Cybersecurity

Steve Kremer, Ludovic Mé, Didier Rémy, Vincent Roca

► To cite this version:

Steve Kremer, Ludovic Mé, Didier Rémy, Vincent Roca. Cybersecurity: Current challenges and Inria's research directions. Inria, 3, pp.172, 2019, Inria white book. http://dx.doi.org/10.5250/ep-01993308

HAL Id: hal-01993308

https://inria.hal.science/hal-01993308

Submitted on 24 Jan 2019

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Cybersecurity

Current challenges
and Inria's research directions

<figure><img src="image_2.png" /></figure>
Inria white books look at major current challenges in informatics and mathematics and show actions conducted by our project-teams to these challenges. Their goal is to describe the state-of-the-art of a given topic, showing its complexity, and to present existing, as well as emerging, research directions and their expected societal impact.

This white book has been edited by Steve Kremer, Ludovic Mé, Didier Rémy and Vincent Roca. They coordinated the contributions from researchers of Inria teams (the complete list of contributors is given at the end of the book). Many thanks to Janet Bertot for proof-reading this document, as well as to François Pottier, Gabriel Scherrer, and Benjamin Smith who read parts of it.

Publication date: January 2019
Executive summary

Wikipedia defines cybersecurity as "the protection of computer systems from theft and damage to their hardware, software or information, as well as from disruption or misdirection of the services they provide." More precisely, cybersecurity consists in ensuring three properties of information, services, and IT infrastructure: confidentiality, integrity, and availability. Thus, securing an information system means preventing an unauthorized entity from accessing, altering, or making unavailable computer data, computing services, or the computing infrastructure. Another increasingly important property is privacy, which may be seen as the confidentiality of the link between persons and data. Note that the terms security and safety are sometimes misused. While safety refers to accidental threats, security refers to intentional threats. Security and safety remain quite different and well-identified domains that build on different hypotheses, and the protection mechanisms against accidental and intentional threats are usually complementary. In this white book, we restrict our attention to security.

The digitalization of our society is radically changing the manner in which computer systems are used. A huge proportion of the population is continuously connected to the Internet, using an amazing number of different services. Simultaneously, we are permanently exposed to attacks: our sensitive data may be stolen, modified, or destroyed. We also live with the risk of mistakenly and irreversibly leaking our private information on the Internet. Companies, states and their critical infrastructures, which nowadays are interconnected, are also vulnerable. The economical and societal damage of successful cyberattacks may be considerable. Cybersecurity has thus become a general concern for all, citizens, professionals, politicians, and, more generally, all decision makers.

This book provides an overview of research areas in cybersecurity, illustrated by contributions from Inria teams. The first step in cybersecurity is to identify *threats* and define a corresponding *attacker model*. Threats, including malware, physical damage or social engineering, can target the hardware, the network, the operating system, the applications, or the users themselves. Then, detection and protection mechanisms must be designed to defend against these threats. One of the core mechanisms is cryptography: *cryptographic primitives* can ensure the confidentiality and integrity of data. These primitives must be the object of continuous *cryptanalysis* to ensure the highest level of security. However, secure cryptographic primitives are not sufficient to guarantee secure communications and services: this task requires the use of so-called *cryptographic protocols*, implementing richer interactions on top of the primitives. Cryptographic protocols are
distributed systems: ensuring that they achieve their goals, even in the presence
of an active adversary, requires the use of formal verification techniques, which
have been extremely successful in this field.

While cryptographic primitives and protocols are fundamental building blocks
for security, additional security services, such as authentication and access control,
are needed to enforce a security policy. These security services, usually provided
by the operating system or the network devices, can themselves be attacked and
sometimes bypassed. Therefore, activities on the information system are monitored
in order to detect any violation of the security policy. Finally, as attacks can spread
extremely fast, the system must react automatically or at least reconfigure itself
to avoid propagating attacks.

As noted above, privacy has become an intrinsic part of cybersecurity. However, even though it often relies on cryptographic primitives and protocols, it also has its own properties, techniques, and methodology. Moreover, the study of privacy often requires to take legal, economical, and sociological aspects into account.

All these security mechanisms need to be carefully integrated in security-critical
applications. These applications include traditional safety-critical applications that
are becoming increasingly connected and therefore more vulnerable to security
attacks, as well as new infrastructures running in the cloud or connected to a
multitude of Things (IoT).

Despite recent significant advances in several areas of cybersecurity, there
are still major scientific questions left open. Here are a few selected challenges
where Inria could make new, major contributions:

→ *Post-quantum cryptography.* Building a quantum computer is widely believed feasible in the next decades and most cryptography used today could be efficiently broken by such a computer. Therefore, it is important to think now about quantum resistant cryptography, as information encrypted today may still be sensitive when quantum computers appear.

→ *Computing on encrypted data.* The need for computing on encrypted data has emerged with the appearance of the cloud and outsourced computation. This problem can be solved using techniques called homomorphic encryption and functional encryption. In 2009 a theoretical breakthrough was achieved with the first fully homomorphic encryption scheme, but this scheme remained completely impractical due to its poor computational efficiency. A lot of progress has been made since, but more research is needed; any significant technical advance may quickly be exploited as an economical advantage.
→ *End-to-end formally verified cryptographic protocols*

The security of cryptographic protocols is extremely difficult to ensure, and the use of rigorous, formal methods is a necessity. Computer-aided security proofs must include all aspects from the specification down to the implementation. Recent works, in particular around TLS 1.3, have shown that this approach is now feasible. However, this still requires a careful co-design of proof and code that can only be performed by experts. Leveraging such proofs to more general code and more complex security properties, e.g., properties guaranteeing the privacy of the user, remains a huge challenge.

→ *Security for IoT.* for IoT is a major challenge. Attacks are still relatively easy (many devices have not been designed with security in mind), invasive (e.g., in our lives), and have major potential impact because of the huge number of available devices, which increases the attack surface and makes distributed denial of service (DDoS) attacks much easier. The research directions are numerous: let us mention for instance the desire to securely update the software embedded in a device, the need for lightweight cryptographic primitives adapted to limited resources, the analysis of the security of new low-power wide-area wireless technologies, the detection and mitigation of intrusions or misbehaving devices, or the need for secure-by-design frameworks and protocols to facilitate the development of IoT devices.

→ *Protecting citizens' privacy.* Our connected world experiences an unprecedented growth in terms of personal, increasingly intrusive data collection, be it while surfing the web, using a smartphone, or driving a connected car. The lack of transparency, as many services and devices behave as black boxes, and the lack of user control are major issues. How to express consent or opposition in the absence of information or user interface? Identification of such hidden behaviors, which requires data flow analyses, is hindered by the number, complexity, and diversity of underlying applications and communication technologies. Challenging transverse research activities are required to bring transparency, highlight good and bad practices, and enable regulators to enforce data protection laws.

It is essential to include security from the start in system design. The same holds for cyber-resilience: massive cyber-attacks are an increasing threat and the security-by-design principle should also apply to resilience of networks and critical, digital infrastructures.

Cybersecurity often lacks incentive, as its benefits are hard to grasp. This is often due to a lack of expertise. Indeed, academics, who have sharp expertise in most areas of cybersecurity, are often underrepresented in national or industrial advisory committees. Education is therefore essential to security, and major
dissemination efforts should be made for all audiences: from teachers, researchers, industrial actors, and specialists, to everyday citizens, including children.

<figure><img src="image_3.png" /><figcaption>High security lab (LHS) at the Inria Research Center in Rennes – Bretagne Atlantique
© Inria / Photo C. Morel</figcaption></figure>
# About this white book

## Our goals

The primary goal of this Inria white book on cybersecurity is to detail Inria's view on cybersecurity challenges. To this end, we include a general overview of academic research topics in cybersecurity and, in particular, a cartography of existing research in cybersecurity at Inria. We also take this opportunity to draw general recommendations in the domain of cybersecurity. We have chosen to conduct all these subgoals in parallel in a single, unified document, without a constant distinction between the objectives. Therefore, while we aim for a complete coverage of research in cybersecurity, the level of detail is intentionally non-uniform: domains where Inria has a strong position or, on the opposite end, where Inria's contribution should be increased are emphasized; less structured fields are also given a more comprehensive presentation.

This white book is written to address a wide audience, and to allow different levels of reading. It includes technical presentations of the different cybersecurity domains and a detailed description of the work done in Inria teams which would interest cybersecurity experts or someone looking for detailed information on a particular subdomain. It also includes more accessible information typeset in text boxes: the sections covering technical material include executive **[Summary]**, as well as a list of **[Inria teams]** working in each area with a short summary of their related activities. Other additional information includes **[Highlights]**, pedagogical **[Note]** and **[Research challenge]** boxes.

Therefore, the non-expert reader may first focus on the text boxes, only digging into the full text when necessary. Challenges are described in situ, but they are also collected in a dedicated chapter (§8.1) for convenience.

## The methodology

This white book is a collaborative effort, with contributions from many people from Inria and its partners. The writing of this book was coordinated by a working group that consisted of Steve Kremer, Ludovic Mé, Didier Rémy, and Vincent Roca. Given the breadth of the topic, they relied on the help of many other researchers who provided input on their topic of expertise to the working group—a complete list of contributors is given at the end of the book. In a second step, the chapters have been proof-read by researchers working in the respective areas. Citations to scientific papers are intentionally restricted to seminal work, rather than trying to give an extensive bibliography. This white book has been conducted under the supervision of the “Cellule de veille et prospective”—the Inria scientific and prospective watch unit—and belongs to a series of other white books<fnref n="1" />.

<footnote n="1">1. https://www.inria.fr/institut/strategie</footnote>
# Outline

The remainder of this white book gives an overview of research areas in cybersecurity and, in particular, the activities of Inria teams. There are certainly many ways to present activities in cybersecurity, sorting them by methodologies, sub-communities, application domains, etc. In this book we follow a winding path, which seemed to be a good compromise for presenting Inria's activities in cybersecurity.

Here is an overview of our journey in cybersecurity:

## Chapter 1: INTRODUCTION

We set the scene: we define the scope of cybersecurity, discuss the issues and stakes, giving examples of attacks and their consequences. We also discuss key security properties, as well as some legal (e.g. cybersecurity regulation) and sovereignty considerations.

## Chapter 2: THREATS

Works on cybersecurity often start by defining the “attack model”: that is, the capabilities of an attacker. In this chapter we discuss different threats that can target the hardware, network, operating system, applications, or even users themselves. We also review some research efforts whose goal is a better understanding of these threats.

## Chapter 3: CRYPTOGRAPHY

Cryptography plays an essential role and constitutes the basis of cybersecurity. In this chapter, we cover all aspects of cryptography, ranging from the design of the core primitives to more complex protocols that provide high-level guarantees regarding the security of communications and transactions.

## Chapter 4: SECURITY SERVICES

Additional security services are needed in order to design operational systems, even if they are often built upon cryptographic primitives and protocols. These are addressed in this chapter where we present security mechanisms that can prevent or mitigate threats and attacks on the information systems and their components, including hardware, networks, and operating systems.

## Chapter 5: PRIVACY

Nowadays, privacy is considered an intrinsic part of cybersecurity. While privacy often relies on cryptographic primitives and protocols, it also has its own properties, techniques, and methodology. In this chapter we focus on privacy, covering technical aspects as well as legal, economical, and sociological issues.
Chapter 6: SECURITY-SENSITIVE APPLICATIONS

While the previous chapters focused on specific services and tools, here we take
the opposite approach, looking at a selected set of security-sensitive applications
and discussing the specific security questions they raise.

Chapter 7: CYBERSECURITY IN FRANCE

Finally, in Chapter 7, we give an overview of cybersecurity activities at Inria
and their positioning in France.

We end the book with general takeaway recommendations.
# Contents

## 1. Introduction 12

1.1 Cybersecurity, a central concern 13

1.2 The scope of cybersecurity 16

1.3 A few examples and lessons learned 18

1.4 Security properties, services, and mechanisms 24

1.5 Legal aspects 27

1.5.1 European security regulation 27

1.5.2 Forensic analysis 28

1.5.3 Surveillance and security 28

1.6 Sovereignty issues 29

## 2. Knowing, understanding, and modeling threats 31

2.1 Hardware attacks 32

2.2 Network threats 36

2.3 The human factor 40

2.3.1 Attacks against the user: social engineering and phishing 40

2.3.2 Improving security mechanism usability 41

2.3.3 A lack of education and awareness 43

2.3.4 Manipulating users and public opinion 45

2.4 Modeling threats and attacks with attack trees 46

## 3. Cryptographic primitives, schemes, and protocols 48

3.1 Cryptographic primitives 50

3.1.1 Cryptography today 51

3.1.2 Cryptanalysis 52

3.1.3 Design 55

3.2 Cryptographic schemes 59

3.2.1 Provable constructions 60

3.2.2 Homomorphic and functional encryption 61

3.2.3 Proofs of knowledge 62

3.2.4 Computer-aided cryptography 63
<figure><img src="image_4.png" /></figure>

<table><tr><td>3.3</td><td>Cryptographic protocols and services: towards provable security</td><td>65</td></tr><tr><td>3.3.1</td><td>Provable security for cryptographic protocols</td><td>67</td></tr><tr><td>3.3.2</td><td>Symbolic automated analysis of cryptographic protocol specifications</td><td>68</td></tr><tr><td>3.3.3</td><td>Veried protocol implementations</td><td>68</td></tr><tr><td>3.3.4</td><td>Electronic voting over the Internet Interne</td><td>69</td></tr></table>

<table><tr><td>4.</td><td>Security services and mechanisms</td><td>72</td></tr><tr><td>4.1</td><td>Identification and authentication</td><td>73</td></tr><tr><td>4.1.1</td><td>User authentication</td><td>74</td></tr><tr><td>4.1.2</td><td>Identification of data owner: watermarking</td><td>76</td></tr><tr><td>4.2</td><td>Access control and flow control</td><td>78</td></tr><tr><td>4.2.1</td><td>Access control</td><td>79</td></tr><tr><td>4.2.2</td><td>Information flow control</td><td>81</td></tr><tr><td>4.3</td><td>Trusted computing</td><td>84</td></tr><tr><td>4.4</td><td>Intrusion detection and alert correlation</td><td>86</td></tr><tr><td>4.4.1</td><td>Intrusion detection paradigms</td><td>87</td></tr><tr><td>4.4.2</td><td>Alert correlation</td><td>88</td></tr><tr><td>4.5</td><td>Malware analysis and detection</td><td>90</td></tr><tr><td>4.5.1</td><td>Malware analysis</td><td>90</td></tr><tr><td>4.5.2</td><td>Malware detection</td><td>91</td></tr><tr><td>4.6</td><td>Reaction to detected attacks</td><td>93</td></tr></table>

<table><tr><td>5.</td><td>Privacy and personal data protection</td><td>95</td></tr><tr><td>5.1</td><td>Privacy principles and regulation</td><td>97</td></tr><tr><td>5.1.1</td><td>Tensions between privacy and other considerations</td><td>97</td></tr><tr><td>5.1.2</td><td>Evolution of the regulatory framework</td><td>98</td></tr><tr><td>5.1.3</td><td>Data Protection Impact Assessment (DPIA)</td><td>99</td></tr><tr><td>5.1.4</td><td>Privacy by design (PbD)</td><td>99</td></tr><tr><td>5.1.5</td><td>Accountability</td><td>100</td></tr><tr><td>5.1.6</td><td>User empowerment through control and transparency</td><td>101</td></tr></table>

<figure><img src="image_5.png" /></figure>
5.2 Privacy tools 104

5.2.1 Tools related to DPIA, privacy by design, and accountability 104

5.2.2 Database anonymization: a necessity for open-data and big-data 105

5.2.3 Dierential privacy 106

5.2.4 Empowering users with personal clouds 107

5.2.5 Privacy preserving protocols and communication technologies 108

5.3 Privacy analysis of existing systems 111

5.3.1 The visible side: the case of social networks 112

5.3.2 The visible side: the case of geolocation information 113

5.3.3 The visible side: the case of biometry 115

5.3.4 Hidden privacy leaks: the case of web tracking 116

5.3.5 Hidden privacy leaks: the smart world 118

5.3.6 Hidden privacy leaks: the case of the Internet 119

6. Critical infrastructures, systems, and applications 123

6.1 Critical infrastructures 124

6.1.1 Security and privacy in the Cloud 124

6.1.2 Security of Software-Dened Networks (SDN) 127

6.1.3 Blockchain 129

6.2 Critical and cyber-physical systems 133

6.2.1 Security of Internet of Things (IoT) 134

6.2.2 Security of industrial systems 139

6.3 Critical application areas 141

6.3.1 Medicine 142

6.3.2 Robotics and connected autonomous vehicles 144

6.3.3 Machine learning based technologies 146

7. Cybersecurity in France 150

7.1 Academic forces at Inria and in France 151

7.2 Education 155

7.3 Inria's impact in cybersecurity 155

7.4 High Security Laboratories (LHS) 157
8. Conclusions and recommendations 159

8.1 Research challenges 160

8.1.1 Hardware-targeted software attacks (see 2.1) 160

8.1.2 Security and usability (see 2.3.2) 160

8.1.3 Post-quantum cryptography (see 3.1.3) 161

8.1.4 Computing on encrypted data (see 3.2.2) 161

8.1.5 End-to-end formally verified cryptographic protocols (see 3.3.4) 161

8.1.6 Intrusion detection for encrypted networks (see 4.4.1) 162

8.1.7 Understanding privacy and deriving practical tools (see 5.1.6) 162

8.1.8 Open data and anonymization (see 5.2.3) 162

8.1.9 Towards a privacy preserving smart connected world (see 5.3.6) 162

8.1.10 Securing the Internet of Things (IoT) (see 6.2.1) 163

8.1.11 Secure Industrial Systems (see 6.2.2) 163

8.2 General recommendations 164

8.2.1 Society should prot more from academic scientific expertise 164

8.2.2 Transfer of expertise between cybersecurity and other domains 164

8.2.3 Promoting security also as an experimental science 164

8.2.4 Education 164

8.2.5 Cyber-resilience by design 165

A List of Teams 166
# 1

## Introduction

<figure><img src="image_6.png" /></figure>
<figure><img src="image_7.png" /></figure>

© Inria / illustration Clod

## 1.1 Cybersecurity, a central concern

### A serious concern for our societies

While the word cybersecurity was hardly known to the general public two decades ago, it has become a recurrent topic in public media punctuated by frequent cybersecurity attacks, the discovery of new breaches, or the revelation of general surveillance by large companies or state bodies.

The world has changed, and quickly. Cybersecurity has become a general concern for all: citizens, professionals, politicians, and, more generally, all decision makers. It has also become a serious concern for our societies that must protect us against cybersecurity attacks with both preventive and reactive measures, which implies a lot of monitoring, and must simultaneously preserve our freedom and avoid general surveillance.

Cyberattacks may be conducted by criminals, but also by states for industrial espionage, for economic damage to apply pressure, or to inflict real damage to infrastructure as an act of war.

