Handshake Messages Research Articles

A survey of methods for encrypted network traffic fingerprinting.

Privacy protection in computer communication is gaining attention because plaintext transmission without encryption can be eavesdropped on and intercepted. Accordingly, the use of encrypted communication protocols is on the rise, along with the number of cyberattacks exploiting them. Decryption is essential for preventing attacks, but it risks privacy infringement and incurs additional costs. Network fingerprinting techniques are among the best alternatives, but existing techniques are based on information from the TCP/IP stack. They are expected to be less effective because cloud-based and software-defined networks have ambiguous boundaries, and network configurations not dependent on existing IP address schemes increase. Herein, we investigate and analyze the Transport Layer Security (TLS) fingerprinting technique, a technology that can analyze and classify encrypted traffic without decryption while addressing the problems of existing network fingerprinting techniques. Background knowledge and analysis information for each TLS fingerprinting technique is presented herein. We discuss the pros and cons of two groups of techniques, fingerprint collection and artificial intelligence (AI)-based. Regarding fingerprint collection techniques, separate discussions on handshake messages ClientHello/ServerHello, statistics of handshake state transitions, and client responses are provided. For AI-based techniques, discussions on statistical, time series, and graph techniques according to feature engineering are presented. In addition, we discuss hybrid and miscellaneous techniques that combine fingerprint collection with AI techniques. Based on these discussions, we identify the need for a step-by-step analysis and control study of cryptographic traffic to effectively use each technique and present a blueprint.

A Two-Step TLS-Based Browser fingerprinting approach using combinatorial sequences

We propose a two-step TLS-based fingerprinting approach using combinatorial sequences and properties of TLS handshake messages. Our approach combines fingerprinting based on attributes of the initial ClientHello message with the observed behavior of TLS clients when presented with permuted handshake messages in order to enhance the granularity of the derived fingerprints without increasing the required number of exchanged messages. We conduct a detailed evaluation against 21 browsers and TLS clients on two operating systems. The results show a significant increase in the entropy of the achieved splittings, allowing for a more precise identification of the TLS client than permitted by either of the underlying approaches in isolation.

App identification based on encrypted multi-smartphone sources traffic fingerprints

The smartphone app identification technology based on traffic fingerprints has begun to play an important role in monitoring malware and assisting network management with the smartphone security issues getting more attention. Smartphones connected to the Internet are often produced by multiple manufacturers, belong to multiple models and use a variety of operating systems. But current researches cannot achieve high-accuracy app identification while using datasets collected from traffic sources of different smartphone. In this paper, we propose an app identification system which use frequency distribution fingerprints to identify apps from encrypted multi-smartphone source traffic. The key idea of our work is to convert the occurrence frequency of traffic stream attribute values (e.g. TCP stream length and SSL/TLS handshake message type) into the format of frequency distribution. We use the random forest algorithm to identify apps from the frequency distributions extracted from the encrypted traffic collected from different three smartphones. In addition, we explore the impact of the app browsing contents, app behaviors, individual differences between smartphones of the same model and brand differences on the performance of our identification system. Our work achieves 99.3% TPR and 0.2% FPR performance on the datasets collected from two different brands of smartphones. Additionally, we show that the variety of app behaviors has the most significant impact on our identification performance, even more than the brand differences.

Priority Enabled Grant-Free Access With Dynamic Slot Allocation for Heterogeneous mMTC Traffic in 5G NR Networks

Although grant-based mechanisms have been a predominant approach for wireless access for years, the additional latency required for initial handshake message exchange and the extra control overhead for packet transmissions have stimulated the emergence of grant-free (GF) transmission. GF access provides a promising mechanism for carrying low and moderate traffic with small data and fits especially well for massive machine type communications (mMTC) applications. Despite a surge of interest in GF access, how to handle heterogeneous mMTC traffic based on GF mechanisms has not been investigated in depth. In this paper, we propose a priority enabled GF access scheme which performs dynamic slot allocation in each 5G new radio subframe to devices with different priority levels on a subframe-by-subframe basis. While high priority traffic has access privilege for slot occupancy, the remaining slots in the same subframe will be allocated to low priority traffic. To evaluate the performance of the proposed scheme, we develop a two-dimensional Markov chain model which integrates these two types of traffic via a pseudo-aggregated process. Furthermore, the model is validated through simulations and the performance of the scheme is evaluated both analytically and by simulations and compared with two other GF access schemes.

