Andreas Westfeld

Jürgen Wurzer

Christian Fabian

Ernst Piller

Pit Stop for an Audio Steganography Algorithm

Keywords: information hiding, steganalysis, spread spectrum BPSK, VoIP steganography

scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Steganography is the art and science of invisible communication. Its aim is the transmission of information embedded invisibly into cover data. Secure watermarking methods embed short messages protected against modifying attackers (robustness, watermarking security) while the existence of steganographically embedded information cannot be proven by a third party (indiscernibility, steganographic security).

In general, steganographic communication uses an error-free channel, hence messages are received unmodified. Digitised image or audio files reach the recipient virtually without errors when sent, e.g., as an e-mail attachment. The data link layer ensures a safe, i.e., mostly error-free, transmission. If every bit of the cover medium is received straight from the source, then the recipient can extract a possibly embedded message without any problem. However, analogue audio telephony with A/D and D/A conversions, re-encoded speech channels of GSM/UMTS, and VoIP telephony use lossy compression or even do without a data link layer. This is because emerging errors have little influence on the (auditive) quality and can therefore be tolerated.

Without error correction, distortions are acceptable only in irrelevant parts of the cover signal. However, typical steganographic methods prefer these locations for hiding payload. The hidden message would experience the most interference in error-prone channels. Therefore, robust embedding functions have to add redundancy and change only locations that are carefully selected w.r.t. the proportion between unobtrusiveness and probability of error. This increases the risk of detection and permits only a small payload.

Information hiding techniques can be described in the classical triangle, i.e., a set of three characteristics: capacity, robustness, and undetectability. There are highly robust watermarking methods that offer small capacities and achieve perceptual transparency. Some watermarking methods are even robust against distortions in the time and frequency domains. Tachibana et al. introduced an algorithm that embeds a watermark by changing the power difference between the consecutive DFT frames [START_REF] Tachibana | An audio watermarking method robust against time-and frequency-fluctuation[END_REF]. It embeds 64 bits in a 30-second music sample. Compared to the proposed steganographic method this is a quarter of the payload in a host signal (cover) occupying 50 times the bandwith. It is robust against radio transmission. However, it was not designed to be steganographically secure and the presence of a watermark is likely to be detected by calculating the statistics of the power difference without knowing the pseudo random pattern. Van der Veen et al. published an audio watermarking technology that survives air transmission on an acoustical path and numerous other robustness tests while being perceptionally transparent [START_REF] Van Der Veen | Robust multi-functional and high-quality audio watermarking technology[END_REF]. The algorithm of Kirovski and Malvar [START_REF] Kirovski | Spread-spectrum watermarking of audio signals[END_REF] embeds about 1 bit per second (half as much as the one in [START_REF] Tachibana | An audio watermarking method robust against time-and frequency-fluctuation[END_REF]) and is even more robust (against the Stirmark Benchmark [4]). Arnold et al. presented an adaptive spread phase modulation (ASPM) that embeds an inaudible watermark with good robustness [START_REF] Arnold | A phase modulation audio watermarking technique[END_REF]. Although watermarking algorithms are perceptually transparent, they are not intended to be steganographically secure.

Examples for robust steganography are rather rare and, in most cases, embed into images. Marvel et al. [START_REF] Marvel | Spread spectrum image steganography[END_REF] developed a robust steganographic method for images based on spread spectrum modulation [START_REF] Pickholtz | Theory of spread-spectrum communications-a tutorial[END_REF]. This technique enables the transmission of information below the noise or cover signal level (signal to noise ratio below 0 dB). Likewise it is difficult to jam, as long as transmitter and receiver are synchronised. Therefore, successful attacks de-synchronise the modulated signal [START_REF] Petitcolas | Attacks on copyright marking systems[END_REF]. Further examples robustly embed messages using DSSS in slow scan television signals [START_REF] Westfeld | Steganography for radio amateurs-a DSSS based approach for slow scan television[END_REF] or in auditive media. This paper evaluates a particular implementation of spread spectrum technique for steganography in auditive media, introduced by Nutzinger et al. in 2010 [START_REF] Nutzinger | Secure hybrid spread spectrum system for stegnanography in auditive media[END_REF] and implemented by Nutzinger and Wurzer in 2011 [START_REF] Nutzinger | A novel phase coding technique for steganography in auditive media[END_REF]. This technique survived several robustness tests, such as noise addition, variable time delay, frequency shifting, GSM coding, air transmission, cropping, and resampling. It also did not show significant changes of perceived distortion level in hearing tests comparing original and modified signals. Finally, the phase spectrum and the time and frequency representation did not show significant changes [START_REF] Nutzinger | A novel phase coding technique for steganography in auditive media[END_REF].

What is the goal of this paper? As the title suggests, it is not a description of an implementation of an audio embedding method that is claimed to be secure, just an evaluation of a previously known method from the literature. It might well be a bit more secure than before, under particular assumptions. We can set some of these assumptions as long as we want to play the attacker, but it would not say much about the security during a real application of the embedding method. It is probable that some of the attacks that we describe in this paper will be effective under certain conditions, and even successful through other steganographic (audio?) techniques. We unveil some weaknesses using rather simple methods that the implementors have not been aware of in their own validation of the embedding method. An evaluation at the given level of security-defined by the embedding method-does not require a universally working detector that is aware of all possible sources of stego signals, even if the steganographer could conceal some of the weaknesses using these sources. It is always advisable to identify the source of the weakness and revise the responsible part of the embedding method.

The paper is organised as follows. In the next section, the algorithm of the spread spectrum technique is described. Section 3 scrutinises the implementation of the spread spectrum technique. We found several weaknesses with proposed fixes in Sect. 4. Finally, Sect. 5 concludes the paper and gives an overview on our further work.

Spread spectrum algorithm

The steganographic algorithm of the StegIT-3 research project uses the audio signal of voice calls as its cover media. The voice call can be either a VoIP call or a mobile call over GSM or UMTS. The steganographic modulation for embedding the secret is applied at the decoded audio signal. The sample values of the uncompressed audio signal S float are between the floating point values -1.0 and 1.0. If the encoded audio signal uses the PCM16 codec, it will be converted as shown below:

S float = S PCM16 /32768.0 (1a)
S PCM16 = S float • 32768.0 + 0.5 if S float ≥ 0 (1b) S PCM16 = S float • 32768.0 -0.5 if S float < 0 (1c)
The implementation of the StegIT-3 framework had a rounding bug. For more information see section 4.1.

For embedding, the original unchanged decoded voice signal (cover signal) c(t) is used. By default, the sample rate f s of a phone call is 8000 Hz, but the algorithm implementation would also work with any higher sample rate. At the sender, each secret bit is embedded as a chip sequence. One pseudo-noise chip sequence represents the bit value false while the other represents the bit value for true. A chip is represented by the value -1 or 1 (V chip (t)). These sequences are generated by a linear feedback shift register (LFSR). Each chip of the chip sequence is embedded into the cover signal by the binary phase-shift keying (BPSK) modulation. The count of chips for one bit can be configured. It is a part of the stego key and also determines the transmission time for one embedded secret bit. The following equations show parameters for embedding a chip. 500.0 Hz ≤ f ≤ 3000.0 Hz BPSK modulation freq.

(2a)

T = 1/f period time (2b) C opc = 3 • • • 12 oscillations per chip (2c) t c = C opc • T chip period, chip time (2d) V chip (t) chip value {-1, 1} (2e)
t start chip start offset (2f) 0 ≤ ϕ ≤ 2π phase for BSPK (2g)
For embedding the chip value V chip (t), the cover signal c(t) is BPSK modulated according to Eq. 3, creating the modified (stego) audio signal

s(t) = c(t) + A embed (t) • V chip (t) • cos(2π • f • t + ϕ). (3)
A embed (t) and V chip (t) are constant for the embedding of one chip (chip time). The challenge of the algorithm is to find the perfect value for A embed . The value of A embed represents the amplitude for the BPSK modulation of one chip and affects the ability of the receiver to successfully extract the chip. A higher amplitude-while enhancing the quality of extraction-has negative impacts on the security of the steganographic algorithm. This algorithm uses a constant modulation frequency. An advanced version of this algorithm is described by Nutzinger [START_REF] Nutzinger | Secure hybrid spread spectrum system for stegnanography in auditive media[END_REF]. Figure 1 shows the BPSK modulation of chips and Fig. 2 the cover and the stego signal with the added BPSK modulation chip signal.

The receiver has to extract the chips from the audio signal. The demodulated chip value at the receiver side is given by

V chip,ext. = 1 if d ≥ 0 -1 if d < 0 , (4)
with d = tstart+tc tstart s(t) • cos(2π • f • t + ϕ) dt. ( 5
)
3 Attacks

The goal of this project was to judge the security of the embedding algorithm. It is sensible to study all information before trying to detect traces of the embedding process in the output signal, however, we (involuntarily) played the attacker in two different setups. Due to an intellectual property issue, neither the C++ source code, nor the binary of the implementation was available in the first phase. We could only get a small number of WAV files (recorded phone calls), each file in several versions (without any message, with an embedded message in three different embedding configurations: "amp," "bpsk," and "phase," in order to find out which one is the best). We also knew that the messages had been embedded with some kind of spread spectrum modulation.