States and their interconnected critical infrastructures are vulnerable. Cyberattacks also put companies—of all sizes—at high risk. The economic damage caused by successful cyberattacks may be considerable. However, our protection level is still considered largely insufficient compared to the risks and potential damages.

While our awareness is improving and protective measures are increasing, they still do so at a slow pace. This is partly due to a lack of incentive: cybersecurity is an investment whose benefits are often hard to grasp, as it only pays off when an
attack that could have otherwise succeeded fails, and this is difficult to measure. This slow progress is also due to a lack of expertise—at all levels.

Cybersecurity is therefore an economic and sovereignty issue for many states, including France.

## A challenge for the digital era

The digitalization of our society is completely changing the usage of computer systems. Until the early 90s, computer systems were only loosely connected. Few people had personal computers at home, and those were rarely connected to the Internet. Email spam hardly existed. Cybersecurity was mostly a concern for states and large companies including the financial industry.

Since the end of the 90s, the situation has completely changed. The growth of the web, and the appearance of ADSL and smartphones quickly brought cheap and fast Internet connections to almost every home in developed countries and revolutionized the role of the Internet. Smartphones and 3G/4G have also spread Internet access into developing countries. A huge proportion of the population is now continuously connected to the Internet, using an amazing number of different services. Simultaneously, we have become permanently exposed to attacks, with our sensitive data at risk of being stolen or damaged. We also live with the risk of mistakenly and irreversibly leaking our private information on the Internet. Cybersecurity is now a serious issue for everyone: citizens, small and large companies, administrative and state bodies. For example, a successful ransomware attack on a small company that does not have (well isolated) backups may put the company's business in danger, or even in bankruptcy. The company may lose access to all of its orders, and the listings of its providers and clients; the company may have to pay a huge amount of money for the decryption key, which in the worst case may never be delivered.

The attack surface has considerably increased due to the number of connected devices, some of them being weakly secured or completely unsecured, and most of them operated by uninformed users. This has tremendously increased the chances for an attack to be successful, to the benefit of the attacker, making cyber-criminality more profitable. Besides, the attack may be launched from anywhere in the world.

The situation is likely to worsen in the upcoming years with the spread of connected devices forming the Internet of Things (IoT), which is still only in its infancy. The number of connected digital devices may increase by at least another order of magnitude. This interconnection exposes everyone to the weakest level of security of the trusted machines to which anyone is connected, as they may serve as an attack relay. By relying on low protection levels, we not only increase the risk for ourselves, but also the risk of contributing to the spread of a large-scale attack. This means that each actor has a responsibility and a moral obligation
towards the community to deploy sufficient protection measures. The IoT increases both the attack surface and the contamination aspect of cybersecurity breaches, which calls for yet higher security levels.

Diffusion across computer science

Since an entire system is only as secure as its weakest link, the interconnection and interaction of machines and applications (which often run in a distributed environment) makes cybersecurity a central question for almost all software today. It is therefore not surprising to observe the diffusion of expertise in cybersecurity to other domains of computer science.

There are several converging reasons for this evolution, leading to cross-fertilization between disciplines. For example, cybersecurity has been a predilection domain for formal methods research: cybersecurity was in urgent need of expertise in the area of formal methods and, simultaneously, formed an extremely challenging and stimulating playground for researchers in formal methods. Formal methods are now well-established in cybersecurity, especially in France, although this is still a growing research domain (see §3.3.2 and §3.3.3).

In the area of databases, researchers have been more and more exposed to
security issues. At first they were cybersecurity users, importing off-the-shelf
techniques to their research domains, but they have quickly become active
contributors to cybersecurity. For example, the database community has proposed
new paradigms such as the private cloud to enforce privacy by design.

In other areas, such as system security, distributed computing, and network
services, the reasons are more intricate; but in each case, the evolution reflects
the increasing exposure of these domains to security issues. More recently, there
have been new and fruitful interactions between cybersecurity and machine
learning, in both directions: on the one hand, machine learning methods are
being applied to security, especially in reactive security (§4.4 and §4.6). On the
other hand, machine learning raises new security and privacy issues (see §6.3.3).

Diffusion across other sciences

Even more importantly, cybersecurity is becoming a major concern for
application domains outside of computer science that use computer devices
or digital services in critical ways: e-health, medicine (§6.3.1), robotics (§6.3.2),
power and water supply plants, smart cities, and, more generally, all critical
infrastructure (§6.2.2).

This interdependence of computer science subdomains regarding security issues is both a real challenge and an opportunity for Inria to seize, since it is present in most of these subdomains. The diffusion of cybersecurity across other sciences is a chance to apply cybersecurity research, for which there will be lasting demand—and expectations.
## 1.2 The scope of cybersecurity

Wikipedia defines cybersecurity as follows:

> Computer security, also known as cyber security or IT security, is the protection of computer systems from the theft and damage to their hardware, software or information, as well as from disruption or misdirection of the services they provide.

However, the exact notion of cybersecurity differs depending on the context<fnref n="1" />. Security in general includes both cybersecurity and physical security. However, cybersecurity requires some form of physical security, since physical access to computer systems enables a whole class of attacks. Conversely, physical security may depend on cybersecurity to the extent that it uses computer systems, e.g., to monitor some physical space or maintain a database of authorized persons. Still, the difference between cyber- and physical security should always be clear, and we only address cybersecurity hereafter. Moreover, in many places, we will just use the word security to mean cybersecurity.

### [Note] Physical security vs. cybersecurity

Physical security and cybersecurity are quite different in nature.

Digital information is *immaterial*: duplicating and exchanging data and code with anyone anywhere in the world is nowadays a trivial, extremely fast process, with almost zero cost. Hence, an attack or malware launched by a single person can spread worldwide, at a large-scale, in less than an hour.

Digital information is of *discrete nature*: a single bit flip may introduce a critical failure and turn a perfectly working system into a malfunctioning one, which is then more vulnerable to compromise. This contrasts with the laws of physics, which tend to be continuous at a macroscopic level, and usually let one observe a slow deformation of a structure before it reaches its breaking point. Digital information ignores borders, and may even play with contradictions between the legislations of different countries or their maladaptation to the digital age.

This makes cybersecurity much harder to achieve than other forms of security.

### Safety vs. security

Software safety is concerned with the absence of misbehavior, both in normal and exceptional situations, but still in a *neutral* environment when no one is trying to intentionally attack the system. Software safety is not just a matter of chasing bugs: it also calls for an analysis of the possible sources of misbehavior

<footnote n="1">1. ENISA, "Denition of Cybersecurity: Gaps and overlaps in standardization", version 1.0, December 2015. https://www.enisa.europa.eu/publications/definition-of-cybersecurity.</footnote>
and how to handle them in a fail-safe manner. This requires a specification of the software's expected behavior, including a model of the environment, and some justification as to how or why the software respects its specification.

In contrast, software security aims for the absence of misbehavior in an adversarial environment, where an attacker intentionally tries to misuse a system, putting it in an erroneous state that is not part of its intended specification. Security can also be approached by modeling the environment, but this is much harder to achieve exhaustively, because attackers do not comply with predefined rules, but rather continuously search for previously unknown means of attack. Hence, security also requires us to keep up-to-date with attackers' progress in all areas (software breaches, algorithms and techniques, hardware capabilities, etc.). A complementary approach consists in describing normal execution paths and monitoring execution, so as to raise an alarm and react appropriately when some trajectory goes outside of normal executions.

[Note] Safety vs. security

The terms security and safety are sometimes misused. Safety refers to accidental threats, due to internal misbehaviors or non-intentional misuse of the system, while security refers to intentional threats. Safety deals with fault-tolerance, while security deals with resistance to attacks. For example, a car may crash because of a software specification or an implementation bug (safety issues), or because of an attacker taking remote control of the vehicle (a security issue).

Despite these differences, safety and security are often tied to one another. Since security works in an adversarial mode, it should also consider accidental threats which may be exploited by the attacker. Hence, security is a stronger requirement than safety. In many situations, however, the software is exposed to the outside world, typically connected to the Internet, where attacks are the norm—and safety without security would often not make much sense!

Safety and security also share a lot in their methodologies. Dealing with the safety of large software systems that interact with the physical world, such as Cyber-Physical Systems (often known as CPS—see §6.2), has led to some well-established methodologies. One should start with a safety risk analysis phase, where all situations that may lead to catastrophic consequences are explored. Representations such as fault trees can be used to systematically describe such situations. The identified risks are then quantified to estimate the probability of the occurrences of these situations. Ensuring safety means ensuring that this probability remains below a given threshold. Of course, a first step to satisfy the safety property is to ensure the absence of internal faults (bugs) in the software, as these faults are the primary cause of failures. Formally, one writes a software specification to describe the expected behavior of the software, and then shows
that the actual implementation satisfies the specification. Unfortunately, not all cases may have been considered in the specification. Moreover, there may be external faults (for example, an erroneous value coming from an external sensor) that are not considered in the software specification, and that can lead to disasters. Hence, we must also use additional mechanisms, essentially based on dynamic error detection and recovery mechanisms, used to treat the errors due to external faults before they lead to catastrophic consequences.

A similar approach applies to security. A security risk analysis (see §2.4) replaces the safety risk analysis. While it is not possible to reason statistically to build an unassailable system in the case of security, it is still useful to ensure that there are no bugs (at least of some kind) in the software, for example by the same formal approach as the one followed for safety, because attacks often build on vulnerabilities that stem from a remaining bug. Monitoring takes the form of dynamic attack detection and recovery mechanisms. This implies a model of the attacker, which should at least cover all known types of attacks, for example in the form of an attack signature base. In this view, the safety-by-design principle becomes the security-by-design principle, meaning that the software must be designed from the foundation to be secure<fnref n="2" />. This has led to design principles such as the OWASP recommendations<fnref n="3" />.

However, security and safety remain distinct and different domains, built on different hypotheses, and the protection mechanisms against accidental and intentional threats are usually complementary. In this white book we restrict our attention to security.

## 1.3 A few examples and lessons learned

Unfortunately, cybersecurity incidents are common, and too often make the headlines. Here we describe a few illustrative examples, in order to highlight the huge diversity of attacks. Some of them target well identified entities, such as TV5 Monde and the Dyn company, although the attacks used totally different techniques. At the other end of the spectrum the Wannacry ransomware targeted a huge population, propagating in a viral manner. Certain electronic voting systems are known to be vulnerable and, on several occasions, security researchers have highlighted their inadequacy through proof-of-concept attacks. The following example illustrates how anonymized databases can sometimes be attacked, revealing physical identities. The last two examples highlight, for the first one, two hardware-targeted software attacks that exploit advanced processor performance optimization techniques, and for the second one, weaknesses of some Internet of Things devices and their exploitation.

<footnote n="2">2. See Wikipedia https://en.wikipedia.org/wiki/Secure_by design</footnote>

<footnote n="3">3. https://www.owasp.org/index.php/Security_by_Design_Principles</footnote>
<figure><img src="image_8.png" /></figure>

Research on malware – © Inria / Photo C. Morel

**The TV5 Monde targeted attack:** on April 9th, 2015 the French TV network TV5 Monde was the victim of a major sabotage. Around 9pm, the website and social media channels (Facebook, Twitter, YouTube) were defaced. About an hour later, the network infrastructure was no longer operational and broadcasting was interrupted, resulting in a complete TV blackout—the worst thing that can happen to a TV network. The French National Cybersecurity Agency (ANSSI) later found that the attack was carefully planned<fnref n="4" />. The attackers first connected in January, using a stolen login and password. This allowed them to get access to the internal network, to collect internal documents containing information on the network infrastructure and existing accounts, and to exploit unconfigured services that still relied on default accounts and passwords. Deleting firmware on the network infrastructure (routers and switches) then caused the breakdown, making a simple restart impossible.

**Denial of service attacks from the Mirai botnet of home devices:** the Mirai malware's goal is to turn vulnerable home devices (such as IP cameras, printers, baby monitors, or home routers) into remotely controlled bots that can later be used to launch large-scale denial of service attacks. This is what happened on October 21st, 2016, when this botnet targeted the name servers of the Dyn company

<footnote n="4">4. https://static.sstic.org/videos2017/SSTIC_2017-06-09_P09.mp4</footnote>
(used for instance when translating domain names to IP addresses, see §2.2). This attack resulted in a blockage of many web sites worldwide for several hours.

**The Wannacry ransomware:** on Friday May 12th, 2017, the WannaCry ransomware propagated throughout the world, infecting more than 230,000 computers in over 150 countries within a single day (source Wikipedia). This ransomware targets computers running the Microsoft Windows operating system, with major consequences for their owners: after infecting a computer, the ransomware encrypts data and displays a note to inform the user, asking for a bitcoin payment in exchange for the decryption key. This ransomware is considered a worm, since it scans for vulnerable systems and then replicates itself on these new targets.

**Electronic voting vulnerabilities:** in the last few years, several European countries (Estonia, France, Norway, and Switzerland) held legally binding political elections that allowed part of the voters to cast their votes remotely via the Internet. French people living abroad were allowed to vote via the Internet for the June 2012 parliamentary elections. An engineer demonstrated that it was possible to write malware that could change the value of a cast vote, with no way for the voter to know. In the 2011 Estonian parliamentary election, a similar attack was reported by computer scientist Pihelgas, who conducted a real-life experiment with fully aware subjects.

**Re-identification in the AOL anonymized database of web search queries:** as reported in the New York Times<fnref n="5" />, AOL released an anonymized database containing more than 20 million web search queries. Even though the data was anonymized, users could be identified after some investigation, thereby revealing all their personal search queries. More generally, database anonymization is a complex task with pitfalls, that requires finding an appropriate balance between utility and privacy.

**The Spectre and Meltdown vulnerabilities:** on January 3rd, 2018, two hardware vulnerabilities, Spectre and Meltdown, were simultaneously released. Both vulnerabilities exploit speculative execution (and in particular branch prediction), an optimization technique in modern processors. To avoid idle processor cycles, e.g., while waiting for the result of a memory access, processors may perform out-of-order execution. A branch may then be speculatively executed, while waiting for the evaluation of a conditional. If the branch was wrongly executed, the results are discarded. However, even if the results are discarded, a memory access nevertheless leaves a trace in the cache. The idea of the Spectre and Meltdown attacks is to force a forbidden memory access. Typically, buffer overflows are prevented by checks on the size of the buffer. These checks can be circumvented however by making the branch prediction wrongly predict the test. Then, a cache attack can be used to check which area of the memory has been executed. (Such

<footnote n="5">5. New York Times, "A Face Is Exposed for AOL Searcher No. 4417749", August 9, 2006 http://www.nytimes.com/2006/08/09/technology/09aol.html</footnote>
attacks simply measure the time necessary for accessing a particular memory address.) The attacks are particularly severe, because they exploit the design of modern processors, and cannot be simply patched by a software update. Moreover, speculative execution is at the core of modern processor design, and is unlikely to be abandoned by processor manufacturers.

**Smart lights causing epilepsy seizures:** researchers from the Weizmann Institute of Science have shown that it is possible to hack commonly deployed smart lights, and to strobe them at a frequency that may trigger epileptic seizures [ER16]. The attack is interesting because by turning traditionally unconnected objects (here, light bulbs) into smart objects, they can be misused to create an unexpected attack. This particular attack exploits a combination of several flaws. First, when initializing the smart light controller, the password that allows the controller to connect to the local WiFi is sent unencrypted and can easily be sniffed. Second, the lights accept commands from any devices on the local WiFi without a proper authentication mechanism. Third, the controller does not verify the length of the commands it receives, allowing the concatenation of multiple commands, circumventing the limit on commands that may be sent per second. Finally, the attack is based on undocumented API options, allowing attackers to create a strobe effect.

## Lessons learned

These examples highlight several key aspects of security:

* **Security is an essential cornerstone in a digital world which increasingly pervades every aspect of our daily lives, public and private.** Without security, the world collapses. Attacks such as WannaCry have deeply impacted unprepared citizens, private companies, and organizations, threatening their activities.

* **All the domains of our digital world are concerned,** including the embedded devices omnipresent in our "smart" homes, and in industrial production controllers (including those for critical infrastructures like power and water supplies). Since all of them are connected to the Internet, security is a serious concern, as demonstrated by the attack on smart lights mentioned above. The Mirai botnet example highlights that all electronic devices need to be secure. Even if this is well understood for computers, it is far from obvious for other objects, in particular embedded devices forming the Internet of Things (IoT)—either because they are autonomous, have a small battery, limited processing power, or are badly connected. Moreover, the inability of IoT devices to apply software updates and patches is a real concern. On the other hand, software updates can themselves be subject to attacks. All of these aspects are still the subject of active research.

<footnote>[ER16]. E. Ronen, A. Shamir. Extended functionality attacks on iot devices: The case of smart lights. In IEEE European Symposium on Security and Privacy (EuroS&P'16), 2016.</footnote>
→ **Education is essential to security.** The WannaCry attack relied on an operating system exploit that had been fixed in a Windows update two months earlier. This only impacted unprepared end users and system administrators who failed to update their computers in a timely manner, not realizing how important it was. Security is often regarded as complex, mechanically limiting its usage. Usable security, meant to facilitate use of security by end users, is an important and active research domain that is closely related to security education and awareness.

→ **The security of a system is always limited by that of its weakest component.** Even if the core security components (e.g., the cryptographic primitives) are rarely attacked, the same cannot be said of the software implementations of the cryptographic protocols and services. In the case of WannaCry, the attack relied on an exploit of the Windows SMB protocol (the first weak link), which was sufficient to take full control of the computer, no matter what other operating system protections were in use. The second weak link was the users, who by not updating their computers made the attack successful. The TV5 Monde attack was made possible first of all by social engineering, and then by the use of unmodified default login/passwords on various technical equipments.

→ **Obscurity does not increase security.** Sometimes, people believe that hiding the internals of a system or security mechanism will increase security. However, by now we know that, on the contrary, open design principles improve a system's security. In cryptography this fact is known as Kerckhoffs's principle, and goes back to the 19th century: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. This principle should be applied to other systems as well. An open design and well documented system will actually ease security reviews by experts. Attackers are often able to reverse engineer systems, and "security by obscurity" only gives a false sense of security. For instance, the attack on smart lights exploited an undocumented functionality.

→ **Large, complex systems cannot be totally validated through human inspection: automatic verification tools are needed to find security protocol flaws as well as implementation flaws.** The SMB component targeted by WannaCry has a long history behind it. In spite of that, a security flaw could be identified that made the attack possible. The increasing complexity of each individual component, and the complex composition of components in large interdependent systems, require advanced and automatic security validation tools, which is traditionally a very active research topic.
-> **Security and privacy are closely related.** The WannaCry ransomware did not try to exfiltrate user's data, but it could have done so. The attacker had full access to data stored on target computers (e.g., the patient database of a medical center) and could have threatened to disclose this sensitive information. It is therefore essential that security and privacy be considered together at the design stage so that, for instance, malicious intrusions do not put data at risk. Security by design, and more recently privacy by design, have become key principles in security design.

