Ge Zhang
email: ge.zhang@kau.se

Analyzing Key-click Patterns of PIN Input for Recognizing VoIP Users

Malicious intermediaries are able to detect the availability of VoIP conversation flows in a network and observe the IP addresses used by the conversation partners. However, it is insufficient to infer the calling records of a particular user in this way since the linkability between a user and a IP address is uncertain: users may regularly change or share IP addresses. Unfortunately, VoIP flows may contain humanspecific features. For example, users sometimes are required to provide Personal identification numbers (PINs) to a voice server for authentication and thus the key-click patterns of entering a PIN can be extracted from VoIP flows for user recognition. We invited 31 subjects to enter 4-digital PINs on a virtual keypad of a popular VoIP user-agent with mouse clicking. Employing machine learning algorithms, we achieved average equal error rates of 10-29% for user verification and a hitting rate up to 65% with a false positive rate around 1% for user classification.

Introduction

 proposed more advanced method using watermark to increase the robustness and accuracy of the calling records detection. Calling records could reveal daily life of a user. For instance, spammers may infer the requirements and preference of a particular user from the calling records (e.g, a recent calling record showing that a user calls a dentist reveal that the user might have dental problems) so that they can send advertisements more effectively. Recently news report that third parties offer traditional telephone calling records for profit [1]. With the increasingly deployment and usage of VoIP services, it can be predicted that the confidentiality of calling records will be an important issue on VoIP as well.

Nevertheless, previous VoIP tracking methods [START_REF] Wang | Tracking anonymous peer-to-peer VoIP calls on the Internet[END_REF][START_REF] Sengar | Tracking skype voip calls over the internet[END_REF] at most enable intermediaries to find out the calling records between two hosts identified with their IP addresses (IP-level calling records). The linkability between a VoIP user and a IP addresses is usually unstable: VoIP users may move from one network to another network with their laptops, or switch between devices (e.g., the user switches from the home computer to an office workstation). Therefore, a user may use different IP addresses at different times. In addition, even one IP address might be shared by several users due to current limited IP address space [START_REF] Egevang | The IP Network Address Translator (NAT)[END_REF]. Thus, the IP-level calling records are not accurate enough to attack a particular user. In this case, attackers require user-level calling records. To solve this, attackers need to extract human-specific characteristics from flows for user recognition. Previous papers [START_REF] Khan | Speaker Recognition from Encrypted VoIP Communications[END_REF] [START_REF] Backes | Speaker Recognition in Encrypted Voice Streams[END_REF] verified that speech features can be extracted to re-identify a user if the user employs a specific codec. This paper investigate another alternative by taking advantage of user key-click patterns: Some automated voice services require users to provide their Personal identification numbers (PINs) for authentication (e.g., access a voice mailbox or a configuration setup). In this situation, users enter their PINs on their VoIP user-agents so that the user-agents generate specific packets to indicate which keys have been clicked. Thus, the key-click pattern for PIN input is a potential characteristic for user recognition. We addresses the following research questions in this paper: (1) How can a malicious intermediary recover the key-click patterns from intercepted VoIP flows? (2) How to minimize the impact from networking conditions (e.g., jitter, packet loss)? (3) Is the recovered key-click patterns accurate enough for user recognition? To answer these questions, we invited 31 subjects to participate in the experiments. Each of them entered 4-digital PIN codes on a popular VoIP useragent by mouse clicking. Employing machine learning algorithms, we achieved average equal error rates of 10-29% for user verification and a hitting rates up to 65% with a false positive rate around 1% for classification. Finally, we also discuss corresponding countermeasures to prevent user recognition.

The rest of this paper is organized as follows. Section 2 introduces some background information about VoIP. Section 3 introduces the general idea of the attack method. Section 4 presents the preparation, procedure and results of the experiments that we conducted. Section 5 lists related work. Finally, we summarize this paper in Section 6.

Background in VoIP flows

The Realtime Transport Protocol (RTP) [START_REF] Schulzrinne | RTP: A transport protocol for real-time applications[END_REF] standardizes the packet format for VoIP conversations. RTP provides end-to-end delivery schemes for data with real-time characteristics over IP networks. It supports a variety of payload types, two of which are especially related to this paper.

-Voice payload: In a conversation, a user-agent constantly encodes acoustic signal into digital data as voice payloads using a codec. The user-agent on the other side recovers the acoustic signal by decoding the payloads from the received RTP packets. We name this kind of RTP payloads as RTP voice packets. In many cases, a user-agent continuously generates RTP voice packets at a constant time interval (e.g., 20 ms) in a conversation unless other types of RTP packets with higher priority are triggered. -Event payload [START_REF] Schulzrinne | RTP Payload for DTMF Digits, Telephony Tones, and Telephony Signals[END_REF]: When a user clicks a phone key in a conversation, the user-agent generates RTP packets with event payloads to indicate which key has been clicked. The RTP packets with event payloads are called RTP event packets. RTP event packets have higher priority than RTP voice packets.

The Secure Realtime Transport Protocol (SRTP) scheme [START_REF] Baugher | The Secure Real-time Transport Protocol (SRTP)[END_REF] has been widely applied to protect RTP packet payloads by encrypting. However, it does not protect RTP headers1 . This means that RTP header fields are available to intermediaries despite of the protection. Several RTP header types are introduced as follows:

-Marker bit: It indicates the beginning of a new event. For instance, a user presses a key "4" may span a series of RTP event packets, but only the first packet has the marker bit set. We define that a RTP event packet with marker bit set is a key-down packet and the others are key-holding packets. -Payload type: It identifies the type of the RTP payload.

-Sequence number: The RTP sequence number is incremented by one in each successive RTP packet sent. The sequence numbers are assigned to RTP packets to allow the receiver to restore the original sequence in case of unreliable transmission.

Attacking method

Image the following scenario illustrated in Figure 2(b): There are several users whose user-agents share the same IP address. An attacker is a malicious intermediary which intercepted a number of RTP flows originated from this IP address. The packets arrival time in the flows are recorded. Some flows have been already correctly labeled with their originator users (we call these flows as testing flows). The rest without being labeled are called testing flows. The attacker aims to further profile user-level calling records using the testing flows. Thus, the attacker may want to (1) label the flows for a particular user; or (2) label the flows for all users. We assume that the users occasionally access their voice mail by providing their PINs on a virtual keypad of a user-agent using a mouse2 (see Figure 2(a)).

In addition, all RTP flows in the environment are encrypted by using SRTP [START_REF] Baugher | The Secure Real-time Transport Protocol (SRTP)[END_REF]. If the attacker detects a VoIP flow for PIN input and recognizes its originator user, it is highly possible that the calls at the time around are done by the same user. In this way, we consider to recognize a user by key-click patterns. The challenge is how to recover the key-click patterns from RTP flows? Given an encrypted RTP flow, the attacker firstly needs to distinguish the RTP event packets and RTP voice packets. Actually it is rather simple: Despite of the protection by SRTP, the RTP headers are still in plain text. Thus, the attacker can distinguish them directly by reading the "Payload-Type" header fields. After picking RTP event packets from a flow, the next step is to restore the key-click behavior. To input 4-digital PIN code, 4 key-click events are generated. The attack can observe 4 key-down packets with following key-holding packets from the marker bits in headers. Moreover, we define the last key-holding packet for each event as the key-up packet. The attacker can restore a key-click pattern by guessing 4 key-holding periods (The period between a key-down packet and its following key-up packet) and 3 key-switching periods (the period between a key-up packet and the next key-down packet). Let us take the example flow in Figure 1, the 4 key-holding periods are: 0.17-0.28s, 0.45-0.58s, 0.85-0.92s and 1.3-1.5s. The 3 key-switching periods are 0.28-0.45s, 0.58-0.85s and 0.92-1.3s.

