AISC '12 Proceedings of the Tenth Australasian Information Security Conference

The Australasian Information Security Conference (AISC) 2012 was held at RMIT University in Melbourne, Australia, as a part of the Australasian Computer Science Week, January 30 - February 3, 2012. AISC grew out of the Australasian Information Security Workshop and officially changed the name to Australasian Information Security Conference in 2008. The main aim of the AISC is to provide a venue for researchers to present their work on all aspects of information security and promote collaboration between academic and industrial researchers working in this area.

A dynamic Web agent for verifying the security and integrity of a Web site's contents

To harness safe operation of Web-based systems in Web environments, we propose an SSPA (Server-based SHA-1 Page-digest Algorithm) to verify the integrity of Web contents before the server issues an HTTP response to a user request. In addition to standard security measures, our Java implementation of the SSPA, which is called the Dynamic Security Surveillance Agent (DSSA), provides further security in terms of content integrity to Web-based systems. Its function is to prevent the display of Web contents that have been altered through the malicious acts of attackers and intruders on client machines. This is to protect the reputation of organisations from cyber-attacks and to ensure the safe operation of Web systems by dynamically monitoring the integrity of a Web site's content on demand. We discuss our findings in terms of the applicability and practicality of the proposed system. We also discuss its time metrics, specifically in relation to its computational overhead at the Web server, as well as the overall latency from the clients' point of view, using different Internet access methods. The SSPA, our DSSA implementation, some experimental results and related work are all discussed

Airport security screeners expertise and implications for interface design

This paper describes research investigating expertise and the types of knowledge used by airport security screeners. It applies a multi method approach incorporating eye tracking, concurrent verbal protocol and interviews. Results show that novice and expert security screeners primarily access perceptual knowledge and experience little difficulty during routine situations. During non-routine situations however, experience was found to be a determining factor for effective interactions and problem solving. Experts were found to use strategic knowledge and demonstrated structured use of interface functions integrated into efficient problem solving sequences. Comparatively, novices experienced more knowledge limitations and uncertainty resulting in interaction breakdowns. These breakdowns were characterised by trial and error interaction sequences. This research suggests that the quality of knowledge security screeners have access to has implications on visual and physical interface interactions and their integration into problem solving sequences. Implications and recommendations for the design of interfaces used in the airport security screening context are discussed. The motivations of recommendations are to improve the integration of interactions into problem solving sequences, encourage development of problem scheme knowledge and to support the skills and knowledge of the personnel that interact with security screening systems.

The Hofstedian approach : suggestions for a conceptual development of comparative journalism studies

In recent years there has been a burgeoning amount of research comparing journalistic practices in a wide range of countries around the world. Much of this literature has tended to focus on identifying what the similarities and differences between these different journalistic cultures are. Most importantly, research has focused on answering the question of whether, particularly in the age of globalisation, ‘a journalistic culture’ may exist. While there has been some evidence that there may indeed be a convergence of journalistic cultures, studies have at the same time found that important differences still persist. However, most of the literature has so far still tended to concentrate purely on the differences and similarities, without examining in detail why these exist. In this context, the author argues that employing a cross-cultural approach rooted in anthropology can at least partially trace the development of particularly the differences by linking them to the wider concept of cultural differences between countries. Specifically the paper here evaluates the usefulness of applying the value systems appraoch, as designed by Dutch anthropologist Geert Hofstede, to journalism research. By examining some of the few studies that have employed Hofstede’s approach, the paper argues that value systems can provide a classification on a conceptual level for investigating how journalism is practiced around the world. In the light of complaints in the Asia-Pacific region that the imported Western models of journalism are not in line with cultural values, this approach can also provide some basis from which to develop future approaches to journalism education.

Standards that we can 'own' : Threshold Learning Outcomes for Journalism, Public Relations, and Media & Communication Studies

