Wireless sensor networks are the emerging information technology for monitoring equipment and ambient conditions of production lines in modern factories. A salient feature of wireless sensor networks is that nodes can relay sensing data to a factory data centre in a multihop fashion. Existing security solutions to sensor networks focus on hop-by-hop encryption and message authentication, as the wireless medium is of an open nature. From an end-to-end perspective, a challenging security problem arises when computer hackers compromise some nodes in a network and these adversarial nodes modify or drop data packets destined to a data centre. In this paper, we propose the Secure Quasimultipath Forwarding (SQF) scheme with the novel idea of dynamic en route retransmission upon encountering adversary nodes. Modelling techniques are employed to study the impact of the data-forwarding security design on packet delivery latency and energy consumption. The simulation results demonstrate that SQF circumvents adversaries with a several-fold reduction in sensor node energy consumption, compared to the existing multipath routing method.

A challenge in secure pairing of two wireless devices is how to share a secret between the two devices in a user-friendly manner, as many users practically choose the simplest setup of no security. Various out-of-band (OOB) methods have been proposed in the literature, where either extra hardware is required (e.g. infrared device, digital camera, near-field communication device, USB flash drive, etc.) or wireless devices with a keyboard/display are assumed. In this paper, we propose a novel method of human perceivable authentication (HPA) that, without any extra hardware, achieves industry-standard security for user interface (UI) constrained devices. A feature of the proposed HPA scheme is the simplicity of user operation for device pairing: a user presses and releases a button on an initiating wireless device in concert with the on/off pattern of LED light on a correspondent wireless device. Simulation experiments have been performed to evaluate the usability aspect of the proposed HPA scheme.

Fast algorithms for multiplication in finite fields are required for several cryptographic applications, in particular for implementing elliptic curve operations over binary fields F/sub 2m/. In this paper, we present new software algorithms for efficient multiplication over F/sub 2m/ that use a Gaussian normal basis representation. Two approaches are presented, direct normal basis multiplication and a method that exploits a mapping to a ring where fast polynomial-based techniques can be employed. Our analysis, including experimental results on an Intel Pentium family processor, shows that the new algorithms are faster and can use memory more efficiently than previous methods. Despite significant improvements, we conclude that the penalty in multiplication is still sufficiently large to discourage the use of normal bases in software implementations of elliptic curve systems.

Linking factory floors to the Internet, coupled with the rapid deployment of wireless access networks, is initiating a new paradigm for factory automation-a corporate employee with a handheld computing device can have anytime, anywhere access to the latest factory floor information. Authentication between a factory database and a remote user is crucial for such paradigm; however, existing authentication protocols are inadequate to defend against strong adversaries with break-in capabilities. In this paper, we design and implement the Energy-Efficient and Intrusion-Resilient Authentication (ERA) protocol. Through a novel combination of hash chain,pin, and message authentication code (MAC), ERA can achieve the security self-recovery when strong adversaries compromise either a user's handheld device or a factory authentication server to obtain the authentication secrets. The technique of mutual MAC is proposed to defend against online pin-guessing attacks launched by strong adversaries. Furthermore, an optimization of tuning hash chain iteration is introduced to reduce energy consumption of a handheld device. Analytical and experimental results show that ERA provides a better security guarantee and incurs much less computation and communication overhead than the existing authentication protocols.

Replacing specialized industrial networks with the Internet is a growing trend in industrial informatics, where packets are used to transmit feedback and control signals between a plant and a controller. Today, denial of service (DoS) attacks cause significant disruptions to the Internet, which will threaten the operation of network-based control systems (NBCS). In this paper, we propose two queueing models to simulate the stochastic process of packet delay jitter and loss under DoS attacks. The motivation is to quantitatively investigate how these attacks degrade the performance of NBCS. The example control system consists of a proportional integral controller, a second-order plant, and two one-way delay vectors induced by attacks. The simulation results indicate that Model I attack (local network DoS attack) impairs the performance because a large number of NBCS packets are lost. Model II attack (nonlocal network DoS attack) deteriorates the performance or even destabilizes the system. In this case, the traffic for NBCS exhibits strong autocorrelation of delay jitter and packet loss. Mitigating measures based on packet filtering are discussed and shown to be capable of ameliorating the performance degradation.

Authentication is an essential premise for deploying wireless LAN inter-network roaming in the real world. The technical challenge lies in the fact that a visited network does not initially have the authentication credentials of a roaming user. Existing solutions require that authentication is performed via three-party communications: user to visited network to home network. In this paper, a new concept that mutual authentication between a visited network and a roaming user can be performed locally without the contact with user's home network is proposed. This new protocol not only satisfies the roaming authentication requirements, but also has efficiency in terms of authentication time delay.