The 4 key-holding periods and 3 key-switching periods are taken as variables for training and testing. Then, the attacker can employ a learning algorithm to construct a classifier, which builds key-click pattern using the training data and classifies the testing flows into correct classes. We did several experiments and the detailed work will be introduced in the next section.

Nevertheless, current Internet does not guarantee the quality of packet transmitting. Since this attack needs exact inter-packet arrival time of RTP event packets, the varying network quality (namely jitter and packet loss) could lead to an inaccurate observation. (1) Jitter indicates latency variations for different packets in a flow. For instance, a packet sent earlier may arrive the destination later. A large jitter on RTP event packets could make the key-click pattern recovering unreliable. Nevertheless, the sequence number on packet header field can help attackers to restore the original packet sequence. Moreover, attackers know what the fixed time interval between two successive packets should be (e.g., 20 ms). In this way, attackers can restore the packet inter-arrival time and sequence. Thus, the impact of jitter is not vital. (2) Packet loss indicates the amount of packets which are accidentally dropped in the transmission. Although attackers can detect packet loss rate by reading sequence number, they do not know the type of the lost packet for key-click pattern recovery. However, the attacker can heuristically guess it by the types of its neighbor packets. For example, if the lost packet is a key-holding packet in the middle, it is also easy for attackers to guess since the packets before and after are the same type.

Experiments

Data Collecting

To test the performance of this kind of attack, we did a series of experiments. We invited 31 students as test subjects who are denoted by S = {s 1 , s 2 , • • • , s 31 }. All of them have experience with using a computer, a mouse and a VoIP client. Each subject was asked to input two kinds of PIN codes. First, we randomly generated 31 different 4-digital PIN codes and thus assigned these PIN codes to the subjects one by one. Each subject was asked to input his/her unique PIN code using the mouse on the virtual-keypad of the X-Lite [START_REF]X-Lite[END_REF], a popular useragent for 50 repetitions. We call these repetitions as unique input repetitions and let du(s i ) j to denote repetition j done by subject s i . Furthermore, some users may have the same PIN code since there is only a 10 4 space for a 4-digital PIN code. Taking this into account, we arbitrarily selected a particular PIN code ("9913") and again asked each subject to input it for 50 repetitions. Similarly, we call the repetitions as a shared input repetitions and use ds(s i ) j to denote these repetitions.

We employed two computers: one ran X-Lite (version 3.0) as the user-agent. It is equipped with a DELL 19-inch flat panel LCD screen with 1024x768 pixel resolution. The mouse is a HP USB optical wheel mouse with the default speed setup on Windows XP platform. Another ran TCPDump [START_REF]TCPDump[END_REF] to simulate attackers to intercept RTP flows.

Data Processing

Following the method introduced in Section 3, we first extract RTP event packets from each flow. Figure 3(a) and Figure 3(b) illustrate the arrival time of RTP event packets of the unique input repetitions done by s 12 and s 17 . (du(s 12 ) j and du(s 17 ) j , 1 ≤ j ≤ 50). At a glance, readers can find the general key-click patterns are different for the two users. Then, we restore the 4 key-holding periods and 3 key-switching periods for each repetition using the method introduced in Section 3.

Learning algorithms

We employ three popular learning algorithms in this paper since these algorithms have been widely tested and performed well in previous work on keystroke biometrics [START_REF] Peacock | Typing patterns: A key to user identification[END_REF][START_REF] Maxion | Keystroke biometrics with number-pad input[END_REF]:

-Supporting Vector Machine (SVM) [START_REF] Bennett | Support vector machines: hype or hallelujah?[END_REF]: SVM works by constructing an Ndimensional hyperplane that groups the data into two spaces. In principle, it only solves the two-class problems. For multi-class problems, the algorithm can repeatedly perform the operations over all the possible two-class pairs and then find the suspect class by a voting mechanism.

-Random Forest (RF) [START_REF] Breiman | Random forests[END_REF]: Random forest is an ensemble learning method by generating a large number of bootstrapped classification trees and aggregating them during the training. Different to SVM, random forest can perform variable selection by itself and thus it is robust against noise. In a previous comparison, random forest provides a better predictive accuracy than other learning algorithms [START_REF] Caruana | An empirical comparison of supervised learning algorithms[END_REF]. -Recursive partitioning (RPart) [START_REF] Breiman | Classification and Regression Trees[END_REF]: Recursive partitioning is a tree-based method for classifying data. It creates a classification tree and further splits the tree based on the condition of variables. The split process will be repeated for each leaf node until a certain stop splitting condition is met. Recursive partitioning is a fast classification algorithm.

We implemented the classifiers in the R platform (version 2.12.0) [START_REF]The R project for statistical computing[END_REF], which provides a wide variety of statistical functions including classification based on the S language. In this paper, we implemented our classifiers using e1071 (SVM) [START_REF]Misc Functions of the Department of Statistics (e1071)[END_REF], random forest [START_REF]randomForest: Breiman and Cutler's random forests for classification and regression[END_REF] and recursive partitioning [START_REF]rpart: Recursive Partitioning[END_REF] packages. By using these packages, we can focus on our classification problems rather than the detail implementation of the algorithms.

Analysis and results

We recovered the 7 variables (4 key-holding periods and 3 key-switching periods) from each repetition. For each subject, we selected the first 30 repetitions (du(s i ) j and ds(s i ) j , 1 ≤ i ≤ 31 ∧ 1 ≤ j ≤ 30) for training and took the rest 20 repetitions (du(s i ) j and ds(s i ) j , 1 ≤ i ≤ 31 ∧ 31 ≤ j ≤ 50) for testing. In this paper, we focus on two problems, namely user verification and user classification.

-User verification: Given a testing repetition and a specific user s x , the attacker asks the classifier whether the testing repetition was done by s x . Thus, it is a binary classification problem (the real user s x and imposters s i̸ =x ). In this way, we split the training repetitions into 2 classes. One contains the repetitions done by user s x (du(s i ) j or ds(s i ) j , i = x ∧ 31 ≤ j ≤ 50) and another contains all the remaining repetitions (du(s i ) j or ds(s i ) j , i ̸ = x ∧ 31 ≤ j ≤ 50). Given the testing repetitions (du(s i ) j or ds(s i ) j , 1 ≤ i ≤ 31 ∧ 31 ≤ j ≤ 50), the classifiers calculate the scores showing how likely these repetitions were done by the user s x . Finally, attackers can set a decision threshold to distinguish the real user and the imposters. -User classification: In this case, there are 31 classes, each of which represents one subject. The attacker trains the classifiers with the training repetitions which have been correctly labeled their classes. Given the testing repetitions (du(s i ) j or ds(s i ) j , 1 ≤ i ≤ 31 ∧ 31 ≤ j ≤ 50), the classifiers distinguish them into the 31 classes using the default decision threshold. Finally, we create a 31 by 31 dimensional confusion matrix in which the element in row s i , column s j is a count of the number of times the subject with true ID s i was classified into ID s j . Like most previous work on classification problems, we evaluate the performance of the implementation by the classification errors, in more detail, false positive, which mistakenly takes the imposter's data as the real user's; and false negative, which mistakenly classifies the real user's data into the imposter's class. For evaluating the user verification problem, we also concern the Equal Error Rate (EER). In a binary classification problem, false positive rate and false negative rate usually varies depending on the decision threshold. EER, as the crossover point at which the false positive rate equals the false negative rate, is an important value to judge the classifier. The lower the EER, the better performance for the classifier. We run the implementation of our classifiers several times for the experiments. Figure 4 shows the result.

