Authentication Authorization Research Articles

Protocol for trusted channel based on portable trusted module

Web-based e-commerce applications need a trusted channel, which provides confidential communication, identity authentication and integrity assurance of endpoints, to guarantee the security of electronic transactions. A user-oriented trusted computing system based on Portable Trusted Module (PTM) is presented. Remote attestation is incorporated into Transport Layer Security (TLS) handshake protocol based on PTM so as to establish a trusted channel between two endpoints in network. This protocol can resist masquerading, trusted path and runtime attacks and propagate the trust in the computing system to the end user effectively. The test results of our proof-of-concept prototype show that our protocol for trusted channel is feasible for deployment in e-commerce applications on the Internet.

The Research of Workflow Access Control Methods Based on Spring Acegi

Access control through restricting users to access to resources, prevents invasion of illegal users and legal users access to unauthorized resources to ensure integrity and privacy of workflow data, which is the key of workflow security mechanism. According to the identity authentication and access authority control, the paper analyzes the safety management entrusted mechanism of Acegi which is Spring security framework, makes full use of its characteristics of depended injection (DI), and realizes statement and configuration of all kinds of safety components such as authentication management and access decision management.

Responsible Conduct of Research: For Students, By Students

ABSTRACT: Purpose: The purpose of this tutorial is to illustrate select research ethics issues that are relevant to speech-language pathology and audiology students who are involved in academic research and scholarship. Method: Graduate students participating in an advanced seminar reviewed the principles of the responsible conduct of research (RCR). They then each developed a realistic hypothetical case (dilemma) as a platform for analyzing standards of conduct as reflected in national and international guidelines and articulated by authoritative authors. Each case closes with a summary and conclusion as to an ethically appropriate course of conduct. Results: A range of RCR issues is addressed: resolving conflicting interests of clinicians and investigators; protecting the well-being of human participants while minimizing harm; respecting the voluntary and informed consent of T

Angela Carter as fiction: Refiguring the real author as Performative Author

In a 2006 article in The Independent, Christina Patterson echoes Gore Vidal by stating ‘Death, as any biographer knows, can be an excellent career move’. Commenting on a brief revival of Angela Carter’s work in 2006 concomitant with Emma Rice’s bringing of Nights at the Circus to the stage, and Vintage’s reissuing of six of her works with new introductions, Patterson refers to Carter’s ‘whole new lease on life’ suggesting the metamorphic potential and curious temporality of the authorial figure with regard to reader reception. The Vintage editions suggest, as Stephen Benson observes, the ‘legend’ of the ‘Carter effect’, identified by The British Academy Humanities Research Board, which distributes postgraduate studentships. This ‘Carter’ effect was also fostered by the theatricality of Carter’s authorial performances. Sarah Gamble has observed the ‘screen’ of authorial identity upon which readers are led to project impressions, which functions as a ‘hall of mirrors’ in relation to penetrating to the authentic author. Such attempts at authorial effacement and control are certainly not unusual. However, Carter’s postmodern enactment of the play of surfaces in the realm of authorial identity appears to heighten the consequent shifting of boundaries between fiction and life staged in her fiction. This article will address the interaction between the games with identity inscribed in Carter’s short stories and the complex identity and temporality of the Performative Author.

The Application of Chaotic Encryption Model in the Network Identity Authentication

This paper analyzes a sort of color still image algorithm based on the Logistic map sorting, and verifies the confidentiality. Further, this algorithm will be applied to the authentication module in network identity authentication system. A new, safe and effective certification system is realized based on the network identity card, and the authority authentication is provided for users requiring identity identification on the network. Nowadays, cryptography and network security is a hot topic for communication and computer industry. Currently, encryption technique in the information security mainly contains conventional private key encryption system and public key encryption system, the former has low computation overhead, but its encryption strength is not high; the latter, although has high encryption strength, its computation cost is huge. Therefore, it has profound theoretical significance and wide application prospects to research a sort of information encryption algorithms and information security software system with security, good confidentiality and high calculation speed. Chaos phenomenon is a determinacy process which is similar to random, and often appears in nonlinear dynamical system, this process is neither periodic nor convergent, and is sensitively dependent on initial value [1-3]. These basic features of chaotic system can just meet the basic requirements of secret communication and cryptology. The researches of Secret communication, information encryption and information hiding technology are based on chaos theory, and have become one of popular and frontier topics developed by the cross fields of international nonlinear science and information science. Also it is an international, high-tech researched new field, cryptography based on chaos theory has recently become very popular science [2]. In our paper, chaotic model images encryption technology is applied to Network identity authentication system to prevent rampant e-commerce fraud.

