Passwordless authentication is increasingly being adopted as an alternative to traditional knowledge-based authentication, primarily because of its convenience and security advantages. There is a clear lack of research geared towards the integration of passwordless authentication with host security and operating systems. We bridge that gap by uncovering critical vulnerabilities in Windows' passwordless authentication. Specifically, we identify misconfigurations where hardware-backed protection is silently bypassed due to improper TPM integration, undermining Windows' intended security guarantees. Furthermore, we show that the use of biometrics weakens data protection. We present three practical attacks that exploit these vulnerabilities. (1) “Template Injection”, bypasses biometrics by injecting forged templates into the system. (2) “Passkey Migration”, extracts and reuses passwordless credentials across devices. (3) “Phishing”, alters host authentication behavior to deceive users into exposing sensitive data. Our evaluation shows that these attacks work across diverse configurations, require no prior knowledge of the victim, and remain undetectable in practice. Among all tested cases, only systems with Enhanced Sign-in Security (ESS) prevented our attacks. Beyond Windows' native authentication, we examine third-party credential sync services, focusing on Google Password Manager (GPM). We find that GPM is vulnerable under certain misconfigurations, allowing abuse of synced credentials. Finally, we discuss the root causes of these issues and propose mitigation strategies.

Windows Hello is a Fast IDentity Online- (FIDO-) based new login system for Windows 10, which provides a single sign-on (SSO) service to diverse online applications. Hardware protection is essential for Window Hello’s security. This paper aims to examine the security of Windows Hello on a device where hardware protection is unavailable. We present the first detailed analysis of Windows Hello’s security. The results show that, on a hardware-unsupported device, the authentication data for Windows Hello is not properly protected. We propose a migration attack to compromise Windows Hello’s security. In the proposed attack, an attacker extracts authentication data from a device to impersonate a victim in his or her Microsoft online account. We consider the possibility of such an attack to be serious and harmful to our society and demand immediate attention for remediation.

Due to the inefficiency of present day Internet architecture, Content-Centric Networking (CCN) has been proposed to evolve the network architecture. In the CCN, every single router has cache storage to store requested contents, and uses it as a key feature to improve overall performance. Routers store all received content, until cache replacement occurs. Therefore, an attacker can infer the activity of the user connected to the access router by using the round-trip time (RTT). In this paper, we introduce a popularity-based caching strategy, PPNDN, which has been designed to prevent cache privacy violation, without compromising network performance. The popularity was measured once by the content provider at the time of creation, and kept updated by local NDN routers based on demands by local users. Adjusting cache period based on the demand makes it immune to cache privacy violation, and at the same time sustains optimal network performance. The analysis confirmed by simulation results shows that PPNDN has the lowest cache period without degrading performance, compared to other cache policies.

Machine type communication (MTC) takes advantages of billions of devices being connected to each other in sensing our ambient environments. When a large number of MTC devices in a group attempt to access a radio link of LTE, congestions in the link may drop throughput of data and signaling traffic significantly. This paper is presented to enhance security overheads in the radio access network by utilizing group-based authentication. Comparing to related works the proposed protocol does not require a radical change in the incumbent security protocol. Further, the proposed protocol is confirmed by performance evaluations that it produces less computational and communication overheads than the current LTE-AKA.

The goal of 3GPP Long Term Evolution/System Architecture Evolution (LTE/SAE) is to move mobile cellular wireless technology into its fourth generation. One of the unique challenges of fourth-generation technology is how to close a security gap through which a single compromised or malicious device can jeopardize an entire mobile network because of the open nature of these networks. To meet this challenge, handover key management in the 3GPP LTE/SAE has been designed to revoke any compromised key(s) and as a consequence isolate corrupted network devices. This paper, however, identifies and details the vulnerability of this handover key management to what are called desynchronization attacks; such attacks jeopardize secure communication between users and mobile networks. Although periodic updates of the root key are an integral part of handover key management, our work here emphasizes how essential these updates are to minimizing the effect of desynchronization attacks that, as of now, cannot be effectively prevented. Our main contribution, however, is to explore how network operators can determine for themselves an optimal interval for updates that minimizes the signaling load they impose while protecting the security of user traffic. Our analytical and simulation studies demonstrate the impact of the key update interval on such performance criteria as network topology and user mobility.

Advantages of a cloud computing sharing IT resources can also be vulnerable from the security perspective. Because users could be allocated in the same virtual network with adversary users, the traffic generated by adversary users causes a decline in the performance of the virtual machine of others users. This leads to the problem of erroneous billing. Proposed architecture minimizes the influence of malicious traffic using the classification of traffic and encryption based on an IP routing table. The analysis shows additional resources required to the proposed architecture in a cloud computing system through performance evaluation using real dataset gathered from a company. Further we suggest effective method to apply proposed architecture in a cloud computing system.