This paper outlines the progress by the JoMeC (Journalism, Media & Communication) Network in developing TLO (Threshold Learning Outcome) statements for Bachelor-level university programs in the disciplines of Journalism, Public Relations and Media & Communications Studies. The paper presents the finalised TLO statement for Journalism, and outlines moves to engage discipline-based groups to further develop preliminary TLOs for Public Relations and Media & Communication Studies. The JoMeC Network was formed in 2011, in response to requirements that from 2014 all degrees and qualifications at Australian universities would be able to demonstrate that they comply with the threshold learning standards set by the Australian Qualifications Framework (AQF). The AQF’s threshold standards define the minimum types and levels of knowledge, skills and capabilities that a student must demonstrate in order to graduate. The Tertiary Education Quality and Standards Agency (TEQSA) will use the AQF’s threshold standards as a key tool in recording and assessing the performance of higher educational institutions, and determining whether they should be registered as Australian Higher Education Providers under the Higher Education Standards Framework. The Office of Learning & Teaching (OLT) places the onus on discipline communities to collaborate in order to develop and ‘own’ the threshold learning standards that can be considered the minimum learning outcomes of university-level programs in that field. With the support of an OLT Grant, the JoMeC Network’s prime goal has been to develop three sets of discipline-specific TLOs – one each for the Journalism, Public Relations, and Media & Communications Studies disciplines. This paper describes the processes of research, consultation, drafting and ongoing revision of the TLO for Journalism. It outlines the processes that the JoMeC Network has taken in developing a preliminary TLO draft to initiate discussion of Public Relations and Media & Communication Studies. The JoMeC Network plans to hand management of further development of these TLOs to scholars within the discipline who will engage with academics and other stakeholders to develop statements that the respective disciplines can embrace and ‘own’.

On the provable security of an efficient RSA-based pseudorandom generator

Pseudorandom Generators (PRGs) based on the RSA inversion (one-wayness) problem have been extensively studied in the literature over the last 25 years. These generators have the attractive feature of provable pseudorandomness security assuming the hardness of the RSA inversion problem. However, despite extensive study, the most efficient provably secure RSA-based generators output asymptotically only at most O(logn) bits per multiply modulo an RSA modulus of bitlength n, and hence are too slow to be used in many practical applications. To bring theory closer to practice, we present a simple modification to the proof of security by Fischlin and Schnorr of an RSA-based PRG, which shows that one can obtain an RSA-based PRG which outputs Ω(n) bits per multiply and has provable pseudorandomness security assuming the hardness of a well-studied variant of the RSA inversion problem, where a constant fraction of the plaintext bits are given. Our result gives a positive answer to an open question posed by Gennaro (J. of Cryptology, 2005) regarding finding a PRG beating the rate O(logn) bits per multiply at the cost of a reasonable assumption on RSA inversion.

Analysis of two authorization protocols using Colored Petri Nets

To prevent unauthorized access to protected trusted platform module (TPM) objects, authorization protocols, such as the object-specific authorization protocol (OSAP), have been introduced by the trusted computing group (TCG). By using OSAP, processes trying to gain access to the protected TPM objects need to prove their knowledge of relevant authorization data before access to the objects can be granted. Chen and Ryan’s 2009 analysis has demonstrated OSAP’s authentication vulnerability in sessions with shared authorization data. They also proposed the Session Key Authorization Protocol (SKAP) with fewer stages as an alternative to OSAP. Chen and Ryan’s analysis of SKAP using ProVerif proves the authentication property. The purpose of this paper was to examine the usefulness of Colored Petri Nets (CPN) and CPN Tools for security analysis. Using OSAP and SKAP as case studies, we construct intruder and authentication property models in CPN. CPN Tools is used to verify the authentication property using a Dolev–Yao-based model. Verification of the authentication property in both models using the state space tool produces results consistent with those of Chen and Ryan.

Threshold MACs

The power of sharing computation in a cryptosystem is crucial in several real-life applications of cryptography. Cryptographic primitives and tasks to which threshold cryptosystems have been applied include variants of digital signature, identification, public-key encryption and block ciphers etc. It is desirable to extend the domain of cryptographic primitives which threshold cryptography can be applied to. This paper studies threshold message authentication codes (threshold MACs). Threshold cryptosystems usually use algebraically homomorphic properties of the underlying cryptographic primitives. A typical approach to construct a threshold cryptographic scheme is to combine a (linear) secret sharing scheme with an algebraically homomorphic cryptographic primitive. The lack of algebraic properties of MACs rules out such an approach to share MACs. In this paper, we propose a method of obtaining a threshold MAC using a combinatorial approach. Our method is generic in the sense that it is applicable to any secure conventional MAC by making use of certain combinatorial objects, such as cover-free families and their variants. We discuss the issues of anonymity in threshold cryptography, a subject that has not been addressed previously in the literature in the field, and we show that there are trade-offis between the anonymity and efficiency of threshold MACs.

