eprints (HSR Hochschule für Technik Rapperswil)
Not a member yet
1196 research outputs found
Sort by
Cryptographic Discovery
No full textThe imminent next generation of computers will rely on quantum computing. This poses a threat to many of the cryptographic algorithms in use today. Quantum computers will be able to break the mathematical primitives of many of the cryptographic algorithms in the not-so-distant future.
A transition from existing cryptographic algorithms to newer, quantum-safe algorithms such as CRYSTALS-Dilithium and CRYSTALS-Kyber is therefore of high importance for enterprises, to maintain a secure environment. But where are the new quantum-safe algorithms to be applied?
The goal of this student research work is to find a way to identify used cryptographic algorithms on a system so that the engineers can change insecure cryptographic algorithms to quantum-safe cryptography. In particular, we focus on the challenge to identify and model the cryptographic assets, which are in use within the network of an enterprise.
This involves scanning and collecting data from a variety of sources, cataloging assets and building an understanding, of how the collected data artifacts are related to each other.
In this thesis, the newly written scanner, which crawls the system autonomously for information, will be used for the detection and cataloging of cryptographic assets. An evaluation of various open-source scanners was conducted, regarding possible implementation in this project. Osquery and YARA were promising candidates, regarding how they could be used for the challenge at hand.
As a solution, the Python-based command line tool named Crypto-Scanner based on YARA rules was implemented during this thesis. The output of the scanner must be converted into a CBOM standard in CycloneDX format. Therefore, a Python-based command line tool called CBOM generator was developed using the CycloneDX Python
library.
Furthermore, Dependency Track, an existing methodology for visualizing SBOM standards, was extended so that CBOM formats, which are extended SBOM formats, can be utilized for the visualization of the existing cryptographic inventory.
Dependency Track is an open-source tool that has been used in trials for similar challenges and has proven to be a great asset for the analysis of the SBOM and also the CBOM standard.
The result of our student research work demonstrates the potential of static scanners in the area of cryptographic discovery. With this work, a basis for further research in this area has been created, which aids in the first step toward the transition to quantum-safe algorithms. This result demonstrates possible ways to identify implemented and used cryptographic algorithms and creates a standardized CBOM format from the identified cryptographic assets. This CBOM format can be uploaded in the extended Dependency Track to visualize the location of the algorithm implementation.
In further research, there are possibilities to improve and expand the scanner results achieved today. For this purpose, the scanner can be extended for other operating systems (currently: Linux). Another possibility would be to combine the written crypto scanner with the CBOM generator, which has also been newly implemented, to simplify CBOM creation even further. To improve performance, there is also the possibility of rewriting the scanner for multiprocessing
FlatFeeStack as a Decentralized Autonomous Organization
No full textThe FlatFeeStack website allows developers to easily and transparently support open-source projects by providing a flat fee of $120 per year. FlatFeeStack gives open-source contributors funds based on their contribution to the project, calculated using metrics like contributed lines of code. The platform accepts payment by credit card and makes payouts using cryptocurrencies.
The community should operate and further develop FlatFeeStack, just like open-source software. For handling payments, FlatFeeStack requires a legal entity. The concept of an association under Swiss law can fulfill these two demands. Which allows for the realization of a collaborative cooperation that can act as a legal entity. Modeling the association on the blockchain ensures a clean democratic process and enables cooperation beyond Swiss borders. Based on the concept of a decentralized autonomous organisation (DAO), smart contracts were written so that all legal requirements of a Swiss association are met and thus, all activities of an association can be performed via the blockchain. Additionally, a frontend is provided for simple interaction with the smart contracts. This frontend was integrated into the existing frontend of FlatFeeStack. Statutes have been developed that are specifically adapted to the concepts of the DAO and the implementation of smart contracts. These are required for the association to be able to act.
With all artifacts from this project, the "FlatFeeStack Association" is ready to be founded
Analyse und Optimierung des Aktionsprozesses des Warenwirtschaftssystems eines Schweizer Grossverteilers
No full textIn einem Einzelhandelsunternehmen ist die Warenwirtschaft eine komplexe Tätigkeit. Für jedes Produkt muss die richtige Menge immer verfügbar sein. Tausende von Produkten müssen gleichzeitig verwaltet werden, weshalb es selbstverständlich ist, dass die Warenwirtschaft effizient und automatisiert sein muss.
Im Jahr 2013 hat die Firma Ergon Informatik AG in Zusammenarbeit mit Coop eine erste Version der Web-App für die Warenbewirtschaftung mit dem Namen ERGO veröffentlicht. Schnelligkeit und Benutzerfreundlichkeit, kombiniert mit einer modernen Architektur, waren die wichtigsten Anforderungen für Coop.
ERGO unterstützt die Coop-Mitarbeiterinnen und -Mitarbeiter bei ihrer täglichen Arbeit und sorgt dafür, dass die Bestandsinformationen in allen Filialen immer aktuell sind. Gute Umsätze hängen von der optimalen Funktionsweise von ERGO ab und viele Prozesse bei Coop sind darauf abgestimmt. Mitarbeitende werden jährlich geschult und ein internes Innovations- und Entwicklungsteam am Coop-Hauptsitz in Basel kümmert sich um die Pflege der Software und veröffentlicht regelmässig Releases.