Numerous entities in a smart grid network communicate with each other via unicast, multicast, and broadcast communications in order to enhance the efficiency, reliability, and intelligence of the power supply chain. This paper proposes an efficient and scalable key management protocol for secure unicast, multicast, and broadcast communications in a smart grid network. The proposed protocol is based on a binary tree approach, and supports all these three types of secure communications by using only one binary tree. The analysis and discussion show that the proposed protocol is versatile, and hence suitable for secure smart grid communications.

In this paper, we propose a mutual authentication and key agreement scheme for V2I communications. Our scheme improves security and privacy protection compared with the existing protocols. We consider common driver's tendency to design a more efficient scheme. The results of the security and performance analysis show that our scheme is suitable for practical use in terms of security, privacy, and performance.

A conditional access system (CAS) proposed by Sun has a critical security weakness in its inability to preserve backward secrecy; a former subscriber can still access programs despite his or her change in status. This weakness in Sun 's CAS originates because 1) no change is made to a group key after a new member arrives, and 2) updates of group keys are done in an insecure manner. We show how simple protocol changes can fix these weaknesses and thus render Sun 's CAS capable of preserving backward secrecy.

Demand for the femtocell is largely credited to the surge in a more always best connected communication conscious public. 3GPP define new architecture and security requirement for Release 9 to deal with femtocell, Home eNode B referred as HeNB. In this paper, we analyze the HeNB security with respect to mutual authentication, access control, and secure key agreement. Our analysis pointed out that a number of security vulnerabilities have still not been addressed and solved by 3GPP technical specification. These include eavesdropping, man-in-the-middle attack, compromising subscriber access list, and masquerading as valid HeNB. To the best of our knowledge, any related research studying HeNB security was not published before. Towards this end, this paper proposes an improved authentication and key agreement mechanism for HeNB which adapts proxy-signature and proxy-signed proxy-signature. Through our elaborate analysis, we conclude that the proposed not only prevents the various security threats but also accomplishes minimum distance from user-tolerable authentication delay.

The integrated core network architecture and various mobile subscriber behaviors can result in a significant increase of signaling loads inside the evolved packet core network proposed by 3GPP in Release 8. Consequently, an authentication signaling analysis can provide insights into reducing the authentication signaling loads and latency, satisfying the quality-of-experience. In this paper, we evaluate the signaling loads in the EPS architecture via analytical modeling based on the renewal process theory. The renewal process theory works well, irrespective of a specific random process (i.e. Poisson). This paper considers various subscribers patterns in terms of call arrival rate, mobility, subscribers' preference and operational policy. Numerical results are illustrated to show the interactions between the parameters and the performance metrics. The sensitivity of vertical handover performance and the effects of heavy-tail process are also discussed.

Despite the popularity of VoIP these clays, this method of communication may present significant security challenges in terms of privacy and accounting. Authentication and message encryption are considered essential mechanisms in VoIP for it to be comparable to PSTN. SIP is responsible for setting up a secure call in VoIP. SIP employs TLS, DTLS or IPSec, combined with TCP, UDP or SCTP, as a security protocol in VoIP. These security mechanisms may introduce additional overheads into SIP performance. However, these overheads have not been understood in detail by the technical community. In this paper we demonstrate the effect of a security protocol on the performance of SIP by comparing the call setup delays that occur with various security protocols. We simulate the various combinations of three security protocols and three transport-layer protocols suggested for SIP. UDP with any combination of security protocols performs much better than the combination of TCP. TLS over SCTP may have more impact on performance on average. The reasons for the differences in SIP performances are given.

The growing importance of Web traffic on the Internet makes it important that we have accurate traffic models in order to plan and provision. In this paper we present a Web traffic model designed to assist in the evaluation and engineering of shared communication networks. Because the model is behavioral we can extrapolate the model to assess the effect of changes in protocols, the network or user behavior. The increasing complexity of Web traffic has required that we base our model on the notion of a Web-request, rather a Web page. A Web-request results in the retrieval of information that might consist of one or more Web pages. The parameters of our model are derived from an extensive trace of Web traffic. Web-requests are identified by analyzing not just the TCP header in the trace but also the HTTP headers. The effect of Web caching is incorporated into the model. The model is evaluated by comparing independent statistics from the model and from the trace. The reasons for differences between the model and the traces are given.