Figure 4(a) and 4(b) illustrate the Receiver Operating Characteristic (ROC) curves with subject s 10 as the genuine user when we did user verification. The repetitions are du(s 10 ) j and ds(s 10 ) j respectively. The True Positive Rate (TPR) is the frequency with the repetitions of subject s 10 has been correctly detected. The False Positive Rate (FPR) is the frequency with which the imposters are mistakenly detected as the genuine users. Both of them varies depending on the decision threshold. We observe that the RF gives the best result and the RPart gives the worst result for both unique and shared input repetitions. The EER in unique input repetitions is from 0.08 to 0.18 and that in shared input repetitions is from 0.3 to 0.4. Figure 4(c) and 4(d) show that the average EER with standard deviation for all the subjects. The RF gives the average EERs around 0.1 and 0.14 for unique and shared input repetitions. The EERs given by SVM are 0.12 and 1.5 respectively. RPart gives the highest EER, around 0.25 and 0.29. As said, the lower the EER, the better performance for the classifier. Therefore, RF gives the best result. Figure 4(e) and 4(f) show the result of the classification problem. The best performance is still given by RF, with the lowest average TPR around 0.65 and FPR around 0.01 for unique input repetitions. The TPR for unique and shared input repetitions are 0.52 with 0.02 FPR. SVM has the similar results to RF. The worst case is still given by the RPart: its average TPR is around 0.52 for unique input repetitions and only 0.32 for shared input repetitions. The results show that VoIP user recognition by key-click patterns is possible. RF algorithm gives better performance than the other two. It is easier to recognize users if they have different PIN codes to input.

Discussion on countermeasure

One countermeasure is to insert random delay between key-click events. When a user-agent receives a key-click event, it does not immediately process the event.

Instead, it puts all information of the event (e.g., the holding time) in a First In First Out (FIFO) queue. The user-agent constantly checks the queue and fetches a event from it after a random time delay for processing. It obscures real key-click patterns. Yet another defending method is to encrypt the whole RTP packet using IPSec. We know that the attacks take advantage of the factor that SRTP does not encrypt RTP headers, which enable attackers to restore key-click patterns. The attacks do not work if the RTP headers are encrypted.

RFC 3711 [START_REF] Baugher | The Secure Real-time Transport Protocol (SRTP)[END_REF] suggests IPSec (ESP method) [START_REF] Kent | Security Architecture for the Internet Protocol[END_REF] if users would like both the RTP headers and contents to be protected. Nevertheless, users may particularly worry about the performance overhead and configuration complexity by using IPSec. Although it is possible to effectively reduce the performance overhead by using packet header compression [START_REF] Barbieri | Voice over ipsec: Analysis and solutions[END_REF], configuration complexity might be a barrier to widely deploy IPSec in VoIP.

Related work

keystroke dynamics is a method to recognize individual users by using their typing characteristics, with the time stamps of key-down and key-up. Many previous work has been done in this domain and a broad overview can be found in [START_REF] Peacock | Typing patterns: A key to user identification[END_REF]. This section only summarizes the work most relevant in the context of ours. Maxion et al. [START_REF] Maxion | Keystroke biometrics with number-pad input[END_REF] asked 28 volunteers to type 200 repetitions of the same 10-digital code using only the index finger on the number pad of a standard keyboard. They intercepted the keystroke information on key-down and keyup time locally and analyze them using random forest classifier. Half of the data were selected for training and the rest were used for testing. The classifier achieved a hitting rate of 99.54% and false alarm rate of 12.50%. Kotani, et al., [START_REF] Kotani | Evaluation on a keystroke authentication system by keying force incorporated with temporal characteristics of keystroke dynamics[END_REF] performed experiments using a special pressure sensitive keypad with 9 subjects. Each subject typed 20 repetitions of the same 4-digital PIN code. Besides key-down and key-up times, stroking force was chosen as a third element. Their classifier gives a equal error rate at 2.4%. Clarke et al., [START_REF] Clarke | Using keystroke analysis as a mechanism for subscriber authentication on mobile handsets[END_REF][START_REF] Clarke | Advanced user authentication for mobile devices[END_REF][START_REF] Clarke | Authenticating mobile phone users using keystroke analysis[END_REF] performed several tests in which they asked different number of subjects (from 16 to 32) to type the same 4-digital PIN code for 30 repetitions on the keypad of a mobile phone. 20 repetitions are used for training and the rest is used for testing. Their neural network classifier gives an equal error rate from 5.5% to 8.5%. Our work is on a different scenario. We recover key-click pattern from VoIP flows and the subjects use a mouse and virtual keypad for input. Moreover, our method needs to take the networking condition impact into account.

On VoIP user recognition, Khan et al. [START_REF] Khan | Speaker Recognition from Encrypted VoIP Communications[END_REF] proposed a scheme exploiting patterns on the sizes distribution of RTP voice packets. Their classifier achieved a hitting rate of 75% for 10 speakers and 51% for 20 speakers. Similarly, Backes et al. [START_REF] Backes | Speaker Recognition in Encrypted Voice Streams[END_REF] proposed an approach using the periods of speech and silence of a speaker in a conversation. This speaker specific pattern is modeled using the speaker's talking speed and frequency. The identification rates obtained were 65% for 13 speakers and 48% for 20 speakers. Nevertheless, their method requires specific codec being applied. Our work achieves the same goal but in another way: We exploit the side channels in RTP event flows rather than RTP voice flows.

Conclusion

This paper proposed an attacking method to recognize VoIP users for user-level calling records profiling. It takes advantage of user-specific key-click patterns. Even if a VoIP flow are protected by SRTP, attackers can still recover key-click patterns from the flow by reading packet header fields. The impact introduced by varying network conditions (jitter, packet loss) can be minimized. In an empirical setup with 31 users our analysis is able to correctly classify unknown RTP flows in about 65%. For user verification, the average equal error rate is from 10% to 29%. The result raises serious concerns about anonymity for VoIP users. To prevent this attack, users can consider to either randomize the time interval between key-clicks or use another security scheme (e.g., IPSec) which not only encrypts the whole part of a RTP packet, but also pads all RTP packets to an equal size.

There are still some limitations on our currant experiments. First, we only asked subjects to enter PINs using the virtual keypad by mouse clicking so far. Nevertheless, some user-agents also support standard keyboard input. Second, we let all subjects to enter the same PIN "9913" for collecting shared input repetitions. The results with only one PIN instance may difficult to be generalized. In future work, we will investigate this problem further not only using virtual keypad, but also standard keyboard. In addition, we will try several shared PIN candidates for collecting shared input repetitions.

Fig. 1 .

 1 Fig. 1. The packet inter arrival time of an example RTP flow

Fig. 2 .

 2 Fig. 2. The environment of experiments

Fig. 3 .

 3 Fig. 3. Generated RTP event packets of the unique input repetitions done by s 12 and s 17 : one dot indicates one RTP event packet and the x-axis indicates packets inter-arrival time.

Fig. 4 .

 4 Fig. 4. Statistical results of our experiments on verification and classification using the 3 algorithms

RTP headers are sent in the clear to allow for billing purposes and header compression.

Some user-agents may also support keyboard input, but in this paper we only consider virtual keypad input.


Amir Alsbih

Felix C Freiling

Christian Schindelhauer

A Case Study in Practical Security of Cable Networks

Cable networks are complex systems that have evolved over years and in which new features like Internet access and Voice over IP (VoIP) have been integrated. We argue that threat models must evolve together with such systems and show that inadequate threat models can be used to explain known and unknown vulnerabilities in today's cable networks. We do this by demonstating an attack on the DOCSIS provisioning standard in cable networks. By exploiting this weakness, an attacker can hijack VoIP accounts. We also show how to mitigate the attack.

