mechanisms to improve system throughput and performance. But some of these optimizations can passively leak crucial side-channel information regarding sensitive data that is being processed and stored in the system. In this paper, we talk about one such optimization mechanism prevalent in modern Linux based operating systems, called page frame cache, which is an integral part of physical memory allocation subsystem. It is a purely software cache storing the page frames that are recently being released by the process or processes running on the corresponding CPU. We show that an adversary can force the kernel to allocate specific page frames to a victim process, running on the same CPU. We also discuss about the possibility of a practical scenario where the adversary can conduct Rowhammer attack to induce bit flips in the victim's page using only user Level Privilege.

  • ExplFrame: Exploiting Page Frame Cache for Fault Analysis of Block Ciphers
    arXiv: Cryptography and Security, 2019
    Co-Authors: Anirban Chakraborty, Sarani Bhattacharya, Sayandeep Saha, Debdeep Mukhopadhyay
    Abstract:

    Page Frame Cache (PFC) is a purely software cache, present in modern Linux based operating systems (OS), which stores the page frames that are recently being released by the processes running on a particular CPU. In this paper, we show that the page frame cache can be maliciously exploited by an adversary to steer the pages of a victim process to some pre-decided attacker-chosen locations in the memory. We practically demonstrate an end-to-end attack, ExplFrame, where an attacker having only user-Level Privilege is able to force a victim process's memory pages to vulnerable locations in DRAM and deterministically conduct Rowhammer to induce faults. We further show that these faults can be exploited for extracting the secret key of table-based block cipher implementations. As a case study, we perform a full-key recovery on OpenSSL AES by Rowhammer-induced single bit faults in the T-tables. We propose an improvised fault analysis technique which can exploit any Rowhammer-induced bit-flips in the AES T-tables.

  • Advanced Fault Attacks in Software: Exploiting the Rowhammer Bug
    Fault Tolerant Architectures for Cryptography and Hardware Security, 2018
    Co-Authors: Sarani Bhattacharya, Debdeep Mukhopadhyay
    Abstract:

    In this chapter, we present to the readers a recently reported fault attack technique in the cryptographic literature - attacks exploiting the Rowhammer bug on actual modern-day processors. Rowhammer attacks have exposed a serious vulnerability in modern DRAM chips to induce bit flips in data which is stored in memory. We present here a methodology to combine timing analysis to perform the hammering in a controlled manner to create bit flips in cryptographic keys which are stored in memory. The attack would require only user Level Privilege for Linux kernel versions before 4.0 and is unaware of the memory location of the key. An intelligent combination of timing Prime \(+\) Probe attack and row-buffer collision is shown to induce bit flip faults in a 1024 bit RSA key on modern processors using realistic number of hammering attempts. This demonstrates the feasibility of fault analysis of ciphers using purely software means on commercial x86 architectures. The attack is also relevant for the newest Linux kernel in a Cross-VM environment where the VMs having root Privilege are not denied to access the pagemap.

  • CHES - Curious Case of Rowhammer: Flipping Secret Exponent Bits Using Timing Analysis
    Lecture Notes in Computer Science, 2016
    Co-Authors: Sarani Bhattacharya, Debdeep Mukhopadhyay
    Abstract:

    Rowhammer attacks have exposed a serious vulnerability in modern DRAM chips to induce bit flips in data which is stored in memory. In this paper, we develop a methodology to combine timing analysis to perform the hammering in a controlled manner to create bit flips in cryptographic keys which are stored in memory. The attack would require only user Level Privilege for Linux kernel versions before 4.0 and is unaware of the memory location of the key. An intelligent combination of timing Prime + Probe attack and row-buffer collision is shown to induce bit flip faults in a 1024 bit RSA key on modern processors using realistic number of hammering attempts. This demonstrates the feasibility of fault analysis of ciphers using purely software means on commercial x86 architectures, which to the best of our knowledge has not been reported earlier. The attack is also relevant for the newest Linux kernel in a Cross-VM environment where the VMs having root Privilege are not denied to access the pagemap.

Zhiting Zhu - One of the best experts on this subject based on the ideXlab platform.

  • Grid authorization management oriented to large-scale collaborative computing
    Lecture Notes in Computer Science, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

  • CSCWD (Selected papers) - Grid authorization management oriented to large-scale collaborative computing
    Computer Supported Cooperative Work in Design I, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

Xianqing Wang - One of the best experts on this subject based on the ideXlab platform.

  • Grid authorization management oriented to large-scale collaborative computing
    Lecture Notes in Computer Science, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.

  • CSCWD (Selected papers) - Grid authorization management oriented to large-scale collaborative computing
    Computer Supported Cooperative Work in Design I, 2005
    Co-Authors: Changqin Huang, Zhiting Zhu, Xianqing Wang, Deren Chen
    Abstract:

    In this paper, we propose Subtask-based Authorization Service (SAS) architecture to fully secure a type of application oriented to engineering and scientific computing. We minimize Privileges for task by decomposing the parallel task and re-allotting the Privileges required for each subtask. Community authorization module describes and applies community policies of resource permission and Privilege for resource usage or task management. It separates proxy credentials from identity credentials. We adopt a relevant policy and task management delegation to describe rules for task management. The ultimate Privileges are formed by the combination of relevant proxy credential, subtask-Level Privilege certificate and community policy for this user, as well as they conform to resource policy. To enforce the architecture, we extend the RSL specification and the proxy certificate, modify Globus's gatekeeper, jobmanager and the GASS library to allow authorization callouts, and evaluate the user's job management requests and job's resource request in the context of policies.