Aggregate signature algorithms combine n signatures on n different messages from n distinct users into one aggregated signature. The aggregated signature allows the verifier to authenticate the n signatures simultaneously. Because the total signature length and authentication costs are significantly reduced, aggregate signature algorithms are attractive to applications with resource constraints and applications requiring efficient batch authentications. In this paper, we propose a novel aggregate signature scheme based on certificateless-PKC. Under this novel scheme, the length of the aggregated signature and the pairing computation cost in the aggregate signature verification process are independent of the number of signatures being aggregated. We also prove that the proposed scheme is existentially unforgeable against adaptive chosen-message and chosen-identity attacks, based on the hardness assumption of the computational Diffie-Hellman problem. The new scheme will be suitable for resource-constrained applications. Copyright © 2016 John Wiley & Sons, Ltd.

The recently proposed TCP-targeted Low-rate Distributed Denial-of-Service (LDDoS) attacks send fewer packets to attack legitimate flows by exploiting the vulnerability in TCP’s congestion control mechanism. They are difficult to detect while causing severe damage to TCP-based applications. Existing approaches can only detect the presence of an LDDoS attack, but fail to identify LDDoS flows. In this paper, we propose a novel metric – Congestion Participation Rate (CPR) – and a CPR-based approach to detect and filter LDDoS attacks by their intention to congest the network. The major innovation of the CPR-base approach is its ability to identify LDDoS flows. A flow with a CPR higher than a predefined threshold is classified as an LDDoS flow, and consequently all of its packets will be dropped. We analyze the effectiveness of CPR theoretically by quantifying the average CPR difference between normal TCP flows and LDDoS flows and showing that CPR can differentiate them. We conduct ns-2 simulations, test-bed experiments, and Internet traffic trace analysis to validate our analytical results and evaluate the performance of the proposed approach. Experimental results demonstrate that the proposed CPR-based approach is substantially more effective compared to an existing Discrete Fourier Transform (DFT)-based approach – one of the most efficient approaches in detecting LDDoS attacks. We also provide experimental guidance to choose the CPR threshold in practice.

Instant messages and online chatting are the earliest forms of online social networking, and they remain as popular communication channels that people use to exchange information and socialize with each other through the Internet, even with the existence of the current diversified and various modern social networks such as mySpace and Facebook. This is especially the case for younger generations, who talk to each other by using text messages much more often than using phone calls and emails. The light-weight communication style of simple type-and-send-in-real-time is the main reason for online chatting (or instant messages) being favorable. However, similar with other sophisticated social networks, online chatting potentially faces the problem of being utilized by perpetrators or even pedophiles to conduct initial approach to innocent online users, who are in many situations children, which may lead to a dangerous crime. Therefore, in some cases, the investigation of victim's online chatting history may play an important role in identifying potential suspects. In this paper we study the aforementioned problem from the technical perspective and seek to conduct systematic approaches to retrieve user online chatting records from general Internet traces. Specifically, we conduct a preliminary study on identifying different types of Google Talk, one of the most popular online chatting software, by using Wireshark (or Ethereal). We describe in details the pattern of each type of online chat messages, and present the corresponding process of identifying the messages. Our experiments show that unencrypted Google Talk chat messages can be easily identified. This study is an initiation on conducting research to provide simple tools for facilitating online message investigations in the future.

Online games are clearly growing as a significant component of the current and future Internet. As a major online game console, the Sony PlayStation 3 (PS3) produces more and more network traffic. People also begin to use PS3 for emails and Web surfing besides playing games due to its enhanced web capabilities. Recognizing the traffic patterns of PS3 is important to network administrators whereas understanding its security is essential for users. However, traffic and security analysis of PS3 has been either done or unpublished. In this paper, we present our initial efforts on game traffic analysis for PS3 and explore the vulnerabilities of PS3 by testing a few attacking schemes on a PS3 console. The research will benefit both network administrators and PS3 users to understand the PS3 systems better.

In the publish/subscribe paradigm, information is disseminated from publishers to subscribers that are interested in receiving the information. In practice, information dissemination is often restricted by policy constraints due to concerns such as security or confidentiality agreement. Meanwhile, to avoid overwhelming subscribers by the vast amount of primitive information, primitive pieces of information can be combined at so-called brokers in the network, a process called composition. Information composition provides subscribers the desirable ability to express interests in an efficiently selective way. In this paper, we formulate the min-cost event distribution problem in pub/sub systems with policy constraints and information composition. Our goal is to minimize the total cost of event transmission while satisfying policy constraints and enabling information composition. This optimization problem is shown to be NP-complete. Our simulation study shows that our heuristics work efficiently, especially in a policy-constrained system. We also find that by increasing the number of broker nodes in a pub/sub system, we are able to reduce the total cost of event delivery.

Trust negotiation is a process that establishes mutual trust by the exchange of digital credentials and/or guiding policies among entities who may have no pre-existing knowledge about each other. Motivated by the desire to disclose as little sensitive information as possible in practice, this paper investigates the problem of minimizing the "cost" of the credentials exchanged by a trust-negotiation protocol. A credential or a policy is assigned a weighted cost, referred to as its sensitivity cost. We formalize an optimization problem, namely the minimum sensitivity cost problem, whose objective is to minimize the total sensitivity costs of the credentials and policies disclosed during trust negotiation. We study the complexity of the minimal sensitivity cost problem and propose algorithms to solve the problem efficiently, for the cases that policies are cost-sensitive and cost-insensitive. A simple finite state machine model of trust-negotiation protocols is presented to model various trust-negotiation protocols, and to provide a quantitative evaluation of the number of exchange rounds needed to achieve a successful negotiation, and the probability of achieving a successful negotiation under various credential disclosure strategies.