Ongoing projects
Externally founded projects
Security of approaches to personnel authentication
This goal of the project is to produce security performance indicators for many classes of personnel authentication mechanisms. The results of the project will be relevant for users, system specifiers, designers, developers and security managers which need to know the security strength and effectiveness of particular approaches to authentication. The project will focus on authentication in a wearable computing setting both of the wearer and persons he can observe will be relevant. Living site.
Authentication in a health service context
This project will focus on authentication in a `health service' context. The goal of the project is to produce security performance indicators for many classes of personnel authentication mechanisms. The results of the project will be relevant for users, system specifiers, designers, developers and security managers which need to know the security strength and effectiveness of particular approaches to authentication. Living site.
BAS5-Critical Information Infrastructure Protection
The principal objective of the project is to develop methodology and analyse the vulnerabilities in those infrastructures that depend on information and communication technology (ICT). The focus will be on systems and infrastructures critical to modern society. The project will also recommend a wide range of measures to reduce vulnerabilities, based on a ranking of their cost effectiveness. Living site.
The objective of the project is to investigate how reporting of security indicators to management can contribute toward reduction of vulnerabilities in critical infrastructure. Living site.
The overall goal is to enable communicating organisations to include privacy enhancing technologies (PETs) in large-scale web-based services for the general public and customers. Living site.
Anonymizing networks tries to hide the information of who is talking to whom, and are in addition often trying to hide what they are talking about. This thesis will address how anonymizing networks can be vulnerable to attacks on the level of anonymity, try to address how to describe and model the anonymizing networks, suggest possible improvements towards existing systems, and/or try to design and test an improved system. Living site.
Smart Cards - Robustness against Electromagnetic Side-Channel Attacks
Microprocessor devices, such as Smart Cards, are used more and more to store and protect secret information. This development has its advantages, but microprocessor devices are susceptible to various side-channel attacks. The implication of this has not been fully investigated. This project addresses the robustness of microprocessor devices, in particular smart cards, against side-channel attacks. Side-channel attacks exploit correlations between the internal secret information and externally available information such as time and power consumption, optical, acoustic or electromagnetic emanation. These attacks can be invasive but also non-invasive such that no traces are left behind. The extensive and
ever increasing use of small devices such as Smart Cards, with a microchip holding some secret information, raises several questions. What attacks are possible to launch? What barriers are faced when launching such an attack? Which smart cards are robust, and which are easy to attack? What implications will different design or implementation choices have? How robust are cards from vendor A compared to vendor B? How can I protect myself? Living site.
Internally founded projects
Connections Between Network Topology and Network Security
Based on the resent advanced in graph theory and studies of complex networks we want to emphasise the connection between network topology and risks in the network. Today network security focuses on single machine single session security. We hope to show that this approach is missing the crucial fact that all machines are part of a large, dynamic, complex network. This might imply that many measures taken today are ineffective. The theory of heavy tailed distribution eliminates to some extent the finite size cut-off effect from the models and includes observations that
by previous models has been considered as extremal observations or outliers.
Possible paths for our project, depending on our findings are: Network dependability, epidemiology in networks, redundancy strategies in networks and risk management in networks. Living site.
Countermeasures against side-channel attacks in FPGAs
FPGAs are today more and more used in security applications in stead of ASICs. The reason is that FPGAs are more flexible (possibility for error correction and adding of new functionality), shorter time-to-market and they use newer technology than graded implementations of ASICs. It is possible to measure the power consumption of an FPGA performing cryptographic algorithms. Using statistical methods on the power traces could reveal the secret key used in the algorithm. The purpose of the work is to find countermeasures against these attacks both on securing VHDL-implementation of cryptographic algorithms and on design strategies. A useful tool in this context, is a true random generator. Therefore an implementation of a fast random generator in an FPGA is interesting. Living site.
Using serious games as infosec learning tools
The objective of this project is to evaluate serious games as learning tools with topics related to information security. Different types of tools will be evaluated. Ideas from commercial games and existing IS-games combined with theories in playability, enjoyment, modeling and information security will be used to construct additional tools, and evaluate these in mixed environments. Learning theories will be used to examine what effect serious games have in learning information security topics and how, if any, changes in awareness and decision making can be detected. Serious games (persuasive games) should resemble real-life events. Effort will be put into modeling events typically related to information security. Tool validity will be evaluated. Living site.
PO Box 191, Teknologivn. 22, N-2802 Gjøvik, Phone. (+47) 61135100, Fax (+47) 61135170, E-mail: postmottak@hig.no