-> **Diversity of attackers' motivations and the difficulty of attribution.** Although WannaCry has been classified as ransomware, motivated by the desire to make money, the NotPetya malware that quickly followed it in June 2017 might be a "state-sponsored malware that attempted to disguise [itself] as ransomware in order to muddy [its] attribution and potentially to delay investigations."<fnref n="6" /> These examples highlight the diversity of the attackers' motivations and the difficulty—sometimes, the impossibility—of attributing an attack.

-> **Detection and mitigation of attacks.** The previous examples show that security is hard to achieve. Since zero risk cannot exist, the early detection and mitigation of attacks is as important as the attempt to reduce the risk of successful attacks.

More generally, there will probably always be vulnerabilities in our systems, despite increasingly efficient preventive security mechanisms. The vulnerabilities appear at all levels of our information systems: applications, OS, firmware, and

<figure><img src="image_9.png" /><figcaption>Malware analysis and detection – © Inria / Photo C. Morel</figcaption></figure>

<footnote n="6">6. https://elie.net/blog/security/unmasking-the-ransomware-kingpins/</footnote>
even hardware, as illustrated recently by the Meltdown and Spectre attacks. Vulnerabilities are sometimes present for a (very) long time in our systems, and we can only hope that they are not exploited before they are discovered. New vulnerabilities are discovered on a daily basis, and new forms of attacks can appear at any time. It is mandatory that we detect well-known attacks, but also new forms of attacks, if we are to increase the security level of our systems.

→ *Security comes at a cost.* It is easy to understand that security may be expensive, with additional costs to study, implement, configure, manage, and evolve security tools. But security can also have an operational cost, leading to less efficient systems. For example, mitigating the Spectre or Meltdown attacks may require removing some cache techniques or disabling speculative execution. Such mitigation would entail a significant and possibly unacceptable processor-speed slowdown. Hence, in some cases, one may have to accept a difficult compromise between security and efficiency.

Each of these topics is the subject of active research and is introduced in this document.

### [Note] The cybersecurity threat

The cybersecurity threat is real and serious. We only see the tip of the iceberg: in the vast majority of cases, even the existence of the attack is a critical piece of information for companies or states that is rarely released.

For experts, the question is not whether large scale cyberattacks will eventually succeed, as the answer is definitely positive, but rather: are we sufficiently prepared? This means we should of course reduce the risk of such attacks by better preventive and reactive protection, but also increase our cyber-resilience including pre-established procedures to reduce the catastrophic impacts of successful attacks, and faster recovery to a safe mode of operation after such attacks.

## 1.4 Security properties, services, and mechanisms

### Security Properties

Cybersecurity consists in ensuring three basic and essential properties of information, services, and IT infrastructures well known as the CIA triad: Confidentiality, Integrity, and Availability. Thus, securing an information system means preventing an unauthorized entity (user, process, service, machine) from

<footnote n="7">7. https://www.cvedetails.com/browse-by-date.php</footnote>
accessing, altering, or rendering inaccessible computer data, computing services, or the computing infrastructure. Notice that other properties, such as authenticity (proof of the origin of information), privacy, or protection against illegal copying could also be listed. However, these additional properties can also be seen as particular cases of these three basic properties.

**[Note] On cybersecurity properties**

**Confidentiality:** assurance that information is disclosed only to authorized persons, entities, or processes.

**Integrity:** assurance that the system (configuration files, executable files, etc.) or information are modified only by a voluntary and legitimate action, i.e., that the system or information have not been accidentally or deliberately changed.

**Availability:** assurance that a system or information is accessible in a timely manner to those who need to use it.

**Authenticity:** assurance that a message is from the source it claims to be from.

**Privacy:** ability for individuals to control their personal data and decide what to reveal to whom and under what conditions. Privacy can thus be generally defined as the right of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.

**Anonymity:** confidentiality of the identity of the user or entity. We note that preventing re-identification through side information is not easy, and that *indistinguishability*, which ensures that an attacker cannot see the difference among a group of entities, is also an important property linked to privacy. Note also that anonymity aims at hiding who performs some action, whereas full privacy may also require hiding which actions are being performed.

**Security policy:** a set of rules that specify how sensitive and critical resources are protected, i.e., how some or all of the previous properties are guaranteed.

**Resilience:** initially defined as the ability of a system to return to its original state after an attack, resilience is nowadays seen as the capacity of a system to deliver its services continuously, even while under attack (i.e., capacity to tolerate attacks).

**Security Services**

Reaching the objectives of cybersecurity requires enforcing *physical, organizational, and logical* counter-measures. Even if physical measures (such as guarding or controlling accesses to buildings) and organizational measures (such as precisely defining the mission of an external IT service provider) are crucial, we focus in this document on logical security, i.e., on hardware and software services and mechanisms to ensure the properties of confidentiality, integrity, and availability.

A secure computer system must offer *preventive* services to hinder any violation of these properties, detection services to identify any successful attempt to violate these properties, and reaction services to deploy new or enhanced
counter-measures in case of any successful violation. Indeed, while the goal of cybersecurity is to protect a computer system against attacks, one must also assume that some of the attacks will succeed. Therefore, cybersecurity also deals with intrusion detection and responses to attacks.

Prevention first involves precisely defining which entity may access what information and in which way: permissions, prohibitions, or obligations<fnref n="8" /> to read or write information are to be defined. This constitutes a so-called security policy. Prevention can even take place before the definition of a policy. Indeed, it is good software engineering to detect early source and binary code vulnerabilities that could be exploited to violate the security properties: this is the security by design principle. Even earlier on, we may also prove that a given property is guaranteed by the software: this is formally proved security.

The security policy is concretely enforced through security services. The following services can be offered, depending on the policy and on the context: entity identification and authentication, control of access to information by these entities, control of information flows within the system, detection of attempts to exploit potential vulnerabilities of the system (intrusion detection, virus detection), and responses to these attempts (reaction).

An even more ambitious objective that could be pursued would be the ability for a computer system to deliver the intended outcome despite adverse cyber events. In other words, the computer systems would tolerate attacks, a capacity generally called cyber-resilience<fnref n="9" />. From a high-level point of view, an entity (state, company, organization, etc.) could be more concerned with cyber-resilience, which is the final objective to achieve, than with cybersecurity, which is a set of deployed techniques that the end-user need not necessarily see.

Cyber-resilience, being the capacity to tolerate attacks, has of course a lot of similarities with fault tolerance, which deals with hazardous hardware failures or software bugs. Even if the hypothesis of safety and security are quite different, since attackers do not follow the rules but rather continuously search for new breaches, the mechanisms proposed to tolerate faults may be adapted to tolerate attacks. Thus, some basic principles of cyber-resilience include replication of data and backups, which have long been well-established in the database community. Besides, replication should be used in the context of a distributed system, to avoid having a single point of failure. While cyber-resilience is of major importance, many techniques to achieve it are reminiscent of other fields (e.g., safety), and will not be detailed in the remainder; others are completely relevant to the security field (e.g., DDoS Mitigation) and will be discussed in the corresponding sections.

<footnote n="8">8. Obligations correspond to preconditions to fulfil to be permitted to read or write information. For example, a user can be authorized to sign a file if and only if this file has already been previously signed by another given user. Obligations are generally enforced at the application level.</footnote>

<footnote n="9">9. Source https://en.wikipedia.org/wiki/Cyber_Resilience</footnote>
## Security Mechanisms

Security services rely on mechanisms implemented at various levels of information systems and infrastructure, including hardware, firmware, operating systems, network layers, hypervisors, and applications. Cryptography is of course a fundamental building block in many cases: the study of *cryptographic primitives* and their use in exchanges between machines (through *cryptographic protocols*) are therefore two essential aspects of digital security.

# 1.5 Legal aspects

## 1.5.1 European security regulation

The European Union cybersecurity strategy<fnref n="10" /> is built on several instruments, with the goal to improve European cyber-resilience and response while preserving for each nation a level of sovereign capacity to control the main components of their national defense strategy.

The European Union Agency for Network and Information Security (ENISA)<fnref n="11" />, set up in 2004, is an important actor of the European cybersecurity landscape. A significant extension of its missions is currently under discussion, aimed at making it the privileged interface with the member states, including support in the implementation and operation of cybersecurity directives.

In mid-2016, the European Union adopted the Directive on security of network and information systems (known as the NIS directive)<fnref n="12" />, for an application mid-2018. This directive focuses both on Digital Service Providers (DSP) and Operators of Essential Services (OES). Both DSP and OES are held accountable for reporting security incidents, even if services are run by non-European companies or if the information system management is outsourced to third parties. DSP and OES are also required to provide information that allows for an in-depth security assessment of their information system and policies. Finally, the member states are required to identify agencies in charge of collecting and processing security incidents, in addition to a national competent authority (e.g., ANSSI in France).

There is also a need to promote the development of secure-by-design products and services throughout Europe. In order to achieve this goal, the European Union is putting forward a proposal to set up a European security certification framework, capable of issuing European level security certifications and labels of products and services. This is a daunting task, because even though a very broad set of security certification schemes exist throughout the world, no unified or combined solution exists. Understanding what is required to make things

<footnote n="10">10. https://ec.europa.eu/digital-single-market/en/cyber-security</footnote>

<footnote n="11">11. Initially called European Network and Information Security Agency, see https://www.enisa.europa.eu/</footnote>

<footnote n="12">12. https://ec.europa.eu/digital-single-market/en/network-and-information-security-nis-directive</footnote>
consistently secure is a complex task. The European Cyber Security Organization (ECSO)<fnref n="13" /> liaises with the European Commission for the definition of a European security certification framework proposal. ECSO has issued a state of the art of existing industrial cybersecurity standards for various activity domains, and is working on a so-called meta-scheme approach encompassing many existing certification schemes, evaluating the level of confidence provided by individual schemes and mapping them onto a harmonized set of security levels<fnref n="14" />.

Because zero risk does not exist, the European Commission has also issued an official blueprint, called *Commission Recommendation of 13.9.2017 on Coordinated Response to Large Scale Cybersecurity Incidents and Crises*<fnref n="15" />. This recommendation sets out the objectives and modes of cooperation between the member states and European institutions when responding to such incidents and crises.

The European Union is at the forefront of privacy and data protection, with the new GDPR regulation and the ePrivacy regulation that will complement it—see §5.1.2 where these aspects will be discussed.

## 1.5.2 Forensic analysis

Generally speaking, forensic analysis is related to scientific methods of identifying the authors of a crime by examining objects or substances involved in the crime. In the context of cybersecurity, forensic analysis is related to the explanation of a cybercrime, based on the analysis of information or traces left by the attacker in the computing systems used or attacked.

Concretely, forensic analysis aims to explain the state of a computing system by extracting information and using it to reconstruct the series of actions undertaken by the attacker. A special effort has been made to produce techniques and tools to analyze the content of mobile phones, which are often used to prepare and perform criminal actions in the real world. Here, defense against cybercrime joins defense against crime.

## 1.5.3 Surveillance and security

With the increase of the terrorist threat, we have witnessed, in several countries, the deployment of mass-surveillance systems intended to help fight terrorism. In France, this took the form of the “Loi relative au renseignement.”<fnref n="16" /> In particular, this law requires the deployment of black boxes within French Internet Service Providers (ISPs) in order to both collect connection information from specific previously-identified targets in real time, and to analyze connection information

<footnote n="13">13. https://www.ecs-org.eu</footnote>

<footnote n="14">14. Documents produced by ECSO WG1 are available at: http://www.ecs-org.eu/working-groups/wg1-standardisation-certification-labelling-and-supply-chain-management.</footnote>

<footnote n="15">15. http://ec.europa.eu/transparency/regdoc/rep/3/2017/EN/C-2017-6100-F1-EN-MAIN-PART-1.PDF</footnote>

<footnote n="16">16. Loi no 2015-912 du 24 juillet 2015 relative au renseignement, Legifrance. https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000030931899</footnote>
of ISP subscribers in order to identify potential suspects via an automatic process (whose details are not publicly known). The re-identification of the subscriber requires an official decision of the Prime Minister (or a delegate).

These laws highlight the tension between public security and privacy. They have also been criticized because of their economic cost and potential inefficiency, in particular when faced with the “false-positive paradox.”<fnref n="17" /> The risk is that “more false positives will only overstress technologies, thus causing even more work for signals-intelligence agents, who are already overloaded.”

The term “mass dataveillance” has been given to practices where governments or governmental organizations perform surveillance and data collection at a national scale (or larger). This is opposed to “personal dataveillance”, which targets an individual of (supposed) interest.

As a reaction to this evolution of surveillance (and in particular to E. Snowden's revelations), the IETF has considered that “pervasive monitoring is an attack” in RFC 7258¹⁸ and that IETF protocols should mitigate it. Encryption by default is among the IETF's initiatives (§2.2).

Surveillance and cyber defense are complex topics by nature. AMNECYS (Alpine Multidisciplinary NETwork on CYber Security studies)<fnref n="19" /> is an example of multi-disciplinary initiative that has gathered several research teams in order to contribute to this complex question.

## 1.6 Sovereignty issues

Since most critical infrastructure is now controlled by computers, often connected to the Internet, protecting infrastructure requires protecting computer systems and networks. Hence, cybersecurity is a sovereignty issue for states and the EU. Therefore, states and the EU must have the ability to understand the risks and threats. This requires the highest scientific competences, and can only be maintained in the long-term by pursuing advanced research in all domains of cybersecurity. We not only need to have the best experts, but we also must have them in sufficient numbers to cover the increasing needs (see §2.3.3). In addition, we also need experts at intermediate and lower levels to be able to implement the security policies correctly.

States should also have the power to act. This requires sufficient control over digital infrastructure and the whole cybersecurity chain, as the security of the whole depends on the security of the weakest link. This implies control over the software and hardware used in critical infrastructures, so that it can be analyzed and certified free of bugs and backdoors. This also implies control over data storage.

<footnote n="17">17. https://hal.archives-ouvertes.fr/hal-01157921/document</footnote>

<footnote n="18">18. https://www.rfc-editor.org/rfc/pdfrfc/rfc7258.txt.pdf</footnote>

<footnote n="19">19. http://amnecys.inria.fr/</footnote>
Hardware is one of the weakest links, as France and Europe do no longer have the capacity to design and produce their own hardware. Hence, some form of sovereignty has already been given up. Indeed, it is quite possible that hardware devices are rigged with backdoors or hidden functions that allow, for example, a government agency or a company to spy on Internet traffic or to prevent the operation of a particular service.

In fact, the digital and thus dematerialized nature of cybersecurity makes cybersecurity sovereignty different from other forms of sovereignty, such as defense. While the latter is the privilege of states or supranational organizations, the former can be implemented at smaller scales. Many entities (citizens, companies, associations, etc.) can claim some degree of sovereignty over the security of their own data, computer systems, and networks. A consequence of digitalization is the potential transfer of some of the traditional state sovereignies to other entities: blockchain-powered land registration, minting money with digital currencies, or citizen identification services<fnref n="20" />, etc. These different levels of sovereignty do not exclude, but rather complement one another, leaving sovereignty of each kind of data at the most appropriate level. This ability of cybersecurity to be decentralized should not endanger the sovereignies of the states. On the contrary, it is a chance that should be exploited, leaving some autonomy to the different entities within certain limits established by incentives, regulations, and laws.

<footnote n="20">20. For example, SecureIdentity https://secureidentity.co.uk/</footnote>
2

Knowing,
understanding, and
modeling threats
There are many types of attacks against information systems. The threats are therefore numerous. The attacks can target the hardware, the network, the system, or the applications (very often through the malicious actions of a malware), or even the users themselves (social engineering, phishing). The attacker can be an insider, or an outsider.

In this chapter, we present bodies of work carried out in order to build a better knowledge of such threats and attacks. Various attack models can be considered in these bodies of work, to define the knowledge of the attacker about the system and the actions the attacker can realize. The section devoted to the human factor also focuses on two crucial aspects of security: usability and education.

Please note that cryptanalysis aims at understanding the threats against existing cryptographic primitives, in order to be ahead of malicious adversaries. Cryptanalysis is thus the foundation of confidence we can have on these primitives, and the knowledge of state-of-the-art cryptanalysis can be seen as the backbone for the design of secure primitives. Cryptanalysis per se is therefore not a threat, but a way to achieve a better security level. It is presented in §3.1.2. Malware analysis and malware detection are presented in §4.5.1.

<figure><img src="image_10.png" /></figure>

## Hardware attacks

### [Summary]

Physical attacks against the hardware are a real threat, even for implementations of algorithms that have been mathematically proven secure. Attacks by observation and attacks by perturbation are two common classes of attacks that require a physical access to the device. More recently, hardware has also been attacked through the software, which is even more dangerous, as it does not require physical access to the device. Nowadays, a serious but unfortunately possible attack scenario is an hardware attack triggered by a JavaScript application embedded in a web page.

When discussing the security of an algorithm, numerous mathematical tools allow developers to assess its security. Unfortunately, those tools cannot consider the interaction of the computing unit with its physical environment. Physical attacks are a real threat, even for algorithms proven secure mathematically. These attacks can be classified as observation attacks, perturbation attacks, and a new field known as hardware-targeted software attacks. The first two assume the insider attacker model i.e., the device is under the attacker's control, while the last one assumes the outsider model. The outsider model requires fewer hypotheses for the attacker and thus can be considered as more dangerous.
<figure><img src="image_11.png" /><figcaption>Studying fault attacks – © Inria / Photo C. Morel</figcaption></figure>

### Observation attacks

Side-channel analyses (SCA) are physical attacks based on the observation of the circuit behavior during a computation. They exploit the fact that some physical quantities depend on intermediary values of the computation in the device. This is the so-called information leakage. The most classic leakages are timing, power consumption, and electromagnetic emissions (EM).

SCA are threats for all standard cryptosystems such as Data Encryption Standard (DES), Advanced Encryption Standard (AES), RSA cryptosystem, Elliptic Curve Cryptography (ECC) and for critical applications not using cryptography, e.g. PIN verification. SCA can also be used to reverse engineer algorithms.

### Perturbation attacks

Fault attacks are now a well-known class of physical attacks where a device undergoes a modification of physical parameters in order to obtain an incorrect behavior. Most classical fault injection means are power glitches, clock glitches, laser pulses, and electromagnetic pulses. Fault attacks have been shown extremely efficient against cryptography, e.g. the Bellcore attack allows any fault, at the correct time, on an RSA-CRT signature to recover the secret. What fault can be achieved and what is the fault model is an active area of research.

This class of attack is chip dependent, i.e. what has been learned of a SoC is not valid for other chips even if they are highly similar (same core). The success of the attack relies essentially on the experiment set up due to the large amount
of parameters (type of the EM probe, distance of the probe on the circuit, form and amplitude of the EM pulse, etc.). Another challenge in this class of attacks is the effects observability. To understand the precise effect, one has to explore the internal state of the chip which is often not available. Most of the countermeasures are related with either temporal or spatial redundancy. The cost of such a redundancy is not affordable for low end devices. Research is focusing on lightweight redundancy to ensure the integrity of the execution.

