论文标题
基于块的移动PDE系统不安全 - 实验攻击
The Block-based Mobile PDE Systems Are Not Secure -- Experimental Attacks
论文作者
论文摘要
如今，移动设备已广泛用于存储和处理敏感数据。为了确保敏感数据的机密性，全磁盘加密（FDE）通常集成在Android和iOS等主流移动操作系统中。但是，FDE无法防御强制性攻击，在这种攻击中，对手可以迫使设备所有者披露解密密钥。为了打击强制攻击，应利用合理的否认加密（PDE）来合理地否认敏感数据的存在。但是，大多数现有用于移动设备的PDE系统都在块层部署，并遭受可否认的折衷。 在观察到文献中没有任何现有作品在实验上证明了上述妥协，我们的作品通过实验确认了块层移动PDE系统的可否认性，从而弥合了这一差距。我们已经建立了一个移动设备测试台，该设备由主机计算设备和闪存存储设备组成。此外，我们在测试台的块和执行磁盘取证的块层中同时部署了隐藏的卷PDE和隐形文件系统，以评估RAW NAND FLASH上的潜在妥协。我们的实验结果证实，对手确实可以通过在实践中访问原始NAND闪光灯来妥协块层PDE系统。在现实世界中进行此类攻击时，我们还讨论了潜在的问题。
Nowadays, mobile devices have been used broadly to store and process sensitive data. To ensure confidentiality of the sensitive data, Full Disk Encryption (FDE) is often integrated in mainstream mobile operating systems like Android and iOS. FDE however cannot defend against coercive attacks in which the adversary can force the device owner to disclose the decryption key. To combat the coercive attacks, Plausibly Deniable Encryption (PDE) is leveraged to plausibly deny the very existence of sensitive data. However, most of the existing PDE systems for mobile devices are deployed at the block layer and suffer from deniability compromises. Having observed that none of existing works in the literature have experimentally demonstrated the aforementioned compromises, our work bridges this gap by experimentally confirming the deniability compromises of the block-layer mobile PDE systems. We have built a mobile device testbed, which consists of a host computing device and a flash storage device. Additionally, we have deployed both the hidden volume PDE and the steganographic file system at the block layer of the testbed and performed disk forensics to assess potential compromises on the raw NAND flash. Our experimental results confirm it is indeed possible for the adversary to compromise the block-layer PDE systems by accessing the raw NAND flash in practice. We also discuss potential issues when performing such attacks in real world.