Exploiting Dissent: Towards Fuzzing-Based Differential Black-Box Testing of TLS Implementations

The Transport Layer Security (TLS) protocol is one of the most widely used security protocols on the internet. Yet do implementations of TLS keep on suffering from bugs and security vulnerabilities. In large part is this due to the protocol's complexity which makes implementing and testing TLS notoriously difficult. In this paper, we present our work on using differential testing as effective means to detect issues in black-box implementations of the TLS handshake protocol. We introduce a novel fuzzing algorithm for generating large and diverse corpuses of mostly-valid TLS handshake messages. Stimulating TLS servers when expecting a ClientHello message, we find messages generated with our algorithm to induce more response discrepancies and to achieve a higher code coverage than those generated with American Fuzzy Lop, TLS-Attacker, or NEZHA. In particular, we apply our approach to OpenSSL, BoringSSL, WolfSSL, mbedTLS, and MatrixSSL, and find several real implementation bugs; among them a serious vulnerability in MatrixSSL 3.8.4. Besides do our findings point to imprecision in the TLS specification. We see our approach as presented in this paper as the first step towards fully interactive differential testing of black-box TLS protocol implementations. Our software tools are publicly available as open source projects.

ME-TLS: Middlebox-Enhanced TLS for Internet-of-Things Devices

In-network middleboxes are vital for the Internet-of-Things (IoT) system security, but the widely adopted transport layer security (TLS) protocol blinds application-level middleboxes due to the encryption of traffic data. To resolve this problem, many solutions have been proposed to date. Among them, SplitTLS is widely adopted in the industry by proxy manufacturers. It requires TLS client to install customized root certificates and incurs additional security flaws, e.g., disabling server authentication and using weak cipher suites. Another approach is to customize the TLS protocol where middleboxes are enabled via either performing handshake directly with TLS endpoints or receiving session key materials in an out-of-band manner. Overall, current solutions would either jeopardize the original TLS handshake procedure or incur additional overheads on the endpoints. In this article, we design a new middlebox-enhanced TLS (ME-TLS), which enables endpoints to introduce authenticated middleboxes into a TLS session while control middleboxes’ access permission and processing order of traffic data. Particularly, in our proposed ME-TLS, the handshake structure of TLS keeps unchanged and middleboxes work in a passive manner. That is, middleboxes in the ME-TLS could recover session key materials by monitoring handshake messages passively instead of interacting with endpoints; secondary secure channels for key transmission are also not needed in our ME-TLS. We implement our ME-TLS based on the TLS 1.3 protocol and evaluate its performances. The experimental results demonstrate that our proposal is practical and deployable for real-world IoT scenarios.

Adjusting Holdoff Algorithm Dynamically According to Network Conditions for Improving Performance of Wireless Mesh Networks

Unlike Wi-Fi, Broadband Wireless Access (BWA) technology provides a high-speed communication in a wide area. The IEEE 802.16 (WiMAX) standard of wireless mesh networks is one of the widely used BWA standards. WiMAX mesh mode achieves data transmission in conflict-free manner in multihop networks by using the control messages (three way handshake messages or MSH-DSCH messages) to reserve channel for sending data. Concurrently, the coordination of three way handshake messages depends on the mechanism named Election based Transmission Timing (EBTT). However, IEEE 802.16 mesh mode uses a static holdoff algorithm, which leads to a low performance in the majority of cases. In this paper, after analyzing the IEEE 802.16 mesh mode with coordinated distributed scheduling, we propose a novel method to improve the throughput by a dynamic holdoff algorithm. The simulation results show that our proposal gets a better throughput performance.

