The Universal Serial Bus (USB) supports a diverse and wide-ranging set of device types. To enable ease of use, USB devices are automatically detected and classified by common operating systems, without any authentication. This trust-by-default design principle can be easily exploited, and led to numerous attacks in the past (e.g., Stuxnet, BadUSB, BadAndroid), specifically targeting high-value organizations. Administrators' efforts to prevent these attacks may also be threatened by unscrupulous users who may insert any USB device, or malicious users (inside attackers) who may try to circumvent OS/kernel-enforced protection mechanisms (e.g., via OS replacement). The root causes of USB attacks appear to be the lack of robust authentication of individual USB devices and inadequate tamper-proofing of the solution mechanism itself. We propose DeviceVeil to address these limitations. To authenticate individual USB devices, we utilize the tamper-proof feature of Physical Unclonable Functions (PUFs); PUFs extract unique features from physical characteristics of an integrated circuit (IC) at a reasonable cost (less than 1 USD). To make our authentication mechanism robust, we implement it as a small hypervisor, and protect it by a novel combination of security technologies available in commodity PCs, e.g., Trusted Platform Module (TPM), customized secure boot, and virtualization support. The OS disk image with all user data is encrypted by a key sealed in TPM and can be decrypted by the hypervisor only. Customized secure boot allows the loading of the legitimate hypervisor and OS kernel only. The hypervisor enables pre-OS authentication to protect the trust-by-default OS from USB attacks. The chain of trust continues from power-on to the insertion of a USB device and disallows all illegitimate USB devices. DeviceVeil's PUF authentication takes about 1.7 seconds during device insertion.

A PAKR (Password-Authenticated Key Retrieval) protocol and its multi-server system allow one party (say, client), who has a memorable password, to retrieve a long-term static key in an exchange of messages with at least one other party (say, server) that has a private key associated with the password. In this paper, we analyze the only PAKR (named as PKRS-1) standardized in IEEE 1363.2 [9] and its multi-server system (also, [12] ) by showing that any passive/active attacker can find out the client’s password and the static key with off-line dictionary attacks. This result contradicts the security claims made for PKRS-1 (see Clause 10.2 of IEEE 1363.2 [9] ).

Security is one of the key concerns for control systems. Tools and simulators for the control system security have attracted a lot of attentions recently, because testing new solutions is a very important work for the control system security studies. In this paper, we firstly analyze the challenges of the security simulations for control system. Then, classification study is done for the existing tools and simulators. The implementation principles the typical simulator examples and security examples are also analyzed. Finally, we compare the important capabilities and characteristic of the tools and simulators, which is valuable to efficient simulations for security studies in control systems.

Recently, Radio Frequency IDentification (RFID) systems are intensively studied and widely used in every-day applications, such as, retailing, supply chain management, and medical equipment management. Tags in RFID systems are highly efficient to be managed and tracked, but at the same time suffering from impersonation and privacy problems. Consequently, RFID systems are required to provide both efficient management, as well as authentication and privacy protection. In this paper, on the basis of fast and light-weight Niederreiter public-key cryptosystem, we propose an efficient RFID authentication protocol which satisfies the above requirements, and enjoys the following merits: 1) unlike most of the previous works that employ symmetric key cryptographic techniques, our proposal has a fast computation to find authenticated ID and needs no exhaustive search in database, which reduces the searching time significantly; 2) the memory size to store the key in RFID tags can be greatly reduced by our novel methods.

Authenticated Key Exchange (AKE) protocol is one of the ways for establishing secure channels between two parties where they authenticate each other and share a common session key. In particular, some AKE protocols using passwords and high-entropy secrets (i.e., two-factor AKE) are preferable since they provide stronger authentication than one-factor authentication. However, existing two-factor AKE protocols never equip ability to distinguish on-line dictionary attacks from other events, such as client's password mis-typing and communication errors. This problem submerges a critical symptom of high-entropy-secret-leakage (since without it adversaries cannot perform the on-line dictionary attacks) or it forces the users inconvenience by letting them change their passwords frequently to reset the entropy of it that might be guessed partially by the on-line dictionary attacks. In this paper, we propose two general methods to distinguish online dictionary attacks (performed by an attacker) from other harmless events in the two-factor AKE protocols.

