Host Authentication Research Articles

Uncovering Lateral Movement Using Authentication Logs

Network infiltrations due to advanced persistent threats (APTs) have significantly grown in recent years. Their primary objective is to gain unauthorized access to network assets, compromise system and data. APTs are stealthy and remain dormant for an extended period of time, which makes their detection challenging. In this article, we leverage machine learning (ML) to detect hosts in a network that are a target of an APT attack. We evaluate a number of ML classifiers to detect susceptible hosts in the Los Alamos National Lab dataset. We (i) scrutinize graph-based features extracted from host authentication logs, (ii) use feature engineering to reduce dimensionality, (iii) explore balancing the training dataset using over- and under-sampling techniques, (iv) evaluate numerous supervised ML techniques and their ensemble, (v) compare our classification model to the state-of-the-art approaches that leverage the same dataset, and show that our model outperforms them with respect to prediction performance and overhead, and (vi) perturb the attack patterns to study the influence of change in attack frequency and scale on classification performance, and propose a solution for such adversarial behavior.

Electromagnetic radiation based continuous authentication in edge computing enabled internet of things

Abstract With the rapid proliferation of Internet of Things, the centralized cloud faces the performance problems caused by remote network access and real-time services. To ensure good performance, edge computing paradigm emerges, and requires a secure authentication between edge host and cloud server to safeguard resources against any illegitimate access. Securing edge host authentication is an effective method and cornerstone to protect the information security in edge computing. Existing methods most recognize an entity's identity by password only once at the time of initial stage, which may lead to security problem. Continuous authentication as a novel authentication modality has the ability to alleviate this issue. Unlike the authentication operating merely at point-of-entry, a continuous edge host authentication method is proposed on the basis of electromagnetic radiation which reflects the behavioral characteristics of edge host with heterogeneous hardware. We demonstrate the feasibility of the proposed method through analysis of success rate from ten thousand waterfall spectrograms, and experimental results show that the average success rate of 95% has been achieved by support vector machine combining multiple features.

AuthFlow: authentication and access control mechanism for software defined networking

Software-defined networking (SDN) is being widely adopted by enterprise networks, whereas providing security features in these next generation networks is a challenge. In this article, we present the main security threats in software-defined networking and we propose AuthFlow, an authentication and access control mechanism based on host credentials. The main contributions of our proposal are threefold: (i) a host authentication mechanism just above the MAC layer in an OpenFlow network, which guarantees a low overhead and ensures a fine-grained access control; (ii) a credential-based authentication to perform an access control according to the privilege level of each host, through mapping the host credentials to the set of flows that belongs to the host; (iii) a new framework for control applications, enabling software-defined network controllers to use the host identity as a new flow field to define forwarding rules. A prototype of the proposed mechanism was implemented on top of POX controller. The results show that AuthFlow denies the access of hosts either without valid credentials or with revoked authorization. Finally, we show that our scheme allows, for each host, different levels of access to network resources according to its credential.

Secure mobile agents with controlled resources

AbstractMobile agents often travel in a hostile environment where their security and privacy could be compromised by any party including remote hosts in which agents visit and get services. It is believed that the host visited by an agent should jointly sign a service agreement with the agent's owner; hence a proxy‐signing model was proposed in the literature, allowing every host in the agent system to sign a service agreement. We observe that this actually poses a serious problem whereby a host that should be excluded from an underlying agent network could also send a signed service agreement. In order to solve this problem, we propose two schemes achieving host authentication with controlled resources, where only selected hosts can be included in the agent network. We provide two schemes in this paper. The second scheme offers a smaller data size. We also define security models and provide rigorous security proofs to our schemes. Copyright © 2010 John Wiley & Sons, Ltd.

A Real-Name Access Mechanism for the Next Generation Internet

With inherent design defects, the current Internet is facing with security threats and application bottlenecks. In this paper, a network security model of host real-name access was established by introducing host identity protocol and PKI system. It consisted of host authentication, host identifier management, and expansion domain name query. The source address and host name authentication, addressing and fine-grained access control were implemented by the model. It greatly improves the Internet security by providing an exploration scheme for construction of reliable next generation Internet.

A trusted host's authentication access and control model faced on user action

The conception of trusted network connection (TNC) is introduced, and the weakness of TNC to control user's action is analyzed. After this, the paper brings out a set of secure access and control model based on access, authorization and control, and related authentication protocol. At last the security of this model is analyzed. The model can improve TNC's security of user control and authorization.

Analysis of host authentication mechanism in current POD copy protection system

This paper analyses the host authentication mechanism in the current POD (point-of-deployment) copy protection system. At first, the re-authentication procedure cannot stand out a simple replay attack. Secondly, the host authentication protocol makes a DH (Diffie-Hellman) private key in any run as significant as a device private key. At last, the credentials of the POD module are futile. The result urges a technical improvement of the current host authentication mechanism.

Migration control for mobile agents based on passport and visa

Research on mobile agents has attracted much attention as this paradigm has demonstrated great potential for the next-generation e-commerce. Proper solutions to security-related problems become key factors in the successful deployment of mobile agents in e-commerce systems. We propose the use of passport and visa (P/V) for securing mobile agent migration across communities based on the SAFER (secure agent fabrication, evolution, and roaming) for e-commerce framework. P/V not only serve as up-to-date digital credentials for agent–host authentication, but also provide effective security mechanisms for online communities to control mobile agent migration. Protection for mobile agents, network hosts, and online communities is enhanced using P/V. We discuss the design issues in detail and evaluate the implementation of the proposed system.

A DSP Based POD Implementation for High Speed Multimedia Communications

In the cable network services, the audio/video entertainment contents should be protected from unauthorized copying, intercepting, and tampering. Point-of-deployment (POD) security module, proposed by OpenCableTM, allows viewers to receive secure cable services such as premium subscription channels, impulse pay-per-view, video-on-demand as well as other interactive services. In this paper, we present a digital signal processor (DSP) (TMS320C6211) based POD implementation for the real-time applications which include elliptic curve digital signature algorithm (ECDSA), elliptic curve Diffie Hellman (ECDH) key exchange, elliptic curve key derivation function (ECKDF), cellular automata (CA) cryptography, communication processes between POD and Host, and Host authentication. In order to get different security levels and different rates of encryption/decryption, a CA based symmetric key cryptography algorithm is used whose encryption/decryption rate can be up to 75 Mbps. The experiment results indicate that the DSP based POD implementation provides high speed and flexibility, and satisfies the requirements of real-time video data transmission.