## Hardware-targeted software attacks

In addition to software attacks against software and physical attacks against hardware-targeted software attacks, appeared in the mid-2000s software attacks against hardware components. For example the Rowhammer attack aims at flipping memory bits while reading and writing another cell. The insider attacker model moves to an outsider one when using a JavaScript program executed in a browser to perform this attack remotely. Recently it has been shown to be effective when applied on SSD disks (NAND flash technology).

Perturbation can also be generated in multicore SoC using the Dynamic Voltage and Frequency Scaling (DVFS), i.e., the energy management technique that saves energy by regulating the frequency and voltage of the processor cores. It has been shown that a misconfiguration of these two parameters can be used to induce faults in the hardware. Each core being individually controlled, one core can inject a fault in another core. Even if it has not yet been demonstrated, this attack should be achievable from within a browser.

Software-based attacks against hardware make it possible to circumvent security mechanisms implemented at the software level. In fact, the software protections consider that the hardware is working properly, "simply" executing instructions to produce a result. Of course, this is not so easy and errors that can be exploited by attackers can also occur at the hardware level.

More generally speaking, the traditional approach of computer science and technologies, constantly adding new more and more powerful levels of abstraction naturally leads, when proposing a security mechanism at a given level of abstraction, to consider that the lower layers are correct and safe. This is however not the case; this is why the attackers have had a tendency these last years to target less and less abstract layers, successively attacking by software the applications, the OS, their kernel, the firmware, and now the hardware.

These low-layer attacks typically exploit flaws from optimization mechanisms implemented in modern OS's and processors, such as caches, branch prediction, or speculative execution. Indeed, these optimizations create differences in program execution time, thus revealing secret information. For example, the recent Spectre<fnref n="1" />

<footnote n="1">1. https://spectreatack.com</footnote>
attack exploits branch prediction and speculative execution and exfiltrates information through a covert channel based on cache access. To mitigate this attack, one could refresh the cells (read and re-write their values) periodically. This solution would of course come at the price of performance limitations, as other read operations asked by programs would not be possible during the refreshes. More generally, protection against attacks of this type would involve the limitation, if not the complete elimination, of certain optimizations, of course at the cost of lower performance.

The Rowhammer attack evoked above is a software attack that actually exploits a physical property of matter. Each DRAM cell is composed of a capacitor and a transistor that electrically implement a bit of information. By repeatedly accessing cells, the charge of these cells leaks and electrically interacts with the charge of other neighbor cells. It is thus possible to change the value of a cell (and therefore to violate the integrity of this cell) without having ever accessed it. Here, the protection against the attack should be physical: for example, one could consider limiting the reduction of the component's surface, even if the cost would be of course very important.

Notice that these attacks are not easy to detect as they leave no trace at the operating system or application levels.

Finally, it is difficult to know whether attacks of this type have already been used in reality. At the time of this document's writing, it seems much simpler to use much more classical attacks against the software or against users (social engineering).

### [Research challenge 1] Hardware-targeted software attacks

Attacks against information systems do not usually involve the hardware layer but exploit a software vulnerability. However, recent attacks, such as Rowhammer, Spectre, or Meltdown, have shown that attacks implemented in software can exploit performance optimizations of the hardware. This new type of attack is especially dangerous as it makes hardware attacks possible at a distance, as opposed to classical side channel attacks. It is not yet completely clear how the current proof of concept attacks can be "industrialized," but they pave the way to a new class of serious attacks. Therefore we need to get a better understanding of how such attacks could possibly be deployed, propose a clear typology of this new kind of attack, and propose countermeasures, both at the hardware and the software levels. This task requires expertise at the hardware, firmware, and operating system levels. The countermeasures can also be difficult to design as they may require to revisit crucial optimizations used for years, such as speculative execution.
## [Inria teams] Hardware attacks

The CAIRN team works on efficient computing architecture. They do not address explicitly the security issues related to this optimization process, but they know how the SoC architecture can help.

The CIDRE team analyses the impact of EM faults on the software stack on modern SoC but also on low end devices. The team also uses circuit observation to optimize the fault injection process. The objective is to evaluate the possibility to move from a high end platform to a low cost platform with the same result. The team characterizes the impact of the fault during the secure boot process to identify potential vulnerabilities. In a collaboration with the PACAP team, it verified the robustness of a countermeasure that uses a dedicated compiler to generate fault resistant code. To resist against side channel attacks they evaluated on the fly compilation solutions to increase the number of traces an attacker has to capture to extract the secret. They have also proposed a template attack against PIN verification implementations.

The PACAP team evaluates the possibility to eradicate leakage in a code at compile time thanks to code annotation (compiler that generates resistant implementations to side-channel analyses attacks). Their solution is evaluated within the Rennes LHS facilities.

The TAMIS team develops new side-channel distinguishers based on machine learning techniques due to their precise knowledge of the underlying leakage measurements and modeling of sensitive information.

## 2.2 Network threats

### [Summary]

At the network level, many examples of attacks exist. Here are two examples targeting the Internet. Finding a path for each packet sent on the Internet, no matter its source and its destination, is a key service known as "routing"[^a]: attacking this basic and essential network service can, for instance, isolate a whole country or at the opposite redirect all the traffic of a country through a surveillance point. Another crucial network service, DNS, translates readable hostnames into IP addresses. An attack against this service can redirect a user to a fake banking web site in order to steal the user's credentials. A secure extension to DNS, called DNSSEC, is now available, but its deployment will take time and will not solve all the problems, in particular those related to privacy.

<footnote>[^a]: See for example this simple introduction: https://interstices.info/internet-le-conglomerat-des-reseaux/</footnote>
Any type of network may be attacked, taking advantage of its characteristics. We focus here on the Internet and some of its specificities: domain name, routing, and potentially non-encrypted payload.

The Internet is a complex assembly of an extremely large number of devices, from user machines or devices to routers, linked by a huge array of wireless and wired networking technologies. Its operation requires a vast range of information resources, protocols, and services, from low-level routing databases, forwarding policies, low-level MAC address/IP address/host-name mapping protocols (i.e., the ARP/NDP/SEND and DNS/DNSSEC protocols), or link-layer specific technologies (e.g., to create and manage a Virtual LAN) up to high-level services, like Web services. This inherent complexity of the Internet constitutes many facets that are all subject to threats. Hereafter, we consider a small subset of these threats and discuss trends to mitigate them, both from the academic and standardization viewpoints, e.g., as done by the Internet Engineering Task Force (IETF)<fnref n="2" />.

## Attacks against the Domain Name System (DNS)

The DNS is a hierarchical decentralized naming system for the Internet, with scalability and flexibility as key design goals. DNS is used for address resolution, i.e., hostname to IP mapping (e.g., "www.example.com" resolves to IPv4 address "1.2.3.4"), as well as the inverse mapping. It is also used by such services as email (DNS records enable a search for mail servers) and blacklisted email hosts.

A typical attack against DNS consists in flooding a DNS server by a huge number of queries, leading to a Denial of Service i.e., the server cannot handle the load and thus does not respond to legitimate queries. A more subtle attack consists in poisoning or spoofing a DNS cache. Indeed, when a system queries a DNS server and receives an IP address as a response, it saves this information in a local cache for a given period of time, such that the system can answer a new similar query without having to retrieve the information from the server. If the cache is compromised, then anyone who uses it may be misguided to a fraudulent site.

Being one of the cornerstones of the Internet, the security of DNS is essential and security services have been added under the name "Domain Name System Security Extensions" (or DNSSEC) in 2005. DNSSEC enables any host to be confident in the address resolution results, the IP address (or any information returned by a DNS query like mail servers).

However, DNSSEC does not address confidentiality requirements as will be discussed in §5.3.6.

<footnote n="2">2. https://ietf.org</footnote>
## Attacks against the Border Gateway Protocol (BGP) interdomain routing

Each IP datagram (or packet) needs to be “routed” through the Internet, from its source to its destination (sometimes multiple destinations). This operation is done hop-by-hop by routers: for each incoming packet a router finds a path and forwards the packet to next router until it reaches its destination. Finding a path within a router is the goal of routing protocols, and these routing protocols leverage a distributed database that contains routing and reachability information. Two types of routing protocols exist: some protocols are meant to operate within Autonomous Systems (or AS), controlled by a single organization (e.g., a university), while others are meant to operate at the interconnection level, between autonomous systems, i.e., at the Internet backbone level. The Border Gateway Protocol (BGP) is the protocol currently in use on the Internet for the exchange of routing and reachability information among autonomous systems. It is therefore of utmost importance since any misbehavior, perhaps caused by an attack, can isolate a whole country from the Internet, or redirect all of a given country’s traffic through a surveillance point<fnref n="3" />.

BGP has long suffered from security weaknesses. For example, an attacker can forge a false BGP response that will allow him to hijack further traffic. Addressing these weaknesses requires:

* setting up a dedicated public key infrastructure to distribute certificates that can be verified by any BGP router. This is the role of the Resource Public Key Infrastructure (RPKI), managed by the various Internet registries (IANA and Regional Internet Registries);

* leveraging on this RPKI to issue certificates, called Route Origination Authorization (or ROA), that attest that an AS controls certain IP address ranges and is authorized to originate route advertisements for these IP address ranges.

Although these mechanisms are required, an ROA by itself does not prevent an attacker (e.g., a malicious BGP router) to forge or propagate malicious route announcements. The underlying problem of validating an AS path for a specific destination is complex and multidimensional: it requires to check the AS validity, the AS neighborhood, the compliance of the AS path listed in the message with the message propagation itself, and the compliance of the AS path with the actual routing policies of each AS. The BGP security extension BGPsec (see below) is meant to provide some guaranties from this point of view.

The Secure Inter-Domain Routing (SIDR) IETF working group has specified the RPKI and BGP security extensions. However, deployment takes time, especially with BGPsec that requires major upgrades, and enjoying a fully secure interdomain routing remains a distant dream. Partial deployment being the rule, several academic works focus on the consequences of attacks that originate from unsecured parts of the Internet and techniques to mitigate them.

<footnote n="3">³ Isolating a geographic area could also be motivated by the desire to disconnect a certain number of servers involved in distributed services and thereby facilitate an attack (e.g., a blockchain-based service.)</footnote>
Another aspect of BGP is the geostrategic importance of routing information. Their analysis can help identifying or understanding attacks (e.g., when a subset of the Internet becomes suddenly unreachable) or surveillance practices (e.g., when a subset of the Internet traffic is redirected through a certain domain).

## Encryption by default and mass surveillance attacks mitigation

"Peeking is irresistible. If there is information visible in the packet, there is no way to keep an intermediate node from looking at it. So the ultimate defense of the end to end mode is end to end encryption." [CWSR02]. Following this wise advice, research and standardization activities have been carried out in order to facilitate the use of encryption within the Internet and to thwart passive eavesdropping in particular.

This is the case of *TCP encryption*, for instance as developed by the TCP Increased Security (tcpinc) IETF working group<fnref n="4" />. The idea behind TCP encryption is to design TCP extensions that are likely to provide unauthenticated encryption and integrity protection of TCP streams. In this case, the unauthenticated key exchange mechanism enables both ends to encrypt and check the integrity of each TCP packet, very easily, without relying on any external service (e.g., PKI infrastructure), nor user solicitation (as with SSL when connecting to a new host), nor any modification to applications for whom this extension is fully transparent. Such an extension, once sufficiently deployed, will enable all TCP flows to be encrypted by default. However, since there is no end-to-end authentication, there is a risk of Man-in-the-Middle attacks: the attacker impersonates the remote node and proposes its own keying material which allows them to decrypt, peek, and re-encrypt all traffic. For this reason, it is viewed as a "better than nothing" security.

Encryption as a default tends to become the rule, as is the case in the new QUIC transport protocol, now developed within the QUIC IETF working group<fnref n="5" />. Initially proposed by Google as a high-performance replacement for HTTP over TLS/TCP connections, this protocol already represents a significant part of Internet traffic (more than 30% of Google's egress traffic, or 7% of Internet traffic, by the end of 2016). Among many innovations, this protocol provides by default secure communications: QUIC packets are always authenticated and the payload is typically fully encrypted, thereby preventing mass surveillance and other forms of attacks.

### [Inria teams] Network threats

The **DATASPHERE** team works on the analysis of BGP data to identify or understand attacks or surveillance practices.

<footnote>[CWSR02]. D. Clark, J. Wroclawski, K. Sollins, and Braden R. Tussle in cyberspace: Defining tomorrow's internet. In *proceedings of SIGCOMM*, 2002.</footnote>

<footnote n="4">4. https://datatracker.ietf.org/wg/tcpinc/about/</footnote>

<footnote n="5">5. https://datatracker.ietf.org/wg/quic/about/</footnote>
## 2.3 The human factor

As in many other fields, there is a well-known adage about security that says that the main threat lies between the chair and the keyboard. This adage may be exaggerated, and at the very least it deserves further study, but it must be recognized that the users are indeed sometimes a source of security problems. Firstly, they can be the target of the attack (see Section 2.3.1). In addition, They can try to avoid using the available protection mechanisms due to the (real or perceived) excessive complexity of their use (see Section 2.3.2). Finally, their level of education and training is too often insufficient (see Section 2.3.3): they are therefore not aware of the real risks, or on the contrary overestimate them. In either case, they do not know what mechanisms are to be used when.

### 2.3.1 Attacks against the user: social engineering and phishing

**[ Summary ]**

Social engineering aims at convincing the user to perform an action, such as revealing a password, by gaining their trust. Closely related, phishing aims at obtaining information like passwords, credit card numbers, etc. It is often based on massive email campaigns (spam) or messages over other communication media (chats, social networks) to request that people provide sensitive information by either replying to an email or connecting to a website.

Social engineering aims at convincing a person to perform a forbidden or sensitive action by gaining their trust. The attacker can impersonate a person's identity or can pretext a fake urgent matter. Social engineering is not strictly limited to the Internet. However, the Internet allows to scale up phishing attacks, a major representative of social engineering attacks. Phishing usually aims at obtaining information like passwords, credit card numbers etc. It is often based on massive email campaigns (spam) or messages over other communication media (chats, social media) requesting that people provide sensitive information either by replying to the email or by connecting to a website. At first phishing campaigns were quite simple and naive because the same email was massively sent without any customization. Spear phishing is more advanced and leveraging higher social intelligence to make people confident in the legitimacy of the request they received. Hence, the request can be customized regarding the country, the location, or the company of the victims. Actually, this kind of information can be easily found on the Internet.

The FBI estimates that money extorted by phishing was about half a billion dollars a year between 2013 and 2016⁶, based on complaints collected in USA. Even though sophisticated techniques can support phishing, such as DNS poisoning to

<footnote n="6">6. https://www.ic3.gov/media/2017/170504.aspx#fn3</footnote>
take over a legitimate website, attackers usually prefer relying on social engineering techniques, that are a much easier way to achieve the same end.

Although massive naive social engineering might be easily detected, it is challenging to detect spear phishing even if carried out at a large scale, due to the automatic personalization for each email sent. Defense occurs at several levels. First, phishing attacks rely on a communication channel to reach the victims. For large campaigns, attackers leverage botnets. Therefore, fighting botnets indirectly limits phishing attacks. Second, an analysis of users' messages, the content itself, and the correlation among them, is another option. Third, most of the time, the victim is redirected to a website. Detecting or preventing such websites to exist or to be accessed is also an effective counter-measure. Both the second and third approaches are relevant to social engineering as, in these cases, the attacker needs some social intelligence to make the victims confident in the legitimacy of the email or the website.

Analyzing message content of an email is problematic due to privacy concerns. In addition, with the use of encryption, only end-users or their email servers may have access to the content, making impossible the correlation of multiple emails sent to different users. Hence, only individual email analysis is possible. That is why blacklisting domain names or URLs is widely used. Moreover, blocking access to a single such website means protecting thousands of users in one go. The main challenge is actually to block early a phishing website or URL and even predict it when possible. Indeed, the attacker needs to setup its infrastructure before effectively starting their campaign. Of course, websites can only be analyzed once a potential URL is known. More active and reactive techniques are thus required to automatically discover and verify potential phishing websites.

[Inria teams] The human factor

The **RESIST** team works on automatic blacklist construction of potential phishing websites. This work includes a reactive approach and a proactive approach.

## 2.3.2 Improving security mechanism usability

**[Summary]**

One of the main sources of computer security failures are still human errors. A major reason for this is that user interfaces of many applications or software systems have often not been designed for the purpose of security. A good user interface for security should consider that the user is rarely a security expert; it should always ensure that the user is well aware of the consequences of their actions and be designed to avoid unintentional errors that compromise security. Designing security mechanism with good usability calls for interdisciplinary research with experts in cognitive sciences.
Human errors are a major source of computer security failures. While increasing the users' awareness of security risks is crucial, supposing that users are well-trained is neither realistic, nor sufficient. One major reason for human errors is that user interfaces of software systems are not well designed for the purpose of security, even if design principles that are suitable for other applications are applied. Indeed, security is not the user's main goal unlike browsing the web, or purchasing goods and services. Ideally, users want security to work without them doing any specific actions; often it is easier to ignore or circumvent security mechanisms if this makes achieving their main goal easier. A classic example is a web site with a bad certificate; simply ignoring the warning allows a user to continue browsing, at the risk of visiting a fake, phishing website. Another example is deactivating the whole firewall, to ensure a given port used by a specific application is not blocked. Often users do not understand, or misunderstand, the consequences of their actions. Therefore, security mechanisms must be designed with usability in mind. The user interface should consider that the user is not a security expert (and does not understand, for example, the underlying mechanisms of access control), ensure that the user is well aware of their actions' consequences, and avoid that user make errors that compromise security. Designing usable security mechanism calls for interdisciplinary research with experts in cognitive sciences.

## [Inria teams] A usability to be improved

The CIDRE team works with ergonomists and psychologists to evaluate how a user is perceiving the importance of a message, to increase the chance that the user is clearly aware of their action.

## [Research challenge 2] Security and usability

Very often, when users request a service, they are willing to sacrifice security, and bypass an annoying security mechanism, if it prevents them from using the service. In order to avoid this problem, security must be as transparent as possible. Even though complete transparency is not always possible, security services must be as simple as possible to use. Work is needed to propose interfaces and security mechanisms that are suitable for nonexpert users, that ensure the user is well aware of the consequence of their actions, and that prevent users from making errors that compromise security. Designing such usable security mechanisms calls for interdisciplinary research including typically experts in cognitive sciences.
### 2.3.3 A lack of education and awareness

**[ Summary ]**

Users are often viewed as the weakest link in the security chain, too often being unaware of security issues and therefore easily deceived by even very simple attacks. This is why the education and awareness of "good practices" and "cyber hygiene strategy" of every computer user (at work or in the home) is crucial. Each young citizen should be introduced to the basics of computer science and cybersecurity. Each professional actor should know about the risks related to economic intelligence and cyberattacks, and be informed of the possible defenses. In addition, system and network administrators should follow periodical training to be kept up to date regarding the most recent threats—and the solutions to mitigate them.