OAEP is one of the few standardized and widely deployed public-key encryption schemes. It was designed by Bellare and Rogaway as a scheme based on a trapdoor permutation such as RSA. RSA-OAEP is standardized in RSA's PKCS #1 v2.1 and is part of several standards. OAEP was shown to be IND-CCA secure assuming the underlying trapdoor permutation is partial one-way, and RSA-OAEP was proven to be IND-CCA under the standard RSA assumption, both in the random oracle model. However, the latter reduction is not tight, meaning that the guaranteed level of security is not very high for a practical parameter choice. We observe that the situation is even worse because both analyses were done in the single-query setting, i.e., where an adversary gets a single challenge ciphertext. This does not take into account the fact that in reality an adversary can observe multiple ciphertexts of related messages. The results about the multiquery setting imply that the guaranteed concrete security can degrade by a factor of$q$, which is the number of challenge ciphertexts an adversary can get. We propose a very simple modification of the OAEP encryption, which asks that the trapdoor permutation instance is only applied to a part of the OAEP transform. We show that IND-CCA security of this scheme is tightly related to the hardness of one-wayness of the trapdoor permutation in the random oracle model. This implies tight security for RSA-OAEP under the RSA assumption. We also show that security does not degrade as the number of ciphertexts an adversary can see increases. Moreover, OAEP can be used to encrypt long messages without using hybrid encryption. We believe that this modification is easy to implement, and the benefits it provides deserves the attention of standard bodies.

In this paper, we investigate the notion of partnership as found in security models for key exchange protocols. Several different approaches have been pursued to define partnership, with varying degrees of success. We aim to provide an overview and criticism of the various definitions and point out some pitfalls that can be encountered when trying to define partnership. As a result, we propose an intuitive way of defining partnership directly from equality of session keys. In addition, we show that authentication can be captured using a definition of partnership by equality of partner identifiers, and give proofs that both definitions achieve what we expect from them.

In the emergency broadcast system (or emergency alert system) which aims to broadcast a warning information immediately in time of emergency such as a natural or civil disaster, computational power-restricted devices such as, pocket terminals and sensors need to instantly and securely verify correctness and integrity of the received message packets. Though a lot of broadcast authentication systems were proposed, most of them require relatively high computation cost. In this paper, we propose a new lightweight broadcast authentication protocol McSBA based on McEliece signature. It can be quickly verified with a tiny computation cost, applicable on power-restricted devices. We first estimate the time performance and compare McSBA with widely used RSA signature and well- known TESLA broadcast authentication protocol, to show that the verification of McSBA has a low cost and is faster than the others. Especially, it is shown by our estimation that McSBA can verify quickly less than Is in emergency situations, however RSA signature with the same security takes more than 4s. Then we make use of a simulation of verification of RSA signature and McSBA, on the same platform, to attest that verification of McSBA is about ten times faster than RSA signature, which also supports our estimation result. Consequently, we expect that our technique is useful in the emergency broadcast system.

Anonymity and specifically sender anonymity have become essential requirements for many privacy-related applications (e.g. net counselling and whistle blowing). On the other hand, anonymity may be abused for various malicious activities (e.g. redistribution of copy-righted contents and illegal drug trading). In this paper, we address both by proposing protocols for authenticated anonymous communications channels. In such channels, the client can authenticate the authentication server while the latter can only authenticate the fact that the client is one of the qualified members that are eligible to use the network (e.g. WLAN hot spots, WiMAX). Our protocols are based on an efficient anonymous password-based authenticated key exchange protocol and on an anonymous IP address assignment and have the following advantages: (1) they can restrict the usage of the established anonymous channels to certain fair purposes; (2) they do not involve rerouting of the packets through a chain of intermediate nodes; (3) they are available right after registration of a normal password to an authentication server as for a classical non-anonymous authentication (e.g. EAP-TTLS and PEAP) and do not require any special registration procedures that would reveal initially to the authentication server that the client belongs to a small list of users of anonymous services. Each protocol fits in a different authentication framework (IEEE802.1x and PANA) and is different with respect to providing controlled IP address assignment.

In this correspondence, iteration-1 of bit flipping decoding based on a set of nonorthogonal check sums is analyzed for both regular and irregular models. In particular, the tradeoff between the Hamming weight (and overlapping) of the check sums and the number of redundant check sums required to start converging under iterative decoding is investigated. The model is then applied to an iterative attack of McEliece public-key cryptosystem since a successful attack of this system can be achieved by algebraic bounded distance decoding of a random code. Based on this model, the attack can be decomposed into two phases: a preprocessing phase which, for one particular key kappa, consists of finding a sufficiently large set S of check sums up to a certain Hamming weight, and a bit flipping decoding phase which uses the set S for each message encrypted with the key kappa

The concept of personal networks is very user- centric and representative for the next generation networks. However, the present security mechanism is not considering at all what happens whenever a mobile node (device) is compromised, lost or stolen. This kinds of leakage of stored secrets has been a great danger in the field of communication security since it sometimes leads to the complete breakdown of the intended security level. In order to solve the problem, we propose a 3-way leakage-resilient and forward-secure authenticated key exchange (3LRFS-AKE) protocol and its security architecture for personal networks. The 3LRFS-AKE protocol guarantees not only forward secrecy of the shared key between device and its server but also a new additional layer of security against leakage of stored secrets. The security architecture includes two different types of communications: PN wide communication and communication between P-PANs of two different users.