On the Unified Authentication Technology of Network Token

This paper has researches on the achievement of unified authentication. It uses Windows Active Directory as the authentication authority. It uses Kerberos, SPNEGO, JAAS and JGSS to achieve unified authentication service with single sign-on.Through unified management, unified authentication and the integration of application servers to avoid the emergence of non-uniform isolated information resources and to solve the key requirements of the unity of interface integration and safety certification.

Ensuring Safety, Security, and Sustainability of Mission-Critical Cyber–Physical Systems

Cyber-physical systems (CPSs) couple their cyber and physical parts to provide mission-critical services, including automated pervasive health care, smart electricity grid, green cloud computing, and surveillance with unmanned aerial vehicles (UAVs). CPSs can use the information available from the physical environment to provide such ubiquitous, energy-efficient and low-cost functionalities. Their operation needs to ensure three key properties, collectively referred to as S3: 1) safety: avoidance of hazards; 2) security: assurance of integrity, authenticity, and confidentiality of information; and 3) sustainability: maintenance of long-term operation of CPSs using green sources of energy. Ensuring S3 properties in a CPS is a challenging task given the spatio-temporal dynamics of the underlying physical environment. In this paper, the formal underpinnings of recent CPS S3 solutions are aligned together in a theoretical framework for cyber-physical interactions, empowering CPS researchers to systematically design solutions for ensuring safety, security, or sustainability. The general applicability of this framework is demonstrated with various exemplar solutions for S3 in diverse CPS domains. Further, insights are provided on some of the open research problems for ensuring S3 in CPSs.

A Usable and Secure Two-Factor Authentication Scheme

ABSTRACT There are many secure authentication schemes that are secure but difficult to use. Most existing network applications authenticate users with a username and password pair. Such systems using the reusable passwords are susceptible to attacks based on the theft of password. Each scheme has its merits and drawbacks (Misbahuddin, Aijaz Ahmed, & Shastri, 2006). To overcome the susceptibility in the existing applications, there is an authentication mechanism known as Two-Factor Authentication. Two-Factor Authentication is a process used to authenticate or verify the identity of a person or other entity requesting access under security constraints. It is a system wherein two different factors are used in conjunction to authenticate. Using two factors as opposed to one factor generally delivers a higher level of authentication assurance. The proposed scheme allows users to freely choose their PassFile (file password) instead of remembering the password, eliminating the problem of entering the reusable password and remembering the password. In this scheme, we proposed an efficient scheme for remote user authentication. It does not maintain verifier table and allows the user to freely choose and change their passwords. The proposed scheme provides best usability for the user in terms of PassFile without changing the existing protocol. This approach uses a smart card and is secure against identity theft, guessing attack, insider attack, stolen verifier attack, replay attack, impersonation attack, and reflection attack. The proposed achieves the mutual authentication essential for many applications.

신뢰적인 개방형 공유 인증 프로토콜 프레임워크

최근 들어 현재의 인터넷에서 널리 사용되고 있는 서비스 제공자 중심적인(service provider-centric) 고립형(isolated) 인증 모델의 사용자 편의성 부족, 고비용 구조, 그리고 프라이버시 보호 어려움 등의 문제를 해결하기 위해 단일 사인온(single sign-on) 기반의 공유 인증에 대한 연구가 활발하게 진행되어 왔다. 인증 제공자(authentication provider)의 인증 결과가 다수의 인터넷 서비스 제공자(service provider)에 의해 공유되는 공유 인증(shared authentication) 모델이 실제 인터넷 환경에 적용되기 위해서는 사용자, 서비스 제공자, 그리고 인증 제공자간의 인증 보증 수준(level of authentication assurance)과 인증 정보 보호 수준(level of authentication information protection)에 대한 신뢰가 매우 중요하다. 본 논문은 사용자 중심적인(user-centric) 동작과 개방형 신뢰 제공자 네트워크(trust provider network)와 결합된 신뢰적이고 프라이버시 보호가 가능한 공유 인증 프로토콜에 대한 프레임워크를 제시한다. 제안된 공유 인증 프로토콜 프레임워크는 상호동작 가능한 개방형의 신뢰적인 인증 서비스를 제공함으로써 기존 공유 인증 연구들과 차별화된다. Recently, researches on the shared authentication based on single sign-on have been actively performed so as to solve the problems of current service provider-centric and isolated Internet authentications, including low usability, high cost structure, and difficulty in privacy protection. In order for the shared authentication model, where the authentications of an authentication provider are shared by several Internet service providers, to be accepted in real Internet environment, trustworthiness among users, service providers, and authentication providers on the level of authentication assurance and the level of authentication information protection is necessarily required. This paper proposes a framework for trustworthy and privacy-protected shared authentication protocol based on the user-centric operation and open trust provider network. The proposed framework is differentiated from previous works in the points that it is able to provide interoperable shared authentication services on the basis of open trust infrastructure.