Introduction

Motivation

Cable networks were initially deployed as a low-cost means to broadcast television programs to customers, first analog and then also digital. Today, almost all cable networks have been re-engineered so that they are able to additionally transport arbitrary digital data both to and from the end user. The number of Internet users in Germany and elsewhere that access the network in this way is rising sharply [START_REF]Tätigkeitsbericht 2008/2009 Telekommunikation[END_REF]. Within the system of cable networks there are three main stakeholders: First of all, there is the user (customer) who wishes to enjoy digital media and network access in high quality at low cost. Second, there is the cable network provider (CNP), a company running the physical cable network infrastructure. Third, there is the Internet service provider (ISP) who provides access to the global Internet. Traditionally, the context and mindset of the CNP is a closed, physical network with static functionality. Since the services of an ISP were added to the portfolio of the CNP only rather recently, the original mindset of the CNP may be reflected in the way the ISP is managed. Since the Internet is an open, virtualizable and dynamic network, there is a potential for misconceptions regarding security assumptions that can lead to many surprises. In this paper we show that this is in fact the case.

Context

Technically, the user's cable modem acts as bridge between the customers home network and the backbone of the ISP. The cable modem is a rather simple device that downloads its configuration after every reboot from a server at the ISP. This is called provisioning and the relevant standard is the Data Over Cable Service Interface Specification (DOCSIS) [START_REF]DOCSIS Website[END_REF]. So there is a way to access the ISP servers from the customer's home networks and therefore the ISP has to secure the provisioning process to restrict the possibilities of a service abuse. In this paper, we document a weakness in the way the provisioning process is handled today.

Related Work

There is relatively little work that investigated cable networks security from an academic viewpoint. Existing work mainly comes from industrial or rather applied forums and deals with possibilities of service theft, e.g., possibilities of achieving higher service bandwidth without paying for it (so-called "uncapping") by manipulating the cable modem [1-3, 11, 15]. Other threats to ISPs have been formulated as well [START_REF]Security on Data-over-Cable Systems: DOCSIS, BPI+ and Beyond[END_REF] and refer to attacks on confidentiality and weak endpoints: The classical attack to confidentiality of network traffic through eavesdropping is omnipresent in shared medium networks like the cable network is. Since the downstream traffic is broadcast across the shared medium, network providers have to enforce rigid access control techniques at the endpoints of the network to ensure confidentiality. A related threat is network access through stolen authentication credentials, e.g., cloning of MAC addresses, a problem that is hard to tackle in networks where endpoints are under complete control of the customer [START_REF]Hacking the Cable Modem: What Cable Companies Don't Want You to Know[END_REF]. In this paper, we give another example for this fact. Since one of the main applications of cable networks is digital telephony (voice over IP, VoIP), attacks on the corresponding protocols like the Session Initiation Protocol (SIP) have also been investigated in the cable network environment [3,[START_REF] Endler | Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions[END_REF]. These attacks include tampering of SIP message bodies like malformed SIP messages, hijacking dedicated SIP accounts or interrupting sessions by injecting fake messages into the network traffic. While being relevant to VoIP technology, they are only specific to cable networks as far as these attacks use access techniques that only exist in cable networks. In this paper, we present such an attack on SIP that is specific to cable networks.

Contributions

In this paper, we describe the context and specifics of the system of cable networks as an evolving complex system that is in regular use all over the world. We show that different mindsets and threat models can be used to explain past and present vulnerabilities in such networks. As a confirmation, we present a new attack on VoIP in cable networks that allows an attacker to extract SIP credentials and therefore misuse the VoIP system in such networks. More specifically, our attack exploits the DOCSIS provisioning requirement that every cable modem needs a provisioning file that contains the configuration of SIP credentials. By gaining access to the management network and partial exhaustive search of the namespace of configuration file names, we are able to extract SIP credentials and take over telephone acounts of other customers. We also show how this attack can be mitigated by adjusting network management policies in cable networks. At the time of writing, our attack was possible in one major (cooperating) cable network in Germany. Since many other CNPs all over the world use the same hardware and software configurations, we believe that the attack is relevant not only in Germany. However, the wish to point out that the attack is just a vehicle to transport the another insight, namely that threat models must be checked regularly. And if they turn out to be unrealistic, they (and all affected security procedures) must be adapted.

Paper Outline

This paper is structured as follows: We give a brief introduction into cable network technology in Sect. 2. In Sect. 3 we show how threat models for cable networks have evolved in the past and the effect of this process on the provisioning process. We present the resulting attack in Sect. 4 and possible countermeasures in Sect. 5. We conclude in Sect. 6.

Background

In this section we give a brief introduction into the basics of modern cable networks.

System Overview

The cable network is a complex system consisting of multiple interconnected networks (see Fig. 1). The customer network connecting the end user devices with each other is a broadcast network that can be used to transport analog and digital signals in an integrated fashion over distinguishable frequency bands. It can be thought of as a long wire to which many receiving stations can be connected, similar to the early Ethernet technology (10BaseT). Technically, the customer network is a hybrid network consisting of optical fiber and coaxial cables that is connected in a tree-like topology. Consequently, this network is called hybrid fiber coax (HFC).

Physical Aspects and Frequency Bands

Inside the HFC network, the frequency spectrum is divided into channels. The channels can be divided into downstream (towards end user) and upstream (from end user). Originally, all channels were downstream and carried either radio or television signals. Subsequently, frequencies were defined for data (i.e., Internet) communication. Since this communication is bidirectional, the CNP will need to provide at least one channel in each direction. On top of this digital channel, digital telephony services (VoIP) can be offered. For Internet communication, the digital signal has to be modulated on to and demodulated from the physical medium at each connected station. This is done at the side of the end user by a cable modem. At the side of the cable network provider, this is done by the cable modem termination system (CMTS). This is similar to how DSL technologies work over the telephone network.

The Interfaces of the Cable Modem

Internally, the cable modem consists at least of two interfaces, each with its own MAC address:

-The first interface is used for remote management of the cable modems from the side of the CNP. It has a unique MAC address called C-MAC. -The second interface is used for realizing the Internet service for the customer.

It's MAC address is called E-MAC.

After the cable modem has been connected to the cable and turned on, the cable modem will configure itself. This process is called provisioning and will be explained later, since it is in the center of our attack. The result of a correct provisioning process is that both interfaces will receive its own IP address, each IP address being in a seperate IP address range.

CMTS and Access Control

If a cable modem is provisioned and tries to communicate, every communication request of the cable modem is handled by the CMTS. The CMTS plays the role of a central router, guiding network packets from the customer network to the Internet and vice versa. At the same time, the CMTS acts as a firewall, enforcing filter rules to, for example, separating the network traffic from the different IP address ranges belonging to the different interfaces of the cable modem. Filtering is even performed on packets that are "routed back" into the customer network. This happens, for example, if two cable customers communicate with each other. So even if the cable network environment is a shared medium every upstream communication is only possible over the CMTS. The filtering rules of the CMTS are one of the most important parts of cable network security. For example, one of the most important rules is one that forbids normal users (via their E-MAC) access via SNMP to the management interface of the cable modem (C-MAC) of other customers. Without this rule it would be possible for every customer to access (and manage) the cable modem of other customers via SNMP. Since the filtering rules on the CMTS are the only reliable way to restrict the customer's communication abilities, it is important to invest a lot of time into the right setup, making sure that the customer is only able to act in the way intended by the CNP [START_REF] Johns | DOCSIS Cable Device MIB Cable Device Management Information Base for DOCSIS compliant Cable Modems and Cable Modem Termination Systems[END_REF][START_REF] Raftus | Radio Frequency (RF) Interface Management Information Base for Data over Cable Service Interface Specifications (DOCSIS) 2.0 Compliant RF Interfaces[END_REF].

