<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-02023738</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-20T23:26:45+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">A Hypergame Analysis for ErsatzPasswords</title>
            <author role="aut">
              <persName>
                <forename type="first">Christopher</forename>
                <forename type="middle">N.</forename>
                <surname>Gutierrez</surname>
              </persName>
              <email type="md5">5fb98972528a58b8925ffa18e6c6d468</email>
              <email type="domain">purdue.edu</email>
              <idno type="idhal" notation="numeric">1042914</idno>
              <idno type="halauthorid" notation="string">1525997-1042914</idno>
              <affiliation ref="#struct-519747"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mohammed</forename>
                <forename type="middle">H.</forename>
                <surname>Almeshekah</surname>
              </persName>
              <email type="md5">f0801cc2d31f1575897967b94be0fccc</email>
              <email type="domain">ksu.edu.sa</email>
              <idno type="idhal" notation="numeric">1042915</idno>
              <idno type="halauthorid" notation="string">1046127-1042915</idno>
              <affiliation ref="#struct-418994"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Saurabh</forename>
                <surname>Bagchi</surname>
              </persName>
              <email type="md5">34501c27787108633f652ebc064044d4</email>
              <email type="domain">purdue.edu</email>
              <idno type="idhal" notation="numeric">1041097</idno>
              <idno type="halauthorid" notation="string">1028454-1041097</idno>
              <affiliation ref="#struct-519747"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Eugene</forename>
                <forename type="middle">H.</forename>
                <surname>Spafford</surname>
              </persName>
              <email type="md5">96601467b1ce7c1498a36a28353ef056</email>
              <email type="domain">purdue.edu</email>
              <idno type="idhal" notation="numeric">986133</idno>
              <idno type="halauthorid" notation="string">1046129-986133</idno>
              <affiliation ref="#struct-519747"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2019-02-21 16:37:54</date>
              <date type="whenModified">2026-02-07 05:16:07</date>
              <date type="whenReleased">2019-02-21 16:40:00</date>
              <date type="whenProduced">2018-09-18</date>
              <date type="whenEndEmbargoed">2021-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-02023738v1/document">
                <date notBefore="2021-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-02023738v1/file/472722_1_En_4_Chapter.pdf" id="file-2044844-2051697">
                <date notBefore="2021-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-02023738</idno>
            <idno type="halUri">https://inria.hal.science/hal-02023738</idno>
            <idno type="halBibtex">gutierrez:hal-02023738</idno>
            <idno type="halRefHtml">&lt;i&gt;33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC)&lt;/i&gt;, Sep 2018, Poznan, Poland. pp.47-61, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-99828-2_4"&gt;&amp;#x27E8;10.1007/978-3-319-99828-2_4&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Sep 2018, Poznan, Poland. pp.47-61, &amp;#x27E8;10.1007/978-3-319-99828-2_4&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-2044844-2051697"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-SEC" corresp="IFIP"> International Information Security Conference</idno>
            <idno type="stamp" n="IFIP-AICT-529" corresp="IFIP-AICT">ICT Systems Security and Privacy Protection</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 1: Authentication</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">A Hypergame Analysis for ErsatzPasswords</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Christopher</forename>
                    <forename type="middle">N.</forename>
                    <surname>Gutierrez</surname>
                  </persName>
                  <email type="md5">5fb98972528a58b8925ffa18e6c6d468</email>
                  <email type="domain">purdue.edu</email>
                  <idno type="idhal" notation="numeric">1042914</idno>
                  <idno type="halauthorid" notation="string">1525997-1042914</idno>
                  <affiliation ref="#struct-519747"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mohammed</forename>
                    <forename type="middle">H.</forename>
                    <surname>Almeshekah</surname>
                  </persName>
                  <email type="md5">f0801cc2d31f1575897967b94be0fccc</email>
                  <email type="domain">ksu.edu.sa</email>
                  <idno type="idhal" notation="numeric">1042915</idno>
                  <idno type="halauthorid" notation="string">1046127-1042915</idno>