Twin Peaks?

We started our research with the simplest attack we could think of, namely a histogram attack à la Twin Peaks [START_REF] Maes | Twin Peaks: The histogram attack to fixed depth image watermarks[END_REF], since the embedding method uses spread spectrum modulation (SS). Not knowing the exact implementation of the SS method, we assumed a simple direct sequence SS (DSSS) algorithm. We hoped that at least one of the three configurations ("amp," "bpsk," and "phase") is close enough to our vague assumption. Figure 3 gives a concrete example of the assumed simple SS embedding 3 with a (zero mean) Gaussian cover signal. A PN sequence, consisting of random samples -1 and 1 only, is used to spread one symbol (e.g. a bit) over a longer time period. If this spreading sequence is added 3 which is indeed hard to match to the real implementation described in Sect. 2 to the cover signal, the symbol can be decoded as the scalar product of the spreading sequence and the stego signal. If the histogram of the cover signal has one peak, there might be two peaks in the histogram of the stego signal. (Hence the name of the attack.) Since the cover signal is Gaussian, the stego signal is the sum of two Gaussian distributions, with a mean distance determined by the spreading sequence (1 -(-1) = 2). If the variance of the cover signal is large (cf. Fig. 4, left), e.g. a louder part of a phone call, the resulting distribution is hard to distinguish from the original Gaussian. However, in more quiet passages of the phone call, the resulting distribution might show twin peaks (cf. Fig. 4, right), or a noticable change of the distribution exploitable for the detection of the steganographic method. We expected at least a kind of automatic volume control of the spread sequence, which reduces the amplitude according to the cover signal. However, since the embedding method should be useful for phone calls, real-time properties are a concern. It may be that the control is delayed, in order not to delay the speech signal too much. Surprisingly, our rather blind attack separated (even parts of) cover and stego signal in our test database perfectly. The detector worked in two steps. The first step selected quiet parts of the signal (a dispensable step as we will see later), the second created a histogram, which showed a single peak at zero for stego signals, but not for cover signals. While the cover signal contained about the same number of zeros as ones (maybe up to 30 % more), in stego signals we found twice as many zeros. Interestingly, this worked for the configurations "amp," "bpsk," and "phase" with the same threshold. If there are more than 1.5 as many zeros than ones, the signal is a detected stego signal.

To understand the reason, we had to wait until we finally received the source code (cf. Sect. 4.1).

"Steps"

A cover-stego attack is possible here, i.e., the synchronous confrontation of cover samples c i and their corresponding stego samples s i . The closer the samples to the diagonal s i = c i , the smaller the change caused by the embedding. Figure 5 opposes cover and stego samples, resulting in an overlay of diagonal stripes. Obviously, there is a mechanism that controls the embedding intensity in discrete steps. However, under more realistic conditions (stego only attack), an attacker has to estimate the cover from the stego signal. This is usually called "denoising."

Saturn Sighted

We could model the cover sample from other, but temporally close stego samples:

c i ∼ s i-2 + s i-1 + s i+1 + s i+2 . (6)
A similar approach was used during the BOWS-2 contest to estimate the unmarked magnitude of wavelet coefficients from its surrounding [START_REF] Bas | Two key estimation techniques for the broken arrows watermarking scheme[END_REF]. This has been successful, because the piece of watermark in s i was independent of the watermark in the samples of the surrounding. Unfortunately, we cannot be sure or even expect this property in the case of the attacked audio signal here, since a chip time could be longer than a sample time. Nevertheless, we simply predicted the next cover sample by the current stego sample ĉi+1 = s i [START_REF] Pickholtz | Theory of spread-spectrum communications-a tutorial[END_REF] leading to the impressive, "astronomic" constellation in Fig. 6. Although resembling the planet Saturn, it is technically a Lissajous curve that can be estimated using the following ellipse:

t 2 = y -mx b 2 - x 2 a 2 , with (8)
a = 3280, b = 2850, m = 0.496,
where t is a threshold parameter. Lissajous curves appear on an oscilloscope in X-Y mode, when the two inputs are sinusoidal signals. Here the two inputs come from the same, but time shifted signal, i.e. have the same frequency but different phase, resulting in an ellipse. The phase shift is determined by the time between two consecutive samples, i.e., depends on the sample rate. A detector can be constructed, which assumes a stego signal if a suspicious amount of samples occurs between the dashed ellipse (t = 0.7) and the dotted one (t = 1.4), compared to the total number of samples.

The strength of the effect might be surprising. It is not the usual parameterisation, but one for testing the algorithm's behaviour on a GSM channel. In this test case it is of course audible. However, even with the "production" parameters, a small ring (a ≈ b ≈ 30: ;-) can be isolated in some quiet passages of the stego signal (and is covered by the dark centre of Fig. 6 otherwise). We admit that we could have missed this fact in the rest of the test cases if the accidental GSM test case would not have been included in our test database setup.

Countermeasures

Solitary Peak

The cover signal is read from an audio source, usually a telephone, sound card or WAV file (e.g., 8000 PCM samples per second, 16 bits per sample, 1 channel). The samples are signed integers. To support different rates and precisions, the embedding algorithm internally maps the raw data to a series of normalised double floating point samples in the range -1 . . . 1.

The conversion is implemented by a type cast from double to integer, followed by scaling down to the desired interval [-1, 1]. Finally, the double values are scaled up (and clipped, if necessary) to the original range, and casted back to integer. If the values are not changed in between by the embedding step, the final cast from double to integer is one-to-one, because the fractional part is zero.

However, if something is embedded, the final double values will also have non-zero fractional parts. The obvious, but careless, use of type cast takes revenge here. The cast operator (y = (int)x;) takes a numeric argument x ∈ R and returns an integer y ∈ Z, formed by truncating the values in x toward 0 (cf. Fig. 7). Possible repair: y = (int)(x + ((x < 0) ? -0.5 : 0.5));

After the problem of spotty rounding around zero was solved, another problem was detected that occurs with some cover signals only, because of the asymmetry of the integer domain. There is an even number of 16 bit integers, one is neutral (0), 32767 are positive, 32768 are negative. If we negated -32768 (0x8000) there would be a sign overflow, resulting in the same (negative) value. The implemented mapping to [-1.0, 1.0] divided all samples by 32767 and clipped -32768 to -1.0. If the signal is sufficiently saturated, there will be peaks in the histogram of cover samples for the saturated values (-32768, 32767). The conversion routines of the mapping shifted the peak at -32768 to -32767. In case of saturation this provides a rather safe feature for detection. The obvious repair is to change the divisor to 32768, and to clip positive values above 32767 when mapping back to integer.

Better amplitude adjustment control for BPSK modulation

At the sender's side, the embedding algorithm determines whether the original cover signal is suitable for embedding the secret chip. In case decoding the original audio signal would result in the secret chip's value, it is not necessary to modify the cover signal to embed the chip. This is shown in Eq. 9. The value of c embed decides if a modification of the cover signal is necessary (cf. Eq. 10).

c embed = tstart+tc tstart c(t) • V chip (t) • cos(2π • f • t + ϕ) dt (9) steganographic modification is not necessary if c embed > 0 necessary if c embed ≤ 0 (10)
In case of embedding, the value of A embed is increased step-by-step until a chip can be extracted correctly at the receiver's side. However, this approach shows steps when plotting the cover against the stego signal (cf. Fig. 5). Also a fix minimum amplitude was added. The fix minimum amplitude increases the effect of "Saturn Rings" (cf. Sect. 3.3). In order to avoid "Saturn Rings" and "steps," the amplitude A embed is determined by a modified control mechanism (cf. Eq. 11 . . . 15).

c avg = 1 t c tstart+tc tstart c(t) • V chip (t) • cos(2π • f • t + ϕ) dt (11) steganographic modification is not necessary if c avg > 0 necessary if c avg ≤ 0 (12) tstart+tc tstart c(t) -2 • c avg • V chip (t) • cos(2π • f • t + ϕ) dt = 0 (13) s ARV = 1 t c tstart+tc tstart |c(t)| dt (14)
A embed = 2 • |c avg | + s ARV • A add (15)
The signal mean c avg (cf. Eq. 11) determines whether embedding is necessary. This value is the basis in the new definition of the embedding amplitude A embed (cf. Eq. 15). For a successful chip extraction at the receiver side, A embed must be greater then the double of c avg . The embedding amplitude A embed is increased by an additional part A add that is scaled with the averaged rectified values in the signal segment s ARV to provide the receiver the necessary margin for extraction of the correct chip value. The scaling relieves the "Saturn" effect (cf. Sect. 3.3) compared to the initial choice of a constant margin (e.g., an unscaled A add = 0.1).

Conclusions

We found several weaknesses in the implementation of a spread spectrum technique for steganography in auditive media. Some of them did not result from the embedding technique itself, but the mapping from the external cover representation to the internal working representation. It seems to be important to carefully check conversion and normalisation functions, their homogeneity around special values like 0, and their properties in case of saturation.

However, also the embedding algorithms itself showed weaknesses. It seems to be important to consider the difference between cover signal and stego signal during the design of the algorithm. Although an average attacker cannot access this difference signal, obtrusive properties might radiate through the cover's shielding guard. It is also advisable to use pathologic signals, like rhythmic audio pulses, to test the integrity, for instance, of control mechanisms.