Mehrere Jahre nach seiner Veröffentlichung entstand bei Coop jedoch der Wunsch, innovative Lösungen zu entwickeln und auf die neuen Bedürfnisse der Mitarbeiter und Mitarbeiterinnen zu reagieren. Es ist schwierig und zeitaufwändig, regelmässig Feedback von Mitarbeitern und Mitarbeiterinnen von Coop einzuholen. Heute besteht die Herausforderung darin, die User von ERGO zu beobachten, zu verstehen und Verständnis für ihre Schwierigkeiten aufzubringen, um eine Lösung zu entwickeln, die es ihnen ermöglicht, die ERGO Web-App optimal zu nutzen.
Genau hier setzt das Projekt «Analyse und Optimierung des Aktionsprozesses des Warenwirtschaftssystems eines Schweizer Grossverteilers» an.
Die Untersuchungen konzentrieren sich auf einen der am häufigsten verwendeten Prozesse in der ERGO Web-App: den Aktionsprozess. Die entwickelten Lösungen ermöglichen es Coop, die Arbeit der Mitarbeiter bzw. Mitarbeiterinnen in Verkaufsstellen besser zu unterstützen
Different Approaches to control GPIO Pins of the Raspberry Pi using Haskell
No full textThe functional programming language Haskell allows the writing of elegant code and reduces the likelihood of runtime errors. This advantage can also be used when programming the General Purpose Input/Output (GPIO) pins on the Raspberry Pi. This paper presents three approaches in Haskell for controlling GPIO pins. The first method uses the GPIO sysfs interface, the second sends commands via sockets to the Python library gpiozero, and the third uses the Foreign Function Interface (FFI) to call functions from the C library bcm2835. The approaches described have different strengths and weaknesses, and it depends on the use case which approach is most suitable
Open Source Intelligence Training in Hacking-Lab (BA)
No full textIn cyber security the topic of Open-source intelligence (OSINT) plays a major role. With OSINT security defender and researcher may find valuable information about cyber crime and attackers. OSINT helps to understand the effects of sharing public information. OSINT is not yet part of the curriculum at OST. An e-learning platform called Hacking-Lab already exists and is used at OST. In Hacking-Lab, students can apply what they have learned in the lecture in a controlled environment in the form of practical hands-on exercises.
The goal of this thesis was to create ten OSINT challenges in the Hacking-Lab for students to solve and practice. In every OSINT challenge, students are given a set of tasks and summative assessment questions. The students are guided through the proposed steps in order to answer the posed questions in form of a write-up.
Each OSINT challenge is framed by a story to make them more engaging. These stories were chosen in a way that many different OSINT techniques are applicable and can be practiced by the students. In OSINT there is not only one way to find the correct answer hence the students are also encouraged to find their own way to reach the expected solution. To guarantee a high quality of the challenges, multiple quality assurance tests were conducted with students and colleagues working in IT. The results of these quality tests are an indicator whether the goal was reached.
As a result of this work, the goal of creating ten OSINT challenges in Hacking-Lab was achieved. These challenges provide some insight into the topic of OSINT without getting lost in details and technicalities.
This project provides a foundation which a lecturer can build upon by creating a lecture on OSINT. This lecture could be integrated in a course on cyber security. Social media was purposely neglected in this project because social media is difficult to maintain and make future-proof, which makes it incompatible with the project's requirements. Therefore, it could also be a future project to expand upon these challenges with a focus on social media as it is an indispensable part of OSINT
The Impact of Aggregated Leaks on Privacy (SA)
No full textPrivacy is in a constant battle with economic, scientific and security interests. In our modern world enormous amounts of personal and identifying information about us is collected and analyzed. While significant resources are allocated to regulate this industry, criminals are not bound by such limitations.
The exploitation of illegally obtained information is already estimated to be a billion dollar industry and its growth has not plateaued yet. In order to be ready for the ever increasing capabilities of cyber criminals it is crucial to examine the challenges that await.
This paper studies network effects emerging from the aggregation and linkage of illegally obtainable personally identifiable information. We achieve this by analyzing a synthetic dataset which represents over 600 distinct data leaks that resulted in the exposure of over 12 billion records.
We show the effectiveness of mitigation strategies such as using different email addresses and introduce User-Initiated Differential Privacy as an effective defense, reducing the risk of link discovery by up to 50%
Crypto Agility: Transition to post-quantum safe algorithms for secure key exchange and certificate generation
No full textThe quantum era is arriving, which poses a significant threat to traditional encryption and public-key cryptography standards. Due to this development, many cryptographic algorithms are broken, as the underlying mathematical problems could be solved by future quantum computers within a short amount of time. With the appearance of quantum computers, cryptographic algorithms have also evolved. New quantum-safe algorithms have been standardized in the past year, but only a few applications already use them. To ensure a secure environment this will need to change.
Faced with these challenges and the rapid improvements in the area of quantum computing, the global cybersecurity landscape plunges into a highly precarious state. It is therefore important to test and deploy the new cryptographic algorithms today.
