Elisa Bertino Haya Shulman Michael Waidner (Eds.) 3 7 Computer Security – 9 2 1 S ESORICS 2021 C N L 26th European Symposium on Research in Computer Security Darmstadt, Germany, October 4–8, 2021, Proceedings, Part II Lecture Notes in Computer Science 12973 Founding Editors Gerhard Goos Karlsruhe Institute of Technology, Karlsruhe, Germany Juris Hartmanis Cornell University, Ithaca, NY, USA Editorial Board Members Elisa Bertino Purdue University, West Lafayette, IN, USA Wen Gao Peking University, Beijing, China Bernhard Steffen TU Dortmund University, Dortmund, Germany Gerhard Woeginger RWTH Aachen, Aachen, Germany Moti Yung Columbia University, New York, NY, USA More information about this subseries at http://www.springer.com/series/7410 Elisa Bertino Haya Shulman (cid:129) (cid:129) Michael Waidner (Eds.) – Computer Security ESORICS 2021 26th European Symposium on Research in Computer Security – Darmstadt, Germany, October 4 8, 2021 Proceedings, Part II 123 Editors Elisa Bertino Haya Shulman PurdueUniversity National Research Center for Applied West Lafayette, IN, USA Cybersecurity ATHENE Fraunhofer Institute for Secure Information Michael Waidner Technology SIT National Research Center for Applied Darmstadt, Germany Cybersecurity ATHENE Technische UniversitätDarmstadt, Fraunhofer Institute for Secure Information Technology SIT Darmstadt, Germany ISSN 0302-9743 ISSN 1611-3349 (electronic) Lecture Notesin Computer Science ISBN 978-3-030-88427-7 ISBN978-3-030-88428-4 (eBook) https://doi.org/10.1007/978-3-030-88428-4 LNCSSublibrary:SL4–SecurityandCryptology ©SpringerNatureSwitzerlandAG2021 Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartofthe material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilarmethodologynow knownorhereafterdeveloped. Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant protectivelawsandregulationsandthereforefreeforgeneraluse. Thepublisher,theauthorsandtheeditorsaresafetoassumethattheadviceandinformationinthisbookare believedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsortheeditors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictionalclaimsin publishedmapsandinstitutionalaffiliations. ThisSpringerimprintispublishedbytheregisteredcompanySpringerNatureSwitzerlandAG Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland Preface The 26th European Symposium on Research in Computer Security (ESORICS 2021) washeldtogetherwiththeaffiliatedworkshopsduringtheweekofOctober4–8,2021. Due to the COVID-19 pandemic the conference and the workshops took place digi- tally, hosted by the Fraunhofer Institute for Secure Information Technology (Fraun- hofer SIT),within theNationalResearch Center for AppliedCybersecurityATHENE, Germany. This year’s ESORICS introduced for the first time in the ESORICS conference series two review cycles: a winter cycle and a spring cycle. This follows the general trendsforconferencesofprovidingmultiplesubmissiondeadlinesandisnotonlymore convenientfortheauthorsbutalsoallowsrevisionandresubmissionforpapers.Inthe case of ESORICS, papers submitted in the winter cycle could be recommended for revision and resubmission to the spring cycle. In response to the call for papers 351 papers were submitted to the conference. These papers were peer reviewed and subsequently discussed based on their novelty, quality,andcontributionbythemembersoftheProgramCommittee.Thesubmissions weresingleblind,andallthemembersoftheProgramCommitteehadaccesstoallthe submissionsandtheirreviewsatalltimestofacilitatediscussionsamongthemembers. The submission of the papers and the review process were carried out using the Easychair platform. Based on the reviews and the discussion 71 papers were selected for presentation at the conference. As a result ESORICS had an interesting program covering timely and interesting security and privacy topics in theory, systems, net- works, and applications. ThepapersthatwereselectedforpresentationatESORICS2021werepublishedin a two volume set of proceedings: LNCS 12972 and LNCS 12973. ESORICS is a flagship European security conference. The aim of ESORICS is to advance the research in computer security and privacy by establishing a European forum, bringing together researchers in these areas, and promoting the exchange of ideas with the developers, standardization bodies, and policy makers and by encour- aging links with researchers in related fields. Wewerehonouredtohavefourkeynotespeakers:ShafiGoldwasser,ChristofPaar, Nicolas Papernot, and Yuval Yarom. Their talks provided interesting insights and researchdirectionsinimportantresearchareas.Theprogramwascomplementedbysix tutorials given by Anna Cinzia Squicciarini, Yossi Oren, Michael Schwarz, Avishai Wool, and Daphne Yao. For tutorials, ESORICS introduced a novel organization, in that tutorials weregiven inadvance with respecttotheconferencedates,withthefirst tutorial given on June 30, 2021, and the last one on September 8, 2021. Tutorial presentationswererecordedandareavailableonline.Thisarrangementtakesadvantage of today’s availability of content dissemination platforms and allows researchers to access the tutorial contents at their own pace. vi Preface TheProgramCommitteeconsistedof185membersacross31countries.Therewere submissions from a total of 1150 authors across 41 countries, with 25 countries rep- resented among the accepted papers. We would like to thank the members of the Program Committee and the external referees for their hard work in supporting the review process as well as everyone who supported the organization of ESORICS. We are grateful to the workshops chairs, Adrian Perrig and David Hay, and all of the workshop