Key Assignment Research Articles

A multi-path interleaved hop-by-hop en-route filtering scheme in wireless sensor networks

A compromised node can generate a fabricated report, which results in false alarms, information loss, and a waste of precious network energy. An interleaved hop-by-hop authentication (IHA) scheme has been proposed to minimize such serious damage by detecting and filtering false reports at the very early en-route nodes. Unfortunately, IHA, with a single path from the source to the BS, cannot keep its security goal if more than t intermediate nodes are compromised. In this paper, an enhanced multi-path interleaved hop-by-hop authentication (MIHA) scheme is proposed. MIHA sets up disjoint and braided paths and switches to alternate paths when there is more than t compromised nodes on the current path to continue dealing with en-route insider attacks. A new key assignment mechanism was also applied to enhance network security and to reduce key storage overhead. Through analysis and simulations, MIHA exhibits improved resilience to en-route insider attacks and filters more bogus reports at early hops than IHA. Specially, with an attack frequency of 1/15 and a false traffic rate of more than 60%, MIHA with three disjoint paths can filter over 27% of false reports and is more energy efficient when compared to IHA.

Dynamic Polynomial Combinants and Generalised Resultants: Parameterization according to Order and Degree

The theory of constant polynomial combinants has been well developed and it is linked to the linear part of the constant Determinantal Assignment problem that provides the unifying description of the pole and zero assignment problems in Linear Systems. Considering the case of dynamic pole, zero assignment problems leads to the emergence of dynamic polynomial combinants. This paper aims to develop the fundamentals of the theory of polynomial combinants by examining issues of their parameterization of dynamic polynomial combinants according to the notions of order and degree. Central to this study is the link of dynamic combinants to the theory of “Generalised Resultants”. The paper provides a description of the key spectral assignment problems, derives the conditions for arbitrary assignability of spectrum and introduces a complete parameterization of combinants and respective Generalised Resultants which is crucial for studying the minimal degree and order spectrum assignability.

Time-Bound Hierarchical Key Assignment: An Overview

The access privileges in distributed systems can be effectively organized as a partial-order hierarchy that consists of distinct security classes, and the access rights are often designated with certain temporal restrictions. The time-bound hierarchical key assignment problem is to assign distinct cryptographic keys to distinct security classes according to their privileges so that users from a higher class can use their class key to derive the keys of lower classes, and these keys are time-variant with respect to sequentially allocated temporal units called time slots. In this paper, we present the involved principle, survey the state of the art, and particularly, look into two representative approaches to time-bound hierarchical key assignment for in-depth case studies.

Enforcing non-hierarchical access policies by hierarchical key assignment schemes

Without proposing a new key assignment scheme, this paper presents a graph translation procedure so that more complicated non-hierarchical access control policies can be enforced by existing hierarchical key assignment schemes.

Variations on a theme by Akl and Taylor: Security and tradeoffs

In 1983, Akl and Taylor [Cryptographic solution to a problem of access control in a hierarchy, ACM Transactions on Computer Systems 1 (3) (1983) 239–248] first suggested the use of cryptographic techniques to enforce access control in hierarchical structures. Due to its simplicity and versatility, the scheme has been used, for more than twenty years, to implement access control in several different domains, including mobile agent environments and XML documents. However, despite its use over time, the scheme has never been fully analyzed with respect to security and efficiency requirements. In this paper we provide new results on the Akl–Taylor scheme and its variants. More precisely: • We provide a rigorous analysis of the Akl–Taylor scheme. We consider different key assignment strategies and prove that the corresponding schemes are secure against key recovery. • We show how to obtain different tradeoffs between the amount of public information and the number of steps required to perform key derivation in the proposed schemes. • We also look at the MacKinnon et al. and Harn and Lin schemes and prove they are secure against key recovery. • We describe an Akl–Taylor based key assignment scheme with time-dependent constraints and prove the scheme efficient, flexible and secure. • We propose a general construction, which is of independent interest, yielding a key assignment scheme offering security w.r.t. key indistinguishability, given any key assignment scheme which guarantees security against key recovery. • Finally, we show how to use our construction, along with our assignment strategies and tradeoffs, to obtain an Akl–Taylor scheme, secure w.r.t. key indistinguishability, requiring a constant amount of public information.