Be aware of correlations within the cover's values. Such correlations will also occur in the stego signal. Often, such correlations can be used to "denoise" the signal or to "calibrate" statistics [START_REF] Fridrich | Steganalysis of JPEG images: Breaking the F5 algorithm[END_REF][START_REF] Kodovský | Calibration revisited[END_REF], even in audio streams.

Fig. 1 .Fig. 2 .

 12 Fig. 1. Generation of the chips

Fig. 3 .

 3 Fig.3. A spreading PN sequence is added to the cover signal (dotted line), resulting in the stego signal (bold line)

Fig. 4 .

 4 Fig.[START_REF] Steinebach | StirMark benchmark: audio watermarking attacks[END_REF]. If the cover signal is strong enough, the resulting composite distribution (bold line) still seems to be Gaussian (left), however, quiet passages of the stego signal might show twin peaks (right)

Fig. 5 .

 5 Fig. 5. Synchronous confrontation of cover and stego samples shows steps of a controller (left), and no steps after correction (right)

Fig. 6 .

 6 Fig. 6. Confrontation of consecutive stego samples (next sample value as an estimate of cover) shows a Lissajous curve (left), and after correction (right)

Fig. 7 .

 7 Fig. 7. Bin 0 collects from a double-width interval due to truncation towards zero, resulting in a histogram peak

Acknowledgments This work was supported in the KIRAS programme for security research by the Austrian Federal Ministry for Transport, Innovation and Technology.


Marcel Eckert
email: marcel.eckert@hsu-hh.de

Igor Podebrad
email: igor.podebrad@commerzbank.com

Bernd Klauer
email: bernd.klauer@hsu-hh.de

Hardware Based Security Enhanced Direct Memory Access

Keywords: Hardware Security, FPGA, Direct Memory Access, Malware

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The security of modern computing systems is mainly based on software, such as anti malware agents or intrusion detection systems. Modern attack vectors consider hardware and software leaks for intrusion purposes. The main target today is software on all software abstraction levels in a computer. Hardware as a target is also moving into the focus of the "Dark Side" (configurable hardware is also infectable hardware) but this fact is not focus of this paper. Although traditional (software based) anti malware approaches are improving daily by enhanced snooping procedures and new malware signatures, Rutkowska has shown, that attacks are possible, which are undetectable by software [START_REF] Rutkowska | Beyond The CPU: Defeating Hardware Based RAM Acquisition[END_REF].

Especially exploits taking advantage from the Direct Memory Access unit (DMA) showed the simplicity of malware injections directly into the main memory of computing systems, bypassing all software based security mechanisms. Rutkowskas attacks imposingly show, that the hardware engineering paradigm "Software writers should provide security; Hardware should just be as fast as possible" [START_REF] Gueron | Where does security stand? new vulnerabilities vs. trusted computing[END_REF] is definitively outdated. To design secure systems in future, security needs to become an issue to be adressed on all abstraction levels of computing systems.

A general introduction into the field of hardware based security is given in [START_REF] Wang | Computer Architecture and Security: Fundamentals of Designing Secure Computer Systems[END_REF], with an excellent elaboration on DMA and related components like memory and interfaces in chapter 5. A comprehensive analysis of related work in the area of processor security is given in [START_REF] Chhabra | An analysis of secure processor architectures[END_REF].

In the remainder of this paper we present our hardware based security enhancement for the DMA-functionality as an example for how to cut down selected hardware originated attack vectors. It's basic functionality is a tamperproof hardware based, highly parallel executed snooping functionality on the data bus, that scans for signatures of malicious code structures interrupting if a signature is found.

Problem

DMA is a well known technique to release processors from time consuming workload caused by simple data transfers. The transfers are performed without supervision. Data and instruction are communicated between the memory as sink and source or between the memory and mass storage or interfaces. They reach their destination block-wise completely before beeing checked by anti malware agents. The DMA reports DMA completions by setting bits in status registers by interrupting the processor or by other status signals [START_REF] Stewin | Understanding dma malware[END_REF]. An anti malware agent can then check the result if the memory was the DMA target.

With the unsupervised DMA transfers stealth features can be implemented. Malicious code and data can be transferred. To complete success the attack pattern needs to launch the code before it has been checked by the anti malware agent.

Another opportunity to exploit the unsupervised DMAs is to infect the anti malware software directly.

Solution

Concept

The vulnerability of a system, based on the security leak imposed by the DMAfunctionality will be solved by the introduction of a DMA-Watchdog (watchdog). The watchdog itself resides between the DMA-controller and the memory controller (of the main memory). The watchdog supervises the data part of the memory-bus with a number x of sensors (S 0 to S x in figure 1).

The sensors provide a pattern matching functionality to identify malware. The detection algorithm of a single sensor can be complex in any order and is variable in principle. If one of the sensors is detecting his pattern it is signaling to the watchdog. The watchdog itself will now block the current DMA-transfer and signals the processor a "bad" transfer where it can be handed over to the operating system and appropriate software (e.g. anti virus software).

Fig. 1. watchdog residing between DMA-controller and main memory

The detection of different patterns is possible by the different sensors and is performed in parallel. For proving the effectiveness of our solution, the implemented proof of concept demonstrator is presented in the next section.

Proof of Concept

This section presents the proof of concept demonstrator for an hardware based DMA-Watchdog as described in the previous section. It is based on the Partially Reconfigurable Heterogeneous System (PRHS) framework as shown in subsection 3.2. The purpose of the proof on concept demonstrator is to prove the following theses:

1. A hardware based DMA-watchdog is able to detect malware infected DMAto-Memory transfers. 2. There is no performance loss for the system processor if a hardware based DMA-watchdog is used.

PRHS Framework Before starting to work on hardware based DMA-watchdogs, it is necessary to have a freely configurable framework for investigations. Already available frameworks, e.g. Xilinx Microblaze, suffer one big problem: Their hardware is either hardwired (hardcores) or the available soft-cores have closed sources. To gain full flexibility for future research and development, it was necessary to have control even over the configuration and architecture of the hardware. Therefore the PRHS framework has been developed. It is presented in the remainder of this section. The framework has been designed for Field Programmable Gate Array (FPGA) usage only, with the intention to have a platform for research and education. Hence it consists of several modules allowing reuse and adaptivity for different FPGAs and Boards (it has already been used for Spartan3, Virtex5, Spar-tan6, Virtex6, Virtex7 FPGAs and evaluation boards hosting such devices (i.e. ML505, ML605, VC707). All necessary hardware-sources (VHDL) have been implemented from scratch. Therefore the system is completely open. The software Fig. 2. schematic overview for base system of PRHS framework (hardware, detailed explanation of components is given in section 3.2) parts are adapted Open Source projects (Linux as OS, gcc and ucLibC for Cross Compiler toolchain) and therefore also fully accessible.

Hardware For allowing flexibility, the PRHS framework comes with three fundamental systems:

-Small system: Combines the PRHS Core -ARM Instruction Set (PRHSC-A) with Block-Ram and an UART. This might serve as starting point for small embedded systems. -Base system: Extends the small system to be able to run a customized Linux (Linux for PRHS (L4PRHS)) including an SD-RAM interface. Figure 2 gives a schematic overview. -Reconfiguration system: Extends the base system with a partial reconfigurable area. (This feature is not used for the DMA-watchdog proof of concept demonstrator)

Description of the board independent components:

PRHSp-A A self implemented processor, consisting of a core, which is instruction set compatible with the ARM8 instruction set, a system co-processor and a memory management unit. Boot-Ram On-chip Block Ram that contains the stage 1 boot-loader. ICACHE/DCACHE Instruction/Data Caches, different implementation variants exist, ranging from a simple bridge mechanism to a 32k Cache. IBusCtrl/DBusCtrl Bus controller to separate fast accesses to Caches/Memory (on primary Bus) and slow accesses to peripheral devices (on secondary Bus). SD-Arbiter Bus Arbiter to prevent mixing of SD-RAM memory access. SysTimers In-system programmable Timers. UART Provides input/output functionality over a RS232 Line.

Between the caches and the SD-Arbiters, a fast, board and FPGA independent protocol for SD-RAM access is implemented. It is mapped by board specific components to the appropriate SD-RAM protocol of a board.

Description of the board specific components:

Bridge This device maps the FPGA independent SD-RAM protocol to the appropriate board specific SD-RAM protocol. Mem-Contr Board specific SD-RAM memory controller. CF-Ctrl Board specific (Compact) Flash controller. This device implements harddrive functionality.

Software The PRHS framework also contains a software part including the following components:

L4PRHS An adapted Linux kernel (version 3.8), including all device driver modules to run properly on the hardware presented in the previous section. cross compiler toolchain gcc based toolchain (including uClibC as Standard Library) to compile the adapted Linux kernel and develop software for the Framework on a high-level language base.

Proof of Concept Demonstrator

The general architecture for our proof of concept demonstrator, based on the base system of the PRHS framework is given in figure 3. To simulate and initiate DMA-functionality, a new device (DMA-simulator) has been added to the secondary data bus of the system. It is also connected to RAM via an SD-Arbiter. Its task is to copy the content of internal Block-Ram (8kByte, contents programmable via software) to a given RAM address (programmable via software) on demand. A write request to RAM contains 256 Bits (32 Bytes) of Data. The 8 Kbyte content of the Block RAM is therefore transfered with 256 write requests to RAM.