co-chairs, the poster chair, Simone Fischer-Hübner, and the ESORICS SteeringCommittee.WearealsogratefultoHuaweiandIBMResearch–Haifa,Israel, forsupportingtheorganizationofESORICS2021.Finally,wewouldliketothankthe authors for submitting their papers to ESORICS 2021. We hope that the proceedings will promote the research and facilitate future work in the field of security. September 2021 Elisa Bertino Haya Shulman Michael Waidner Organization General Chair Michael Waidner National Research Center for Applied Cybersecurity ATHENE/Technische Universität Darmstadt/Fraunhofer SIT, Germany Program Committee Chairs Elisa Bertino Purdue University, USA Haya Shulman National Research Center for Applied Cybersecurity ATHENE/Fraunhofer SIT, Germany Steering Committee Joachim Biskup Véronique Cortier Frédéric Cuppens Sabrina De Capitani di Vimercati Joaquin Garcia-Alfaro Dieter Gollmann Sokratis Katsikas Mirosław Kutyłowski Javier Lopez Jean-Jacques Quisquater Peter RYAN Pierangela Samarati Einar Arthur Snekkenes Michael Waidner Program Committee Ruba Abu-Salma International Computer Science Institute / University of California, Berkeley, USA Yehuda Afek Tel Aviv University, Israel Mitsuaki Akiyama NTT, Japan Cristina Alcaraz UMA, Spain Mark Allman International Computer Science Institute, USA Vijay Atluri Rutgers University, USA Erman Ayday Case Western Reserve University, USA Guangdong Bai University of Queensland, Australia Lejla Batina Radboud University, The Netherlands viii Organization Steven M. Bellovin Columbia University, USA Antonio Bianchi Purdue University, USA Marina Blanton University at Buffalo, USA Carlo Blundo Università degli Studi di Salerno, Italy Tamara Bonaci Northeastern University, USA Nora Boulahia Cuppens Polytechnique Montréal, Canada Alejandro Cabrera Aldaya Tampere University of Technology, Finland Lorenzo Cavallaro King’s College London, UK Berkay Celik Purdue University, USA Aldar C.-F. Chan BIS Innovation Hub Hong Kong Centre, Hong Kong Liqun Chen University of Surrey, UK Rongmao Chen National University of Defense Technology, China Xiaofeng Chen Xidian University, China Yu Chen School of Cyber Science and Technology, Shandong University, China Sherman Chow Chinese University of Hong Kong, Hong Kong Mauro Conti University of Padua, Italy Scott Coull FireEye, Inc., USA Bruno Crispo University of Trento, Italy Michel Cukier University of Maryland, USA Frédéric Cuppens Polytechnique Montréal, Canada George Danezis University College London, UK Sanchari Das University of Denver, USA Sabrina De Capitani di Università degli Studi di Milano, Italy Vimercati Hervé Debar Télécom SudParis, France Roberto Di Pietro Hamad Bin Khalifa University, Qatar Wenrui Diao Shandong University, China Tassos Dimitriou Computer Technology Institute, Greece/Kuwait University, Kuwait Shlomi Dolev Ben-Gurion University, Israel Josep Domingo-Ferrer Universitat Rovira i Virgili, Spain Changyu Dong Newcastle University, UK Haixin Duan Tsinghua University, China François Dupressoir University of Surrey, UK Pardis Emami Naeini Carnegie Mellon University, USA Paulo Esteves-Veríssimo Université du Luxembourg, Luxembourg Jose-Luis Ferrer-Gomila University of the Balearic Islands, Spain Sara Foresti Università degli Studi di Milano, Italy Michael Franz University of California, Irvine, USA David Galindo University of Birmingham, UK Debin Gao Singapore Management University, Singapore Joaquin Garcia-Alfaro Telecom SudParis, France Siddharth Garg New York University, USA Thanassis Giannetsos Technical University of Denmark, Denmark Dieter Gollmann Hamburg University of Technology, Germany Organization ix Neil Gong Duke University, USA Stefanos Gritzalis University of Piraeus, Greece Daniel Gruss Graz University of Technology, Austria Zhongshu Gu IBM T.J. Watson Research Center, USA Thomas Haines Norwegian University of Science and Technology, Norway Feng Hao University of Warwick, UK Juan Hernández-Serrano Universitat Politècnica de Catalunya, Spain Xinyi Huang Fujian Normal University, China Syed Hussain Pennsylvania State University, USA Sotiris Ioannidis Technical University of Crete, Greece Tibor Jager Bergische Universität Wuppertal, Germany Philipp Jeitner Fraunhofer SIT, Germany Yuseok Jeon Ulsan National Institute of Science and Technology, South Korea Shouling Ji Zhejiang University, China Ghassan Karame NEC Laboratories Europe, Germany Sokratis Katsikas Norwegian University of Science and Technology, Norway Aggelos Kiayias University of Edinburgh, UK Hyoungshick Kim Sungkyunkwan University, South Korea Ryan Ko University of Queensland, Australia Juliane Krämer TU Darmstadt, Germany Steve Kremer Inria France Marina Krotofil Honeywell Industrial Cyber Security Lab, USA Christopher Kruegel University of California, Santa Barbara, USA Yonghwi Kwon University of Virginia, USA Costas Lambrinoudakis University of Piraeus, Greece Shir Landau-Feibish The Open University of Israel, Israel Kyu Hyung Lee University of Georgia, USA Corrado Leita VMware, UK Shujun Li University of Kent, UK Zitao Li Purdue University, USA Kaitai Liang Delft University of Technology, The Netherlands Xiaojing Liao Indiana University Bloomington, USA Hoon Wei Lim Trustwave, Singapore Zhiqiang Lin Ohio State University, USA Xiangyu Liu Alibaba Group, China Joseph Liu Monash University, Australia Rongxing Lu University of New Brunswick, Canada Xiapu Luo Hong Kong Polytechnic University, Hong Kong Shiqing Ma Rutgers University, USA Leandros Maglaras De Montfort University, UK Fabio Martinelli IIT-CNR, Italy Sjouke Mauw Université du Luxembourg, Luxembourg Weizhi Meng Technical University of Denmark, Denmark