IP Layer

As mentioned above, the cable modem and the CMTS function as endpoints to transport data over the physical HFC network. The CMTS routes the IP data from the fast Ethernet backbones of the ISP to the cable network and vice versa. The cable modem works as a bridge between the network of the ISP and the local area network of the customer (see Fig. 2).

VoIP via SIP

The Session Initiation Protocol (SIP) is the most commonly used VoIP protocol today. SIP phone calls use two different protocols, SIP for the connection handling of the calls, and Realtime Transport Protocol (RTP) for the voice stream. SIP was designed for the IP world, and since IP addresses are not as static as telephone numbers, the clients have to register themselves at a SIP server, to let the SIP server know where it should route the incoming call to. To register an account on a SIP server, the customer needs (1) his own phone number, as well as (2) the corresponding username and (3) the password for that phone number. He also needs to know the SIP server managing the connection. Note that these three items have to be known to the cable modem in order to allow seamless telephone service over VoIP for the cable network customer. Therefore, these credentials are contained within the configuration file during the provisioning process (see below).

Different Threat Models and their effects on the Provisioning Process

A threat model is a precise description of the possible threats to the system [START_REF] Swiderski | Threat modeling[END_REF].

It usually consists of a set of security issues a system designer cares about together with a set of expected attacks. Often, threat models only exist implicitly in the mindset of the people working at the network operator and are therefore not documented within organizations. In such cases the threat model used in an organization can only be inferred through interviews and from analyzing existing security mechanisms.

Traditional Threat Model of the CNP

Traditionally, the context and mindset of the CNP is a closed, physical network with rather static functionality. Before upstream data communication was possible, the cable network was a pure "broadcast" network. The endpoints (antenna sockets in houses) were usually protected by physical means like tamper-evident seals. This was also the way how access control to the cable network worked. Since the transmitted data was the same for everyone and the selection of which channel to watch was performed at the endpoint (the television set), there were also no real privacy or confidentiality problems. Possible attacks involved only physically breaking the seal of the endpoint and accessing the service without paying.

Adapted Threat Model of the CNP/ISP

The threat situation changes dramatically if individual communication is handled via the cable network both upstream and downstream. The typical threat model used by CNP/ISP in these scenarios, however, is very similar to the original threat model. As mentioned above and from our experiences, the threat model is usually not explicitly documented. So we inferred the following assumptions from interviews and an analysis of the literature on known attacks [1-3, 11, 15]:

-The endpoint is physically protected. This means that only original cable modems are attached to the cable endpoints and these cable modems always correctly follow the provisioning process. -The end users are untrustworthy, i.e., they may send and receive arbitrary packets via their E-MAC to/from the Internet. This implies that the management network (accessed using the C-MAC) needs good protection from the user network (accessed using the E-MAC).

The second point is realistic and the main reason for the complex filtering rules within the CMTS. The first point, however, does not hold in todays networks and can be exploited in most cable networks today, as we now explain.

The Provisioning Process and its Weaknesses

The DOCSIS standard describes the steps each modem has to fulfill to register itself on the cable network. If a step in the process fails, the modem has to repeat the step until it succeeds. Since it is up to the CNP where he will place the digital channels that are in use for realizing the Internet service, the first step of the cable modem is a large frequency scan to search for the downstream channel. After that, the cable modem will get the parameters for the upstream by searching for a special packet in the downstream channel called upstream channel descriptor. Since the cable modem now has knowledge about both the down-and the upstream channels, the modem now has to synchronize itself to the channels in a step called ranging. In this step, the cable modem adjusts the timing, power, and frequency to balance the network delay. Subsequently, the cable modem establishes IP connectivity. Therefore it sends a Dynamic Host Configuration Protocol (DHCP) discover packet with option code 60 (vendor class identifier) for the C-MAC and a normal DHCP (without option 60) for the E-MAC interface. The cable modem listens for a DHCP offer packet that contains the needed data. Option 60 of DHCP allows the interfaces to tell the DHCP server which kind of network devices they are [START_REF] Alexander | DHCP Options and BOOTP Vendor Extensions[END_REF] by attaching a message to the DHCP request. This is used to ensure that every interface gets an IP address in a separate IP address pool. The DHCP offer for the cable modem contains an IP address that is assigned to the cable modem management part (C-MAC). Usually, this IP address comes from the cable modem address pool 10.61.0.0/16 [START_REF]DOCSIS Website[END_REF]. The DHCP offer also includes the IP address of a TFTP server in the management network and the name of a configuration file residing on the TFTP server. The content of a typical DHCP offer is shown in Fig. 3. The client IP address (assigned to the C-MAC) is the entry in the field "your client IP address", in this case it is 10.61.151.101. The name of the TFTP server that hosts the configuration file for this cable modem is contained in the field "Next server IP address" and is 172.30.*.* in this case. The name of the configuration file itself is encoded in the "Boot file name" field. As next step, the cable modem will download the configuration file from the TFTP server. After this step the modem has to send the file to the CMTS in a step that is called transferring the operational parameters. This has to be done to authenticate the modem as modem of the CNP. If the modem is in the database of the CNP, the CMTS sends a message to the modem that it has passed registration. Now the modem is fully provisioned and able to act as bridge between the cable network and the LAN of the customer. A sample configuration file is shown in Fig. 4 where critical data (like passwords) has been sanitized. The SIP username ("0305338890") and the SIP password ("ABCDE123456") are directly stored in cleartext. This shows that access to configuration files opens complete access to a SIP account.

Attacking the Provisioning Process

There are many reasons for an attacker to steal configuration files, but only the SIP credentials are profitable for an attacker. Therefore, we aim to steal the configuration files that contain SIP credentials from the provisioning servers. With the SIP credentials, the attacker can make free telephone calls, hijack and spoof phone calls, and do anything that the real owner of the SIP account can do.

The Attack

The steps of an attacker are as follows: 1. In a first step the attacker fakes the MAC address of his own computer using standard tools [START_REF] Pahwa | Spoofing Media Access Control (MAC) and its Counter Measures[END_REF] for anonymity and maybe also to avoid access control restrictions in the CMTS (for example, if only certain vendors are allowed).

PCMA comm1 public comm1 @mtaprov comm1 comm1 comm2 5g21wm7sdl comm2 @mtaprov comm2 comm2 'x[0-9]*.[t#]|11[025]|[*#][2-9]x|[*#]1xx
Then he attaches his own computer to the HFC network to the LAN port of the cable modem. 2. Now the attacker accesses the provisioning network. The attacker has to spoof the device information of his computer in a way that the DHCP server that is responsible for the cable modems "thinks" that the attacker is in fact a part of the cable modem. This can be realized by configuring the DHCP client to send the right form of option 60 with his DHCP request. One correct form of this option is for example to set the vendor class identifier to the value "pktc1.0" [START_REF]DOCSIS Website[END_REF]. This tells the provisioning server that the device sending the request is a cable modem that is only capable of the DOCIS 1.0 provisioning process. After issuing this request using appropriate tools [START_REF] Alexander | DHCP Options and BOOTP Vendor Extensions[END_REF], the attacker will receive the corresponding DHCP response including an IP address inside the HFC access network. The DHCP response also includes the IP address of the TFTP server hosting the configuration files, and a route through the CMTS to the provisioning network. 3. Depending on the MAC address of the attacker, the name of the configuration file within the DHCP response will be some default configuration file name pointing to a location on the TFTP server that will not contain anything important. If by chance, the MAC address is known to the TFTP server, it will point to a configuration file containing the credentials of the corresponding user. Since the name scheme of the configuration files is up to the CNP, it could require some reverse engineering to find out the mapping of MAC addresses to configuration file names. One approach, for example, is to sniff the provisioning process by using the real MAC address of the attacker. In practice we observed different naming schemes. One scheme concatenated the MAC address with the suffix d u.cfg. Using this knowledge about the configuration file naming scheme and with access to the TFTP server, the attacker can easily enumerate configuration file names by using tools like TFTP brute to brute force MAC. 4. After the successful download of one or more configuration files, the attacker can extract the SIP credentials from the configuration files easily, e.g., by using the Linux command strings.