The industry needs experts on cybersecurity, although it is facing a shortage of skilled cybersecurity experts at all levels. Even if cybersecurity curricula are now offered by a large number of institutions, efforts must still be made to train more experts.

Users (citizen or professional actor) are impacted more or less consciously by cybersecurity or the lack thereof. Too often a victim of cyberattacks, they are considered by many as the weak link of the chain, being unaware of security issues and therefore easily deceived even by technologically very simple attacks such as phishing or social engineering. Insufficiently informed of the importance of protecting themselves, they may for example use passwords that too weak or too predictable. Finally, a given functionality may be more important for them than security, thus they tend to systematically click on a web link or use an unsigned certificate. Thus, an important challenge is to make security tools more easily usable (see §2.3.2).

More generally, most successful attacks leverage well-known security problems and a vast majority of cyberattacks are the result of poor cyber habits within the victims' organizations.

In this context, the education and awareness of each user is essential. Users must be educated about "good practices" for domestic and professional situations and should be able to enforce a "cyber hygiene strategy" in order to reduce the risks of becoming a victim or spreading an attack.

As a first step, each young citizen should be introduced to basic security concepts and tools, at the same time when being introduced to the basics of computer science. Examples of topics include the importance of updating the software or the operating system to avoid keeping too many vulnerabilities, the importance of an antivirus, the definition of a good password or an electronic signature.

A second step is to educate each professional actor, in each educational program, whatever the domain, introducing additional good practices relative to the professional context. Each professional should be explained the economic
intelligence risks, be taught about the separation of professional and personal data and applications, about the partitioning of networks, and about the importance of backups and business continuity plans. In France, a good example of what could be done is ANSSI's (Agence Nationale de la Sécurité des Systèmes d'Information) CyberEdu project<fnref n="7" /> that aims to develop pedagogical material facilitating the integration of digital security in higher education for non-specialists.

A third step targets the operational teams, especially, but not only, within small and medium sized businesses. These teams must be aware of the state of the art in cybersecurity and must therefore follow periodical training on recent risks and threats, on the fine-tuning of systems, on security reinforcement, on maintaining a global safe condition, and on legislation and regulation. Several initiatives are following this path: in France, ANSSI has produced the "40 Essential Measures for a Healthy Network" guide<fnref n="8" /> dedicated to people in charge of information systems security. At EU level, the ECSO "Cybersecurity Human Resources Network" is looking at raising the awareness levels through various cyber hygiene initiatives, and the ENISA issued its own document<fnref n="9" />.

Finally, the education of cybersecurity professionals is of course a main issue. Today, the industry already faces a shortage of skilled workers in cybersecurity, as proved by the number of job offers published on APEC<fnref n="10" /> for cybersecurity positions, which in France has quadrupled from 315 offers to 1,133 offers<fnref n="11" /> between 2014 and 2016. Worldwide, the Frost & Sullivan business consulting firm forecasted a lack of 1.5 million professionals by 2020, according to the 2017 Global Information Security Workforce Study<fnref n="12" />.

Addressing this problem represents a long term effort in education and training. The inherent difficulty is that cybersecurity requires both an extremely solid background in computer science, together with additional skills relative to the threat landscape, security concepts and tools, and a good understanding of law, human factors and psychology, social sciences, economics, and risk management.

Technical curricula are now proposed by a large number of institutions. In France, ANSSI launched SecNumEdu<fnref n="13" />, whose objective is to certify some curricula to provide assurance to students and employers that training in the digital security field meets criteria defined by ANSSI in collaboration with industry and higher education institutions. A first list of programs are already labeled<fnref n="14" />. A similar job

<footnote n="7">7. https://www.ssi.gouv.fr/entreprise/formations/cyberedu/</footnote>

<footnote n="8">8. https://www.ssi.gouv.fr/uploads/IMG/pdf/guide_hygiene_v1-2-1_en.pdf</footnote>

<footnote n="9">9. https://www.enisa.europa.eu/publications/cyber-hygiene</footnote>

<footnote n="10">10. https://www.apec.fr/</footnote>

<footnote n="11">11. http://www.bretagne.bzh/upload/docs/application/pdf/2017-06/etude_apeccybersecuritebretagne.pdf</footnote>

<footnote n="12">12. https://iamcybersafe.org/wp-content/uploads/2017/06/Europe-GISWS-Report.pdf</footnote>

<footnote n="13">13. https://www.ssi.gouv.fr/entreprise/ formations/secnumedu/</footnote>

<footnote n="14">14. https://www.ssi.gouv.fr/particulier/ formations/secnumedu/ formations-labellisees-secnumedu/</footnote>
has been done by the NATO mainly for US and UK universities<fnref n="15" /> and the ENISA for EU universities<fnref n="16" />. One can also cite at the European level, the EIT Digital Activities in Cyber Security that includes Professional<fnref n="17" /> and Master schools<fnref n="18" />.

The interdisciplinary nature of cybersecurity may require novel teaching methods and strategies. Here, practical (and not just theoretical) learning is crucial. Programs could also take advantage of MOOCs and specific technical professional training such as large scale Cyber Defense Exercises (CDXs). An example of the latter is NATO's Locked Shields 2017¹⁹.

### 2.3.4 Manipulating users and public opinion

**[ Summary ]**

Data and technologies can be used to influence opinions or decisions online, through profiling and well-targeted *fake news*. This requires technical solutions to deter unwanted profiling and enable easy verification of information as well as validation of its source.

A serious issue, actually only loosely connected to security but very often linked to security, at least in the minds of the general public, is that data and technologies are also used to motivate, influence, or shape people's opinions or decisions online. The better understanding of users' behaviors combined with the capacity of building accurate psychological profiles create opportunities to develop techniques that influence users online, by shaping their opinions. These technologies try to impact the user's reasoning and decisions by manipulating their "cognitive biases," e.g., their emotions, memory, or beliefs.

One particular way to manipulate public opinion is fake news. Globally speaking, disinformation through the Internet is seen today as a major issue that requires technical solutions to enable easy verification of information as well as validation of its sources. In the media industry, a number of recent initiatives have started to identify, track, and debunk fake news and wrong claims that circulate over the Internet, for instance creating a shared repository of fake news or lists of trusted and non-trusted information sources (see, e.g., *the Decodex database*<fnref n="20" /> from Le Monde in France).

<footnote n="15">15. https://digitalguardian.com/blog/cybersecurity-higher-education-top-cybersecurity-colleges-and-degrees</footnote>

<footnote n="16">16. https://resilience.enisa.europa.eu/nis-platform/shared-documents/wg3-documents/cybersecurity-education-snapshot-for-workforce-development-in-the-eu/view</footnote>

<footnote n="17">17. https://www.eitdigital.eu/eit-digital-academy/professional-school/</footnote>

<footnote n="18">18. https://www.eitdigital.eu/eit-digital-academy/master-school/</footnote>

<footnote n="19">19. https://ccdcoe.org/locked-shields-2017.html</footnote>

<footnote n="20">20. http://www.lemonde.fr/verification/</footnote>
## [Inria teams] Manipulating users and public opinion

esk The PRIVATICS team investigates how personal data is being used to manipulate people online.

Inria, together with partners in the media industry as well as in the defense sector, studies how to fight against user manipulation and fake news, by leading projects on fake news detection.

At the content analysis level, the LINKMEDIA team investigates image retrieval and tracing as well as image forensics, in conjunction with text mining to help in the detection and tracking of fake news.

The ALMANACH team applies natural language processing techniques to identify fake news.

At the data and knowledge management level, the CEDAR and GRAPHIK teams work on easy access to heterogeneous data sources to facilitate information cross-checking and validation in complex environments.

The DANTE team focuses on graph analytics to identify the networks of diffusion for fake news and the accounts that legitimate fake news.

Visualization teams such as ILDA study the mechanisms needed for human analysts working in a collaborative and dynamic fashion to make the most of data, its related processing, and management algorithms, in an effort to increase information security in the media industry and beyond.

## 2.4 Modeling threats and attacks with attack trees

### [Summary]

To represent all kind of attacks, one can use a graphical representation called "attack trees." In this representation, each leaf of the tree expresses a step that the attacker has to perform in order to carry out their attack. Each non-terminal node contains a label expressing how its children are connected (and, or, sequence). Globally, an attack tree represents the sequences of possible actions that the attacker can perform to reach their objective. Attack trees are largely used during the risk analysis step: risks (threats) are identified, a security policy is designed, and then security mechanisms are chosen to enforce that policy.

In the safety field, so called "fault trees" have been proposed in the early 80's [VGRH81] to graphically represent the safety risks a system faces. In 1999, Bruce

<footnote>[VGRH81] William E. Vesely, Francine F. Goldberg, Norman H. Roberts, and David F. Haasl. Fault tree handbook. Technical report, Nuclear Regulatory Commission Washington DC, 1981.</footnote>
Schneier adapted this representation to the security field, introducing "attack trees." [Sch99]

As with any tree, an attack tree is composed of nodes and leaves. A node's label (AND or OR) expresses how the children of the node are connected. Each leaf expresses a step that the attacker has to perform in order to carry out their attack. To be able to express more subtle links between the different steps of an attack, more evolved operators have also been introduced, such as the "Sequential AND" that imposes a time order between the operators of a logical AND.

Common attack trees bring a qualitative representation of an attack. Some research works to enrich attack trees by adding quantitative attributes that include the impact of the attack, the costs of countermeasures, etc.

The semantics of attack trees have been largely extended over the last decade. One of the main extensions considers not only the description of an attack, but also of the actions that the security administrator can carry out to stop its progression. This class of trees are called attack-defense trees [KMRS10]. The originality of this representation relies on the fact that the leaves are heterogeneous and represent both the attacker and the defender perspectives. The link between attacker and defender views has also been investigated in the domain of alert correlation.

Due to the difficulty of building attack trees, various attempts have been made to generate them automatically.

Many other graphical modeling techniques have been proposed, from small variations on the original attack trees to changes of representation, as in attack graphs, Bayesian attack graphs, or Petri Nets. For more detailed information on the various graphical models that are used in security to model an attack and their subtleties, the reader should refer to [KPCS14].

### [Inria teams] Modeling threats and attacks with attack trees

* The **CIDRE** team proposes a solution to automatically build correlation rules starting from existing attack trees and the description of the monitored systems.

* The **DIVERSE** team works on the synthesis of attack trees for supporting computer-aided risk analysis.

* The **PRIVATICS** team uses attack trees for the quantification of privacy.

* The **TAMIS** team uses attack trees for the quantification of security.

[Sch99] Bruce Schneier. Attack Trees: Modeling security threats. *Dr. Dobb's Journal*, 24(12):21-29, December 1999.

[KMRS10] Barbara Kordy, Sjouke Mauw, Sasa Radomirovic, and Patrick Schweitzer. Foundations of Attack-Defense Trees. In *Formal Aspects of Security and Trust*, Lecture Notes in Computer Science, pages 80-95. Springer, Berlin, Heidelberg, September 2010.

[KPCS14] Barbara Kordy, Ludovic Pietre-Cambacedes, and Patrick Schweitzer. DAG-based attack and defense modeling: Don't miss the forest for the attack trees. *Computer Science Review*, 13(Supplement C):1-38, Novembre 2014.
3

Cryptographic primitives, schemes and protocols
Cryptography aims at providing techniques and tools to secure communications, even in the presence of an adversary. Historically, the main goal of cryptography was to ensure the confidentiality of messages through encryption, i.e., information remains hidden to non-authorized people. Early methods of encryption were generally rather naive, such as Caesar's cipher which consists in shifting each letter by a constant (e.g., replacing 'A' by 'D', 'B', by 'E', and so on) and can be easily broken using techniques such as a frequency analysis. A substantial advance occurred during World War II with the Enigma rotor machine used by Germany. Breaking the Enigma cipher required significant effort and resources. Nowadays, cryptography is based on firm mathematical grounds and aims at guaranteeing many more properties than just confidentiality: cryptography provides tools to protect the integrity and authenticity of messages (avoiding for instance that the amount in a financial transaction is changed), to ensure non-repudiation (the sender cannot deny being the author of a message) and anonymity. Moreover, these tools may be combined to ensure even more complex goals. The aim of cryptanalysis is to "break" the cryptographic techniques that are meant to ensure security and is actually used to check their robustness.

<figure><img src="image_12.png" /><figcaption>Close-up of an Enigma rotor assembly. — TedColes via Wikipédia, CCO</figcaption></figure>

The chapter is structured in three parts:

• cryptographic primitives are the most basic building blocks; such primitives allow to encrypt or digitally sign a message;

• cryptographic schemes generally build on primitives to provide stronger security goals, guaranteeing the integrity and authenticity of arbitrarily sized messages;

• cryptographic protocols rely on schemes to achieve more complex security goals, e.g., establishing a secure communication channel that may be used for confidential and authenticated message exchanges.
## 3.1 Cryptographic primitives

### [Summary]

Cryptographic primitives, such as encryption functions and digital signatures, are the basic building blocks for designing secure systems. They can be divided in two families: symmetric and asymmetric cryptography. Symmetric cryptography supposes that communicating parties privately share a secret key. This kind of cryptography is more efficient than asymmetric cryptography, but requires a preliminary secure key exchange. Asymmetric, or public-key, cryptography does not require sharing a secret key, as the public key (used for encrypting or verifying signatures) does not need to remain secret. The use of these two kinds of primitives is complementary. A typical approach is exchanging a symmetric key using asymmetric cryptography in order to encrypt later communications more efficiently with symmetric cryptography using the exchanged key. Hence, both types of cryptography are required in most applications.

Today we have mature constructions for both symmetric and asymmetric cryptography. Nevertheless, there is still a need for research in both cryptanalysis and design. The aim of the cryptanalyst is to find weaknesses and assess the strength of existing constructions. On the one hand, this work consists in carefully assessing the difficulty of solving the underlying assumed algorithmically hard problems, considering both the evolution of computing power and the improvement of algorithms. On the other hand, this work must also explore new attack methods, such as attacks relying on a possible quantum computer or attacks that exploit side channels. The design of new primitives may be driven by (foreseeable) cryptanalytic breakthroughs (e.g., due to the construction of a quantum computer) or a new demand or need from industry. New demands include lightweight cryptographic schemes that can operate on low-power devices, as well as new functionalities, such as the need for functional or homomorphic encryption that permit computations on encrypted data, typically required when computation on sensitive data is outsourced, which is a current trend.

Cryptographic primitives come in two different flavors. On the one hand, the primitives that rely on a unique secret shared by all the protagonists are known as secret-key cryptography, also called symmetric cryptography. This family also includes cryptographic hash functions: as any hash function, a cryptographic hash function maps an arbitrarily sized value to a fixed size one, but additionally ensures properties such as being a one-way function (it is difficult to find the pre-image of a hash value) or collision resistance (it is difficult to find two values that map to the same hash value). Hash functions do not rely on any secret but are based on similar design principles as symmetric encryption. On the other hand, the primitives that use asymmetric keys (as the signing key and the verification
key in signature primitives) are gathered together under the name public-key cryptography, also called asymmetric cryptography.

Symmetric primitives are very efficient in both software and hardware implementations, and are thus usually well-adapted to constrained environments. Conversely, asymmetric primitives require heavy mathematical tools to be implemented, and their efficiency is several orders of magnitude worse than symmetric cryptographic primitives. However, they do not require a previous agreement between users. Therefore, symmetric and asymmetric primitives offer complementary security features, so they often have to be associated in concrete applications to achieve both appropriate security properties and efficiency requirements. For instance, in most applications, data is encrypted by an efficient symmetric encryption scheme under a secret key. This (short) secret key, which needs to be shared by the users, is either transmitted with an asymmetric encryption scheme or obtained by a key exchange protocol (e.g., Diffie-Hellman key exchange).

### 3.1.1 Cryptography today

Most of the basic cryptography needs are met today with a relatively small number of standardized primitives, namely AES [DR02] (together with some mode of operation like CTR or GCM) for symmetric encryption and SHA-2 and SHA-3 for cryptographic hashing. For digital signature, key exchange, and public-key encryption, most primitives, like RSA [RSA78] or Diffie-Hellman key exchange [DH76], are based on number theory assumptions (e.g., computational hardness of factoring or computing discrete logarithms).

### WHAT ARE THE ISSUES?

In addition to the exploration of new features (e.g., functional encryption), one of the main tasks of cryptographic research is to maintain confidence in the existing primitives and to devise new ones whenever necessary. This confidence stems from the understanding of the threats and their evolution due to new cryptanalytic methods or to technological breakthroughs. Therefore, existent primitives must be continuously scrutinized in order to check that all these threats are adequately addressed.

Cryptanalysis tells us when and why primitives must evolve (e.g., with larger keys, more rounds) or be replaced (e.g., due to algorithmic or technological breakthroughs). It provides the designer with evaluation tools and design criteria

<footnote>[DR02] J. Daemen and V. Rijmen. *The Design of Rijndael: AES - The Advanced Encryption Standard*. Information Security and Cryptography. Springer, 2002.</footnote>

<footnote>[RSA78] R. Rivest, A. Shamir, and L. Adleman. A method for obtaining digital signatures and public-key cryptosystems. *Commun. ACM*, 21(2):120-126, 1978.</footnote>

<footnote>[DH76] W. Diffie and M. Hellman. New directions in cryptography. *IEEE Trans. Information Theory*, 22(6):644-654, 1976.</footnote>
that help to adapt existing cryptographic primitives or propose new ones that
are resistant against the new attacks.

## 3.1.2 Cryptanalysis

The aim of academic cryptanalysis is to understand the threats to security of the existing primitives in order to be ahead of malicious adversaries. One difficulty is that the threats may evolve over time with the progress of algorithms, mathematics, or computers (e.g., Moore's law or quantum computing), but the attacker's capabilities evolve as well (e.g., physical access to an implementation, which was not always considered, must now be taken into account in the case of lightweight primitives for IoT). Cryptanalysis is the foundation of confidence we have in these primitives: the more we analyze them, the more we can trust them. It provides an empirical measure of security thanks to a thorough and never-ending scrutiny, searching for possible weaknesses. The knowledge of state-of-the-art cryptanalysis is thus the backbone for the design of secure primitives. In what follows we will distinguish mathematical cryptanalysis, focusing on the design, and implementation cryptanalysis, exploiting particular implementation details. We will also distinguish classical, as opposed to quantum cryptanalysis.

### CLASSICAL CRYPTANALYSIS

Cryptanalysing a cryptographic primitive consists in solving a problem that is claimed to be hard in the security model (e.g., recover the secret key, decrypt or forge a signature without the key, find a collision). The attack succeeds if it is more efficient than expected from the security claims. Cryptanalysis usually only succeeds in breaking reduced versions of the primitive (e.g., smaller key, smaller block size, fewer rounds). The security margin of a given primitive is then quantified by how much the reduced versions differ from the original primitive.

The state-of-the-art cryptanalysis is actually the only security criterion to decide at what point a primitive must evolve or be replaced. For instance, after a 10-year cryptanalytic effort by several research teams, a collision has recently been found for the SHA-1 hash function<fnref n="1" />, that is now considered unsafe from a cryptographic point of view and is slowly being replaced in applications. Another recent spectacular cryptanalytic breakthrough, strongly affecting the security of some pairing-based cryptosystems, is a quasi-polynomial algorithm for computing discrete logarithms in finite fields of small characteristics.

