Moritz Finke

Chair of Software Engineering (Informatik II)
Department of Computer Science

University of Würzburg
Am Hubland, 97074 Würzburg

E-Mail: moritz.finke@uni-wuerzburg.de (GPG: 865F9BFCDBCA0BE5)

Teaching

SS 2018/19:

Preparatory Course: Introduction to Programming

Occupation

Since Nov 2021	Research Assistant at the Chair of Software-Engineering, University of Würzburg
Sep 2020 - Jun 2021	Research Assistant at the Chair of Software-Engineering, University of Würzburg
Oct 2018 - Dec 2018	Student Research Assistant at the Chair of Artificial Intelligence and Knowledge Systems, University of Würzburg

Research interests

IoT Security
Behavioral Biometrics & Liveness Detection
Online Fraud Detection

Publications

2024[ to top ]

SPOQchain: Platform for Secure, Scalable, and Privacy-preserving Supply Chain Tracing and Counterfeit Protection. Finke, Moritz;. Master Thesis, 2024, Juni.
- [ Abstract ]
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
Product counterfeiting continues to cause damage for the global economy and poses consid- erable safety risks for consumers. The need for automated product verification systems is emphasized exemplarily by Customer-to-Customer (C2C) platforms that deal with prod- ucts of unknown origin and currently require significant additional work to verify the authenticity of incoming goods. To address the lack of trustworthy central instances and limited traceability within supply chains, several systems for product tracing have been proposed in recent years that employ blockchain technology. In some approaches, product identification is additionally secured through Physical Unclonable Functions (PUFs) that cannot be copied by counterfeiters. While the use of blockchain offers increased trust, it is also associated with considerable performance losses and increased transparency, limiting global deployments and risking the privacy of its users users. This work presents SPOQchain, a novel platform for the management of product lifecycles and counterfeit detection. With SPOQchain, a scalable, more efficient use of blockchains is achieved through the intelligent batching of individual products. By covering the entire lifecycle, SPOQchain can not only be used for tracing within supply chains but also for securing C2C relations. Users retain their privacy and decide autonomously over passing on product data. SPOQchain allows the physical verification by means of any desired PUF and incorporates current advancements that enable more efficient verification using Zero Knowledge (ZK) proofs. With this work, the architecture of SPOQchain is specified and compared with existing approaches. Furthermore, different operational modes of SPOQchain are discussed and its implementation as a software library, decentralized client, and backend system is de- scribed. Finally, the system’s security aspects are discussed in regard to potential attacks. Furthermore, the impact on user privacy and the performance of the utilized blockchain are evaluated. It is shown that SPOQchain is a beneficial solution for supply chain par- ticipants, end customers, etc., and that it enables insights into product lifecycles with minimal effort.

@mastersthesis{finke2024spoqchain, abstract = {Product counterfeiting continues to cause damage for the global economy and poses consid- erable safety risks for consumers. The need for automated product verification systems is emphasized exemplarily by Customer-to-Customer (C2C) platforms that deal with prod- ucts of unknown origin and currently require significant additional work to verify the authenticity of incoming goods. To address the lack of trustworthy central instances and limited traceability within supply chains, several systems for product tracing have been proposed in recent years that employ blockchain technology. In some approaches, product identification is additionally secured through Physical Unclonable Functions (PUFs) that cannot be copied by counterfeiters. While the use of blockchain offers increased trust, it is also associated with considerable performance losses and increased transparency, limiting global deployments and risking the privacy of its users users. This work presents SPOQchain, a novel platform for the management of product lifecycles and counterfeit detection. With SPOQchain, a scalable, more efficient use of blockchains is achieved through the intelligent batching of individual products. By covering the entire lifecycle, SPOQchain can not only be used for tracing within supply chains but also for securing C2C relations. Users retain their privacy and decide autonomously over passing on product data. SPOQchain allows the physical verification by means of any desired PUF and incorporates current advancements that enable more efficient verification using Zero Knowledge (ZK) proofs. With this work, the architecture of SPOQchain is specified and compared with existing approaches. Furthermore, different operational modes of SPOQchain are discussed and its implementation as a software library, decentralized client, and backend system is de- scribed. Finally, the system’s security aspects are discussed in regard to potential attacks. Furthermore, the impact on user privacy and the performance of the utilized blockchain are evaluated. It is shown that SPOQchain is a beneficial solution for supply chain par- ticipants, end customers, etc., and that it enables insights into product lifecycles with minimal effort.}, author = {Finke, Moritz;}, keywords = {sssgroup}, month = {06}, publisher = {Master Thesis}, school = {University of Würzburg}, title = {SPOQchain: Platform for Secure, Scalable, and Privacy-preserving Supply Chain Tracing and Counterfeit Protection}, year = 2024 }
SPOQchain: Platform for Secure, Scalable, and Privacy-Preserving Supply Chain Tracing and Counterfeit Protection. Finke, Moritz; Dmitrienko, Alexandra; Stang, Jasper. In ArXiv | arXiv:2408.17049. 2024.
- [ Abstract ]
- [ BibTeX ]
- [ URL ]
- [ BibSonomy-Post ]
Product lifecycle tracing is increasingly in the focus of regulators and producers, as shown with the initiative of the Digital Product Pass. Likewise, new methods of counterfeit detection are developed that are, e.g., based on Physical Unclonable Functions (PUFs). In order to ensure trust and integrity of product lifecycle data, multiple existing supply chain tracing systems are built on blockchain technology. However, only few solutions employ secure identifiers such as PUFs. Furthermore, existing systems that publish the data of individual products, in part fully transparently, have a detrimental impact on scalability and the privacy of users. This work proposes SPOQchain, a novel blockchain-based platform that provides comprehensive lifecycle traceability and originality verification while ensuring high efficiency and user privacy. The improved efficiency is achieved by a sophisticated batching mechanism that removes lifecycle redundancies. In addition to the successful evaluation of SPOQchain's scalability, this work provides a comprehensive analysis of privacy and security aspects, demonstrating the need and qualification of SPOQchain for the future of supply chain tracing.