Security and Privacy in Vehicular Ad-Hoc Networks : Survey and the Road Ahead

Vehicular Ad-hoc Networks (VANETs) can make roads safer, cleaner, and smarter. It can offer a wide range of services, which can be safety and non-safety related. Many safety-related VANETs applications are real-time and mission critical, which would require strict guarantee of security and reliability. Even non-safety related multimedia applications, which will play an important role in the future, will require security support. Lack of such security and privacy in VANETs is one of the key hindrances to the wide spread implementations of it. An insecure and unreliable VANET can be more dangerous than the system without VANET support. So it is essential to make sure that “life-critical safety” information is secure enough to rely on. Securing the VANETs along with appropriate protection of the privacy drivers or vehicle owners is a very challenging task. In this work we summarize the attacks, corresponding security requirements and challenges in VANETs. We also present the most popular generic security policies which are based on prevention as well detection methods. Many VANETs applications require system-wide security support rather than individual layer from the VANETs’ protocol stack. In this work we will review the existing works in the perspective of holistic approach of security. Finally, we will provide some possible future directions to achieve system-wide security as well as privacy-friendly security in VANETs.

Security in wireless sensor networks : issues and challenges

Wireless Sensor Networks (WSNs) are employed in numerous applications in different areas including military, ecology, and health; for example, to control of important information like the personnel position in a building, as a result, WSNs need security. However, several restrictions such as low capability of computation, small memory, limited resources of energy, and the unreliable channels employ communication in using WSNs can cause difficulty in use of security and protection in WSNs. It is very essential to save WSNs from malevolent attacks in unfriendly situations. Such networks require security plan due to various limitations of resources and the prominent characteristics of a wireless sensor network which is a considerable challenge. This article is an extensive review about problems of WSNs security, which examined recently by researchers and a better understanding of future directions for WSN security.

Electronic conveyancing in Australia: Is anyone concerned about security?

Three proof requirements as essential for a sustainable land registration system. These were proof of identity, proof of ownership, and authority to deal. Our attention in this paper is drawn to the latter two requirements and will ask whether the introduction of the Property Exchange of Australia (PEXA), and its underpinning regulatory regime will meet the concerns that we have in relation to proof of ownership and authority to deal. In drawing out some problems with PEXA, we then offer an innovative idea, sourced from the transfer of equities that could serve to generate discussion on how we can ensure the Torrens system of land registration is sustainable for another 160 years.

A digital watermarking framework with application to medical image security

Dealing with digital medical images is raising many new security problems with legal and ethical complexities for local archiving and distant medical services. These include image retention and fraud, distrust and invasion of privacy. This project was a significant step forward in developing a complete framework for systematically designing, analyzing, and applying digital watermarking, with a particular focus on medical image security. A formal generic watermarking model, three new attack models, and an efficient watermarking technique for medical images were developed. These outcomes contribute to standardizing future research in formal modeling and complete security and computational analysis of watermarking schemes.

Women, peace and security as an ASEAN priority

The Association of South East Asian Nations (ASEAN) Secretariat and its member states have repeatedly professed their commitment to the protection and advancement of women’s economic and human rights. Such commitments have included the Declaration on the Advancement of Women in ASEAN in 1988, the ASEAN Declaration on the Elimination of Violence Against Women in 2004, and the ASEAN Declaration of Human Rights in 2012, as well as the establishment of the ASEAN Committee on Women in 2002 and the ASEAN Commission on the Promotion and Protection of Women and Children in 2009. However, none of these regional commitments or institutions expressly take up the core concern of the Women, Peace and Security (WPS) agenda set out in United Nations Security Council (UNSC) Resolution 1325 in 2000. ASEAN has no 1325 regional action plan and amongst the ASEAN membership, the Philippines is the only state that has adopted a 1325 National Action Plan (NAP). We explore the possible reasons for lack of ASEAN institutional engagement with 1325, outline the case for regional engagement, and suggest specific roles for ASEAN Secretariat, donor governments and individual member states to commit to UNSCR 1325 as a regional priority.

Measurement studies on Superhydrophobic materials

Superhydrophobicity is directly related to the wettability of the surfaces. Cassie-Baxter state relating to geometrical configuration of solid surfaces is vital to achieving the Superhydrophobicity and to achieve Cassie-Baxter state the following two criteria need to be met: 1) Contact line forces overcome body forces of unsupported droplet weight and 2) The microstructures are tall enough to prevent the liquid that bridges microstructures from touching the base of the microstructures [1]. In this paper we discuss different measurements used to characterise/determine the superhydrophobic surfaces.

National security and pandemics

Pandemics are for the most part disease outbreaks that become widespread as a result of the spread of human-to-human infection. Beyond the debilitating, sometimes fatal, consequences for those directly affected, pandemics have a range of negative social, economic and political consequences. These tend to be greater where the pandemic is a novel pathogen, has a high mortality and/or hospitalization rate and is easily spread. According to Lee Jong-wook, former Director-General of the World Health Organization (WHO), pandemics do not respect international borders. Therefore, they have the potential to weaken many societies, political systems and economies simultaneously.