The impact of key assignment on VANET privacy

AbstractThere are two underlying principles that guide how a vehicular ad hoc network (VANET) is built: there will be misbehavior and the extent to which vehicles can misbehave should be bounded. Additionally, the main use for VANETs currently is to enable safety applications where vehicles' position, velocity, and acceleration are broadcast to other vehicles in the VANET. Combining these guiding principles with this application results in the privacy of vehicles and users being an important concern for VANET design. Safety application messages are signed using keys and therefore linked to vehicles. In this work, we investigate how to assign keys to vehicles in order to preserve privacy and maintain our guiding VANET design principles. Specifically, we investigate the design space where individual keys may be given to multiple vehicles and vehicles may have multiple keys. Through a simple security analysis, we eliminate the case where all keys are common. Through mathematical and logical analysis, we conclude that keys should not be owned by multiple vehicles, that is, keys should be unique to vehicles and vehicles should be given multiple keys. Specifically, we show that it is impossible to provide good privacy and fast revocation when keys are shared among vehicles. Copyright © 2009 John Wiley & Sons, Ltd.

Research on Project Level Collaborative Design Process Oriented to Complex Product

This paper established a decomposition hierarchical network model of project level collaborative design process, based on work breakdown structure WBS, for character complex product collaborative design in dynamic alliance. The workflow of product collaborative design was established using time sequence Petri net, and the key assignment which has influence on design schedule and all design time were solved, after analyzing and comparing existing model method of collaborative design. And then experiments were used to verify. Theses technology support time management of workflow in project collaborative and shorten development cycle of collaborative project.

Cryptographically-enforced hierarchical access control with multiple keys

Hierarchical access control policies, in which users and objects are associated with nodes in a hierarchy, can be enforced using cryptographic mechanisms. Protected data is encrypted and authorized users are given the appropriate keys. Lazy re-encryption techniques and temporal hierarchical access control policies require that multiple keys may be associated with a node in the hierarchy. In this paper, we introduce the notion of a multi-key assignment scheme to address this requirement. We define bounded, unbounded, synchronous, and asynchronous schemes. We demonstrate that bounded, synchronous schemes provide an alternative to temporal key assignment schemes in the literature, and that unbounded asynchronous schemes provide the desired support for lazy re-encryption.

A fuzzy-based interleaved multi-hop authentication scheme in wireless sensor networks

In sensor networks, a compromised node can either generate fabricated reports with false votes or inject false votes into real reports, which causes severe damage such as false alarms, energy drain and information loss. An interleaved hop-by-hop authentication (IHA) scheme addresses the former attack by detecting and filtering false reports in a deterministic and hop-by-hop fashion. Unfortunately, in IHA, all en-route nodes must join to verify reports while only a few are necessary to the authentication procedure. In this paper, we propose a fuzzy-based interleaved multi-hop authentication scheme based on IHA. In our scheme, the fuzzy logic system only selects some nodes for verification based on the network characteristics. Moreover, we apply a voting method and a hash-based key assignment mechanism to improve network security. Through performance evaluation, the proposed scheme is found to save up to 13% of the energy consumption and to provide more network protection compared to IHA.

Efficient migration access control for mobile agents

The speed and convenience of the Internet has facilitated dynamic development in electronic commerce in recent years. E-commerce technologies and applications are widely studied by expert researchers. Mobile agent is considered to have high potential in e-commerce; it has been attracting wide attention in recent years. Mobile agent has high autonomy and mobility; it can move unbridled in different runtime environments carrying out assigned tasks while automatically detecting its current environment and responding accordingly. The above qualities make mobile agent very suitable for use in e-commerce. The Internet is an open environment, but transfer of confidential data should be conducted only over a secure environment. So, to transfer information over the Internet, a secure Internet environment is absolutely essential. Therefore, the security of present Internet environment must be improved. During its execution, a mobile agent needs to roam around on the Internet between different servers, and it may come in contact with other mobile agents or hosts; it may also need to interact with them. So, a mobile agent might come to harm when it meets a malicious host, and the confidentiality of data could also be compromised. To tackle the above problems, this paper proposes a security scheme for mobile agents. It is designed to ensure the safety of mobile agents on the Internet, and it also has access control and key management to ensure security and data confidentiality. Volker and Mehrdad [R. Volker, J.S. Mehrdad, Access Control and Key Management for Mobile Agents, “Computer Graphics”, Vol. 22, No. 4, August 1998, pp. 457–461] have already proposed an access control and key management scheme for mobile agents, but it needs large amount of space. So, this paper proposes a new scheme that uses the concepts of Chinese Remainder Theorem [F.H. Kuo, V.R.L. Shen, T.S. Chen, F. Lai, A Cryptographic Key Assignment Scheme for Dynamic Access Control in a User Hierarchy, “IEE Proceeding on Computers & Digital Techniques”, Vol. 146, No. 5, Sept. 1999, pp. 235–240., T.S. Chen, Y.F. Chung, Hierarchical Access Control Based on Chinese Remainder Theorem and Symmetric Algorithm, ”Computers & Security”, Vol. 21, No. 6, 2002, pp. 565–570., U.P. Lei, S.C. Wang, A Study of the Security of Mambo et al.'s Proxy Signature Scheme Based on the Discrete Logarithm Problem, June 2004], hierarchical structure and Superkey [S.G. Akl, P.D. Taylor, Cryptographic Solution to a Problem of Access Control in a Hierarchy, “ACM Transactions on Computer Systems”, Vol. 1, No. 3, August 1983, pp. 239–248]. A security and performance analysis of the proposed scheme shows that the scheme effectively protects mobile agents.