A DMA-watchdog as described in the previous section has also been implemented. The sensors implement only a very simple pattern matching algorithm without any fuzziness. It simply compares its programmed (via software) pattern (256 bit wide) with the actual data signal (256 bits wide) of the DMA-to-memory transfer.

As the watchdog and the sensors itself are working independently from the system processor by design, there is no performance loss for the processor. Nonetheless, performance measurement has been done with dhrystone [START_REF] Weicker | Dhrystone: a synthetic systems programming benchmark[END_REF] and ramspeed [START_REF] Hollander | RAMspeed, a cache and memory benchmarking tool[END_REF] benchmarks and has proven: watchdog functionality isn't consuming processor time.

Detection functionality has been tested with a proof of concept demonstrator based system including 40 sensors. The two possibilities, DMA data contains (positive test) or doesn't contain "bad" data (negative test) were extensively tested. In both cases, DMA data and sensors patterns were generated randomly. For the negative test cases, one of the sensor patterns was randomly selected and inserted at a random position in the DMA data at each iteration. For both cases 1.000.000 iterations were carried out. In all iterations of both cases, the watchdog worked correctly.

Evaluation

Our proposal has shown, that a security mechanism can be implemented on a very low level, which doesn't cost any processor performance by design, because it doesn't use any computational resources of the processor. The design of the memory controller and the DMA-controller are also not affected by the introduction of a DMA-watchdog. Nevertheless, additional resources are necessary to implement the sensors and the watchdog, which can bee seen as a very special kind of (co)-processor, consuming their own processing time.

The introduced approach is able to cut down only a certain part of the overall attack tree, namely the hardware related ones. This means that a hardware based solution is powerful but definitively not able to fulfill all requirements concerning detection at all levels. Nonetheless with our solution we are for the first time in the position to detect malicious code structures at a very low level in a tamperproof way.

The proposed solution is "signature" based and therefore lacks the problem of actuality. Additionally, the number of detectable "signatures" is limited by the implemented number of sensors.

As mentioned in section 3 it would also be imaginable to implement a more complex behaviour based detection mechanism [START_REF] Ye | A Benchmark Suite for BehaviorBased Security Mechanisms[END_REF]. In this case, the sensors will only signal at the "end" of a behavior. This results in data already transfered to RAM, but the entire transfer, or more exactly the "final" transfer will be prevented.

The current solution lacks the problem of a static detection algorithm. This is related to the hardware implementation of this algorithms. Some already available commercial systems like Convey HC-series or Xilinx Zynq and the academic PRHS framework (section 3.2) introduce the possibility to modify hardware components at system runtime via (re)configurable hardware based on FPGA. These technologies offers the possibility to exchange the hardware based detection algorithms for our proposed solution.

Conclusion and future work

In this paper we presented our solution for the problem of unsupervised DMAtransfers. The proposed solution introduced a hardware based DMA-watchdog. A proof of concept demonstrator , based on an ARM-system running Linux, has also been implemented to prove the feasibility of our solution and to underline one of the big advantages: this approach doesn't consume processor performance at all.

For the future we want to introduce the ability to also modify the hardware based detection algorithm by means of partial and dynamic reconfiguration. This might include also a behavior based detection algorithm.

Fig. 3 .

 3 Fig. 3. general architecture for proof of concept demonstrator


Takayuki Yamada

Seiichi Gohshi
email: gohshi@cc.kogakuin.ac.jp

Isao Echizen
email: iechizen@nii.ac.jp

Privacy Visor: Method for Preventing Face Image Detection by Using Differences in Human and Device Sensitivity

Keywords: Privacy, Unauthorized face image revelation, Face detection, Haarlike feature, Near-infrared LED

A method is proposed for preventing unauthorized face image revelation through unintentional capture of facial images. Methods such as covering the face and painting particular patterns on the face effectively prevent detection of facial images but hinder face-to-face communication. The proposed method overcomes this problem through the use of a device worn on the face that transmits near-infrared signals that are picked up by camera image sensors, which makes faces in captured images undetectable. The device is similar in appearance to a pair of eyeglasses, and the signals cannot be seen by the human eye, so face-to-face communication is not hindered. Testing of a prototype "privacy visor" showed that captured facial images are sufficiently corrupted to prevent unauthorized face image revelation by face detection.

Introduction

Due to the popularization of portable devices with built-in cameras and advances in social networking services and image search technologies, information such as when and where a photographed person was at the time the photograph was taken is revealed by the posting of photos online without the person's permission [START_REF] Cutillo | Safebook: A privacy-preserving online social network leveraging on real-life trust[END_REF][START_REF] Debatin | Facebook and Online Privacy: Attitudes, Behaviors, and Unintended Consequences[END_REF]. This has resulted in a greater need to protect the privacy of photographed individuals. A particularly serious problem is unauthorized face image revelation through the posting of images of people captured unintentionally and shared over the Internet. If, for example, your face or figure is unintentionally captured in an image taken by someone, and then that image is shared by posting it on a social networking site, information about where you were and when can be revealed through the face recognition process of an image retrieval service (e.g., Google Images) that can access the geographic location and shooting date and time information contained in the image's geotag, without your permission [START_REF] Blackman | Omniveillance, Google, Privacy in Public, and the Right to Your Digital Identity: A Tort for Recording and Disseminating an Individual's Image Over the Internet[END_REF]. An experiment conducted at Carnegie Mellon University showed that the names of almost one-third of the people who participated could be determined by comparing the information in photographs taken of them with the information in photographs posted on a social networking site.

Furthermore, other information about some of the participants, including their interests and even their social security number, was found [START_REF]Face Recognition Study FAQ[END_REF].

In this paper, we describe a method we have developed for preventing unauthorized face image revelation through facial recognition from images captured with a digital camera that does not hinder face-to-face communication. It is based on a method for preventing video recording in movie theaters using near-infrared (IR) signals [START_REF] Yamada | Preventing re-recording based on difference between sensory perceptions of humans and devices[END_REF]. No new functions need to be added to existing cameras or networking services because IR signals are used to add noise to the facial portions of captured images. We have developed a prototype wearable device (a "privacy visor") that implements this method. The device is worn on the face like a pair of eyeglasses, so the user does not have a feeling of strangeness. Near-IR light emitting diodes (LEDs) on the device are located near the eyes and nose. Prototype testing demonstrated that our method effectively prevents unauthorized face image revelation through image capture.

The next section describes previous methods for preventing unauthorized face image revelation. Section 3 describes various methods developed for detecting faces. Our proposed method for making faces in captured images undetectable is presented in Section 4, and our prototype wearable device implementing this method is described in Section 5. In Section 6, we describe our evaluation of the prototype implementation, present the results, and discuss them. We close in Section 7 with a summary of the key points.

Previous Methods

Methods proposed for preventing unauthorized face image revelation include hiding one's face with an unfolded shell [START_REF] Gaia | [END_REF] and painting particular patterns on one's face [START_REF] Harvey | CV Dazzle[END_REF]. The first method physically protects the user's privacy by using material in the shape of a shell (a "Wearable Privacy Shell") that can be folded and unfolded. When folded, it functions as a fashion accessory; when unfolded, it functions as a face shield, preventing unintentional capture of the wearer's facial image. The second method prevents identification of the person by using particular coloring of the hair and special paint patterns on the face that cause facial recognition methods to fail. However, such methods interfere with face-to-face communication because they hide a large portion of the face and/or distract the attention of the person to whom the wearer is communicating. The method we have developed for preventing unauthorized face image revelation through the unintentional capture of facial images does not hinder face-to-face communication. It is implemented in a wearable device (a privacy visor) that makes face detection impossible by irradiating near-IR signals, which do not affect human vision. They affect only the imaging devices used in cameras.

Face Detection

Face detection is the key to facial image processing [START_REF] Cairo | Detection and Tracking of Facial Features in Video Sequences[END_REF] as it is the first step in facial recognition. The method most commonly used for face detection is the one reported by Viola and Jones in 2004 [START_REF] Viola | Robust Real-Time Face Detection[END_REF]. The "Viola-Jones method" is based on a multi-scale detection algorithm that uses cascade composition of the Haar-like features, image integration, and a cascade architecture with strong classifiers. It achieves highly accurate and high-speed detection.

Haar-like features

Haar-like features are rectangular image features used for object recognition. Figure 1 shows the basic patterns of Haar-like features. The black areas represent dark features (negative areas), and the white ones represent bright features (positive areas). As shown in Figure 2, Haar-like features are superposed on a detection area, and their values are calculated by subtracting the average of the pixel values in the black areas s(r 2 ) from that of those in the white areas s(r 1 ) for each detection area. That is, the value of the Haar-like features h(r 1 ,r 2 ) is given by

) ( ) ( ) , ( 2 1 2 1 r s r s r r h - = . ( 1
)
Changing the position and size of the basic patterns of the Haar-like features in a detection area makes various Haar-like features applicable to the detection area. As shown in Figure 3, a strong classifier determines "1: True" or "0: False" for each detection area. In the case of "False," the process is terminated and then restarted for the next detection area. In the case of "True" for the Nth strong classifier, the detection area is identified as a face candidate.