Now it is possible to abuse that SIP account.

Why is the Attack Possible?

There are two specific points in the attack that are critical for its success. First, the names of configuration files are deterministic and can be enumerated. This problem can be easily fixed by giving configuration files a new random name when they are distributed. In a sense, this also ties a specific configuration file to a specific MAC address. But even if this is done, the second problem remains, namely that end users can impersonate any other device by spoofing their MAC address. In summary, the attack exploits exactly those weaknesses that result from an inadequate threat model. The main point is the inadequate assumption that endpoints are physically protected and therefore impersonation is impossible. That this attack exists is surprising since it is well known how easy it is to attach computers instead of cable modems to the network endpoints. Similarly, it is usually possible to reprogram cable modems by installing manipulated firmware. As shown in the attack, this opens the path for MAC address spoofing and impersonation of specifically weak end devices.

Countermeasures

There are many obvious technical countermeasures to the attack described above. The basis for good countermeasures, however, is a more realistic threat model.

Adapted Threat Model

The adequate threat model for cable networks takes into consideration that the CMTS is the last (physically) controllable point in the cable network and that the cable modem is an untrustworthy device that could do anything and act different from the way that is expected. In particular, it is not possible to bind service usage to particular physical endpoints as it can be done in classical telephone networks.

Technical Countermeasures

Binding service usage to particular users is known as the problem of authorization.

A prerequisite for authorization is authentication. The DOCSIS standard specifies a set of features that can enforce authentication within the provisioning process (BPI+ and DOCSIS shared secret [START_REF]Security on Data-over-Cable Systems: DOCSIS, BPI+ and Beyond[END_REF][START_REF] Latini | Avoiding Piracy in DOCSIS Networks[END_REF]). Most of these features are, however, not used or only optional and not enforced in practice. These features at least prevent other known attacks such as uncapping of cable modems, clear text network traffic on the downstream side and normal protocol attacks that are not specific to cable networks by not only enforcing authentication but also encryption. The fact that they are almost never turned on points again to an insufficient threat model but possibly also can be explained by the cumbersome effort to set up a public key infrastructure and equip modems with certificates. While enforcing authentication, both BPI+ and DOCSIS Shared Secret do not prevent the mass downloading of configuration files. One approach to prevent this is to hide the location of the TFTP server from the customer. By using cable dynamic-secret mode (DMIC), the CMTS will change the DHCP offer in the way that it will point to the CMTS and not to the TFTP server. The CMTS then will download the configuration file from the real TFTP server and insert a HMAC based on a onetime password and a cryptographic hash of the file. The modem then only is allowed to register itself if it contains the correct HMAC. The important aspect is that the TFTP server is hidden from the customer. This makes it impossible for the attacker to brute-force configuration files and extract the SIP credentials [START_REF] Millet | Theft of Service -Inevitable? CableFAX[END_REF].

A similar result can be achieved by using randomization in the following way: Whenever a cable modem sends a DHCP request, the name of the configuration file is chosen in a random fashion and uploaded to the TFTP server. The space from which the filename is chosen must be large enough so that it is hard to guess real filenames (e.g., a 64 bit number). But this method has not been standardized in DOCSIS yet. The DOCSIS standard also does not specify any procedures for the secure provisioning of cable modems that use VoIP since there is no well-tested and accepted procedure for this yet. It is not clear whether there will be a clean and working solution in the near future. Therefore, at least a fast detection approach for such attacks has to be implemented.

Conclusion

As shown in this paper and in the literature, the security problems of cable networks are not only the result of a weak DOCSIS standard, it is the way how DOCSIS is "implemented" within an organization that causes the attack vectors to persist. Many security features such as BPI+ are often not enabled. Since such actions are consistent with the current threat model that assumes the user endpoint as trustworthy, we have argued that the risks in modern cable networks are mainly due to inadequate threat models at the side of the CNP. While this point is true in general for all systems that allow attacks, cable networks offer a particularly interesting case study because they show how adding certain features (Internet access) to a secure system (TV cable networks) results in an insecure system if the threat model does not evolve too.

Fig. 1 .

 1 Fig. 1. Cable network reference figure.

Fig. 2 .

 2 Fig. 2. IP traffic via cable modem and CMTS based on[6].

Fig. 3 .

 3 Fig.3. Excerpt from the DHCP offer sent by the DHCP server within the configuration process (captured and visualized using Wireshark, identifable data is obfuscated).

Fig. 4 .

 4 Fig. 4. Example DOCSIS configuration file extracted with strings.

Acknowledgments We thank Andreas Dewald and Martin Mink for helpful comments on a previous version of this paper.


SH (Basie Kai Rannenberg

Leon Solms

Strous

Committee 11 Security and Privacy Protection in Information Processing Systems 1

Keywords: Security, Privacy, Protection, Information Processing Systems, IT Systems, ICT Systems

on Security and Privacy Protection in Information Processing Systems was created in 1983 under the chairship of the late Kristian Beckman of Sweden. Representatives from more than 30 IFIP member societies are members of TC-11 and meet at least once a year at the IFIP/Sec conferences that are held in different member countries. This text gives an overview on the state of TC-11 and its development over the last 28 years. It starts with a snapshot on the current situation of TC-11, followed in Section 2 by an overview of the historical background and trends of TC-11 and its flagship conference IFIP/Sec. Section 3 is dedicated to the main development trends in the field of TC-11, while Section 4 honours the awardees of TC-11's Kristian Beckman Award, many of them TC-11 Pioneers. Section 5 then gives an outlook on the future role of TC-11.

TC-1-a snapshot

TC-11 can to some degree be recognized by its aims, scope, and last but not least its working groups, which are introduced in the following sections. All three underwent some significant changes over the past 28 years, which are documented in the remainder of this article

TC-11 Aims

To increase the trustworthiness and general confidence in information processing and to act as a forum for security and privacy protection experts and others professionally active in the field 1 This text is an updated version of "IFIP Technical Committee 11 Security and Privacy Protection in Information Processing Systems", pp. 302-310 in: Kai Rannenberg, Vijay Varadharajan, Christian Weber (Eds.): "Security and Privacy -Silver Linings in the Cloud", Proceedings of the 25th IFIP TC 11 International Information Security Conference, SEC 2010, held as part of WCC 2010, Brisbane, Australia, September 20-23, 2010, IFIP Advances in Information and Communication Technology, Vol. 330, 2010, ISBN 978-3-642-15256-6, and pp. 153-161 in Klaus Brunnstein and Heinz Zemanek (Eds.): "50 years of IFIP -Development and Visions", ISBN: 978-3-901882-43-2, www.ifip.org.

TC-11 Scope

Work towards:

 the establishment of a common frame of reference for security and privacy protection in organizations, professions and the public domain;  the exchange of practical experience;  the dissemination of information on and the evaluation of current and future protective techniques;  the promotion of security and privacy protection as essential elements of information processing systems;  the clarification of the relation between security and privacy protection.

TC-11 Working Groups

Already in 1985 TC-11 established its first working groups. Since then number and activity of TC-11's WGs underwent a non-linear but steady growth with two new WGs being established in 2010 driving the number of TC-11s WGs up to twelve, of which two WGs are shared with fellow TCs. The current WG list reads as follows:

2

The historical background of TC-11 and its flagship conference

In May 1983, the 1st International Conference on Information Security, IFIP/Sec '83, took place in Stockholm, Sweden. This conference was organized by members of the Swedish Special Interest Group on Information Security, as well as a number of further people, including some from existing IFIP Committees. The organization was under the chairman-ship of Kristian Beckman of Sweden. A proposal was submitted to IFIP's General Assembly (GA), and at its meeting in September 1983 in Paris, TC-11 was formally established. Kristian Beckman was appointed as the first Chairman of TC-11.