Beaconless Packet Forwarding Approach for Vehicular Urban Environment

Existing wireless technologies provide communication and information services to all fields of life. The one of the emerging and popular field is vehicular ad hoc networks, with its unique characteristics and highly mobile environment. Different types of routing protocols have been proposed to address the routing issues in network and one of the most efficient types is geographical routing. In this type of protocols, the beacon messages are using to update the node locations and positions. However, these protoocls have been suffered with high channel congestion issue in the network. To this end, we propose a beaconless packet forwarding strategy based on modified handshake messages mechanism. The protocol uses some realistic metrics to select the next forwarder node such as forward progresss and link quality. The protocol performance is evaluated with existing beacon and beaconless geographical routing protocols. The simulation results showed the better performance of the proposed protocol in terms of packet delay and data delivery ratio in realistic wireless channel conditions.

Enhancing EAP-TLS authentication protocol for IEEE 802.11i

IEEE 802.11i authentication framework is composed of the 802.1x and an extensible authentication protocol (EAP) mechanism. One of the most applicable techniques in the EAP methods is EAP-transport layer security (EAP-TLS). The EAP-TLS implementation issues are high execution time; high number of data exchanges between two parties and possibility of closing connection as a result of modification in the contents of the handshake messages, which are all addressed in this paper. This research analyses the EAP-TLS in WLANs to improve this method's efficiency in terms of the security analysis, time and memory usage. Based on the results, this research proposes an enhanced method with a discrete cryptographic mechanisms and a distinct handshake structure, which reduces the number of steps in the handshake protocol. This enhanced method also provides robust security compared to the original EAP-TLS with approximately the same level of memory usage, which reduces execution time significantly.

Handshaking Protocol for Distributed Implementation of Reo

Reo, an exogenous channel-based coordination language, is a model for service coordination wherein services communicate through connectors formed by joining binary communication channels. In order to establish transactional communication among services as prescribed by connector semantics, distributed ports exchange handshaking messages signalling which parties are ready to provide or consume data. In this paper, we present a formal implementation model for distributed Reo with communication delays and outline ideas for its proof of correctness. To reason about Reo implementation formally, we introduce Timed Action Constraint Automata (TACA) and explain how to compare TACA with existing automata-based semantics for Reo. We use TACA to describe handshaking behavior of Reo modeling primitives and argue that in any distributed circuit remote Reo nodes and channels exposing such behavior commit to perform transitions envisaged by the network semantics.

Passive estimation of TCP round-trip times

We propose and evaluate a passive measurement methodology that estimates the distribution of Round-Trip Times (RTTs) for the TCP connections that flow through a network link. Such an RTT distribution is important in buffer provisioning, configuration of active queue management, and detection of congestion unresponsive traffic. The proposed methodology is based on two techniques. The first technique is applicable to TCP caller-to-callee flows, and it is based on the 3-way handshake messages. The second technique is applicable to callee-to-caller flows, when the callee transfers a number of MSS segments to the caller, and it is based on the slow-start phase of TCP. The complete estimation algorithm reports an RTT for 55-85% of the TCP workload, in terms of bytes, in the traces that we examined. Verification experiments show that about 90% of the passive measurements are within 10% or 5ms, whichever is larger, of the RTT that ping would measure. Also, measurements on several NLANR traces show that the two estimation techniques agree within 25ms for 70-80% of the processed TCP connections. We also apply the estimation methodology on a number of NLANR traces and examine the variability of the measured RTT distributions in both short and long timescales.

A novel spread spectrum-based synchronization and location determination method for wireless system

A new spread-spcetrum-based synchronization and geolocation method is presented. The synchronization method is based on determining the round-trip time between nodes. By using a spread-spectrum technique, delays of processing handshaking messages and switching transceivers from receiving mode to sending mode do not incur any inaccuracy. The geolocation method integrates our synchronization technique with the triangulation method, which is commonplace in geolocation systems. This new synchronization and geolocation method provides a cheap, efficient, and effective way to synchronize nodes and render location information in a wireless environment.