A private-personal area network (P-PAN) is the very user-centric and basis component of personal networks. However, the current security mechanism is not robust against leakage of stored secrets that can happen when a mobile node (device) is compromised, lost or stolen. This results in unauthorized accesses to other devices and services. For that, this paper introduces a leakage-resilient and forward secure authenticated key exchange (LRFS-AKE) protocol and its usage in the relation to P-PANs. The LRFS-AKE protocol guarantees not only security against classical attacks but also a new additional layer of security against leakage of stored secrets

Network mobility introduces far more complexity than host mobility. To address the extensions needed for network mobility, the IETF NEMO working group has recently standardized the network mobility basic support protocol in RFC 3963. However, in this RFC, it is not mentioned how authentication authorization and accounting (AAA) issues are handled in NEMO environment. Also the use of IPsec to secure NEMO procedures does not provide robustness against leakage of stored secrets. To address this security issue and to achieve AAA with mobility, we propose new handover procedures to be performed by mobile routers and by visiting mobile nodes. These new handover procedures are based on leakage resilient-authenticated key establishment (LR-AKE) protocol.

Radio frequency identification systems (RFID systems) are becoming popular in various applications, such as supply chain management, animal husbandry and so on. They are useful to manage not only things but also living things. Privacy, however, must be taken in account when they are used around people since people with RFID tags can easily be tracked and traced. While several solutions have been proposed to solve this problem, they have drawbacks that the back-end servers (or the readers) must exhaustive-search all the registered IDs to identify the RFID tags and/or that database must synchronize with the tags. The former is not desirable when a huge number of RFID tags must be managed, and the latter is not desirable when restoring database from backup (since tags and the database are not synchronous after restoration). In this paper, we propose how to solve these problems without deteriorating the privacy protection ability.

Network mobility introduces far more complexity than host mobility. Therefore, host mobility protocols such as Mobile IPv6 (MIPv6) need to be extended to support this new type of mobility. To address the extensions needed for network mobility, the IETF NEMO working group has recently standardized the network mobility basic support protocol in RFC 3963. However, in this RFC, it is not mentioned how authentication authorization and accounting (AAA) issues are handled in NEMO environment. Also, the use of IPsec to secure NEMO procedures does not provide robustness against leakage of stored secrets. To address this security issue and to achieve AAA with mobility, we propose new handover procedures to be performed by mobile routers and by visiting mobile nodes. This new handover procedure is based on leakage resilient-authenticated key establishment (LR-AKE) protocol. Using analytical models, we evaluate the proposed handover procedure in terms of handover delay which affects the session continuity. Our performance evaluation is based on transmission, queueing and encryption delays over wireless links

In wireless networks, security is an essential feature that can be provided using a variety of protocols. On the other hand, the security protocols can affect applications to varying degrees depending on the network conditions. In this paper, we propose to evaluate the overhead introduced by the security mechanisms in WLAN such as authentication. To do so, we develop an analytical model based on random errors to evaluate the authentication delay for various error rates taking into account the reliability mechanisms involved. We also measure the authentication delay for WLAN 802.11b using CISCO access point and client cards. We generate the average, minimum and maximum delay for the different authentication configuration available in the CISCO security suite. The analytical and the experimental results are compliant. The major contributor of the authentication delay is the probing time needed to detect the surrounding access point.

Authenticated key exchange (AKE) protocols are designed to allow mutual authentication and generation of a cryptographically-secure session key. We revisit the conventional AKE protocols employed in IEEE 802.1x for wireless security considering the following situation: (1) a user has some insecure devices with built-in memory capacity; (2) the counterpart server is not perfectly secure; (3) neither PKI (public key infrastructure) nor TRM (tamper-resistant module) is available. In addition, the paper introduces a new kind of AKE protocol, which is secure against an active attacker in the above-mentioned situation, in order to enhance the overall security level and usability of passwords. For authenticity, the user's password is combined with an additional secret stored on insecure mobile devices. Nevertheless, the user remembers only one relatively short password while maintaining its connections with a variety of different servers.