The 2nd International Conference on Information Security, IFIP/Sec '84, took place in May 1984 in Toronto with the motto "Computer security: a global challenge". During this conference, the first official meeting of TC-11 was held. Unfortunately, because of ill health, Kristian Beckman could not attend that meeting. He asked Per Hoving from Sweden to act as Chairman, but during the conference, the sad news that Kristian Beckman passed away, reached TC-11.

The next TC-11 meeting took place in Dublin during IFIP/Sec 85, which had the motto "Computer security: The practical issues in a troubled world". Per Hoving was elected as Chairman for a three year term, with Willis Ware from the USA as Vice-Chairman.

Subsequent IFIP/Sec Conferences took place as follows and show the real global approach of TC-11 both with regards to its flagship conference as well as its management teams:

 IFIP/Sec

3

Main development trends in the field of TC-11

The 80es

The early eighties were the years when personal computers started to invade people's lives. One saw an increasing concern about several issues like privacy and witnessed the "birth" of computer viruses. The attention for security started to evolve from the closed defence and mainframe environments to business and small computer environments, from confidentiality towards integrity, from technical security to managerial issues. This was clearly an era where establishing a TC dedicated to security was an obvious thing to do. The founders made it clear by the name and aims and scope of TC-11 that security is not limited to computers but encompasses computers, applications, data and the organization. That was more or less a visionary view because in those days the term computer security was more common than the term information security.

The 90es

The increasing trend towards distributed systems, and the associated use of communication networks, as well as the tendency to use such systems and networks for more and more highly sensitive applications like electronic commerce and medical applications, catapulted the absolute importance of the securing and protecting of electronic information during storage, processing and transmission right into the forefront of Information Technology research and implementation.

It became clear that a very large number of such systems would not be acceptable if proper solutions would not exist for the security and protection of such systems. Developments in cryptography showed to be essential to provide non-reputability and proof of origin in electronic messages. Without digital signatures, provided by cryptography, electronic purchasing was deemed to be not possible.

Security in distributed systems became known to be much more difficult and complex than in centralized systems. Authentication and Authorization in distributed systems are of extreme importance, and must be given the necessary attention.

New techniques to implement and to specifically manage Information Security were constantly needed, and with the growing complexity of IT systems, the internal control of the systems became ever more important. The same held for the growing role, importance and commitment of senior management of companies, up to Board level, towards the security of their companies' IT systems. Special efforts were needed to provide skilled people to be able to evaluate, address and manage security risks involved in IT systems, and to ensure that such systems are operated within the necessary secure environment.

With the fact that computers became so much more user friendly than before, and so much more were being used by the public in general, a serious effort showed up as being needed to make these people aware of the importance of Information Security on their systems, and to show them the risks if such security measures were ignored.

In the application field, Information Security became ever more essential for the growing use of systems in medical applications. Standardization efforts and cryptology policies in different countries also required attention. All in all, Information Security had never before been a more important and essential part of IT systems and networks.

These developments were reflected in TC-11's work mainly by the expanding activities in the respective TC-11's Working Groups, but also by public statements from TC-11. One statement concerns IFIP's position on crypto policies and was drafted in the second half of the nineties. It reflected that cryptography was a hot topic from a policy point of view and discussions concentrated on questions such as whether governments should have access to the keys in encryption systems used by companies and individuals. A second statement concerned information security assessment and certification and addressed TC-11's opinion that the information security status of IT systems and the information security management of such systems should be assessed against specified standards related to information security management and that members of IFIP should be instrumental to ensure that such standards, for systems and individuals, be harmonized on an international level.

The Beginning of the new Millennium

The early beginning of the new Millennium was driven by the Internet and mobile Communication becoming more and more mainstream. "E-words" such as "E-Commerce" and "E-Business" became and more popular. While many of them were just buzzwords, as almost everything from the "old" world became e-d there was little doubt that some of these areas would have significant impact on business and society as a whole. Following this it stepwise became clear that trust and confidence in the security and reliability of all those "e-words" was necessary for them to become the success that everybody was hoping (and waiting) for. So many topics within the scope of TC-11 were influential in that respect, e.g. identification and authentication means (biometrics and smart(er) cards), integrity of messages, secure business transactions and payments.

The events of September 11, 2001 pointed strongly to further aspects of security such as cyber terrorism and (critical) infrastructure protection (CIP). Not only did these issues require new technologies or larger scale use of known technologies (biometrics and smart(er) cards again?) they also shed a different light on privacy issues and human aspects.

To address these issues in an effective way even more cooperation between the different IFIP disciplines was required. Topics of most of the TC's became relevant such as topics like software quality (TC-2), training people (TC-3), safety-critical systems (TC-10), and social aspects and human-computer interaction (TC-9 and TC-13). And although those issues may have seemed to be of a technical nature, one could not hide from the fact that cultural and political aspects also do play a role. IFIP had to consider this when addressing the issues and trying to find a way to deal with them in an as "neutral" as possible fashion. New successful WGs such as WG 11.9 Digital Forensics (established 2004) and the trio of WG 11.6: Identity Management,WG 11.10 Critical Infrastructure Protection,and WG 11.11 Trust Management (all three established 2006) reflected these developments.

A related achievement concerned the objective to promote security and protection as essential elements of information processing systems. TC-11 had been successful in this area, which can be measured directly within the IFIP community by the fact that more and more TC's and working groups were including security in their aims and scopes. This also resulted in an increasing cooperation between TC's and working groups on security topics such as the Communications and Multimedia Security (CMS) conferences of TC-6 and TC-11 and the E-Commerce, E-Government and E-Business (I3E) conferences of TC-6, TC-8 and TC-11, and last but not least the joint WG with TC-9 on legal, privacy and social issues (WG 9.6/11.7 IT Misuse and the Law), a very successful example of an active cooperation.

At the same time some "old" issues did not disappear and one did not succeed in eliminating them. Although their "hot" days were over and they were no longer in the focus of attention (with the exception of an occasional short hype), these activities still had and continued to have a significant impact. Hackers and viruses continued to cost society a lot of money and the security professionals kept trying to find ways to limit the effects as much as possible.

Another important issue was attention for developing countries. While IFIP as a whole supported the work of the Developing Countries Support Committee (DCSC) and the World IT Forum (WITFOR) TC-11 was one of the TCs actively participating in these initiatives by e.g. actively strengthening its activities in developing countries and encouraging participation from the respective member societies to also review and revise traditional (maybe "northern" or "western") views.

Moreover in 2002 TC-11 agreed on another statement which contains a request to all member societies of IFIP to urge their relevant government and education bodies to ensure that proper education and certification requirements are set for those people who intend to become information technology security professionals and including those who audit the security of IT systems.

Current Challenges

Especially the Internet but also other Information and Communication Technology (ICT) systems such as Mobile Communication systems have moved even further on: From popular and established mainstream technologies to the information and communication backbones for many societies and countries and moreover as the essential infrastructures for global and international cooperation.

The rapid and radical movement towards new and Internet based ICT systems was partially supported by the decline of some established technologies, but also by the changing habits of users. It has raised major questions of trust in to the ICT systems and into information security as such and demonstrated the importance of projection of citizens, consumers and their privacy. TC-11 reflected this development in more and more IFIP/Sec mottos since 2003 and moreover with its first TC name change since its inception: In 2007 the term "Privacy" was added to TC-11's name and subsequently the aims and scope were adapted accordingly. This was preferred to simply establishing a new WG on Privacy as the deep and delicate relations between security and privacy were considered where information security sometimes supports privacy and sometimes endangers it. These delicate relations affect the work of most WGs in IFIP TC-11.