Each target detection area Strong Classifiers

Proposed Method

The proposed method for preventing unauthorized face image revelation through unintentional capture of facial images does not interfere with face-to-face communication in physical space. The near-IR signals used to add noise to the facial portion of a captured image cannot be seen by the human eye and hence do not hinder face-to-face communication. Moreover, no new functions need to be added to existing cameras and/or networking services.

Principle

Our proposed method is based on the difference between human sensory perception and recording device characteristics. It uses near-IR signals to corrupt images captured by a charge-coupled device (CCD) or CMOS device. According to the International Commission on Illumination (CIE), the wavelength of visible light ranges from 380 to 780 nm [START_REF]Colorimetry: Understanding the CIE System[END_REF]. In contrast, the wavelengths that can be picked up by such image sensor devices as the CCDs and CMOS devices used in digital cameras and camcorders range from 200 to 1100 nm. This ability to pick up wavelengths outside the visible range gives digital camcorders the high level of luminous sensitivity needed for shooting in the dark [START_REF] Holst | CMOS/CCD Sensors and Camera Systems[END_REF].

Our proposed method adds a noise signal corresponding to the near-IR signals between 800 and 1000 nm, which people cannot see but to which sensor devices react. This noise signal is generated by LEDs located near the eyes and nose so that it prevents face detection, the first step in the face recognition process. In particular, the noise signal distorts the Haar-like features [START_REF] Viola | Robust Real-Time Face Detection[END_REF] around the eyes and nose, which are used in the face detection process. This means that new functions do not need to be added to cameras, social networking services, or image retrieval services. Our purpose is to establish a method that prevents identification of a person without causing physical discomfort to the user. We do this by irradiating near-IR signals from near a person's eyes and nose that react with only the imaging device in a camera, thereby adding noise to captured facial images. These signals do not affect the person's vision but do cause facial detection misjudgment. The near-IR irradiation from near the eyes and nose can be prototyped by implementing a near-IR light source in a pair of glasses or goggles, which is something that is commonly worn, as a noise source. The means we propose for achieving our purpose is a wearable device privacy visor) in the shape of goggles that incorporates near-IR LEDs. The transmitted near-IR signals act as a noise source, which makes the face in captured images undetectable.

Arrangement of near-IR LEDs

The near-IR LEDs must be effectively arranged to prevent the strong and weak classifiers from classifying the input image as an object. To interfere with the weak classifiers, it is necessary to change the difference in luminance between the positive and negative areas of each feature. We analyzed the Haar-like features effective in face detection by using supervised learning and determined into which portion of the face a noise light source should be arranged.

To determine the composition of the Haar-like features to be trained by supervised learning, we used an Open CV [START_REF] Bradski | Learning Open CV Computer Vision with the Open CV Library[END_REF] example cascade that had been trained in advance by using 5000 facial and 3000 non-facial images [START_REF] Lienhart | Empirical Analysis of Detection Cascades of Boosted Classifiers for Rapid Object Detection[END_REF]. By setting the pixel value of the positive area r 1 to +1 and setting the pixel value of the negative area r 2 to -1, we identified the partial regions that have a large absolute value and determined the part where the effect of face detection using the change in the luminosity value is large.

The superposition of the Haar-like features as determined by using the first strong classifier (k=1) and by using the 10-th strong classifier (k=10) is shown in Figure 4. A positive area representing bright features is concentrated on the circumference of the nose, and a negative area representing dark features is concentrated on the circumference of the eyes and nose. To make face detection fail, we have to make the negative area bright or make the positive area dark so that features are obscured. Near-IR LEDs can make a dark area bright. We therefore focus on the negative area. By considering the combination of the negative area with the area where a device with a goggle form could be worn, we determined that the near-IR LEDs should be arranged around the eyes and along the periphery of the nose bridge.

Prototype

Description

An overview of the prototype privacy visor is shown in Figure 5, and the specifications are listed in Table 1. The prototype is a pair of commercial goggles to which near-IR LEDs have been attached. The LEDs have a peak wavelength of 870 nm and are positioned so as to maximize the distortion of the Haar-like features.

Table 1. Specifications of prototype privacy visor.

Near-IR LEDs

Type

Configuration Near-IR LEDs

We used chip-type-with-lens near-infrared LEDs based on the sensitivity of human eye and imaging sensor device characteristics by considering the basic types of LEDs (bullet, reflective, and chip with lens), the peak wavelength, the spectral width, etc.

Goggles

We used goggles with a plastic frame and polycarbonate lenses because goggles facilitate the "attachment" and "detachment" of near-IR LEDs to the human body. To effectively interfere with face recognition and maximize the noise effect in captured images, the noise light source must be carefully placed on the face. Because face detection uses the Haar-like features of several areas on the face, face detection cannot be prevented by simply wearing sunglasses. Therefore, to distort the large Haar-like features around the eyes and along the bridge of the nose, we attached 11 near-IR LEDs to commercial goggles on the basis of the analysis results described in Section 4.2. They were positioned around the eyes (3 above each eye; 1 on the inside of each eye) and around the nose (1 on each side of the nose; 1 on the glabella).

Because unintentional image capture can also occur from a slant as well as from the front, image capture from a slant must also be prevented. Therefore, the six LEDs above the eyes were arranged in the normal direction of the curved surface of the lenses.

An example of the privacy visor in use is shown in Figure 6. When the noise light source is turned on (right-side images in Figure 6

Evaluation

We evaluated our prototype privacy visor with the assistance of ten participants (age: 20-40) using a commercial digital camera (1/2.3-inch CCD; ~10 million effective pixels). The room illumination had a light intensity of 67.5 lux. The camera was set to "Camera focus: spot AF," "Photometry: multi-aperture," "Iris: f/3.3 (automatic setup)," "Exposure time: 1/10 s (automatic setup)." We took images of each participant under three conditions: (a) not wearing the privacy visor, (b) wearing it without IR emission, and (c) wearing it with IR emission. They were taken from three directions (0°, 10° off centerline, and 20° off centerline) and at distances of 1-20 m.

6.1

Method

The images were evaluated using an Open CV face detection API and the same example [START_REF] Harvey | CV Dazzle[END_REF] used to consider the arrangement of the near-IR LEDs. The images had a resolution of 3264 × 2448 pixels, and the cascade was used to set the detection area to various sizes (from 20 × 20 pixels to the maximum number of pixels so that it fit into the image, magnified by a scale factor of 1.1) and to various positions (a loop stride of program is at least two pixels, determined by the scale) from corner to corner. A detection area classified as an object by all strong classifiers was considered to be a face candidate. After all face candidates were detected, a single candidate was focused on, and the number of neighbor candidates M, that had a size different from and were included in the focused on candidate was counted. If M was two or more, it was determined that there was a face in the detection area, and the face was detected.

If M was less than two, especially if the scales of the included candidate were not continuous, it was determined that there was not a face in the detection area, and a face was not detected.

Results

The face detection results for the images taken from the closest distance (1 m) are shown in Figure 7. Each rectangle indicates a candidate classified as an object by all the classifiers in the cascade. The different colors represent different scales. The number of people detected is plotted in Figure 8. The number of people detected increased in the order of (c), (b), and (a). The plots show that a person not wearing the privacy visor or wearing it without noise could be detected for certain directions and distances while a person wearing the privacy visor with noise could not be detected for any direction or distance. This means that the near-IR signals had a greater noise effect than the visor itself. Details of the evaluation results for each angle are given below.

Images taken from front

As shown in Figure 7 (i), for conditions (a) and (b), a face was detected because other candidates were included in the outer candidate for more than two continuous scales. For (c), a face was not detected because there was no candidate on the actual face. As shown in Figure 8 (i), for conditions (a) and (b), all the faces were detected when the distance was less than 16 m. When it was 16 m or more, the number of faces detected decreased moderately. For (c), no face was detected at any distance.

Images taken from 20° off centerline

As shown in Figure 7 (ii), for conditions (a) and (b), a face was detected because other candidates were included in the outer candidate for more than two continuous scales. For (c), a face was not detected because there was no other candidate in the outer candidate. As shown in Figure 8 (ii), for conditions (a) and (b), all the faces were detected when the distance was less than 11 m. When it was 11 m or more, the number of faces detected decreased rapidly. For (c), no face was detected at any distance, the same as for (i). In this evaluation, the maximum slant was up to 20° off the centerline. If it is 20° or more, face detection becomes difficult. (ii) Taken from 20° off centerline.

Conclusion

The method we proposed in this paper prevents unauthorized face image revelation through unintentional capture of facial images. It adds invisible noise signals to images captured with an image sensor, thereby preventing the revelation of sensitive information via the face recognition process of image retrieval services. Specifically, our method prevents the recognition of people's faces by adding noise to imaged facial images by irradiating from near a person's eyes and nose near-IR signals that react with only the imaging device on a camera and do not affect the user's vision. These noise signals cause facial detection to fail, and facial detection is required for facial recognition. Testing of a prototype privacy visor implementing this method demonstrated that it can effectively prevent unauthorized face image revelation by interfering with the facial images, thus validating the feasibility of our proposed method.

We are now working on a method that uses absorption/reflective material and the reflection properties of light so that a power supply is not needed.