Key hierarchies for hierarchical access control in secure group communications

The problem of hierarchical access control in secure group communications has elicited much interest in the literatures. However, most of the researches to date on hierarchical access control pay more attention to the particular encryption techniques, but considered little about the features of key hierarchies. In hierarchical access control systems, keys are usually organized hierarchically. We analyze the user-based, resource-based and unified key hierarchies in this paper. The first two hierarchies are established from the access matrix. By unifying these two hierarchies, we get the unified key hierarchy. Furthermore, we introduce the explicit accessible set and the explicit dominating set to describe the key distributions for these hierarchies, and prove that the unified key hierarchy can be formed from the explicit dominating sets in the user-based key hierarchy or the explicit accessible sets in the resource-based key hierarchy. To evaluate the efficiency of the described key hierarchies, we combine these hierarchies with the existing key assignment models and analyze their storage and rekey overheads. These overheads can be derived from the access matrix, and the derivation procedure is described. The conclusions of this paper can help to establish a suitable key hierarchy so as to make the key assignment scheme more efficient in practical applications.

Skipping, Cascade, and Combined Chain Schemes for Broadcast Encryption

We develop a couple of new methods to reduce transmission overheads in broadcast encryption. The methods are based on the idea of assigning one key per each partition using one-way key chains after partitioning the users. One method adopts <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">skipping</i> <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">chains</i> on partitions containing up to <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</i> revoked users and the other adopts <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cascade</i> <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">chains</i> on partitions with layer structure. The scheme using the former has the transmission overhead [( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> )/( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</i> +1)]+ [( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> - <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> )/( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">c</i> )], which is less than <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> / <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</i> if <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> > <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">p</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> / <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">c</i> . The scheme using the latter keeps the same transmission overhead with the subset difference (SD) scheme when <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> approaches 0, where <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> is the number of revoked users. Combining the two schemes, we propose a new broadcast encryption scheme whose transmission overhead is the same with that of the SD scheme for small <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> and becomes smaller than that of the SD as <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</i> grows. The scheme using skipping chains possesses an advantage that any number of new users can join any time at no cost for current users. Finally, we show that the proposed key assignment scheme satisfies <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">key-indistinguishability</i> assuming pseudorandom generators.

Meshing Streaming Updates with Persistent Data in an Active Data Warehouse

Active data warehousing has emerged as an alternative to conventional warehousing practices in order to meet the high demand of applications for up-to-date information. In a nutshell, an active warehouse is refreshed online and thus achieves a higher consistency between the stored information and the latest data updates. The need for online warehouse refreshment introduces several challenges in the implementation of data warehouse transformations, with respect to their execution time and their overhead to the warehouse processes. In this paper, we focus on a frequently encountered operation in this context, namely, the join of a fast stream 5 of source updates with a disk-based relation R, under the constraint of limited memory. This operation lies at the core of several common transformations such as surrogate key assignment, duplicate detection, or identification of newly inserted tuples. We propose a specialized join algorithm, termed mesh join (MESHJOIN), which compensates for the difference in the access cost of the two join inputs by 1) relying entirely on fast sequential scans of R and 2) sharing the I/O cost of accessing R across multiple tuples of 5. We detail the MESHJOIN algorithm and develop a systematic cost model that enables the tuning of MESHJOIN for two objectives: maximizing throughput under a specific memory budget or minimizing memory consumption for a specific throughput. We present an experimental study that validates the performance of MESHJOIN on synthetic and real-life data. Our results verify the scalability of MESHJOIN to fast streams and large relations and demonstrate its numerous advantages over existing join algorithms.