The coupling of mobility and quality-of-service with security is a challenge that should be addressed in future wireless overlay systems. The mobility of a node can disrupt or even intermittently disconnect an ongoing real-time session because a secure handover must be performed to ensure continuous connectivity. The duration of the such interruptions is called disruption time or handover delay and can heavily affect the user satisfaction. The handover procedure needs to protect its integrity and confidentiality-otherwise, the packets may be rerouted to a malicious node and the legitimate handover may not be performed. The security procedure to ensure this should not lengthen significantly the handover delay to provide good quality real-time services. In this paper, we focus on the network-layer mobility, specifically, on Mobile Internet protocol version 6 (MIPv6) since it is the natural candidate for providing such mobility in future systems. To solve the problem of on-path attackers and prevent leakage of secrets, we propose a security architecture for MIPv6 based on leakage resilient-authenticated key establishment (LR-AKE) protocol and its cooperation with public key infrastructure. The proposed architecture prevents against on-path attackers which was not addressed in the specifications of MIPv6, and also provides robustness against leakage of secret values. Using analytical models, we evaluate MIPv6 handover delay for real-time services. We identify the crucial factors affecting the handover delay among transmission delays of MIPv6, security and LR-AKE messages, queueing delays and en/decryption delays.

Ad-hoc networks are usually constructed with a lot of nodes managed by unknown users and have a vague reliability level. In order to establish a reliable connection with the target node, users somehow need to evaluate the nodes and connection paths as correctly as possible. One of the solutions to this problem is to employ the trust-metrics to the node-and-path evaluation of the ad-hoc network. The trust-metrics are mainly used to evaluate the reliability (validity) of the public-keys of unknown users, e.g. in PGP. We, however, point out that there are some drawbacks when applying the ever known metrics to the node-and-path evaluation of the ad-hoc networks. We show that they are either low privacy - high utility or high privacy - low utility. To overcome these disadvantages, we propose the realization of high privacy high utility trust metrics and its application for evaluating the node's performances in ad-hoc networks (electronic power consumption, transmission speed, etc).

Broadcast Encryption allows a broadcaster to broadcast an encrypted message so that only a dynamically changing designated group of users can decrypt it. The stateless setting considers the case where the private key at each user is never updated. A central open problem in this area is to design a stateless scheme where both the size of transmission header which encapsulates the session key and the size of private key at each user are small and independent of the number of users (all/privileged/revoked users). We propose schemes that meet this requirement by providing a tradeoff between security against collusion and non-secret storage size. The proposed schemes are based upon new notions of one-way accumulators which are of independent interest.

McEliece public-key cryptosystem (PKC) is one of a few alternatives for the current PKCs that are mostly based on either the integer factoring problem (IFP) or the discrete logarithm problem (DLP) that would be solved in polynomial time after the emergence of quantum computers. The security of the McEliece PKC is based on the decoding problem and it is known that it satisfies, with an appropriate conversion, the strongest security notion, i.e., INDistinguishability of encryption against adaptively Chosen-Ciphertext Attacks (IND-CCA2), in the random oracle model under the assumption that the underlying primitive McEliece PKC satisfies a weak security notion of One-Wayness against Chosen-Plaintext Attacks (OW-CPA). OW-CPA is said to be satisfied if it is infeasible for chosen plaintext attacks to recover the whole plaintext of an arbitrarily given ciphertext. Currently, the primitive McEliece PKC satisfies OW-CPA if a parameter n/spl ges/2048 with optimum t and k is chosen since the binary work factor for (n,k,t)=(2048,1278,70) to break it with the best CPA is around 2/sup 106/, which is infeasible even if world-wide computational power is used. While the binary work factor for the next smaller parameter n=1024 is in a gray level of 2/sup 62/, it will be improved by applying Loidreau's modification that employs Frobenius automorphism in Goppa codes. In this paper, we carefully investigate the one-wayness of the Loidreau's modified McEliece PKC against ever known CPAs and new CPAs we propose, and then show that it certainly improves the one-wayness against ever known CPAs but it is vulnerable against our new CPAs. Thus, it is rather harmful to apply the new modification to the McEliece PKC.

Distortion invariant pattern recognition is an interesting problem from the biological and technological point of view. However, it has not yet been solved by neural networks in satisfactory way. This paper investigates an associative neural network system to improve the recalling accuracy for distortion patterns. On a perception type of neural network with feedback, error back-propagation algorithm and energy function are used for a learning process and a recalling process, respectively. By using gradated patterns as learning and unknown patterns, it is shown that the recalling accuracy becomes higher than using original pattern themselves.