Fig. 1 .

 1 Fig. 1. Basic patterns of Haar-like features.

Fig. 2 .

 2 Fig. 2. Example of Haar-like features in detection area.

  is composed of several different Haar-like features. It calculates the value of a given feature, and the value is compared with a threshold value. A strong classifier comprises various weak classifiers. Strong classifiers are arranged in a Haar-like features Detection area cascade architecture in order of complexity, as shown in Figure 3. The composition of the weak classifiers and the connection order of the strong classifiers are determined in advance by supervised learning using positive (facial) and negative (non-facial) images. Haar-like features effective for face detection are chosen by supervised learning.

Fig. 3 .

 3 Fig. 3. Cascade architecture.

Fig. 4 .

 4 Fig. 4. Superposition of Haar-like features in detection area.

Fig. 5 .

 5 Fig. 5. Overview of prototype privacy visor.

Fig. 6 .

 6 Fig. 6. Example of privacy visor in use.

Fig. 7 .

 7 Fig. 7. Face detection results for pictures taken from 1 m.

Fig. 8 .

 8 Fig. 8. Number of faces detected.


Jana Fruth

Carsten Schulze

Marleen Rohde
email: marleen.rohde@st.ovgu.de

Jana Dittmann
email: dittmann@ovgu.decarsten.schulze

E-Learning of IT Security Threats: A Game Prototype for Children

Keywords: e-learning, IT security threats, internet, game, children

établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction and Motivation

Nowadays more and more children are using personal computers and the Internet. More than half of the primary-school pupils (6 to 10 years old) use these technologies regularly [START_REF] Livingstone | EU Kids Online II -Final Report[END_REF]. Surfing the Internet may expose children to many threats and risks, such as malicious codes infecting their personal computers, or their personal data being spied on [START_REF] Livingstone | EU Kids Online -Final Report[END_REF][START_REF] Livingstone | EU Kids Online II -Final Report[END_REF]. There are various concepts to raise children's awareness to IT security threats. Most parents set rules for their children's Internet usage (e.g. time limits). At school children are taught about the proper usage of personal computers by their teachers in computer science or IT classes. Furthermore, many different initiatives and websites offer information for both the parents and their children about IT security threats (see Section 2). However, according to research results and personal experiences those concepts are not reaching the children [START_REF] Livingstone | EU Kids Online -Final Report[END_REF][START_REF] Livingstone | EU Kids Online II -Final Report[END_REF]. To overcome this problem this article introduces an educational game prototype for children based on subjects of IT security. This method for raising children's awareness can also be adopted for safety (physical integrity) related subjects. The educational game prototype can be extended to cover subjects referring to safety related aspects of mobile toys like robots. The article is structured as follows: in Section 2 a short overview of the state of the art of methods for raising the awareness to safety and IT security related topics are illustrated. In Section 3 the educational game prototype "InSiKids" (engl. "Internet Security for Kids") mentioned above is introduced. In Section 4 the results of the usability test that was performed with the prototype "InSiKids" is presented and discussed. The success of intermediation of IT security threats metaphors to primary school children and the confirmation of assumptions is checked. Section 5 concludes the paper and shows future prospects.

State of the Art

In this section the state of the art of children's psychology of learning, playing games, using the Internet are descripted. Furthermore, current techniques of computer game development and current IT security awareness raising methods for children are illustrated.

Children's Psychology

How children learn: Remo H. Largo, the Swiss paediatrician, says that children learn in different ways [START_REF] Largo | Schülerjahre: Wie Kinder besser lernen[END_REF]: Social learning: The child imitates the behaviour of role models, like parents and other children. Learning by experiences with the objective environment: The child becomes acquainted with its environment by occuping itself with objectives via its motion activities and senses. So the child develops for example a comprehension for the dimension, shape or color of different objects. Learning by education: According to Largo the learning opportunities should be adapted to children's development-specific interests. Ideally, teachers creates the learning environment in such a way, that a child is able to gain experience and new comprehension on its own. This will be successful if a child has the comprehension for this specific learning assignment.

Why children play games: The terms 'play' and 'game' [START_REF] Piaget | Play, dreams and imitation in childhood[END_REF][START_REF] Rubin | Play. Handbook of child psychology[END_REF] need to differentiated. Both, play and games are guided by rules, while rules of play (e.g. fantasy play) are flexible, games (e.g. basketball) are governed by explicit rules, which are not negotiable [START_REF] Pellegrini | The role of play in human development[END_REF]. Various researchers [START_REF] Piaget | Play, dreams and imitation in childhood[END_REF][START_REF] Singer | Play=learning: How play motivates and enhances children's cognitive and social-emotional growth[END_REF] claim, that play is being essential for children's healthy development. Its a cornerstone of children's development of cognitive, social skills, and a fundament to learn higher complex concepts if children are elder.

How they play games: Conventional games: Children in the primary school age prefer various games. Examples are sports (e.g. cycling), and traditional games (e.g. hide and seek). Favourite games of girls include verbal games, role playing, play with dolls [START_REF] Laux | Was kinder heute spielen: Anknüpfungspunkte für die schule[END_REF]. Boys often play construction games and games [START_REF] Laux | Was kinder heute spielen: Anknüpfungspunkte für die schule[END_REF] involving physically activities, like ball games [START_REF] Pellegrini | The role of play in human development[END_REF]. Computer and online games: Among conventional games, computer games are an inherent part of primary school pupils leisure time. About 13% of children between 6 and 9 years play computer games every day, about 40% of them play regularly (once and/or several times a week) [START_REF] Behrens | Medienpädagogischer Forschungverbund Südwest[END_REF]. The majority of children in this age play not longer than one hour. The most used device are portable games consoles, such as Nintendo DS. Online games are not so common in this age. Only 15% plays online games once a week. Offline games are more common. Nearly half of the children in this age play them. The favourite games differ between boys and girls. Boys often play 'FIFA', 'Mario Kart', and 'Pokémon'. The favourite games for girls are 'The Sims', 'Singstar', and 'Wii Sports'.

How and why children use the Internet: Aloud a survey throughout the EU [START_REF] Livingstone | EU Kids Online -Final Report[END_REF] 60% of children aged between 6 and 9 years use the Internet. Their favourite Internet activities during their leisure time are surfing the Internet, viewing websites for children, watching films and videos online. It's not so common that peers in this age communicate via social networks. Girls are more active in social networks than boys. Only 5% of the 6 to 7 years old and 13% of the 8 to 9 years old are a member of a social network community [START_REF] Behrens | Medienpädagogischer Forschungverbund Südwest[END_REF]. Furthermore more often, primary school children are invited by their teachers, to use the Internet to do their homework.

Development of Computer Games for Children

Modern game development is an iterative process [START_REF] Fullerton | Game design workshop: A playcentric approach to creating innovative games[END_REF]: firstly game ideas are generated and formalised, afterwards the game is tested and test results are evaluated. The iterative process has to repeated, if the evaluation indentifies some problems with the game design. A modern game design should have six core elements [START_REF] Perry | David perry on game design: A brainstorming toolbox[END_REF]: challenge, goals, rewards, rules, interactivity, and decision making. Game designers usually distinguish between demographic groups, differ in age and gender [START_REF] Schell | The art of game design: A book of lenses[END_REF]. Amongst other factors, specific skills of a demographic group define a user specific game design. The group of 'kids', children aged between 7 and 9 years, are very interested in computer game playing, usually have reading skills, and start logical thought. The challenge for a game designer for those kids is to avoid overwhelming them with too much information (see passage "Children as Users"). For the development of computer games programmer could choose various game engines1 . A common game engine is the XNA Game Studio 4.0 [START_REF]Microsoft: Xna game studio 4.0[END_REF]. Its an programming environment provided by Microsoft, which includes the XNA Framework. It allows an easy game development of small game projects, with a comparative small implementation effort in comparison to standard game implementations. Amongst other functions XNA provides the window managment, the display of 2D and 3D graphics, the handling of user inputs (keyboard, game controller) and the output of sound. The game described in Chapter 3 is developed using the XNA framework because of the easy way of 2D game implementation. In our opinion the use of 2D games with a simple visual design are adaquat to allow learning without distracting children.

Children as Users: The way children think differs a lot from adults. Children in general are used to thinking in a world of fantasy and dream of magic [START_REF] Menzel | Design and evaluation of security multimedia warnings for children's smartphones[END_REF]. Furthermore, young children have problems reading long and especially complicated texts [START_REF] Nielsen | Children's websites: Usability issues in designing for kids[END_REF]. Therefore, texts should be short, easy to understand and the information has to be limited. If the children are overwhelmed with too much information, they will easily feel frustrated, lose their concentration on the task at hand [START_REF] Berk | Child Development[END_REF]. To support the learning process of children the use of multimedia is appropriate [START_REF] Menzel | Design and evaluation of security multimedia warnings for children's smartphones[END_REF]. The use of metaphors ensures that the children will be able to understand the complex information. Those metaphors should wrap the complex information (IT security) into something the children know from their daily life [START_REF] Nielsen | Children's websites: Usability issues in designing for kids[END_REF]. The prototype "InSiKids" realises this metaphorical approach for a target audience of primary school pupils aged between 7 and 9 years (see Section 3). The game prototype was evaluated with test methods adapted to children ("thinking aloud technique", "active intervention method" and "retrospection" method) [START_REF] Kesteren | Assessing usability evaluation methods on their effectiveness to elicit verbal comments from children subjects[END_REF]. But gender particularities must be observed. Research results of the developmental psychology validate developmental differences in cognitive skills between girls and boys [START_REF] Berk | Child Development[END_REF] (see Section 4). Girls in comparison to boys tend to have better verbal skills (e.g. spelling, writing, linguistic understanding), while boys tend to have an affinity for technics resulting in comparatively more interest in the functionality of technical devices [START_REF] Berk | Child Development[END_REF].