@article{finke2024spoqchain, abstract = {Product lifecycle tracing is increasingly in the focus of regulators and producers, as shown with the initiative of the Digital Product Pass. Likewise, new methods of counterfeit detection are developed that are, e.g., based on Physical Unclonable Functions (PUFs). In order to ensure trust and integrity of product lifecycle data, multiple existing supply chain tracing systems are built on blockchain technology. However, only few solutions employ secure identifiers such as PUFs. Furthermore, existing systems that publish the data of individual products, in part fully transparently, have a detrimental impact on scalability and the privacy of users. This work proposes SPOQchain, a novel blockchain-based platform that provides comprehensive lifecycle traceability and originality verification while ensuring high efficiency and user privacy. The improved efficiency is achieved by a sophisticated batching mechanism that removes lifecycle redundancies. In addition to the successful evaluation of SPOQchain's scalability, this work provides a comprehensive analysis of privacy and security aspects, demonstrating the need and qualification of SPOQchain for the future of supply chain tracing.}, author = {Finke, Moritz and Dmitrienko, Alexandra and Stang, Jasper}, journal = {ArXiv | arXiv:2408.17049}, keywords = {sssgroup}, title = {SPOQchain: Platform for Secure, Scalable, and Privacy-Preserving Supply Chain Tracing and Counterfeit Protection}, year = 2024 }
Triple-S: Security Scoring System for IoT Devices. Finke, Moritz; Dmitrienko, Alexandra. In IEEE International Conference on Omni-layer Intelligent Systems (COINS). 2024.
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
@article{finke2024triples, author = {Finke, Moritz and Dmitrienko, Alexandra}, journal = {IEEE International Conference on Omni-layer Intelligent Systems (COINS)}, keywords = {sssgroup}, title = {Triple-S: Security Scoring System for IoT Devices}, year = 2024 }
Time-Aware Face Anti-Spoofing with Rotation Invariant Local Binary Patterns and Deep Learning. Finke, Moritz; Dmitrienko, Alexandra. In ArXiv | arXiv:2408.14829. 2024.
- [ BibTeX ]
- [ URL ]
- [ BibSonomy-Post ]
@article{noauthororeditor2024, author = {Finke, Moritz and Dmitrienko, Alexandra}, journal = {ArXiv | arXiv:2408.14829}, keywords = {facialauthentication}, title = {Time-Aware Face Anti-Spoofing with Rotation Invariant Local Binary Patterns and Deep Learning}, year = 2024 }

2023[ to top ]

AuthentiSense: A Scalable Behavioral Biometrics Authentication Scheme using Few-Shot Learning for Mobile Platforms. Fereidooni, Hossein; König, Jan; Rieger, Philipp; Chilese, Markus; Finke, Moritz; Goekbakan, Bora; Dmitrienko, Alexandra; Sadeghi, Ahmad-Reza. In Network and Distributed System Security Symposium (NDSS). 2023.
- [ BibTeX ]
- [ BibSonomy-Post ]
@article{hossein2023authentisense, author = {Fereidooni, Hossein and König, Jan and Rieger, Philipp and Chilese, Markus and Finke, Moritz and Goekbakan, Bora and Dmitrienko, Alexandra and Sadeghi, Ahmad-Reza}, journal = {Network and Distributed System Security Symposium (NDSS)}, keywords = {moritzfinke}, title = {AuthentiSense: A Scalable Behavioral Biometrics Authentication Scheme using Few-Shot Learning for Mobile Platforms}, year = 2023 }