The Concept of Extensible Authentication Protocol for Mobile Equipment to Heterogeneous Network (EAP-M2H)

Extensible Authentication Protocol (EAP) is a universal authentication framework defined by RFC3748 and updated by RFC5247. It is not a specific authentication mechanism for exclusive system and then the widespread acceptance and implementation in wireless networks or other Point-to-Point (P2P) connections. A number of vendor specific EAP methods were proposed for special purpose such as EAP-MD5, EAP-TLS, EAP-TTLS, EAP-PEAP, LEAP, SPEKE, EAP-SIM, EAP-AKA, EAP-FAST, and so on. All of them have a common characteristic that the client submitted his Security Association (SA) to the neighbor Access Point (AP), then AP forward it to identify his validity by Authentication Authorization Accounting (AAA) server of both sides. Although these EAPs are design to meet the widespread authentication demands. But in fact they have the independent authentication procedure respectively. That is they are incompatible with each other. For mobile devices, in order to meet the needs of different connection it had to support many of the EAPs. This situation for the most mobile devices is a heavy load and result the inconvenient which move in the different service network. This paper devotes in solves this situation. For this goal, an extensible authentication protocol for mobile equipment to heterogeneous network (EAP-M2H) is provided in the paper. EAP-M2H development from the EAP-AKA and improve their applicability and compatibility in heterogeneous network.

Enterprise unified authentication and authorization system based on Web services

In order to achieve the goal of unified scheduling and unified management in application system,unified authentication and authorization has become more and more important and sophisticated.The background and the goal of unified authentication and unified authorization system were analyzed firstly,then the unified authentication,authorization and Web services were analyzed and compared,and a unified method of authentication and authorization in enterprise combining the Web services was proposed;therefore,it was more convenient to administer the concrete application system for administrator,which truly reconstructed completely unified authentication and authorization,and the design and implementation of the concrete service specification(or interface) by the practical project were given.

Secure interoperation of identity managements among different circles of trust

Secure Interoperation between different identity management (IdM) systems has become a challenge. In this paper, a framework is proposed to discover interoperation paths among identity providers (IdP) located in different circles of trust (CoT). According to the proposed framework, interoperation path and path discovery algorithm are proposed to establish a trust relationship between different CoTs. Security of the interoperation path is improved by the deployment of authentication assurance level (AAL) conversion and role mapping. Moreover, security of the path discovery process is guaranteed by path authentication which can resist security violation.

Embedding Authentication & Authorization in Discovery Protocols for Standard Based Publish/Subscribe Middleware: A Performance Evaluation

Standard based Pub/Sub middleware, such as OMG Data Distribution Service (DDS), could assume a key role in supporting computer communications requiring continuous state information updating, deterministic deadline to data delivering and real time information adjourning. This kind of capability could be well ex-ploited by Peer-To-Peer (P2P) systems, Internet-wide as long as private ones, like in Public Safety or Civil Protection Communication Systems; but Pub/Sub specifications, and DDS/RTPS (Real Time Publish Sub-scribe) as well, usually do not provide Authentication & Authorization (AA) mechanisms. In the present work two important novelties are assessed: a possible scheme to implement AA in DDS/RTPS networks and a time performance evaluation study about embedded Authentication in RTPS.

La Parodie Entre Respect et Contestation de L'auctoritas: Le Cas de Théodore de Banville

This article is concerned with parody in Banville's work and offers an analysis of the relationship between the author and the models which he rewrites. After a theoretical framing and definition of parody, I note how parody usually targets authoritative authors. If Banville declares his explicit wish to pay homage to those he admires thanks to parody and thus possesses a prestige notion of this mode of writing, his connection to the authors he rewrites brings with it a certain ambivalence. Banvillian parody, without involving the rejection of literary tradition (in particular of Hugo), nevertheless retains a critical relationship to his models, and his strong desire for originality conveys the need to overcome such models.

Infectious Diseases in Obstetrics and Gynaecology, 5th Edition

Infectious Diseases in Obstetrics and Gynaecology, 5th Edition

STORK: The European Electronic Identity Interoperability Platform

The STORK project aims to achieve the interoperability of the European electronic identifiers, which will allow European citizens to establish new e-relations with the Public Administration and private sectors. These new e-relations will be tested by means of pan-European pilots, with new service providers being connected to the platform on a regular basis. As a result, Pin a medium term, every citizen will be able to establish a company, pay her taxes, or change her address without physical presence, and just by using her national eID independently of wherever the service is provided at. All European countries have already deployed electronic identity solutions. However, the level of assurance respecting each solution differs. Consequently, STORK has established a mapping between the levels of assurance of each country and a commonly agreed set of quality authentication assurance levels (QAA). Thanks to STORK design, service providers can interact with foreign users in a seamlessly and transparent fashion, delegating to STORK the particularities of each eID solution processing, while at the same retain the control respecting the required level of assurance in the user's identity. In any case, the user will always be able to control the data flow, aborting a transaction if desired. Explicit consent of the owner of the data, the user, is always required before sending her data from one entity to another. On the other hand, the platform does not store any personal data, so the user's privacy is guaranteed and enforced by design.