As modern cryptography advocates for security by knowledge, i.e., having a public design rationale, including justification of the design choices, public cryptanalysis is the only way of being able to trust such primitives. Therefore, any

<footnote n="1">1. https://www.inria.fr/centre/saclay/actualites/sha-1-les-predictions-d-inria-verifiees</footnote>
standardization effort is preceded by a long and intensive cryptanalysis phase that is necessary to evaluate the future standard. Moreover, analyzing new proposals often leads to the definition of new attacks that could also be considered as new threats to existing primitives.

[Highlights] Cryptanalytic record computations

Inria has been a key actor in several record computations for cryptanalysis:

→ In 2010 a 768-bit RSA key has been factored. The computational effort was about 1500 CPU years and 2 calendar years. This record computation was led by EPFL and Inria's **ARAMBA** team. At about the same time, credit card keys were increased from 896 to 960 bits and ANSSI released a recommendation to use 2048-bit RSA keys in 2010.

→ In 2013, researchers from the **ARAMBA** and **OURAGAN** teams in collaboration with A. Joux designed an efficient algorithm to break discrete logarithms in finite fields of characteristic 2, as well as pairings for algebraic curves based on binary finite fields.

→ Since 2014, researchers from **ARAMBA** and **GRACE** have solved discrete logarithms in several finite fields of the GF(p<sup>k</sup>) for k≤6.

→ In 2015, the **FREAK** attack (**PROSECCO** team) highlights how factorizing 512-bit RSA keys (in combination with a common implementation bug) can be used to break TLS connections affecting about 25% of the web. This work led to fixes in major web browsers and websites.

→ In 2015, the **LogJam** attack on TLS (**PROSECCO** and **ARAMBA** teams) highlights that using a pre-computation for a specific 512-bit group, Diffie Hellman keys can be effectively broken and (the still widely used) keys in 768-bit groups are now within reach of academic research teams.

→ In 2016, the **SLOTH** attack (**PROSECCO** and **SECRET** teams) highlights how hash collisions in MD5 and SHA-1 can be used to break signature-based authentication in protocols like TLS. This work led to the deprecation of MD5 and SHA-1 in TLS 1.3.

→ In 2016, researchers from the **ARAMBA** team, in collaboration with colleagues from the University of Pennsylvania, showed how to solve Diffie-Hellman for specially crafted prime numbers. As a result, a few months later, an **RFC** (Request For Comments) that did not provide details about the generation of the parameters was withdrawn.

QUANTUM CRYPTANALYSIS

After a couple of decades of study mostly limited to the academic world, quantum computing is now at the center of a race between high-tech companies like Google, Microsoft, or IBM. While the prospect of a large universal quantum machine is arguably still many years away, dismissing its potential impact for cryptography has become a rather untenable position. Indeed, the American National Institute of Standards and Technology, NIST, has recently launched a call for quantum safe cryptosystems that would resist attacks implemented with the help of a quantum computer.
Common wisdom in the field says that public key cryptography relying either on the difficulty of factoring or discrete logarithm, e.g., RSA or elliptic curves, is irremediably broken in a quantum world because of Shor's algorithm [Sho]. Symmetric cryptography looks at first much more immune to quantum cryptanalysis since the main applicable speed up seems given by Grover's algorithm in exhaustive search, a task for which quantum computers only provide a quadratic advantage, i.e., the cost of an exhaustive search drops from $N$ to $\sqrt{N}$ where $N$ is the number of keys. In particular, one could naively think that doubling the secret-key size is sufficient to take care of quantum attacks against symmetric cryptography. Unfortunately, this assessment is not backed up by the many years of effort required to gain confidence in the security of cryptosystems through dedicated cryptanalysis. New results have recently appeared in this direction, for instance showing that, in certain models, Simon's quantum algorithm for period finding completely breaks the security of the most widely used modes of operation (such as CBC-MAC or GCM) for authentication and authenticated encryption.

The lesson is that quantum cryptanalysis deserves much more attention than it has received so far. Standards take many years to evolve because of new threats. Therefore, a better understanding of the impact of quantum computers on cryptography is definitely called for now in order to see how quantum attacks should be modeled, to understand how secure post-quantum solutions based on lattices or codes really are, and more generally to integrate quantum techniques in the toolbox of cryptosystems designers.

## IMPLEMENTATION CRYPTANALYSIS

The security of a cryptographic primitive relies both on the software and the hardware that implements the primitive and the hardware the code runs on. The attacker of cryptographic primitives may just have access to the software, e.g., by remotely running some other process on the same machine, or may also have access to the hardware and be able to measure some physical quantity during execution, such as the precise timing or voltage, or even perform fault injection. However, the distinction between software and hardware is not so significant for the cryptographers who establish a model of the threats that is usually abstracted over the low-level details and the differences between software and hardware. A more practice-oriented discussion of this kind of attacks is given in §2.1.

When a cryptographic algorithm is implemented on a physical device (a smart card, a cell phone, a computer, ...), an adversary can measure the physical properties of the system during the execution of the cryptographic algorithm. The accuracy of these measures depends on whether the attacker has physical access to the hardware. In this case, they are able to measure the variations of

<footnote>[Sho] P. Shor. Algorithms for quantum computation: Discrete logarithms and factoring. In *IEEE FOCS'94*.</footnote>
the power consumption or of the electromagnetic radiations during execution. They may even be able to perform fault injections. If the attacker just has access to the software, e.g., by remotely running some other process on the same device, they may obtain only some timing information. However, in both cases, these physical measures are correlated to the secret key manipulated by the system and the key can be efficiently extracted unless special countermeasures are used. An important research area thus focuses on evaluating the effectiveness of these attacks and devising effectual countermeasures. In particular, we now have a good understanding of the protection offered by masking, using techniques from multiparty computations to split the secret into shares that are not correlated to the actual secret.

Physical attacks also include fault attacks, where an attacker manipulates the circuit to induce a fault (e.g., by tampering with the power supply or with a laser shot) and exploits the difference between a normal output and a faulty one to recover the secret key. Most implementation attacks require physical access to the system, but attacks are also possible when an adversary can just run code on the same machine as the victim. In particular, cache attacks and fault attacks based on the Rowhammer technique[<sup>KDK+14</sup>] can be very effective and have been demonstrated from JavaScript code running in a web browser.

### 3.1.3 Design

New primitives are designed either after some cryptanalytic breakthrough (e.g., the breaking of most standardized hash functions in 2004 and 2005) or to answer some pressing demand from the industry (e.g., lightweight primitives for low-cost devices). In modern cryptography, new primitives come with design rationale and security arguments. Such arguments do not provide an unconditional guarantee of security and may take different forms. In asymmetric cryptography, the argument will typically ascertain that any adversary breaking the primitive with given parameters will solve a problem that is widely believed to be difficult (e.g., factoring a 2048-bit number corresponding to the product of two primes, generic decoding for a linear code, or finding a short vector in a lattice of given parameters). In symmetric cryptography, the arguments are based on properties of the underlying building-blocks that guarantee (or tend to guarantee) their resistance to known classes of attacks (e.g., linear, differential, or algebraic attacks).

<footnote>[KDK+14] Y. Kim, R. Daly, J. Kim, Ch. Fallin, J.-H. Lee, D. Lee, Ch. Wilkerson, K. Lai, and O. Mutlu. Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors. In *ACM/IEEE ISCA'14*, 2014.</footnote>
[Highlights] International Cryptographic Competitions

For more than 20 years, the main new cryptographic standards have been specified after open competitions initiated by standardization bodies or international projects. These competitions attract submissions from many countries, from both academia and industry. The candidates are then scrutinized during several years by the whole cryptographic community in a public security evaluation process. Inria has submitted several primitives to these competitions and has contributed to the evaluation process.

Two stream ciphers were submitted by the **SECRET** team to the eSTREAM project launched in 2004 by the ECRYPT Network of Excellence. One of them, Sosemanuk, has been selected (among 34 submissions) in the final portfolio of recommended ciphers for software-oriented environments a.

The Shabal and the SIMD hash functions, designed by the **SECRET** and **CASCADE** teams together with several partners, are two of the 64 candidates to the SHA-3 competition b launched by the NIST in 2007. Both of them were selected among the 11 semi-finalists of the competition.

The **ARIC**, **GRACE**, **POLSYS**, and **SECRET** teams are involved in the design of 10 (out of 68) candidates to post-quantum cryptography standardization process c initiated by the NIST in 2017.

a. http://www.ecrypt.eu.org/stream/

b. https://csrc.nist.gov/projects/hash-functions/sha-3-project

c. https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization

<figure><img src="image_13.png" /><figcaption>Cryptographic properties of components of an encryption system – © Inria / Photo C. Morel</figcaption></figure>
LIGHTWEIGHT CRYPTOGRAPHY

In the last decades, we have seen a huge increase in the number of low-cost
smart devices: e.g., contactless cards, key fobs (RKE), sensor networks, home
automation, NFC/RFID tags, or medical implants. Most of them transmit sensitive
information wirelessly (e.g., contactless cards are often used for payment, access
control, or fee collection) and require cryptography to do it securely. Unfortunately,
hardware constraints of embedded devices limit their computing abilities and
power budget (being powered by a battery or even passively), preventing the
use of conventional cryptography. Therefore, many industrial products use weak
homemade cryptography (e.g., MIFARE Classic, KeeLoq, Megamos, Hitag2) or no
cryptography at all (e.g., medical implants, wireless mice). To fill this gap, secure
lightweight ciphers have been designed to run with low consumption of critical
resources (energy, power, execution time). These harsh implementation constraints
may have downsides, like a smaller block size forcing to renew keys more often
or a low latency. Several designs have been introduced and standardized in the
last decades, such as KASUMI (UMTS), PRESENT (ISO/IEC 29192-2), or HIGHT (ISO/
IEC 18033-3). Lightweight symmetric cryptography is a very active research area,
with several new proposals every year and an ongoing standardization effort by
NIST<fnref n="2" />. An important effort is also needed for designing lightweight key exchange
and asymmetric primitives. One of the specificities of lightweight cryptography is
that, in most applications, the low-cost devices are highly vulnerable to physical
attacks. Therefore, lightweight primitives should not only have a lightweight
specification but also a secure and lightweight implementation.

In such a constrained environment, randomness generation is also an issue.
While random coins are required in most of the cryptographic schemes and also
for securing their hardware implementation, they are quite hard to generate,
especially at a low cost. Pseudo-random generators allow to expand a random
seed into a larger stream of random bits, but both the entropy of the seed and the
quality of the expansion have to be studied. Any weakness at any point can weaken
the whole system. This is even worse if the adversary can have some control on
the device, which could allow them to reduce the entropy of the internal state.

POST-QUANTUM CRYPTOGRAPHY

The availability of quantum computing will render obsolete all cryptographic primitives based on number theory that are routinely and almost exclusively used today for securing communications. Even though quantum computers will not appear before one or more decades, the research community needs to line up now and start preparing alternative primitives notably for key exchange mechanisms and digital signatures. In particular, replacements must be ready soon if one

<footnote n="2">2. https://www.nist.gov/programs-projects/lightweight-cryptography</footnote>
wishes to insure long-term confidentiality<fnref n="3" />. An action was initiated by NIST<fnref n="4" /> to standardize quantum safe cryptographic schemes (public-key encryption, key exchange, digital signature). The five-year public analysis phase within the NIST standardization process is expected to provide a better view on the security level and performance of these techniques.

The oldest quantum safe technique for asymmetric cryptography, the McEliece encryption scheme, was proposed in 1978 and is contemporary to RSA. Its security relates to the hardness of decoding an arbitrary linear code and is the seminal work of code-based cryptography. Later, multivariate cryptography, relying on the hardness of polynomial system solving, and lattice-based cryptography, relying on the hardness of finding short vectors in a Euclidian lattice, were developed. The past decade has been extremely productive, in particular with the emergence of LWE [Reg] and its much more practical cyclic variants (Ring-LWE). Those techniques are reaching maturity and will assert themselves as a practical alternative for asymmetric cryptography in the coming decade. To be complete, let us mention that other techniques are being considered for quantum safe cryptography, one of the most notable being hash-based cryptography (based on the Merkle tree technique) allowing quantum safe digital signature schemes provided the cryptographic hash function it is built upon is collision-resistant.

### [Research challenge 3] Post-quantum cryptography

Building a universal (i.e., as opposed to special purpose) quantum computer is widely believed to become feasible in the next decades. Therefore, it is important to think now about quantum-resistant cryptography, as some information that is encrypted today may still be sensitive in, say, 50 years. Most asymmetric cryptography used today is based either on the hardness of factoring or computing discrete logarithms, these problems are both known to be efficiently solvable by a quantum computer. Hence, there is a need for alternatives: lattice-based, code-based, and multivariate-based primitives are the most prominent candidates. It is urgent to perform an in-depth security analysis of these new schemes.

## CRYPTOGRAPHY BASED ON THE LAWS OF PHYSICS

Most cryptographic proposals rely on computational assumptions and are therefore vulnerable to algorithmic and hardware breakthroughs. A way to stop relying completely on those computational assumptions is to use quantum

<footnote n="3">3. Note that the situation is critical for confidentiality since an adversary may store encrypted documents today that need to be protected during decades, even after a quantum computer becomes available. The situation is different for integrity which can be enforced by resigning documents when the quantum threat becomes real.</footnote>

<footnote n="4">4. https://csrc.nist.gov/Projects/Post-Quantum-Cryptography</footnote>

<footnote>[Reg] O. Regev. On lattices, learning with errors, random linear codes, and cryptography. In Proceedings of the 37th ACM Symposium on Theory of Computing (STOC 2005).</footnote>
cryptography. Using quantum communication, it is possible to construct an unconditionally secure key distribution protocol (known as the BB84 protocol). This means that even an all-powerful (potentially quantum) adversary cannot break the scheme. This offers a very-long-term security, but can only be used for a limited number of applications such as key distribution because of deployment constraints and is thus usually combined with standard or quantum-safe cryptography. In Europe and in Asia, quantum networks are developed in order to be able to perform unconditional quantum key distribution protocols. Currently, these protocols only work on a limited distance of about 50-150 km. In order to create large scale networks, we require trusted nodes, which can be dangerous from a cryptographic point of view, or quantum repeaters. Quantum repeaters are technologically out of reach today, but seem much easier to build than a full quantum computer and could arrive in a near future.

Another solution to obtain unconditional cryptography is to use other laws of physics. Relativistic cryptography [Kan15], for instance, uses space-time constraints between the agents to perform cryptographic protocols with unconditional security. These constraints limit the possible applications, but, unlike quantum cryptography, can be developed on a large scale with today's technology. It is important to follow the advances of unconditional cryptography, which can be seen as a safe backup plan in case we lose our trust in the computational assumptions used in standard cryptography.

<figure><img src="image_14.png" /></figure>

# 3.2 Cryptographic schemes

## [Summary] Cryptographic schemes

Whereas cryptographic primitives are the basic building blocks, cryptographic schemes achieve stronger properties with specific modes of operations. Some applications, such as outsourced computation may also require more advanced functionalities than classical encryption. So-called homomorphic and functional encryption schemes permit working on encrypted data, and cryptographic proofs ("proofs of knowledge") may be used to get evidence that outsourced computation was performed correctly. With the increasing complexity of cryptographic schemes and their security proofs, there has been a recent trend, called computer-aided cryptography, which consists in developing tools to check security proofs and achieve higher confidence in the security of some constructions.

<footnote>[Kan15] J. Kaniewski. *Relativistic quantum cryptography*. PhD thesis, Centre for Quantum Technologies, University of Singapore, 2015. https://arxiv.org/pdf/1512.00602.pdf.</footnote>
The security of a block cipher, such as AES, or of a trapdoor one-way function, such as the RSA function, does not generally provide secure encryption schemes on their own. For example, these basic functions are not randomized and encrypting twice the same will yield two identical ciphertexts, hence leaking the information that the two plaintexts were identical. Encryption schemes or signature schemes are thus usually defined by a primitive together with a mode of operation that specifies how to use the primitive in order to accommodate arbitrary-length messages and to reach a specific security goal. Examples of these constructions include standardized block-cipher modes for symmetric encryption (e.g., CBC, CTR) or for authenticated encryption (e.g., CCM, GCM), some padding schemes for asymmetric encryption (e.g., OAEP [FOPS01]) or for signatures (e.g., PSS). The security level offered by such constructions is evaluated under the assumption that the underlying primitive has an ideal behavior. The aim is to guarantee that a given scheme is secure as long as no specific weakness has been identified for the primitive. There are two complementary approaches to analyze the security of a mode of operation: the search for generic attacks (i.e., independent of the underlying primitive) provides upper bounds on the security level, while security proofs provide lower bounds.

### 3.2.1 Provable constructions

The area of provable cryptography, initiated in the seminal work of Goldwasser and Micali [GM84], is rooted in computational complexity theory. Adversaries are modeled as arbitrary probabilistic polynomial time Turing machines, that have access to oracles (for encryption or decryption). Security is then typically expressed as the adversary's inability to distinguish (with probability significantly better than 1/2) whether they have access to an encryption oracle or to a function that always simply returns a random string. Proofs are then performed by reduction: an adversary who can win such an indistinguishability game can be used to efficiently construct an adversary who can invert the underlying one-way function or distinguish the underlying block cipher from a random permutation. Hence, the proof essentially shows that breaking the construction is as hard as solving the underlying problem that is supposed to be hard. Such results have been obtained for classical modes of operation used to achieve authenticated symmetric and asymmetric encryption. However, there is still an important line of research on the design of new efficient modes of operation for symmetric encryption with a high security level. Indeed, most block-cipher modes of operation have their security limited by the so-called birthday-bound: they become insecure if the number of

<footnote>[FOPS01] E. Fujisaki, T. Okamoto, D. Pointcheval, and J. Stern. RSA-OAEP is secure under the RSA assumption. In *Proceedings of Crypto '01*, volume 2139 of LNCS, 2001.</footnote>

<footnote>[GM84] S. Goldwasser and S. Micali. Probabilistic encryption. *Journal of Computer and System Sciences*, 28(2), 1984.</footnote>
calls to the underlying block cipher is close to $2n/2$ where n is the block size. This is a major issue for lightweight cryptography since block ciphers operating on 64-bit blocks are preferred in these applications. This implies that the amount of data that can be encrypted under the same key must be much lower than 32 GBytes. This issue has been recently demonstrated on the CBC mode of operation used in HTTP over TLS and OpenVPN in an attack named Sweet32⁵ that led the NIST to lower the limit before rekeying 3DES to 8 MBytes. Designing an efficient mode of operation with a higher security level is therefore an important open problem.

While this approach has been widely used for proving the security of public-key encryption schemes and signature schemes under well-known assumptions, it is now required for any new constructions, and namely for the advanced constructions such as fully homomorphic encryption and functional encryption.