2020[ to top ]

Strategies for the Security Assessment of IoT Devices by Certification Authorities. Finke, Moritz Anton. Bachelor Thesis, 2020, Mai.
- [ Abstract ]
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
The Internet of Things (IoT) is a global infrastructure that interconnects physical and virtual things based on evolving information and communication technologies. Along with the rise of the IoT, multiple unprecedented forms of security issues and attacks have emerged. While their limited resources disallow the utilization of computing-intensive security measures, the services of IoT devices represent an attractive target for vulnerability exploitation. Certification Authorities (CAs) have responded to the trend and offer security assessments and certification for IoT devices. To ensure qualitative and fair certification, security testing requires well-defined strategies. This bachelor thesis analyzes the existing IoT security assessment models and proposes a novel, CA oriented Testing Guide Model (TGM) for standardized and reproducible assessments. The TGM describes a complete security assessment approach for application in IoT device security certification procedures of CAs. As part of the bachelor thesis, the TGM is specified, implemented, and its applicability evaluated with the help of existing IoT devices. CAs account for the security of certified products. The certification of devices that (subsequently) prove to be insecure can lead to a consumer's loss of trust in the CA. Therefore, the decision for issuing certificates must be comprehensible and made carefully. For the risk estimation of security issues and vulnerabilities, it is common to make use of numerical scoring systems. Well-defined scoring systems allow precise and reproducible estimations. In addition to the introduction of the TGM, this bachelor thesis analyzes the scoring systems established in the field of IT security in regard to their applicability for the scoring of IoT related vulnerabilities, complete IoT devices, and for the specific requirements of CAs. This thesis uncovers incompatibilities and insufficiencies in the existing systems that disallow application for the scoring of IoT devices and for application by CAs. To counter these issues, the thesis introduces a novel Security Scoring System (SSS) for rating IoT devices based on the risks of their vulnerabilities, services, and operational contexts. The SSS is integrated into the TGM, implemented in software, and evaluated with a comparison to the existing scoring systems. To summarize, the contributions of this bachelor thesis are two novel models for the security assessment of devices of the IoT: the TGM and the SSS. The models are intended to find application for CAs and both standardize and improve the security testing and assessment procedures.

@mastersthesis{finke2020strategies, abstract = {The Internet of Things (IoT) is a global infrastructure that interconnects physical and virtual things based on evolving information and communication technologies. Along with the rise of the IoT, multiple unprecedented forms of security issues and attacks have emerged. While their limited resources disallow the utilization of computing-intensive security measures, the services of IoT devices represent an attractive target for vulnerability exploitation. Certification Authorities (CAs) have responded to the trend and offer security assessments and certification for IoT devices. To ensure qualitative and fair certification, security testing requires well-defined strategies. This bachelor thesis analyzes the existing IoT security assessment models and proposes a novel, CA oriented Testing Guide Model (TGM) for standardized and reproducible assessments. The TGM describes a complete security assessment approach for application in IoT device security certification procedures of CAs. As part of the bachelor thesis, the TGM is specified, implemented, and its applicability evaluated with the help of existing IoT devices. CAs account for the security of certified products. The certification of devices that (subsequently) prove to be insecure can lead to a consumer's loss of trust in the CA. Therefore, the decision for issuing certificates must be comprehensible and made carefully. For the risk estimation of security issues and vulnerabilities, it is common to make use of numerical scoring systems. Well-defined scoring systems allow precise and reproducible estimations. In addition to the introduction of the TGM, this bachelor thesis analyzes the scoring systems established in the field of IT security in regard to their applicability for the scoring of IoT related vulnerabilities, complete IoT devices, and for the specific requirements of CAs. This thesis uncovers incompatibilities and insufficiencies in the existing systems that disallow application for the scoring of IoT devices and for application by CAs. To counter these issues, the thesis introduces a novel Security Scoring System (SSS) for rating IoT devices based on the risks of their vulnerabilities, services, and operational contexts. The SSS is integrated into the TGM, implemented in software, and evaluated with a comparison to the existing scoring systems. To summarize, the contributions of this bachelor thesis are two novel models for the security assessment of devices of the IoT: the TGM and the SSS. The models are intended to find application for CAs and both standardize and improve the security testing and assessment procedures.}, author = {Finke, Moritz Anton}, keywords = {IoT}, month = {05}, publisher = {Bachelor Thesis}, school = {University of Würzburg}, title = {Strategies for the Security Assessment of IoT Devices by Certification Authorities}, type = {Bachelor Thesis}, year = 2020 }

Teaching

Occupation

Research interests

Publications

Data privacy protection

Data privacy protection

Picture credits