Awareness Methods to IT Security Threats for Children

To raise the children's awareness to problems and questions of IT security while using the Internet various procurement methods exist: Parents and school: IT security is a complex subject, which children mainly learn about by asking their parents and friends (see peers) or while taking computer science / IT classes at school [START_REF] Livingstone | EU Kids Online -Final Report[END_REF][START_REF] Livingstone | EU Kids Online II -Final Report[END_REF]. Most parents arrange specific rules with their children, e.g. time limits for using the Internet [START_REF] Kuhlmann | Voruntersuchungen und erste Ergebnisse zur Webseitengestaltung für die Situationsbewusste Unterstützung von Kindern in IT-Sicherheitsfragen[END_REF]. At school the children are often instructed only on how to use computers, but rarely the risks and threats they can encounter [START_REF] Livingstone | EU Kids Online II -Final Report[END_REF]. Peers: Children learn while interacting with their friends (peers). The interaction with qualified others is essential in learning new things [START_REF] Fuhrer | Cultivating Minds: Identity as Meaning-Making Practice[END_REF]. Initiatives: Many initiatives have been formed to convey the crucial knowledge about IT security to children as well as their parents. Initiatives like the website 'klickSafe'2 focus on increasing the awareness of Internet users in general to possible threats and conveying the appropriate behaviour in such critical situations. The website 'fragFinn.de'3 is a web search engine especially developed for children, which provides a safe way searching the internet. Another approach to convey this subject to children as the target audience is the use of websites containing games, comics and quizzes. This approach is relatively wide spread since it takes advantage of things children like, such as 'Sheeplive'4 . Even though these subjects have been widely discussed before the stated projects seem to fail to convey the crucial information to their target audience [START_REF] Livingstone | EU Kids Online -Final Report[END_REF][START_REF] Livingstone | EU Kids Online II -Final Report[END_REF]. Therefore, new approaches have to be taken. The e-learning game prototype, introduced in Section 3, is a new approach to teach children IT security threats.

Game prototype: E-learning of IT Security for Children

Based on standard guidelines of infantile learning environments (e.g. paradigm of simplicity, multidimensional stimuli, characters, simple descriptions) the game prototype was developed [START_REF] Nielsen | Children's websites: Usability issues in designing for kids[END_REF][START_REF] Menzel | Design and evaluation of security multimedia warnings for children's smartphones[END_REF]. Key feature of this prototype are the utilized metaphors for the security threats, which should relate the abstract threads to known everyday situations for the children.

User specific game design: In the game the children become part of the company of hero characters. Every character stands for a mini-game about a particular security threat (chatting, publishing of personal information, malicious codes) (see Table 1). A mascot provides advice and explanation through the game. The text was presented in speech bubbles as in comic or manga with a big font size. The mini-games were keep short to prevent exhaustion. Technical description of game prototype: The game is implemented with hand drawn two dimension (2D) sprites 5 and backgrounds. In the field of game development sprites are an established technique, which allows the easy creation and handling of geometries in comparison to other techniques. Only point and click user interaction method was implemented to keep the interaction simple. The user interface is designed using the well-known icons from music players. If the infantile player successfully finishes a mini game, he earns a medal, which is placed on the character icon button in the main menu. Furthermore, children can easily navigate between the mini games through the corresponding icon of the character or through scrolling with the arrow buttons (see Fig. 1).

In the following two sections the creation and realisation of the metaphors is further described. Design of IT Security Threat Metaphors: Metaphors are essential for teaching children about abstract security threats and appropriate precautions. Children cannot associate a computer virus, as they do not touch or see (problem of non-suitable warning messages of virus scanner for children) the threat to their security and safety. Therefore, the goal is to develop suitable metaphors to form proper environment for the children to raise their awareness of security threats. In addition, the metaphor must be chosen age-based for maximum learning success but not every metaphor can be realized in an educational game. Using the Internet children are threatened by the same threats as adults but children are more susceptible to threats because of their stage of development. Thus the threats in Table 1 are gathered without limitation. Afterwards, the threats are rated on the basis of media use of children [START_REF] Behrens | Medienpädagogischer Forschungverbund Südwest[END_REF][START_REF] Behrens | Medienpädagogischer Forschungverbund Südwest[END_REF] and the following three are chosen to be implemented in the educational game: Social network: publishing of personal data, Chat rooms: strangers in the Internet, and Malicious codes: viruses. Realisation of Metaphors in the Game Prototype: To generate meta-phors for threats, the appropriate precautions are collected and set into the age-based context. Around the threat and precaution a metaphor is developed to provide the children with situations they could relate to. At the beginning of the mini games the mascot gives a short introduction to the situation of the character and provides the player with a task. The children are provided with additional information about the consequences of their choices, e.g. if you misplace your party invitations, the party could be over crowded with strangers. The social network game is designed as visual novel. The character and her conscience embodied by little devil and little angel propose different solutions to place the birthday party invitations in school (see Fig. 2) a. In the virus game the children should react to a virus infection which was displayed as desktop-icon eating monsters (see Fig. 3). They could try to use a spray to distroy the viruses, but these keep spawning until all data, which is symbolised by the desktop icons being destroyed. The solution to win is to shut down the system. The chat room game was designed as a memory game. Five characters are presented to the children, so they could memorize them. Afterwards they had to interview a randomly chosen out of the five and then guess which the chosen character was (see Fig. 4).

User Study

The educational game prototype "InSiKids" is designed for primary-school pupils aged between 7 and 9. To evaluate the knowledge transfer via the games and the knowledge, which is present prior to the test, an online questionnaire developed by using the LimeSurvey Framework6 has been used. By reason of absence of a pre test with a time interval to the main test, only knowledge not learning effects could be measured. Test environment: The usability test of "InSiKids" took place at the trilingual international primary school in Magdeburg. The children are familar with their school environment so the stress during the test are decreased [START_REF] Nielsen | Children's websites: Usability issues in designing for kids[END_REF]. The children could use their own personal laptops 7 and had been gaining experience with computers for over a year. The usability test was performed within two third grade classes. The number of pupils was 17 respectively 19 in each class. The results of the test are not representative, because of the small size of the test group (36 pupils). Therefore, only tendencies for knowledge transfer effects for the game prototype could derived from the test results.

Test Realisation: Testing the game prototype was done in different phases: Preparation was done by installing the game to the children's laptops prior to the test. Introduction: The team and the prototype were introduced to the children. The operating concept and the test procedure in general were introduced and explained to them. The duration of this phase should not exeed 10 minutes, because children tend to lose their concentration rather quickly. Game testing:

The children could start playing the games. They were free to start with which game they wanted to play the most. The children were only admonished to play every game at least once. This phase lasts for approximately 25 minutes. In the process of testing the team split in groups which were distributed to the two classes. Two team members stayed in each class to answer the children's questions and take notes on their behavior while playing. Break: With a duration of 15 minutes for recreation. Questionnaire: With a duration of approximately 20 minutes the children evaluated the games via an online questionnaire. Certificates and Conclusion: Certificates were handed out to the children, on which they could have their names signed on and thus could join the company of heroes. Mentioning the certificates to the children resulted in a higher motivation to play the games and to learn about the presented IT security subjects.

