The role of the adversary model in applied security research. Issue 81 (March 2019)

• Record Type: Journal Article
• Authors: Do, Quang; Martini, Ben; Choo, Kim-Kwang Raymond
• Is Part Of: Computers & security. Issue 81(2019)
• Page Start: 156
• Page End: 181
• Publication Date: 2019-03
• Subjects: Adversary Model -- Applied security -- IoT Security -- Forensic Adversary Model -- Mobile Security; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2018.12.002
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: Adversary model in applied security research. Adversary model for mobile and IoT security. Digital forensic adversary models. Zero permission adversary models. Graphical-based authentication adversaries. Abstract: Adversary models have been integral to the design of provably-secure cryptographic schemes or protocols. However, their use in other computer science research disciplines is relatively limited, particularly in the case of applied security research (e.g., mobile app and vulnerability studies). In this study, we conduct a survey of prominent adversary models used in the seminal field of cryptography, and more recent mobile and Internet of Things (IoT) research. Motivated by the findings from the cryptography survey, we propose a classification scheme for common app-based adversaries used in mobile security research, and classify key papers using the proposed scheme. Finally, we discuss recent work involving adversary models in the contemporary research field of IoT. We contribute recommendations to aid researchers working in applied (IoT) security based upon our findings from the mobile and cryptography literature. The key recommendation is for authors to clearly define adversary goals, assumptions and capabilities. Graphical abstract: