Message Integrity Protection Research Articles

Message Integrity Protection Over Wireless Channel: Countering Signal Cancellation via Channel Randomization

Physical layer message integrity protection and authentication by countering signal-cancellation has been shown as a promising alternative to traditional pure cryptographic message authentication protocols, due to the non-necessity of neither pre-shared secrets nor secure channels. However, the security of such an approach remained an open problem due to the lack of systematic security modeling and quantitative analysis. In this paper, we first establish a novel signal cancellation attack framework to study the optimal signal-cancellation attacker's behavior and utility using game-theory, which precisely captures the attacker's knowledge using its correlated channel estimates in various channel environments as well as the online nature of the attack. Based on theoretical results, we propose a practical channel randomization approach to defend against signal cancellation attack, which exploits state diversity and swift reconfigurability of reconfigurable antenna to increase randomness and meanwhile reduce correlation of channel state information. We show that by proactively mimicking the attacker and placing restrictions on the attacker's location, we can bound the attacker's knowledge of channel state information, thereby achieve a guaranteed level of message integrity protection in practice. Besides, we conduct extensive experiments and simulations to show the security and performance of the proposed approach. We believe our novel threat modeling and quantitative security analysis methodology can benefit a wide range of physical layer security problems.

A Role-Based Access Control Model in Modbus SCADA Systems. A Centralized Model Approach.

Industrial Control Systems (ICS) and Supervisory Control systems and Data Acquisition (SCADA) networks implement industrial communication protocols to enable their operations. Modbus is an application protocol that allows communication between millions of automation devices. Unfortunately, Modbus lacks basic security mechanisms, and this leads to multiple vulnerabilities, due to both design and implementation. This issue enables certain types of attacks, for example, man in the middle attacks, eavesdropping attacks, and replay attack. The exploitation of such flaws may greatly influence companies and the general population, especially for attacks targeting critical infrastructural assets, such as power plants, water distribution and railway transportation systems. In order to provide security mechanisms to the protocol, the Modbus organization released security specifications, which provide robust protection through the blending of Transport Layer Security (TLS) with the traditional Modbus protocol. TLS will encapsulate Modbus packets to provide both authentication and message-integrity protection. The security features leverage X.509v3 digital certificates for authentication of the server and client. From the security specifications, this study addresses the security problems of the Modbus protocol, proposing a new secure version of a role-based access control model (RBAC), in order to authorize both the client on the server, as well as the Modbus frame. This model is divided into an authorization process via roles, which is inserted as an arbitrary extension in the certificate X.509v3 and the message authorization via unit id, a unique identifier used to authorize the Modbus frame. Our proposal is evaluated through two approaches: A security analysis and a performance analysis. The security analysis involves verifying the protocol’s resistance to different types of attacks, as well as that certain pillars of cybersecurity, such as integrity and confidentiality, are not compromised. Finally, our performance analysis involves deploying our design over a testnet built on GNS3. This testnet has been designed based on an industrial security standard, such as IEC-62443, which divides the industrial network into levels. Then both the client and the server are deployed over this network in order to verify the feasibility of the proposal. For this purpose, different latencies measurements in industrial environments are used as a benchmark, which are matched against the latencies in our proposal for different cipher suites.

PFC-CTR, PFC-OCB: Efficient stream cipher modes of authencryption

ABSTRACTAuthencryption is a cryptographic process of providing confidentiality and integrity protection of messages in a single pass, simultaneously, without any support of conventional checksum, MAC, or hash function. This article encompasses the process to construct the stream cipher-based authencryption environment, where the keystream is generated from any secure block algorithm like AES. Accordingly, in order to demonstrate the working principle of authencryption in the stream cipher environment, the authors introduce two stream cipher modes of authencryption, namely, PFC-CTR and PFC-OCB. PFC-CTR denotes the counter-based authencryption environment, and PFC-OCB specifies the authencryption environment built upon the underlying foundation of OCB. They argue that both of the proposed stream cipher modes of authencryption are quite robust against several active attacks (e.g., message stream modification attacks, known-plain-text attacks, and chosen-plain-text attacks). At the same time, they can efficiently deal with other issues like “limited error propagation,” and so on, existing in several conventional stream cipher modes of operation like CFB, OFB, and CTR.

Robust stream‐cipher mode of authenticated encryption for secure communication in wireless sensor network

AbstractAuthenticated Encryption is a cryptographic process of providing confidentiality and integrity protection of messages in a single pass without any support of conventional checksum, Message Authentication Code (MAC), or hash function. In this paper, at first, we show that how to construct the stream‐cipher‐based Authenticated Encryption environment, where the key‐stream is generated from any secure block algorithm like Advanced Encryption Standard. In order to do that, we introduce two stream‐cipher modes of Authenticated Encryption, namely, PFC‐CTR (Counter‐based Authenticated Encryption environment) and PFC‐OCB (OCB‐based Authenticated Encryption environment), which are quite robust against several active attacks, for example, message stream modification attacks, known‐plain‐text attacks, and chosen‐plain‐text attacks, and at the same time, they can also efficiently deal with some other issues like “limited error propagation” existing in several conventional stream‐cipher modes of operation like Cipher Feedback, Output Feedback, and Counter. Finally, we enforce the concept of Authenticated Encryption in the sense of data communication security of the wireless sensor network (WSN), Global Mobility Networks (GLOMONET), and Cloud Computing environment, where only encryption can guarantee both the privacy and integrity in a single pass with the assurance of reasonable computational overhead. Copyright © 2015 John Wiley & Sons, Ltd.

A solution to the anonymity of the mobile subscriber

The user anonymity mechanism provided in GSM and UMTS network is analyzed, and a new approach to solve the anonymity of mobile subscriber is proposed in this paper. Using the ciphering algorithm with a dynamic key and a static key, the method allows mobile subscribers to connect network with user anonymity, and it can be seamlessly integrated with the existing authentication algorithms. The analyses reveal that the proposed scheme can provide the integrity protection of messages, prevent the replay attacks, and be implemented easily.

UWB Noise-OFDM Netted Radar: Physical Layer Design and Analysis

It is well known that ultra-wideband (UWB) noise radar achieves high-resolution imaging of targets and terrain. The wide bandwidth yields fine range resolution, while the noise waveform provides immunity from detection, interference, and interception. Having multiple noise radars networked with each other provides significant benefits in target detection and recognition. We propose a scheme to modify the UWB noise radar to supplement it with secure multi-user network communication capabilities, thus architecting the UWB noise-orthogonal frequency-division multiplexing (OFDM) netted radar. The salient features of this multi-functional radar system include surveillance with embedded security-enabled OFDM-based communications, multi-user capability, and physical layer security. The system's physical layer design is analyzed for the composite UWB noise-OFDM waveform's dual performance, communications reliability, confidentiality, and message integrity protection. We also present critical issues that underscore the need for a unique medium access control (MAC) algorithm as a duplex multiplexing technique for this ad hoc multi-radar communications network.

Message Origin Authentication and Integrity Protection in Chaos-Based Optical Communication

In this paper, a message authentication and integrity protection scheme based on optically generated chaos is proposed. The introduced protocol relies physically on the dependence of chaos synchronization on the phase experienced by the delayed portion of the optical field inside the external cavity. The protocol's security is analytically evaluated, considering data modification and impersonation attack scenarios, and issues related to the practical implementation of the scheme are investigated.

Integrity Codes: Message Integrity Protection and Authentication over Insecure Channels

Inspired by unidirectional error detecting codes that are used in situations where only one kind of bit errors are possible (e.g., it is possible to change a bit "0" into a bit "1", but not the contrary), we propose integrity codes (I-codes) for a radio communication channel, which enable integrity protection of messages exchanged between entities that do not hold any mutual authentication material (i.e. public keys or shared secret keys). The construction of I-codes enables a sender to encode any message such that if its integrity is violated in transmission over a radio channel, the receiver is able to detect it. In order to achieve this, we rely on the physical properties of the radio channel and on unidirectional error detecting codes. We analyze in detail the use of I-codes on a radio communication channel and we present their implementation on a wireless platform as a "proof of concept". We further introduce a novel concept called "authentication through presence", whose broad applications include broadcast authentication, key establishment and navigation signal protection. We perform a detailed analysis of the security of our coding scheme and we show that it is secure within a realistic attacker model.