The further miniaturisation and the pervasive use of ICT lead WG 11.2 to changing its name from "Small System Security" to "Pervasive Systems Security" reflecting the fact, that almost every aspect of (human) life is now exposed to ICT. This trend also led to the founding of WG 11.12 "Human Aspects of Information Security and Assurance". At the same time it became clear, that Information Security is also important for researchers and in the information systems field leading to a new WG 8.11 / 11.13 "Information Systems Security Research" together with TC-8. The Kristian Beckman Award TC-11 established the Kristian Beckman Award in 1992 to commemorate the first chair of the committee, Kristian Beckman from Sweden, who had also been responsible for promoting the founding of TC-11 in 1983. This award is granted not more than annually to a successful nominee and is usually presented at IFIP/Sec. The objective of the award is to publicly recognise an individual, not a group or organisation, who has significantly contributed to the development of information security, especially from an international perspective. However this particular requirement will not necessarily preclude nominations of those whose main achievements have been made on a national level. Many of the awardees can be considered IFIP (TC-11) Pioneers.

5

The Future Role of TC-11

With the rising importance of ICT systems and society's dependability on these systems, the role of TC-11 and its topics has risen significantly over the last years, and is still rising. TC-11 has taken up this challenge and is active on several fronts through its Working Groups, its special conferences to discuss research developments, and other dissemination services to member societies of IFIP and to the international community in general. However a number of challenges remain and are even growing:

 Still relevant security and privacy issues are only considered relatively late in system development processesand often still too late.  Security and privacy are "horizontal" subjects and orthogonal to many topics that are cared for by other IFIP TCs.  In many cases appropriate decisions with regard to security and privacy can only be taken, if the respective (application) context is considered.

Therefore TC-11 is encouraging the inclusion of security and privacy topics in all areas and actively cooperates with other TCs. This will hopefully contribute to a situation, where relevant security and privacy considerations and measures are embedded as a natural topic in all domains rather than coming in late.

  TC-11 was honoured to award the Kristian Beckman Award to:  Harold Highland (USA) in 1993, presented in Toronto (Canada)  Per Hoving (Sweden) in 1995, presented in Cape Town (South Africa)  Sushil Jajodia (USA) in 1996, presented in Samos (Greece)  Donald Davies (UK) in 1997, presented in Copenhagen (Denmark)  Richard Sizer (UK) in 1998, presented in Vienna and Budapest (Austria and Hungary)  Willis W. Ware (USA) in 1999, presented in Amsterdam (Netherlands)  William Caelli (Australia) in 2002, presented in Cairo (Egypt)  Roger Needham (UK) in 2003, presented in Athens (Greece)  Jean-Jacques Quisquater (Belgium) in 2004, presented in Toulouse (France)  William List (UK) in 2005, presented in Tokyo-Chiba (Japan)  Butler W. Lampson (USA) in 2006, presented in Karlstad (Sweden)  Pierangela Samarati (Italy) in 2008, presented in Milano (Italy)  Klaus Brunnstein (Germany) in 2009, presented in Pafos (Cyprus)  Sebastiaan von Solms (South Africa) in 2010, presented in Brisbane (Australia)  Ann Cavoukian (Canada) in 2011, to be presented in Lucerne (Switzerland)

  At the TC-11 meeting during this conference Sebastiaan von Solms from South Africa was elected as Vice-Chair and David Bachelor from Canada as Secretary. Later that year Sebastiaan von Solms was appointed as acting Chair of TC-11 by the IFIP President.  IFIP/Sec 95 Cape Town, South Africa: "Information securitythe next decade". At the TC-11 meeting preceding the conference Sebastiaan von Solms was elected as new Chair with Reinhard Posch from Austria as Vice-Chair.  IFIP/Sec 96 Samos Island, Greece: "Information systems security: facing the information society of the 21st century"  IFIP/Sec 97 Copenhagen, Denmark: "IT Security in Research and Business"  IFIP/Sec 98 Vienna/Budapest, Austria/Hungary with the motto "Global IT security " and as part of the IFIP World Computer Congress  1999: No IFIP/Sec Conference took place, but a TC-11 meeting was held in Amsterdam (Netherlands) in conjunction with a TC-11 Working Group conference.  IFIP/Sec 2000 Beijing, China with the motto "Information Security for global information infrastructures "as part of the IFIP World Computer Congress: Geoff Fairall from Zimbabwe was appointed as new Secretary of TC-11.  IFIP/Sec 2001 Paris, France: "Trusted information: the new decade challenge". At the TC-11 meeting preceding the conference Leon Strous from the Netherlands was elected as new Chair with Kai Rannenberg from Germany as Vice-Chair. Rossouw von Solms from South Africa was appointed as WG coordinator.  IFIP/Sec 2002 Cairo, Egypt: "Security in the information society: visions and perspectives"  IFIP/Sec 2003 Athens, Greece: "Security and privacy in the age of uncertainty"  IFIP/Sec 2004 Toulouse, France with the motto "Security and protection in information processing systems " as part of the IFIP World Computer Congress  IFIP/Sec 2005 Tokyo-Chiba, Japan: "Security and privacy in the age of ubiquitous computing". Lech Janczewski from New Zealand, representing SEARCC, was appointed as Secretary.  IFIP/Sec 2006 Karlstad, Sweden: "Security and privacy in dynamic environments"  IFIP/Sec 2007 Johannesburg-Sandton, South Africa: "New approaches for security, privacy and trust in complex environments". At the TC-11 meeting preceding the conference Kai Rannenberg from Germany was elected as new Chair with Rossouw von Solms from South Africa as Vice-Chair.  IFIP/Sec 2008 Milano, Italy as part of the IFIP World Computer Congress: At the TC-11 meeting preceding the conference Yuko Murayama from Japan was appointed as WG Coordinator.  IFIP/Sec 2009 Pafos, Cyprus: "Emerging Challenges for Security, Privacy and Trust"  IFIP/Sec 2010 Brisbane, Australia with the motto "Security & Privacy -Silver Linings in the Cloud" as part of the IFIP World Computer Congress: At the TC-11 meeting preceding the conference Yuko Murayama from Japan was appointed as Vice Chair in addition to Rossouw von Solms from South Africa.  IFIP/Sec 2011 Lucerne, Switzerland with the motto "Future Challenges in Security and Privacy for Academia and Industry"  IFIP/Sec 2012 scheduled for Greece TC-11's annual IFIP/Sec conferences are established as an integral and wellreputed part of the international Information Security conference scene. The same holds for many Working Group conferences.

	86 Monte Carlo: "Security and protection in information systems"
	 1987: No IFIP/Sec Conference took place, but a TC-11 meeting was held in
	Vienna (Austria) in conjunction with a TC-11 Working Group conference.
	 IFIP/Sec 88 Gold Coast, Australia: "Computer security in the age of information".
	At the corresponding TC-11 meeting Bill Caelli from Australia was elected as new
	Chair, Willis Ware re-elected as Vice-Chair, and David Lindsay from the UK as
	Secretary.
	 1989: No IFIP/Sec conference was held, and efforts were combined with the IFIP
	Congress which took place in San Francisco, USA.
	 IFIP/Sec 90 Helsinki, Finland: "Computer security and information integrity"
	 IFIP/Sec 91 Brighton, England: "Information security"
	 IFIP/Sec 92 Singapore: "IT security: the need for international cooperation"
	 IFIP/Sec 93 Toronto, Canada: "Computer security". Unfortunately David Lindsay
	died before IFIP/Sec 93. Bertil Fortrie from the Netherlands took over as Secretary.
	 IFIP/Sec 94 Curaçao:

6

Contact Information