arXiv subjects

Gorka Guardiola Múzquiz

Publications and source records attributed to Gorka Guardiola Múzquiz.

6 recordsLinked to original sources

arXiv2026

Auditable and Transparent Fully Authenticated Disk Encryption via USB Storage Interposition

Full Disk Encryption (FDE) has become increasingly important in the last decades due to the evident confidentiality concerns. In most systems, encryption is provided by an operating system driver, through which the user can transparently access the encrypted disk after supplying the required keys (or the credentials from which those keys are derived). In this work, we explore an alternative approach: the use of an intermediate USB device placed between the host system and the external hard disk, where the encrypted data are stored. Although there are existing devices that follow this inline approach (such as RAID controllers and USB enclosures with built-in encryption), we explore the use of a general-purpose single-board computer running Linux with USB On-The-Go support (e.g. a Raspberry Pi), to provide FADE (Fully Authenticated Disk Encryption). Our system, named CC (Cryptographic Companion), performs the cryptographic operations (encryption/decryption and authentication), providing a standard USB mass-storage interface to the host (which is entirely unaware of the presence of encryption) while relying on the external USB hard disk to store the corresponding encrypted blocks. Our design provides several key advantages: flexibility, low cost, transparency, the use of generic hardware and free and open-source software, adaptability to emerging cryptographic schemes, and mitigations against malicious disk firmware. This paper presents the design and implementation of the CC and an experimental evaluation of our current research prototype, which indicates that it is sufficiently efficient for most common use cases.

cs.CR↗

arXiv2025

$π_B$ in asymetric Minkowski normed spaces

We extend the classical results of Stanislaw Golab, on the values of pi in arbitrary normed planes, to asymmetric norms where the unit ball has one axis of symmetry. First, we characterize the values of $π_B$ for different families of polygons as unit ball B. Then we prove that $π_B \ge 3$, and can take all possible values and is not bounded in such spaces.

math.GM↗

arXiv2025

The Reverse File System: Towards open cost-effective secure WORM storage devices for logging

Write Once Read Many (WORM) properties for storage devices are desirable to ensure data immutability for applications such as secure logging, regulatory compliance, archival storage, and other types of backup systems. WORM devices guarantee that data, once written, cannot be altered or deleted. However, implementing secure and compatible WORM storage remains a challenge. Traditional solutions often rely on specialized hardware, which is either costly, closed, or inaccessible to the general public. Distributed approaches, while promising, introduce additional risks such as denial-of-service vulnerabilities and operational complexity. We introduce Socarrat, a novel, cost-effective, and local WORM storage solution that leverages a simple external USB device (specifically, a single-board computer running Linux with USB On-The-Go support). The resulting device can be connected via USB, appearing as an ordinary external disk formatted with an ext4 or exFAT file system, without requiring any specialized software or drivers. By isolating the WORM enforcement mechanism in a dedicated USB hardware module, Socarrat significantly reduces the attack surface and ensures that even privileged attackers cannot modify or erase stored data. In addition to the WORM capacity, the system is designed to be tamper-evident, becoming resilient against advanced attacks. This work describes a novel approach, the Reverse File System, based on inferring the file system operations occurring at higher layers in the host computer where Socarrat is mounted. The paper also describes the current Socarrat prototype, implemented in Go and available as free/libre software. Finally, it provides a complete evaluation of the logging performance on different single-board computers.

cs.CR↗

arXiv2025

User-space library rootkits revisited: Are user-space detection mechanisms futile?

The kind of malware designed to conceal malicious system resources (e.g. processes, network connections, files, etc.) is commonly referred to as a rootkit. This kind of malware represents a significant threat in contemporany systems. Despite the existence of kernel-space rootkits (i.e. rootkits that infect the operating system kernel), user-space rootkits (i.e. rootkits that infect the user-space operating system tools, commands and libraries) continue to pose a significant danger. However, kernel-space rootkits attract all the attention, implicitly assuming that user-space rootkits (malware that is still in existence) are easily detectable by well-known user-space tools that look for anomalies. The primary objective of this work is to answer the following question: Is detecting user-space rootkits with user-space tools futile? Contrary to the prevailing view that considers it effective, we argue that the detection of user-space rootkits cannot be done in user-space at all. Moreover, the detection results must be communicated to the user with extreme caution. To support this claim, we conducted different experiments focusing on process concealing in Linux systems. In these experiments, we evade the detection mechanisms widely accepted as the standard solution for this type of user-space malware, bypassing the most popular open source anti-rootkit tool for process hiding. This manuscript describes the classical approach to build user-space library rootkits, the traditional detection mechanisms, and different evasion techniques (it also includes understandable code snippets and examples). In addition, it offers some guidelines to implement new detection tools and improve the existing ones to the extent possible.

cs.CR↗

arXiv2024

Implementing a Robot Intrusion Prevention System (RIPS) for ROS 2

It is imperative to develop an intrusion prevention system (IPS), specifically designed for autonomous robotic systems. This is due to the unique nature of these cyber-physical systems (CPS), which are not merely typical distributed systems. These systems employ their own systems software (i.e. robotic middleware and frameworks) and execute distinct components to facilitate interaction with various sensors and actuators, and other robotic components (e.g. cognitive subsystems). Furthermore, as cyber-physical systems, they engage in interactions with humans and their physical environment, as exemplified by social robots. These interactions can potentially lead to serious consequences, including physical damage. In response to this need, we have designed and implemented RIPS, an intrusion prevention system tailored for robotic applications based on ROS 2, the framework that has established itself as the de facto standard for developing robotic applications. This manuscript provides a comprehensive exposition of the issue, the security aspects of ROS 2 applications, and the key points of the threat model we created for our robotic environment. It also describes the architecture and the implementation of our initial research prototype and a language specifically designed for defining detection and prevention rules for diverse, real-world robotic scenarios. Moreover, the manuscript provides a comprehensive evaluation of the approach, that includes a set of experiments with a real social robot executing a well known testbed used in international robotic competitions.

cs.RO↗

arXiv2024

Towards a Robotic Intrusion Prevention System: Combining Security and Safety in Cognitive Social Robots

Social Robots need to be safe and reliable to share their space with humans. This paper reports on the first results of a research project that aims to create more safe and reliable, intelligent autonomous robots by investigating the implications and interactions between cybersecurity and safety. We propose creating a robotic intrusion prevention system (RIPS) that follows a novel approach to detect and mitigate intrusions in cognitive social robot systems and other cyber-physical systems. The RIPS detects threats at the robotic communication level and enables mitigation of the cyber-physical threats by using System Modes to define what part of the robotic system reduces or limits its functionality while the system is compromised. We demonstrate the validity of our approach by applying it to a cognitive architecture running in a real social robot that preserves the privacy and safety of humans while facing several cyber attack situations.

cs.RO↗