This bachelor thesis aims to demonstrate how two recently standardized post-quantum secure algorithms can be used by testing their compatibility with a Hardware Security Module (HSM) in a controlled environment. To demonstrate how these could be implemented in a quantum-safe manner at a later stage, two different use cases will be realized. The algorithms used are CRYSTALS-Kyber and CRYSTALS-Dilithium.
First, two Proof of Concepts (PoCs) were written, that demonstrate the compatibility between the HSM architecture and the two CRYSTALS algorithms. Afterward work on the two use cases began in parallel. The use case: Bring Your Own Key (BYOK) demonstrates how locally generated keys can be imported into the HSM in a quantum-safe manner. In this demonstration, the Key Encapsulation Mechanism (KEM) CRYSTALS-Kyber is used to generate a
shared secret so that the client application can communicate to the HSM using AES.
The second use case focuses on a Public Key Infrastructure (PKI) based on a post-quantum secure infrastructure. The HSM is used as a key store to secure the identity of the Root Certificate Authority (CA), which acts as the root of trust. This ensures that keys are never exposed in clear text in memory. Furthermore, the quantum-safe signature scheme CRYSTALS-Dilithium is used to sign certificates which further increases security.,
Further research and development work can be carried out in the future based on the insights gained through the implementation of these use cases. In addition, the implementation facilitates the replication of a similar use case for enterprise architecture and the transition from today’s legacy algorithms to the new secure post-quantum algorithms with increased efficiency. Both the BYOK and PKI implementations could also still be extended to provide more functionality, and higher security standards based on the algorithm versions or protocol used. The PKI implementation could also be further improved by using a quantum-safe variant of Transfer Layer Security (TLS)
Link Management Tool with Internet Archive Integration
No full textHyperlinks, also known as URLs or links, are the foundation of the Internet, they allow seamless navigation between online resources with a single click.
They make the Web a web.
However, the content behind a link can change, move or be deleted without notice.
This, combined with the often short-lived nature of content on the Internet, can lead to problematic situations.
The phenomena of disappearing content and unannounced changes are known as link rot and content drift respectively.
This thesis addresses the challenges of both link rot and content drift.
We develop a command-line tool called Link Management Tool (LMT) to provide an automated approach to detecting and fixing broken links and drifted content.
Additionally, we extend an existing free and open source link-checking tool called lychee.
In both implementations, we integrate the Wayback Machine, a digital web archive, to provide access to archived snapshots of websites from the past
Matching (engineering) problems to competence profiles
No full textThe company PATRIZ AG is establishing a new platform for crowd-engineering.
A base frame with a project and user management system has been setup by a preceding bachelor thesis. The goal of this term paper is to extend the platforms functionality with a competence ecosystem, a feedback option and a matching logic. The competence system applies to users and projects, meaning both can possess competences. Concerning feedback, users should be able to voice their opinions to PATRIZ AG so the platform can improve. The matching logic is the connecting link between projects and users, which generates matches based on their competences.
First, functional requirements are elaborated and specified. For the implementation of the competence system a data model has to be created to support a tree data structure and CRUDoperations. The tree will be used to store connections between competences and their respective categories. To manage the competence system an admin interface will be implemented to enable CRUDoperations and to manage the tree. Furthermore, a project and user front-end for the competences will be implemented. For the feedback system, the data model has to be extended to support CRUDoperations for the feedback entity. User can submit feedback via the front-end and admins can view all feedbacks via an admin page. The matching logic uses selected competences for a project and maps those onto user competences to show potential partners.
The users now can add competences to their profiles. Customers now can assign needed competences to their projects. This process is directly integrated in the existing process of the project creation via the project creation wizard. This enables a matching which now allows to see potential partners for a project based on the competences. Furthermore, an easy handling of those competences and categories is possible with the introduction of an admin and the corresponding interface. The whole feedback process has been realized as well, allowing a fast and organic exchange between the users and PATRIZ AG
Reverse Engineering Labs
No full textAs it stands today there is no module or learning unit at the OST to teach the concept of reverse engineering software.
Because reverse engineering is an important topic in the cyber security space, the goal of this SA is to create challenges in the topic of reverse engineering. These challenges will or can be used by lecturers of the OST in Rapperswil-Jona to teach the basics to the students.
To achieve this goal we created challenges in ascending difficulty. At first the students will get information about the software they will use and the overall strategies of reverse engineering. After that they learn about some more advanced concepts. The focus here is creating the challenges in a manner, which should teach the basics in a easy to understand fashion. These challenges will be hosted on the Hacking-Lab platform. To ensure the quality of our challenges we did organise testing participants, who are cyber security students in their fifth semester as well. These tests should be the indicator if the goal was reached.
The primary goal was to create a total of up to 10 challenges in this SA. This goal was achieved with a total of 11 created challenges. The testing was also successfully carried out and the feedback overall positive. If there was some common feedback, we adjusted the corresponding challenge based on it.
This project was overall very successful, but there has also to be said that the topic of reverse engineering is huge and only a very small portion of it was covered in these challenges. There are many more techniques and tools which have not been covered yet and this could be a future work