### 3.2.2 Homomorphic and functional encryption

With the development of outsourced storage and computing, classical encryption is not enough: when encrypted, the privacy of the data is guaranteed, but no processing can be performed on the data. In 2009, Gentry proposed the first encryption scheme that allows homomorphic operations: from the encryption of two messages, it is possible to produce the encryption of the sum or of the product, without any secret information. More concretely, it is possible to send encrypted data to the cloud, and let the cloud evaluate a circuit on this encrypted data. The cloud can then send back the encryption of the result, without having learned any information about the result. The owner of the decryption key can then decrypt the result. Whereas the initial construction of fully homomorphic encryption was prohibitive at both the computational and communicational levels, many improvements have recently been proposed, and some small circuits can now be concretely evaluated.

However, the result output by the cloud is still encrypted under the same key as the inputs, thus it can only be shared with those who could already decrypt the inputs. This is the reason why, Boneh, Sahai, and Waters proposed the notion of functional encryption: an authority can distribute functional decryption keys that help to compute the evaluation of a given function on the plaintext. The keys do however not leak the full input, but only the result of the computed function. The authority initially encrypts the data under a master key and derives a functional key kf for a chosen function f. The function f is evaluated on the plaintext data when decrypted with kf. This allows, for example, to do some aggregation on data (statistical analysis) without revealing the data.

<footnote n="5">5. https://sweet32.info/
[Gen09] C. Gentry. Fully homomorphic encryption using ideal lattices. In *Proceedings of the 41st ACM Symposium on Theory of Computing (STOC'09)*, 2009. http://portal.acm.org/citation.cfm?id=1536414.1536440
[BSW11] D. Boneh, A. Sahai, and B. Waters. Functional encryption: Denitions and challenges. In *Proceedings of Theory of Cryptography Conference (TCC'11)*, 2011. http://ia.cr/2010/543..</footnote>
While classical techniques (discrete logarithm) allow to instantiate functional encryption for simple families of functions, such as the inner-product [ABDP15], it seems that lattice-based techniques will be required for advanced functions. Similarly, ElGamal encryption is (simply) homomorphic, but to achieve fully homomorphic encryption, lattice-based encryption, or some approaches with noise/error look necessary. Hence the huge activity on lattice-based and code-based cryptography.

### [Research challenge 4] Computing on encrypted data

The need for computing on encrypted data has emerged, in particular, with the appearance of the cloud and outsourced computation. In cryptography, this problem can be solved using homomorphic or functional encryption. Gentry showed in 2009 in his breakthrough paper that it was indeed possible to construct a fully homomorphic encryption (FHE) scheme. However, this construction remained theoretical and was completely impractical due to its poor performance. Since then, significant progress has been made on FHE schemes, achieving approximately a still very low speed of 50 logical gates per second. Significant progress will have extremely useful applications for privacy preserving cloud computing, where any technical advance may quickly be exploited as an economical advantage.

### 3.2.3 Proofs of knowledge

For verifiability of outsourced computations performed by the cloud that we do not trust, proofs are required to convince the user of the cloud's honest behavior. There has been a huge activity in zero-knowledge or witness-indistinguishable proofs for privacy concerns. However, in the context of outsourced computing, the soundness and the succinctness of the proof are the most important issue, since there are no privacy concerns with respect to the user, hence the new SNARG (succinct non-interactive argument) primitive that provides succinct proofs for complex statements.

Still, usual zero-knowledge proofs are of major interest for anonymous credentials and any kind of advanced authentication mechanisms that preserve anonymity. New techniques have recently been developed with the Smooth-Projective Hash Functions (SPHFs).

Also, to limit interactions, Non-Interactive Zero-Knowledge Proofs (NIZKs) have become more effective, first with the Groth-Sahai methodology, making it possible to prove many kinds of relations between committed scalars or groups elements, or more recently with the Quasi-Adaptive NIZKs, based on SPHFs that are more specific but more compact and efficient.

<footnote>[ABDP15] M. Abdalla, F. Bourse, A. De Caro, and D. Pointcheval. Simple functional encryption schemes for inner products. In *Proceedings of Public Key Cryptography (PKC'15)*, 2015</footnote>
### 3.2.4 Computer-aided cryptography

Carrying out reduction proofs in a rigorous way is extremely difficult because they manipulate complex probabilistic algorithms. Indeed, the literature contains many examples of subtle errors in proofs, a famous example being the OAEP construction, "proven" in 1994 with an error discovered in 2001. In a position paper, Halevi [Hal05] advocates the use of proof assistants to verify the correctness of the mundane parts of cryptographic proofs automatically. As for reductions in complexity theory, proofs consist of a creative part for finding the reduction and a mundane, but difficult, part which consists in verifying the correctness of the reduction. In recent years, several tools, including CryptoVerif<fnref n="6" />, CertiCrypt, and EasyCrypt<fnref n="7" />, have shown that these parts are indeed amenable to automated proof verification. The most mature and versatile of these tools is EasyCrypt: the tool consists in a dedicated interactive theorem prover that shows relational properties on schemes modeled as probabilistic programs. While the tool offers solid guarantees it also requires a high level of expertise. For specific applications, such as chosen plaintext or ciphertext security of encryption schemes, full automation has been achieved with the dedicated ZooCrypt tool, resulting in the verification of numerous schemes and in the design of new ones proven secure. The area of computer-aided cryptography is currently expanding by widening its scope, including security of primitives against side channels, constructions based on pairings, applying these ideas to cryptographic protocols rather than schemes (see §4.3) and improving automation.

**[Inria teams] Cryptographic primitives and schemes**

- The **ARIC** team is working on lattice-based cryptography (LBC). Lattice algorithms is an established research area that is being revived by LBC and by the new tools and concepts that it introduced. Their goal is to contribute to the major technological switch, from conventional to lattice-based cryptography.

- The **CARAMBA** team studies mathematical, algorithmic, and high-performance software aspects for asymmetric cryptography based on number theory (RSA and Diffie-Hellman cryptosystems, elliptic curves). Their cryptanalytic work demonstrates the urgent need to increase key sizes for several of these primitives. The team is also involved in the design and cryptanalysis of symmetric cryptographic primitives (in particular in the lightweight context).

- The **CASCADE** team focuses on the provable security aspects of the advanced primitives or in advanced settings. They namely study the privacy-preserving primitives (such as FHE, functional encryption, etc.), but they also consider powerful adversaries, with side-channel attacks and quantum computers.

<footnote>[Hal05] Sh. Halevi. A plausible approach to computer-aided cryptographic proofs. Technical Report 181, IACR Cryptology ePrint Archive, 2005.</footnote>

<footnote n="6">6. http://cryptoverif.inria.fr</footnote>

<footnote n="7">7. https://www.easycrypt.info/</footnote>
The **GRACE** team works in algorithmic number theory and the computational issues related to algebraic curves over various fields and arithmetic rings. They also build codes for error correction. Their goal is to provide better cryptosystems and better security assessments for their key sizes.

The **LFANT** team researches algorithms in number theory and arithmetic geometry. They cover all aspects from complexity theory over optimized implementations up to cryptologic applications.

The goal of the **MARELLE** team is to study and use techniques for verifying mathematical proofs on the computer to ensure the correctness of software. They have applied their techniques in the context of cryptographic proofs by contributing to the development of the EasyCrypt special purpose proof assistant.

The **OURAGAN** team works on effective computations of algebraic objects with applications to cryptology.

The **POLSYS** team develops efficient algorithms for computing the complex or real solutions in finite fields. Cryptology is one of the many applications, where it can be used in the emerging topic of algebraic cryptanalysis. This consists in reducing the security of a cryptosystem to the solving of an algebraic system with coefficients in a finite field.

The **SECRET** team works on the design and analysis of symmetric primitives, of asymmetric primitives based on error-correcting codes and on cryptographic schemes based on the law of physics. They have contributed to the design of several primitives (stream ciphers, block ciphers, hash functions, code-based encryption and signature schemes, and key-exchange), and too many cryptanalytic works in these areas. They notably focus on the design quantum-safe primitives and investigate the use of quantum algorithms for attacking both symmetric and asymmetric schemes.
3.3 Cryptographic protocols and services:
towards provable security

[ Summary ]

Security of communications and transactions is nowadays ensured by the means of cryptographic protocols, e.g., TLS. The security of the underlying cryptographic primitives and schemes is however not sufficient to guarantee overall security goals, such as confidentiality, authenticity, or anonymity. Even careful scrutiny of these protocols by experts, cannot guarantee the absence of vulnerabilities: rigorous, possibly computer-aided, security proofs are therefore absolutely needed at the level of specifications and implementations to further increase the confidence level. We can distinguish three approaches in this area. The first one uses proofs by reduction to show that breaking the security of a protocol would imply breaking the underlying cryptographic primitives. These are mathematical, generally handwritten, proofs although a new trend consists in using techniques from theorem proving and program verification to achieve computer checked proofs. The second direction uses automated verification tools to analyze the protocol specifications and find vulnerabilities in the protocol logic, such as man in the middle attacks. These tools are able to analyze complex protocols, but idealize the underlying cryptography. Finally, the third approach aims at producing verified implementations. This approach relies on expressive type systems for special purpose programming languages and requires high expertise, but can result in an end-to-end verified implementation. A major success in this area is a completely verified implementation of TLS.

Strong cryptography is itself not sufficient to ensure security goals at a higher
level, e.g. securing communications or web transactions. Correctly using and
programming with cryptography is a complicated task and there are many examples
of security vulnerabilities that do not require breaking the underlying cryptography
(see the Heartbleed, French Passport, and TLS attack examples below). It is
therefore important to design and analyze protocol standards and libraries that
make use of cryptography to guarantee higher-level properties.

Cryptographic protocols, such as TLS (Transport Layer Security), IKE (Internet Key Exchange), or Kerberos, are in charge of securing our connections and web transactions. They are distributed programs that use cryptography to ensure, for instance, the confidentiality of transmitted data and the authentication of communications and entities. With the increasing diversity of electronic services they are quickly spreading out: for instance, they are the basis for the security of messaging applications and of RFID enabled objects, such as electronic passports; they are also central in security services such as the widespread Single-Sign-On (SSO) or cloud-based services.
<figure><img src="image_15.png" /><figcaption>Securing data exchange on the internet – © Inria / Photo C. Morel</figcaption></figure>

The design of protocols and security standards requires expertise in several areas of computer science including cryptography, computer networks, and also secure implementation. This task is difficult, even for experts, who may miss attacks due to the high complexity of these protocols. One of the difficulties in correctly designing and implementing cryptographic protocols comes from the fact that security must be guaranteed in the presence of an arbitrary attacker that controls the network and may compromise protocol participants. Vulnerabilities may arise at all levels. For instance, the famous Heartbleed<fnref n="8" /> attack is due to an implementation error, allowing a memory overflow, in the popular OpenSSL implementation of TLS: this attack did not reveal an error in the protocol specification, nor did it break the underlying cryptography. An early version of the French electronic passport<fnref n="9" /> was shown to be vulnerable to a linkability attack, enabling passport holders to be traced. The vulnerability was due to imprecisions in the protocol specification regarding the error messages: the French e-passport used detailed error messages, effectively allowing to differentiate a particular, previously observed passport, from another one, by using a replay attack. Finally, the FREAK<fnref n="10" /> and LogJam<fnref n="11" /> attacks on TLS mix vulnerabilities at different levels to downgrade the

<footnote n="8">8. https://en.wikipedia.org/wiki/Heartbleed</footnote>

<footnote n="9">9. Defects in e-passports allow real-time tracking. The Register, 26th January 2010.</footnote>

<footnote>http://www.theregister.co.uk/2010/01/26/epassport_rfid_weakness/</footnote>

<footnote n="10">10. https://en.wikipedia.org/wiki/FREAK</footnote>

<footnote n="11">11. https://en.wikipedia.org/wiki/Logjam_(computer_security)</footnote>
cryptographic key lengths. Dealing correctly with legacy code to guarantee backward compatibility, but avoiding downgrade attacks is extremely tricky.

As illustrated by the above examples, designing protocols and services correctly and guaranteeing their security is a difficult task. Therefore, rigorous security proofs and formal analysis techniques are needed to further improve their security. There have been different complementary approaches and research directions: some analyze protocols at the specification level, whereas others directly analyze the protocol implementation; the analysis may focus on the protocol logic or the underlying cryptography; the degree of automation may also vary, ranging from completely hand-written proofs, to fully automated analysis, as well as interactive computer-checked proofs.

### 3.3.1 Provable security for cryptographic protocols

The provable security approach, initially introduced to give solid security guarantees for cryptographic schemes, relies on reductionist proofs (inspired by the proofs in computational complexity): typically, one shows that breaking the cryptographic primitive is at least as difficult as breaking an underlying computationally hard problem, such as factoring, computing discrete logarithms, etc. This approach has been applied to protocols, where the reduction shows, for instance, that breaking an expected security property is as hard as breaking an underlying cryptographic primitive. The adversaries that are considered are arbitrary probabilistic polynomial-time Turing machines that may interact in different ways with legitimate protocol participants and compromise some of them.

There have also been proposals for general frameworks for rigorously designing security protocols. Secure multi-party computation (MPC) protocols provide a general model for computing the result of a function, allowing different parties that do not trust each other to provide confidential input. MPC protocols make it possible to implement a variety of protocols, but efficient constructions, secure against strong adversaries, are still an active and challenging research topic. Another family of frameworks, called universally composable, or simulation-based, aim at being highly modular and showing security of components that can be assembled into larger systems. Being able to split the proof of a complex system into proofs of its components can pave the way for creating secure-by-design protocols that can be used as building blocks for larger systems.

In the work described above, proofs are generally carried out by hand, making them error-prone. As for cryptographic schemes, there have been initiatives to automate proofs in these models, e.g., through the CryptoVerif tool, or to use dedicated interactive theorem proving, e.g., EasyCrypt. Improving the scope and the automation of these tools is still a challenging, active research field.
### 3.3.2 Symbolic automated analysis of cryptographic protocol specifications

Symbolic automated analysis of cryptographic protocols focuses on the protocol logic and its concurrent behavior and can be applied to complex protocol specifications. While the goals are similar to those described in the previous section, the techniques and the underlying models differ. In symbolic models the so-called Dolev-Yao [DY81] attacker is supposed to control the communication network completely: an attacker can read any message sent on the network, remove messages, and insert (or modify) messages. The attacker is computationally unbounded, but the cryptographic primitives are idealized: the way an attacker can manipulate messages is explicitly given by a set of rules. Such rules typically specify that when the attacker knows an encryption and the corresponding decryption key the plaintext can be extracted —however, no other unspecified operation (such as cryptanalysis) is allowed. Hence, these models manipulate cryptographic primitives at an abstract, axiomatic level. However, so-called soundness results [AR07] link this approach to the provable security approach (showing that a symbolic proof implies the existence of a computational one), even though their scope is rather limited. Relying on techniques from automated reasoning and concurrency theory, proofs in symbolic models can often be completely automated, exploring all possible attacker behaviors. Mature, automated tools, e.g., ProVerif<fnref n="12" />, as well as Tamarin<fnref n="13" /> and AVISPA<fnref n="14" /> exist nowadays for analyzing many security goals. Major research areas in this field consist in applying these tools to a larger class of security properties (technically this requires showing behavioral program equivalences) that allow us to analyze anonymity and privacy-like properties, to consider protocol executions on partially compromised platforms, and to scale to protocols with a complex underlying control flow.

### 3.3.3 Verified protocol implementations

As illustrated by the Heartbleed attack, implementation bugs may introduce serious vulnerabilities. Therefore, techniques from the field of programming languages have been used to study the security of implementations directly. This approach primarily relies on the use of expressive type systems to state security theorems directly at the implementation level. One particular successful approach in this area relies on the F* language<fnref n="15" />, a strongly-typed higher-order effectful language especially designed for developing proven implementations. For instance, the F*

<footnote>[DY81] D. Dolev and A. Yao. On the security of public key protocols (extended abstract). In *Proceedings of FOCS'81*, 1981.</footnote>

<footnote>[AR07] Martín Abadi and Phillip Rogaway. Reconciling two views of cryptography (the computational soundness of formal encryption). *J. Cryptology*, 20(3), 2007.</footnote>

<footnote n="12">12. http://proverif.inria.fr</footnote>

<footnote n="13">13. https://tamarin-prover.github.io/</footnote>

<footnote n="14">14. http://www avispa-project.org/</footnote>

<footnote n="15">15. https://www fstar-lang org/</footnote>
language has been used in the miTLS project<fnref n="16" />, a collaboration between Microsoft Research and Inria that resulted in a completely proven, reference implementation of the TLS 1.2 protocol and the new candidate protocol for TLS 1.3, going down to the level of the implementation of the cryptographic primitives. Currently, this approach only applies to carefully written implementations with many type annotations. A major challenge in this area is to make it applicable to more general code, which might not have been written by a formal methods expert. Another direction consists in extracting models directly from implementations, either by specifying small language subsets, or in a more dedicated setting by probing the system in a black-box manner. These models can then be automatically analyzed.

### 3.3.4 Electronic voting over the Internet

We finish this chapter with a particular application of cryptographic protocols: e-voting. Elections are arguably a cornerstone of modern democracies and a security critical process. Estonia has been pioneering this practice since 2005, and using Internet elections even for national parliament elections. Some regions in Switzerland and Australia also offered the use of Internet voting. In France, Internet voting was proposed to French citizens living abroad in the 2012 national election, but in the 2017 elections, this offer was not renewed, because of security concerns.

The main security guarantees an election must offer are vote secrecy and correctness of the result. Vote secrecy should ensure that nobody knows how a given voter voted (unless this can be deduced from the election result, e.g., in case of a unanimous vote). Correctness ensures that the result corresponds to the tally of the votes, as expressed by all eligible voters. In traditional paper elections, at least in France, these properties are ensured through a voting ritual, with a transparent ballot box, a voting booth which provides the necessary privacy to cast a vote secretly, and observers monitoring the box and the tally. The use of computers and machines significantly complicates this task, as computer programs may contain errors and correctness of a system is difficult to ensure. Moreover, the software may be intentionally tampered with, or a malware may alter its functionality. This may both change the votes, as well as leak the individual votes of persons, hence breaking both fundamental properties of an election.

To overcome the above-mentioned problems, cryptographically enforced secret, end-to-end verifiable elections have been proposed. Secrecy is generally achieved by casting an encrypted vote. This vote is then either mixed with other ballots before decryption, so that it can no longer be linked to the voter's identity, or the tally is performed homomorphically, i.e., the tally is computed on the encrypted votes providing an encryption of the result, without a decryption of individual votes. This ensures that even the tallier and server collecting the

<footnote n="16">16. https://mitls.org/</footnote>
votes are unable to break vote secrecy. Correctness is achieved by the notion of end-to-end verifiable elections: the voter can verify that their vote has been correctly recorded and that the tally was performed correctly. For this, the system generates cryptographic proofs that the operations were performed correctly. This property actually avoids having to verify the correctness of the software performing the tally, as it generates evidence, i.e., mathematical proofs that can be verified independently of the result correctness.