New constructions for provably-secure time-bound hierarchical key assignment schemes

A time-bound hierarchical key assignment scheme is a method to assign time-dependent encryption keys to a set of classes in a partially ordered hierarchy, in such a way that each class in the hierarchy can compute the keys of all classes lower down in the hierarchy, according to temporal constraints. In this paper we propose new constructions for time-bound hierarchical key assignment schemes which are provably secure with respect to key indistinguishability. Our constructions use as a building block any provably-secure hierarchical key assignment scheme without temporal constraints and exhibit a tradeoff among the amount of private information held by each class, the amount of public data, the complexity of key derivation, and the computational assumption on which their security is based. Moreover, the proposed schemes support updates to the access hierarchy with local changes to public information and without requiring any private information to be re-distributed.

Efficient Key Distribution for Access Control in Pay-TV Systems

The conditional access system (CAS) is an essential part of digital pay-TV systems for controlling access to the program services. Conventionally, due to the restrictions of bandwidth and computational capability, a CAS only supports period subscription services that are charged on a monthly basis. In this paper, based on the concept of hierarchical key assignment, we propose three key distribution schemes for the access control of pay-TV systems. With these schemes, a CAS can support more charging strategies for service providers, such as adopting a smaller charging unit and allowing a subscription of any subset of channels with little communication and computational overhead. In addition, the piracy management problem can also be dealt with easily.

An Efficient Time-Bound Hierarchical Key Management Scheme for Secure Broadcasting

In electronic subscription and pay TV systems, data can be organized and encrypted using symmetric key algorithms according to predefined time periods and user privileges and then broadcast to users. This requires an efficient way of managing the encryption keys. In this scenario, time-bound key management schemes for a hierarchy were proposed by Tzeng and Chien in 2002 and 2005, respectively. Both schemes are insecure against collusion attacks. In this paper, we propose a new key assignment scheme for access control, which is both efficient and secure. Elliptic-curve cryptography is deployed in this scheme. We also provide the analysis of the scheme with respect to security and efficiency issues.

PVFS: A Probabilistic Voting-based Filtering Scheme in Wireless Sensor Networks

In this paper, we study two important attacks in Wireless Sensor Networks (WSNs): the fabricated report with false votes attack; the false votes on real reports attack. Most of the existing works address the first attack while leaving an easy way for the attackers to launch the second. We draw our motivation from this and propose a Probabilistic Voting-based Filtering Scheme (PVFS) to deal with both of these attacks simultaneously. With the general en-route filtering scheme as the underlying model, PVFS combines cluster-based organisation, probabilistic key assignment, and voting methods to curtail these attacks. Through both analysis and simulation, we demonstrate that PVFS can achieve strong protection against both the aforementioned attacks while maintaining a sufficiently high filtering power.

Clique-based group key assignment in Wireless Sensor Networks

Security has become the corner stone of research in Wireless Sensor Networks (WSNs). Watchdog-based-monitoring systems require pairwise-connectivity of group-members to avoid information asymmetry attacks. Existing group-key protocols in literature don't address this requirement. Although, pairwise-key protocols resolve this drawback, they are highly restrictive and impose substantial storage overhead. Additionally, messages encrypted with pairwise-keys render monitoring systems useless. In this paper, we propose CAGE – a novel, distributed, clique-based group-key protocol that strikes an optimal balance between pairwise-key and group-key protocols. We then present E-CAGE, an improvisation of CAGE that mitigates computation-time to achieve the same results as CAGE.

Energy and Bandwidth-Efficient Key Distribution in Wireless Ad Hoc Networks: A Cross-Layer Approach

We address the problem of resource-efficient access control for group communications in wireless ad hoc networks. Restricting the access to group data can be reduced to the problem of securely distributing cryptographic keys to group members, known as the key distribution problem (KDP). We examine the KDP under four metrics: (a) member key storage, (b) group controller (GC) transmissions, (c) multicast group (MG) update messages, and (d) average update energy. For each metric, we formulate an optimization problem and show that the KDP has unique solutions for metrics (a) and (b), while is NP-complete for (c) and (d). We propose a cross-layer heuristic algorithm called VP3 that bounds member key storage, and GC transmissions, while significantly reducing the energy and bandwidth consumption of the network. We define the notion of path divergence as a measure of bandwidth efficiency of multicasting, and establish an analytical worst-case bound for it. Finally, we propose on-line VP3, which dynamically updates the key assignment structure according to the dynamics of the communication group in a resource-efficient way.

A secure time-bound hierarchical key assignment scheme based on RSA public key cryptosystem

A secure time-bound hierarchical key assignment scheme based on RSA public key cryptosystem