Collective Remote Attestation (CRA) is a well-established approach where a single Verifier attests the integrity of multiple devices in a single execution of the challenge-response protocol. Current CRA solutions are well-suited for Internet of Things (IoT) networks, where the devices are distributed in a mesh topology and communicate only with their physical neighbours. Recent advancements on low-energy protocols, though, enabled the IoT devices to connected to the Internet, thus disrupting the concept of physical neighbour. In this paper, we propose HolA (Holistic and Autonomous Attestation), the first CRA scheme designed for Internet-like IoT networks. HolA provides defence against attacks targeting both the nodes and the network infrastructure. We deployed HolA on both a network of real devices (i.e., 5 Raspberry Pis) and a simulated environment (i.e., 1M devices in an Omnet++ network). Our results demonstrate that HolA can resist against a disruptive attacker that compromises up to half of the network devices and that tampers with network traffic. HolA can verify the integrity of 1M devices in around 12 s while the state-of-the-art requires 71 s. Finally, HolA requires 7 times less memory per device compared with the state-of-the-art.@en

Intel Software Guard eXtension (SGX) is a technology to create enclaves (i.e., trusted memory regions) hardware isolated from a compromised operating system. Recently, researchers showed that unprivileged adversaries can mount code-reuse attacks to steal secrets from enclaves. However, modern operating systems can use memory-forensic techniques to detect their traces. To this end, we propose SnakeGX, an approach that allows stealthier attacks with a minimal footprint; SnakeGX is a framework to implant a persistent backdoor in legitimate enclaves. Our solution encompasses a new architecture specifically designed to overcome the challenges SGX environments pose, while preserving their integrity and functionality. We thoroughly evaluate SnakeGX against StealthDB, which demonstrates the feasibility of our approach.@en

Modern Autonomous Vehicles (AVs) leverage road context information collected through sensors (e.g., LiDAR, radar, and camera) to support the automated driving experience. Once such information is collected, a neural network model predicts subsequent actions that the AV executes. However, state-of-the-art research findings have shown the possibility that an attacker can compromise the accuracy of the neural network model in predicting tasks. Indeed, mispredicting the subsequent actions can cause harmful consequences to the road user's safety. In this paper, we analyze the disruptive impact of adversarial attacks on road context-aware Intrusion Detection System (RAIDS) and propose a solution to mitigate such effects. To this end, we implement five state-of-the-art evasion attacks on vehicle camera images the IDS uses to monitor internal vehicular traffic. Our experimental results underline how this type of attack can reduce the attack detection accuracy of such detectors down to 2.83%. To combat such adversarial attacks, we investigate different countermeasure and propose PAID, a robust context-aware IDS that leverage feature squeezing and GPS to detect intrusions. We evaluate PAID's capability in identifying such attacks, and implementation results confirm that PAID achieves a detection accuracy of up to 93.9%, outperforming RAIDS's performance.@en

Attribute-based encryption has the potential to be deployed in a cloud computing environment to provide scalable and fine-grained data sharing. However, user revocation within ABE deployment remains a challenging issue to overcome, particularly when there is a large number of users. In this work, we introduce an extended proxy-assisted approach, which weakens the trust required of the cloud server. Based on an all-or-nothing principle, our approach is designed to discourage a cloud server from colluding with a third party to hinder the user revocation functionality. We demonstrate the utility of our approach by presenting a construction of the proposed approach, designed to provide efficient cloud data sharing and user revocation. A prototype was then implemented to demonstrate the practicality of our proposed construction.@en