                  <affiliation ref="#struct-418994"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Saurabh</forename>
                    <surname>Bagchi</surname>
                  </persName>
                  <email type="md5">34501c27787108633f652ebc064044d4</email>
                  <email type="domain">purdue.edu</email>
                  <idno type="idhal" notation="numeric">1041097</idno>
                  <idno type="halauthorid" notation="string">1028454-1041097</idno>
                  <affiliation ref="#struct-519747"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Eugene</forename>
                    <forename type="middle">H.</forename>
                    <surname>Spafford</surname>
                  </persName>
                  <email type="md5">96601467b1ce7c1498a36a28353ef056</email>
                  <email type="domain">purdue.edu</email>
                  <idno type="idhal" notation="numeric">986133</idno>
                  <idno type="halauthorid" notation="string">1046129-986133</idno>
                  <affiliation ref="#struct-519747"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC)</title>
                  <date type="start">2018-09-18</date>
                  <date type="end">2018-09-20</date>
                  <settlement>Poznan</settlement>
                  <country key="PL">Poland</country>
                </meeting>
                <editor>Lech Jan Janczewski</editor>
                <editor>Mirosław Kutyłowski</editor>
                <imprint>
                  <publisher>Springer International Publishing</publisher>
                  <biblScope unit="serie">ICT Systems Security and Privacy Protection</biblScope>
                  <biblScope unit="volume">AICT-529</biblScope>
                  <biblScope unit="pp">47-61</biblScope>
                  <date type="datePub">2018</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-99828-2_4</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Game Theory</term>
                <term xml:lang="en">Computer Security</term>
                <term xml:lang="en">Deception</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>A hypergame is a game theoretic model capturing the decisions of rational players in a conflict where misperceptions, from deception or information asymmetry, are present. We demonstrate how hypergames can model an actual security mechanism: ErsatzPassword, a defense mechanism to protect password hashes from offline brute-force attacks. Two ErsatzPassword defensive strategies are considered: to block the attacker and trigger an alarm, or to redirect the attacker into a honeynet for attack analysis. We consider the scenario where there is information asymmetry in the system and one side under-estimates or over-estimates the risk tolerance of the other side. We analyze plausible strategies for both attacker and defender and then solve 57,600 hypergame configurations to determine the optimal 1st line defense strategies under various levels of risk tolerance and misperceptions.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="laboratory" xml:id="struct-519747" status="VALID">
          <orgName>Center for Education and Research in Information Assurance and Security (Purdue University)</orgName>
          <orgName type="acronym">CERIAS</orgName>
          <desc>
            <address>
              <addrLine>Purdue University / Recitation Building / 656 Oval Drive / West Lafayette IN 47907-2086</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.cerias.purdue.edu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-147250" type="direct"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-418994" status="VALID">
          <orgName>College of Computer and Information Sciences [Riyadh]</orgName>
          <desc>
            <address>
              <addrLine>King Saud University, Riyadh 12371</addrLine>
              <country key="SA"/>
            </address>
            <ref type="url">http://ccis.ksu.edu.sa/en</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302265" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-147250" status="VALID">
          <idno type="ROR">https://ror.org/02dqehb95</idno>
          <orgName>Purdue University [West Lafayette]</orgName>
          <desc>
            <address>
              <addrLine>Hovde Hall, 610 Purdue Mall, West Lafayette, IN 47907</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://www.purdue.edu/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-302265" status="VALID">
          <idno type="ROR">https://ror.org/02f81g417</idno>
          <orgName>King Saud University [Riyadh]</orgName>
          <orgName type="acronym">KSU</orgName>
          <desc>
            <address>
              <addrLine>King Saud University, Riyadh 12372</addrLine>
              <country key="SA"/>
            </address>
            <ref type="url">http://ksu.edu.sa/en/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>