## [Highlights] The Belenios e-voting system

The **PESTO** team has been working on precise definitions of the properties a voting system should guarantee and the formal verification of these properties. This work permitted the discovery of an attack on the popular Helios voting scheme and also clarified the trust assumptions of many protocols. The **PESTO** and **CARAMBA** teams develop the Belenios voting system: a free, open-source voting system that guarantees vote secrecy and verifiability, including verifiability of the casted votes' eligibility, hence avoiding ballot stuffing. Still, this system, as many others, has short-comings: it does not prevent coercion, as a voter can prove how they voted. The system is therefore only recommended for low coercion elections. Moreover, it is vulnerable to malware that may be installed on the machine running the voting client: such a malware could leak the vote, breaking secrecy, or change the vote before it is encrypted (and verifiability only allows to track the encrypted ballot). Solving coercion-resistance and malware-resistance in a satisfactory way are still open research questions.

Moreover, one should note that Internet voting removes the privacy guarantee of a voting booth and requires a means to identify voters remotely. This is actually the case for any remote voting scheme, including paper-based ones, such as postal voting. Finally, cryptographic e-voting schemes also require voters to trust some experts as they rely on advanced mathematical notions, making their understanding difficult. Therefore, these systems seem not yet ready for high stakes, e.g., political, elections.
## [Research challenge 5] End-to-end formally verified cryptographic protocols

As the security of cryptographic protocols is extremely difficult to ensure (pencil and paper proofs regularly contain errors), the use of rigorous, formal methods appears increasingly as the only way to achieve the expected security level for this class of systems. Therefore, the area of computer-aided security proofs is an increasingly important topic and must include all aspects from the specification down to the implementation. Recent work, in particular around TLS 1.3, have shown that this is now achievable.

However, such proofs still require carefully crafted code and a very high level of expertise. Leveraging the proof techniques to make them applicable to more general code and usable by a wider audience is now the main challenge. Different protocols often ensure different security properties, but existing tools for verifying certain properties, such as anonymity, do not yet have the same maturity as tools for verifying authentication properties. Yet another challenge is to consider stronger adversary models, e.g., an adversary that may control part of the computer through malware.

## [Inria teams]

There are several Inria teams working on formal proofs and analysis of cryptographic protocols:

* The **CASCADE** team, in addition to their work on cryptographic primitives, also works on the design of protocols and their security analysis in computational models.

* The aim of the **PESTO** team is to build formal models and techniques, for computer-aided analysis and design of security protocols, using techniques from automated reasoning, concurrency theory, and programming languages. They are particularly interested in automated analysis of anonymity properties and e-voting protocols. They contribute to the development of several tools, including AVISPA<sup>a</sup>, DEEPSEC<sup>b</sup>, and the Tamarin<sup>c</sup> prover.

* The **PROSECCO** team conducts formal and practical security research on cryptographic protocols, software security, web security, and hardware protection mechanisms. To this end, they design and implement programming languages, formal verification tools, dynamic monitors, testing frameworks, verified compilers, etc. They develop the automated protocol prover ProVerif<sup>d</sup> and contribute to the design of the F* language that they used to develop a completely verified implementation of TLS. They have also worked on extracting models from implementations of the PKCS#11 key management standard, resulting in the creation of the Cryptosense startup.

<footnote>a. http://www.avispa-project.org/</footnote>

<footnote>b. https://deepsec-provergithub.io/</footnote>

<footnote>c. https://tamarin-prover.github.io/</footnote>

<footnote>d. http://proverif.inria.fr</footnote>
4

Security services
and mechanisms

<figure><img src="image_16.png" /></figure>
When a user starts using a computer system, she first identifies herself (identification), then she proves that she really is who she claims to be (authentication). This proven identity is then used by the system to grant or restrict access to a resource or service only to authorized users or entities (access control), or to avoid a specific information to flow to a given destination (flow control) through the actions of a user. When a user needs to execute a program on an untrusted machine, a hardware-based solution may guarantee isolation and software integrity. All these security services are preventive. Unfortunately, they can sometimes be bypassed by attackers and therefore reactive security is also needed. The user actions are therefore monitored to verify that they do not violate the security policy (intrusion detection and alert correlation). Of course, such a policy violation may have occurred without the user's knowledge, who may have been attacked by a malware acting on her behalf. Malware analysis and detection are thus other security services to offer. Ideally, if ever an intrusion or a malware is detected, the system should react and at least reconfigure itself to avoid another similar attack.

In the remainder of this chapter, we successively present the security services that have been introduced above: identification and authentication (§4.1), access and flow control (§4.2), trusted computing (§4.3), intrusion detection and alert correlation (§4.4), malware analysis and detection (§4.5), and reaction (§4.6).

4.1 Identification and authentication

[Summary]

Identification and authentication are generally the first two security services used when initiating a cyber exchange, either between a human being and a machine or between two machines.

Identification, for a given entity (i.e., a user, service, device, etc.), is the act of stating its identity. Authentication, for this entity, is the act of proving that it is really the entity it previously claimed to be.

Authentication is used to restrict access to a resource or service only to authorized users or entities. Authentication is achieved by presenting an authenticator that generally belongs to one of the following three classes: what you know, e.g., a password or pin; what you have, e.g., an access card; what you are, e.g., mechanisms based on biometry. These authenticators are often combined in so-called multi-factor authentication. Despite their numerous drawbacks, passwords remain the most common means of authentication.

Another form of identification is the ownership of a piece of data. This can be achieved through watermarking, which consists in hiding messages in the data. A
good watermarking technique must create a robust link between the piece of media and the hidden message, such that distorting the media does not erase the message. Watermarking is used in copyright management and copy protection, mainly focusing on multimedia content even if the spectrum of applications is larger and it may be used, e.g., to protect source codes, e.g., to protect source codes, or databases.

Identification, for a given entity (i.e., a user, service, device, etc.), is the act of stating its identity. For example, a user would provide their login. As such, identification is not really a security service, as the entity can lie and give the wrong information. That is why the authentication service is needed; it is the act of proving that it really is the one it claimed to be. For example, a user could reveal the password that is associated with their login.

Notice that some authors consider that authentication is a service related to identification. As such, the word identification can be used for "identity authentication."

### 4.1.1 User authentication

Authentication is used to restrict access to a resource or service only to authorized users or entities. For example, to access a system a login and password are required<fnref n="1" />. Many on-line services provided by private companies or public administrations also require user authentication. In such cases, identification happens through a network and the means for identification may be coupled with a cryptographic protocol such as TLS (Transport Layer Security). Authentication is achieved by presenting an *authenticator* that is generally in one of the following three classes:

* what you *know*, e.g., a password or pin;

* what you *have*, e.g., an access card;

* what you *are*, e.g., mechanisms based on biometry.

These authenticators are often combined in so-called multi-factor authentication. For example, cash withdrawal with a credit card requires both possession of the credit card and knowledge of the pin. Creating a new user identity, letting the user manage it, offering a password recovery service, and perhaps multi-factor authentication is however a highly complex task.

Passwords remain the most common means of authentication. Unfortunately, password management is complicated, both for the user who wants to be identified and the system that grants the access. On the system side, passwords need to be stored. However, passwords must not be stored as plaintext<fnref n="2" />, as a leak of the stored

<footnote n="1">1. Data authentication is different from entity authentication and is generally achieved using cryptographic means, e.g., by a key exchange protocol, and the use of a message authentication code (MAC) with the resulting key, see Chapter 3.</footnote>

<footnote n="2">2. See, e.g., Recommendation R22 in ANSSI Note technique - Recommendations pour la securisation des sites web. [in French] https://www.ssi.gouv.fr/uploads/IMG/pdf/NP_Securite_Web_NoteTech.pdf</footnote>
list would directly compromise all user accounts and passwords. It is therefore highly recommended to store only the hash value of the passwords, using a one-way hash function. Moreover, as passwords need to be easily remembered by humans, they are vulnerable to dictionary (or guessing) attacks, i.e., brute-force attacks by enumeration. We distinguish online and offline guessing attacks. In online guessing attacks, an attacker tries all possible passwords by executing the identification mechanism for each trial. These attacks can be thwarted by adding an additional delay after an unsuccessful trial or limiting the number of attempts, making this approach infeasible. Offline guessing attacks are possible when a list of hashed passwords is leaked. To avoid the same brute-force attack being applied to all passwords at the same time, a salt value is used: for each user, one stores a random value, called salt, and the hash value of the result of the concatenation of the password with the salt. Some hash functions are also specially designed to be costly in time and memory consumption, in particular on dedicated hardware, to slow down brute force attacks.

Ideally, one would like to have a hash function that is fast when verifying correct passwords and slow on incorrect ones: this idea has been partially realized by the notion of *pepper*. Similar to salt, an additional random value, the pepper, is hashed. This value is however not stored, and must be brute-forced: when the correct password is provided the expected number of hashes is N/2, where N is the number of possible pepper values, while N hashes are needed to discard an incorrect password. From the user's perspective passwords are often complicated to manage: ideally passwords should be difficult to guess and should not be re-used for different services. Some services require the use of digits or special characters in passwords. However, recent recommendations<fnref n="3" /> question this practice and recommend longer passwords, also called passphrases. Indeed, studies on real data have shown that without constraints, the word "password" appears as one of the most popular choices. When adding special characters or digits "password" is replaced by "password!" and "password123" in the list of most frequent passwords, hence not improving the security. A good practice is therefore to use a password manager that encrypts all passwords using one master password. Non-technical attacks such as social engineering or phishing are discussed in §2.3.1.

Given the high number of password leaks, there have been efforts to either get completely rid of passwords or couple them with a second authenticator. More widespread, is the use of two-factor authentication. For online payment, the 3D-secure protocol may rely on a confirmation code, sent by SMS to your mobile phone, that needs to be re-entered on the device used for the payment. The goal is to prove both knowledge of the credit card number and possession of the phone. Similarly, the Google 2 Step protocol, can either send a confirmation

<footnote n="3">3. NIST Special Publication 800-63B. Digital Identity Guidelines – Authentication and Lifecycle Management – https://pages.nist.gov/800-63-3/sp800-63b.html</footnote>
code, require a tap on the phone, or be configured to require the use of a FIDO U2F USB dongle plugged in your computer. These multi-factor protocols generally offer additional security. However, the increased complexity of both the protocol and the recovery methods, e.g., when a phone is lost or broken, may sometimes increase the attack surface.

Biometry is another means of user identification that relies on sensors to measure biologic characteristics, such as fingerprint, iris, voice, or face specificities. An inherent difference with other authenticators is that biological data is a priori not secret and cannot be modified, or replaced. Therefore, sensors are becoming more sophisticated in order to distinguish the physical presence from a copy (e.g., a fake finger with a copy of the fingerprint or a photo of a face). Although these means are becoming increasingly popular, e.g., laptops and mobile phones can be unlocked using fingerprint or, more recently, face recognition, they still suffer from false negatives and false positives. Therefore, it is recommended that they are only used as a second factor authenticator.

### 4.1.2 Identification of data owner: watermarking

Data hiding is the art of hiding messages into a cover media. It encompasses two branches, steganography and watermarking, where the word 'hiding' finds two different meanings.

* In steganography, 'hiding' messages means that an adversary, the steganalyzer, cannot statistically detect whether a piece of media contains a secret message. Thus, changing or not changing the value of a pixel of an image that is shared by two or more people is a simple (and actually naive) way of transmitting hidden information between these people. Steganography finds application in Intelligence services with steganalysis in fight against terrorism for example.

* In watermarking, 'hiding' means that secret messages are deeply embedded into media. This secret can be invisible to a human being, making the watermark a special case of steganography. It creates a robust link between a piece of media and the secret such that distorting the media (for example, rotating or cropping an image) does not erase the secret. Watermarking finds application in copyright management and copy protection. For instance, watermarking identifies the owner of a piece of data by embedding in their piece of media their identity as a hidden message.

While literature about watermarking mainly focuses on multimedia content, the spectrum of the cover media natures is very broad: programs (protection of source codes, parameters of Deep Learning classifiers, etc.), databases, maps, 3D objects, or DNA sequence.
Watermarking should not spoil the regular use of the cover media. For multimedia content, the user should not perceive any difference. Watermark embedding makes a big usage of human perceptual models. For programs, a drop in performance (relevance of the output, runtime) should be kept small. For databases, querying should yield similar answers.

The robustness of watermarking is gauged by measuring how the probability of a hidden message decoding error increases as the protected media is more and more distorted. The worst-case attack is defined as the attack maximizing this error probability for a given level of distortion.

Watermarking is nothing more than a secret communication scheme. Embedding and decoding share a secret key which defines how the message to be hidden modulates a given part of the cover media. Security enters the picture when the same secret key is used to protect many pieces of media. It amounts to answering the question as to whether an adversary can estimate the secret key by analyzing these watermarked pieces of media. Once the secret key is disclosed, the adversary may erase the watermark (removing any proof of ownership), modify the watermark or embed their own watermark into any media to usurp ownership.

The actual trend in watermarking moved away from ownership authentication to media consumer identification. This especially concerns confidential and highly valuable documents. Thanks to watermarking, the identification code of a user is embedded into their copy of the media to make it unique. This will disclose the identity of the user who has leaked the content. It does not prevent illegal redistribution per se, but it is a dissuasive weapon to avoid leakage. Identification codes are designed such that even if a collusion of several users mix their copies, the decoding will identify at least one of the traitors.

Another trend is emerging making the connection between data hiding and the generation of adversarial samples deluding deep learning classifiers.

Robust watermarking is a mature technology. Many research results have already been transferred to real life products. The number of research works on the topic has drastically decreased in recent years. The main consumer of watermarking technology is the entertainment industry. However, a robust and secure watermarking doesn't exist yet. It appears that the entertainment industry has little interest in security and is satisfied with the level of robustness achieved so far. More research on watermarking as a means to authenticate ownership is thus not recommended. The trend is on a cross-layer design of watermarking and traitor tracing codes, and on the development of protocols between parties (content owners, content distributors and content consumers), who do not trust one and another.
## [Inria teams] Identification and authentication

The **LINKMEDIA** team and its spin-off company Lamark work on multimedia (audio/video) protection through watermarking. For example, in the domain of traitor tracing, the team proposes identification codes such that even if a collusion of several users mix their copies, the decoding will identify at least one of the traitors. From the attacker point of view, the team studies how an attacker who has one or several watermarked pieces of data can estimate the secret key used by the watermarking scheme.

The **MULTISPEECH** team studies voice-based authentication and detection of spoofing attacks. It co-organizes the international ASVspoof challenge.

The **PESTO** team applies formal, symbolic verification methods to analyze the security of multi-factor authentication protocols.

The **PROSECCO** team uses symbolic verification in ProVerif to analyze web authentication protocols such as OAuth 2.0 and ACME with respect to a novel web attacker threat model.

## 4.2 Access control and flow control

### [Summary]

Enforcing security first involves precisely defining which previously identified and authenticated entity may have access to what information and in which way. Classically, access permissions (reading or writing) to information are granted if and only if some condition is fulfilled (for example, the user who asks for access is correctly authenticated). A read-write sequence engenders an information flow that may also be controlled in some cases.

Preventive security requires to first define precisely which entity may access what information and in which way. Classically, permissions to read or write information are granted if and only if some condition is fulfilled. For example, the Bell-LaPadula policy states that high level (i.e., secret) information cannot flow into low level (i.e., public) containers.

To implement such a policy, each information container (e.g., a file) is classified (e.g., secret or public) depending on the type of information it contains and each user has a clearance (e.g., secret or public) depending on the type of information they need to know, given their role in the organization: a secret-level user can read both public or secret containers, but can only write into secret containers. This ensures that previously read secret information will never flow to a public container in which a public-level user can read.

Practically speaking, the implementation of a security policy generally builds on access control and flow control mechanisms, implemented at the operating system level.
<figure><img src="image_17.png" /></figure>

© WavebreakmediaMicro - Fotolia

### 4.2.1 Access control

Access control generally refers to regulating the requests to access the resources managed by an information system. This regulation can happen in various places of the information system: at the network level (in firewalls), at the node level (in operating systems), or at the service level (in applications).

At the network level, firewalls allow access to the network resources for authenticated users or legitimate traffic and deny access to unauthenticated users or illegitimate traffic. However, bad configuration of a firewall may cause security breaches. In particular, conflicted filtering rules can lead to blocked legitimate traffic and to accepted unwanted packets.

In operating systems, access control enforces the security policy by granting authorizations to subjects (i.e., authenticated users or processes) on objects (i.e., resources like data, network, computation facilities, etc.). Many access control models have been proposed and some have been widely used for decades, like the DAC and RBAC models. Such models typically represent the authorizations as triples (subject, object, permission) and are frequently employed in operating systems and databases. Many variants of these models have been proposed in the last decade, to capture additional information such as the context of the access (time, location, etc.), the purpose of the applications, or the specificities of the organizations; this gave rise to context-based, purpose-based, and organization-based access control.
Today such solutions are well established and often normalized. In general, these models consider a centralized architecture, i.e., the resources and additional information required to define the access control policies are located on the server side and managed by trusted authorities and administrators.

More recently, cloud computing and the emerging areas of user-centric systems and the Internet of Things (IoT), put a new light on access control research. While the goal is still to define, evaluate, and enforce authorizations, the intrinsic specificities of these contexts induce a deep rethinking of the access control models and their enforcement strategies. In cloud computing, data and computations being outsourced to potentially untrusted entities, access control management must adapt to new trust assumptions. In user-centric systems, the focus is on enabling access control management without resorting to IT experts. The IoT raises the problem of adapting the access control when the Things, who have scarce resources, collect the data.

In addition, Things (e.g., embedded sensors or GPS devices, pedometers, smart meters, connected TVs, toys) track the events occurring in their surroundings and thus generate sensitive data. A myriad of new applications and services are being built by querying this data. Designing access control models for the Internet of Things is thus a critical problem, although difficult because of two conflicting objectives: (i) the access control model should be generic enough to cover the needs of highly diverse applications and (ii) it should be lightweight considering the hardware constraints of the Things they target. So far, the data collected by Things end up on centralized servers where they are analyzed and queried.

In human centric contexts (e.g., the personal cloud), individuals want to manage their personal data themselves, i.e., under their control and not delegate this task to a central administrator. However, designing a well-calibrated access control policy, and enforcing it, confronts the individuals with the difficult choice between delegating the data administration to a qualified third party and giving up their sovereignty or taking charge of it themselves using complex sharing models and tricky security protocols that they probably do not master. Hence the need to design new access control models, simple enough to be managed by individuals.

To conclude, although access control is a long-lasting research issue, the evolution of computing architectures opens important new lines of research. The current trend suggests that the access control, usually thought in a centralized context, should be considered in a more distributed and global context, i.e., regulating data accesses along the whole life cycle of the data, from the Things that collect it to the Cloud that stores it. In terms of enforcement, this also calls to complement access control with security techniques like encryption, data flow control, and trusted computing.