Test Results: The test results of the evaluation of the educational game prototype using descriptive statistics [START_REF] Howell | Statistical Methods for Psychology[END_REF] are presented. The evaluation results are collected by a non-standardized questionnaire, which was self-developed. The questions presented are categorized into four categories: sociodemographic characteristics (age, gender) and questions considering previous knowledge (use of different technical devices and frequency ot use of the Internet), questions about the three mini games (virus, social network, chat rooms), and the personal consternation of the test persons concerning IT security threats. The test results were separated into gender groups, which can be reasoned by cognitive differences between girls and boys based on the findings of developmental psychology [START_REF] Berk | Child Development[END_REF]. 34 children participated in the test. Four data sets were invalid, so 30 valid data sets (20 female, 10 male) were evaluated. To provide comparable results for groups differing in size the collected data was normalized. Sociodemographic characteristics: the girls average age was 8,4 years and the boys average age was 8,8 years. Previous knowledge: At home boys (60%) are predominantly use laptops while girls predominantly use personal computers (50%) instead of other technical devices. The boys (50%, 4-6 times a week) use the Internet more often than the girls (50%, 2-3 times a week). 15% of the girls do not use the Internet while all interviewed boys use the Internet between one and six times a week. In the following the results of the comprehension questions to the three mini games (virus, social network, chat) are presented. The questions are analysed by using a rating system. Correct answers are coded with a score of 2 (more relevant) or 1 (relevant), and incorrect answers with a score of 0. In case a child gets a score of zero in one group of questions, he could not achieve a higher score. This is based on the assumption, that the metaphors and the communication of the knowledge about IT security threats fail. It should be measured if the teaching of metaphors of IT security threats were successful. Because of the missing pre test, only knowledge effects not learning effects could be measures. Besides the illustration of test results via block diagrams, the data is also statistically analysed [START_REF] Howell | Statistical Methods for Psychology[END_REF]. The independent two-sample t-test verifies the relationship of the means of two population on basis on the means of two independent samples. In our case, the t-test is used to identify differences between the test results of girls and boys. Cohen's d effect size determines the practical relevance of significant results for small samples and is defined as: <0,3 minor, 0,3-0,5 middle, >0,5 major, >0,7 strong. In the mini game "virus" the children could achieve an overall score of seven (see Fig. 5). The polynominal trend lines in Figures 567symbolise the distribution of the sample data. In comparison to the boys, the answers of the girls are more variant. The t-test results and the minor effect size of Cohen's d (0,26) show no indication for a difference between the results of girls and boys. "social network" game an overall score of seven could be achieved (see Fig. 6). The scores of the girls as well as the boys are accumulated in the middle and higher range. In comparison to the boys in average girls achieve higher scores. The t-test results are not significant. But the middle effect size of Cohen's d (0,73) show an indication for a difference between the results of girls and boys. In the "chat" game an overall score of four could be achieved. In this game the distribution of the score is relatively homogeneous for both groups (see Fig. 7). T-test and Cohen's effect size (0,21) are not significant. Discussion: In this section the test results are discussed and our findings are represented. The test goal were to measure if the teaching of metaphors of IT security threats to the assessed children were successful. Due to the missing of a pre test only knowledge effects could be measured instead of learning effects. The results of the virus and the chat game are no significant. Only the results for the social network game indicate a higher knowledge of girls in comparison to the boys. It can be explained by the well designed metaphor of the social network threat, which seem to address the girls more than the boys. Otherwise, in comparison to the boys, girls use more often social networks. This fact can include the search of a suitable test environment (e.g. a school), test persons (e.g. pupils), and assisting personal (e.g. class teachers). Amongst others, the information leaflets (e.g. parent's letter of agreement), the questionnaire, and the technical systems have to be prepared. Test realisation: From our experience, it is benificial to have the help of persons, who are familiar with the children. They could facialitate a smooth test process. It's helpful to have sufficient personal for different tasks during the test. In our test only two people had to monitor children's behaviour and to assist pupils by playing the game. Analysis: Amongst other things, it has to be determined while preparing the test, what kind of property (e.g. knowledge) should be measured. For example, learning effects could be measured if a certain time period has to be elapsed between a pre test and the main test. The consultation of experts of empirical analysis, such as psychologists, could help to plan an scientific evaluation with representative results.

Conclusion and Future Work

The user study with 36 primary school children shows, the metaphors for exemplary IT security threats (virus infection of the computer, inviting somebody in social networks, chatting with strangers) partially support children's way of playful learning. In the future, the e-learning game prototype 'InSiKids' is to be extended and improved in design, content and techniques, respectively. The latter can be done in synchronizing and adding sound effects to the games to enhance the learning effect. Clues to help the children solve the tasks can be extended and a reference page to look up terms and definitions could be implemented. Due to the prototype's mini game structure more games should be easily added. The medals which can be won in the games could be extended to a bronze, silver and gold medal according to how well the children did solving the task. Additionally, new metaphors for existing and other IT security threats are to be designed and relalised in the prototype. The concept of teaching of IT security threats via metaphors is to be extended and assigned for other user groups, e.g. teenagers. Furthermore, the test setup and test realisation is to be improved. Adapted (e.g. improved questionnaire) and improved test methods are to be used in future user studies. To consider a learning effect future studies and usability tests should be designed for long-term studies.

Fig. 1 . 2 .Fig. 3 . 4 .

 1234 Fig. 1. Main menu Fig. 2. Social network game

Fig. 5 .Fig. 6 .

 56 Fig. 5. Test results: computer virus game

Fig. 7 .

 7 Fig. 7. Test results: chat game

http://www.indiedb.com/engines, last access: 14. June

www.klicksafe.de, last access: 14. June 2013

www.fragfinn.de, last access: 14. June 2013

at.sheeplive.eu, last access: 14. June 2013

In the field of game development a "sprite" is defined as, an 2D image or an anmiation, which is included into a larger game scene[START_REF] Perry | David perry on game design: A brainstorming toolbox[END_REF].

www.limesurvey.org, last access: 14. June 2013

www.intel.com/content/www/us/en/intel-learning-series/classmatepcconvertible.html, last access: 14. June 2013

Acknowledgments

We want to thank the "Dreisprachige Internationale Grundschule Magdeburg", her schoolmaster Irina Horstmann, the teachers, parents and children of the third classes of the year 2012/2013, Sebastian Stellmacher, Dennis Hartmann, Michael Knuth, Volkmar Hinz, and the Acagamics e.V. Jana Fruth is funded by the German Ministry of Education and Science (BMBF), project 01IM10002A. The presented work is part of the ViERforES project [1].


Matthias Trojahn
email: matthias.trojahn@volkswagen.de

Florian Arndt
email: florian.arndt1@volkswagen.de

Frank Ortmeier
email: frank.ortmeier@ovgu.de

Authentication with Time Features for Keystroke Dynamics on Touchscreens

Keywords: keystroke authentication, mobile devices, capacitive display

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Today, smartphones are not only used like normal telephones to phone or write SMS's. This changed with the introduction of the iPhone in the year 2007. With this or other smartphones the number of security relevant data and information which are stored on the smartphone (or provided through applications) are increased.

Different studies showed already an improvement for the authentication if keystroke dynamics are used [START_REF] Joyce | Identity authentication based on keystroke latencies[END_REF][START_REF] Ord | User authentication for keypad-based devices using keystroke analysis[END_REF]. But the existing publications are mainly dealing with computer keyboards or 12-key hardware keyboard of mobile phones.

In this paper, we will discuss the standard features of keystroke dynamics on touchscreen devices. The goal is to see that an authentication with a touchscreen keyboard can be done. On the following questions our research is focused. If an authentication is done with a touchscreen keyboard using time features, the same error rates can be achieved compared with the existing keystroke dynamics studies.

Keystroke Authentication Background

Keystroke behaviour can be described as a biometric characteristic of a person. In particular how this person is typing on a keyboard [START_REF] Monrose | Authentication via keystroke dynamics[END_REF]. It is used like other biometric methods to verify a person. Furthermore, the rhythm how a person is typing can be calculated by different points but at least the time differences are used [START_REF] Moskovitch | Identity theft, computers and behavioral biometrics[END_REF].

In general, two basic types of events can be recorded: The duration time which describes how long a key is pressed (time between pressing and releasing a key) is the first type. The second one describes the time period between n keystrokes, defined by the n press events. This is called n-graph [START_REF] Moskovitch | Identity theft, computers and behavioral biometrics[END_REF]. Several variants of the time period exist. The most used is the digraph were n=2. In addition, some publications are using the combination of three key presses. This is called the trigraph [START_REF] Choraś | Keystroke dynamics for biometrics identification[END_REF]. Basically, each value over n > 1 is possible in order to determine the time differences. But with a higher value the information decreases which can be extracted by the input. The reason with a higher value is that an average over n events is calculated.

Experimental Design and First Results

In our experiment, the subjects were asked to enter a predefined, 17-digit pass phrase on a smartphone (ten times in a row). For the experiment we used a Samsung Galaxy Nexus. To record the information of the keyboard we implemented a soft keyboard, in addition, to an application were the subject had to type the pass phrase.

As a first evaluation we calculated the standard features (duration time of the keystroke, the digraph and trigraph). Figure 1 shows the extracted data for five randomly selected subjects (like [START_REF] Lau | Enhanced user authentication through keystroke biometrics[END_REF][START_REF] Clarke | Authenticating mobile phone users using keystroke analysis[END_REF]). The left figure shows the data of the digraph and while the right represents the data of the duration time. On the left, it can be seen that the average duration is in most cases more constant over the time. However, there are differences between the people. Even the general speed or the time between single digraphs of one subject differs. The differences between one subject can be explained on the basis of experience. E.g. the fifth person has a lot of experience while subject number four has no experience. This is the reason why the fourth person has a higher value for each digraph than the others. The small value for the digraph at fifth time event for all subjects can be explained by a double letter in the pass phrase. No subject has to search the next letter in this situation.

The rhythm of the duration time (Figure 1 on the right), is less constant between individuals and, in addition, between different attempts by one person. Furthermore, the duration time tends to be less than the digraph. A person needs more time to press the next key than to hold a key.

Conclusion

The first result of this experiment shows that there are inter-differences between subjects for the time features and intra-similarities between different attempts of one user. This has to be evaluated more in a bigger experiment. On touchscreen keyboards, which are now installed in nearly every smartphone, besides the wellknown features, other possibilities for typing behavior can be recorded. Examples for this are the pressure or the size of the fingertip during typing. These can be used in combination with the time values for authentication [START_REF] Ross | Information fusion in biometrics[END_REF].

Fig. 1 .

 1 Fig. 1. (left) Digraph for five different users, (right) duration time of the same subjects