Leveraging Biometrics for User Authentication in Online Learning: A Systems Perspective

With the rapid proliferation of online learning, students are increasingly demanding easy and flexible access to learning content at a time and location of their choosing. In these environments, remote users connecting via the public Internet or other unsecure networks must be authenticated prior to being granted access to sensitive content such as tests or personal/private records. Today, the overwhelming majority of online learning systems rely on weak authentication mechanisms to verify the identity of remote users only at the start of each session. One-time authentication using password, personal identification number (PIN), or even hardware tokens is clearly inadequate in that it cannot defend against insider attacks including remote user impersonation or illegal sharing or disclosure of these authentication secrets. As such, these methods are entirely unsuitable for circumstances where the outcome of an online assessment or a course of study is the granting of a formal degree, professional certification, or qualification or requalification for a particular skill or function. This paper examines the problem of remote authentication in online learning environments and explores the challenges and options of using biometric technology to defend against user impersonation attacks by certifying the presence of the user in front of the computer, at all times. It also leverages a 5-step process as the basis for a systems approach to ensuring that the proposed solution will meet the critical remote authentication assurance requirements. The process and systems approach employed here are generic, and can be exploited when introducing biometric-enabled authentication solutions to other applications and business domains. The paper concludes by presenting a biometrics-based client-server architecture for continuous user authentication in e-learning environments.

Multicast receiver access control by IGMP-AC

IP multicast is best-known for its bandwidth conservation and lower resource utilization. The present service model of multicast makes it difficult to restrict access to authorized End Users (EUs) or paying customers. Without an effective receiver access control, an adversary may exploit the existing IP multicast model, where a host or EU can join any multicast group by sending an Internet Group Management Protocol (IGMP) join message without prior authentication and authorization. We have developed a novel, scalable and secured access control architecture for IP multicast that deploys Authentication Authorization and Accounting (AAA) protocols to control group membership. The principal feature of the access control architecture, receiver access control, is addressed in this paper. The EU or host informs the multicast Access Router (AR) of its interest in receiving multicast traffic using the IGMP protocol. We propose the necessary extensions of IGMPv3 to carry AAA information, called IGMP with Access Control (IGMP-AC). For EU authentication, IGMP-AC encapsulates Extensible Authentication Protocol (EAP) packets. EAP is an authentication framework to provide some common functions and a negotiation of the desired authentication mechanism. Thus, IGMP-AC can support a variety of authentications by encapsulating different EAP methods. Furthermore, we have modeled the IGMP-AC protocol in PROMELA, and also verified the model using SPIN. We have illustrated the EAP encapsulation method with an example EAP method, EAP Internet Key Exchange (EAP-IKEv2). We have used AVISPA to validate the security properties of the EAP-IKEv2 method in pass-through mode, which fits within the IGMP-AC architecture. Finally, we have extended our previously developed access control architecture to accomplish inter-domain receiver access control and demonstrated the applicability of IGMP-AC in a multi-domain environment.

Secure fast WLAN handoff using time‐bound delegated authentication

AbstractTo support multimedia applications with good quality of services for roaming wireless local area network users, it is imperative to reduce the long re‐authentication latency that users experience during handoff among access points (APs). Athough a great deal of research resources have been put into the reduction of the re‐authentication latency, these schemes developed so far seem to either suffer from heavy overhead problems or have weak security. In this paper, we propose a novel approach to reducing the re‐authentication latency. With the authentication server (AS) periodically delegating its authentication authority to the authenticated APs, the APs can authenticate the roaming users on behalf of the AS. As our performance analysis and simulation results demonstrate, our new approach is capable of greatly reducing the latency and overhead while achieving a high security level. Furthermore, it does not increase the complexity on the AP side because only the already existing four‐way handshake with new keying mechanism is required. Copyright © 2008 John Wiley & Sons, Ltd.

Going Digital

Since its founding in March 2003, Queue has addressed the informational needs of the software development community through its printed version and Web site. Each issue has been carefully planned by a working board of prominent computing professionals and guest experts who meet monthly to set the magazine’s editorial agenda and suggest and enlist the most qualified and authoritative authors. Our Queue team has greatly benefited from your feedback over the past five years. You’ve helped us shape a unique magazine, and we thank you for your input and your loyalty.