Non-privileged Users Research Articles

Comments on “Provably Secure Generalized Signcryption Scheme With Public Verifiability for Secure Data Transmission Between Resource-Constrained IoT Devices”

Very recently, Karati et al. presented a new generalized CLSC (gCLSC) to provide the functions of digital signature and encryption to fulfill the authenticity and confidentiality for the resource-constrained Internet-of-Things (IoT) devices. Karati et al. claimed that the newly proposed gCLSC supports the property of public verifiability and security of an ideal signcryption under the strong Diffie–Hellman and bilinear Diffie–Hellman inversion problems without the random oracle model. Unfortunately, their scheme is insecure with respect to unforgeability. It is demonstrated that any receiver or nonprivileged user can generate a valid signature or signcrypted ciphertext on any message. Finally, this article also points out the flaw in their unforgeability proof and gives some suggestions on the construction of a concrete scheme.

Block Level De-duplication Check for Shared Data on Hybrid Cloud using Convergent Key

In regards to increase in use of digital information users prefer to store information in cloud system. In cloud storage system many users can store same type of data leading to data duplication causing a high utilization of bandwidth. Some techniques are proposed for making cloud more efficient and effective regarding to storage and bandwidth. In current time data de-duplication is effective technique to avoid such data duplication caused due to privileged as well as non-privileged user. To save bandwidth to transact data when replicating it offsite for disaster recovery huge organization, companies and all education institutes supports de-duplication technique. With the help of “Content hash keying” data confidentiality is provided. Using this technique data is first encrypted and the encrypted data is outsourced to the client. To address the problem of authorized access in our proposed system deduplication check technique is introduced and privileged access which is different from traditional data de-duplication check system. Log based approach for unauthorized data duplication check in hybrid cloud architecture is also explored. For privileged as well as for non-privileged users de-duplication can be managed using the above technique. Proposed system provides clever solution for duplication of data and also works on bandwidth efficiency.

Distributed Encrypting File System for Linux in User-space

Linux systems use Encrypting File System (EFS) for providing confidentiality and integrity services to files stored on disk in a secure, efficient and transparent manner. Distributed encrypting file system should also provide support for secure remote access, multiuser file sharing, possible use by non-privileged users, portability, incremental backups etc. Existing kernel-space EFS designed at file system level provides all necessary features, but they are not portable and cannot be mounted by non-privileged users. Existing user-space EFS have performance limitations and does not provide support for file sharing. Through this paper, modifications in the design and implementation of two existing user-space EFS, for performance gain and file sharing support, has been presented. Performance gain has been achieved in both the proposed approaches using fast and modern ciphers. File sharing support in proposed approaches has been provided with Public Key Infrastructure (PKI) integration using GnuPG PKI module and Linux Pluggable Authentication Module (PAM) framework. Cryptographic metadata is being stored as extended attributes in file's Access Control List (ACL) to make file sharing task easier and seamless to the end user.

Plan 9 authentication in Linux

In Linux, applications like su and login currently run as root in order to access authentication information and set or alter the identity of the process. In such cases, if the application is compromised while running as a privileged user, the entire system can become vulnerable. An alternative approach is taken by the Plan 9 operating system from Bell Labs, which runs such applications as a non-privileged user and relies on a kernel-based capability device working in coordination with an authentication server to provide the same services. This avoids the risk of an application vulnerability becoming a system vulnerability. This paper discusses the extension of Linux authentication mechanisms to allow the use of the Plan 9 approach with existing Linux applications in order to reduce the security risks mentioned earlier. It describes the port of the Plan 9 capability device as a character device driver for the Linux kernel. It also describes the port of the Plan 9 authentication server and the implementation of a PAM module which allows the use of these new facilities. It is now possible to restrain processes like login and su from the uncontrolled setuid bit and make them run on behalf of an unprivileged user in Linux .

A micro-kernel for concurrency in C

A micro-kernel that supports concurrent execution of C procedures within a single user process is described. A micro-kernel provides only four primitives, which have been used to build a number of higher-level abstractions, including support for distributed processing. The micro-kernel differs from other efforts in that it is small and efficient, it is written entirely as a non-privileged user program, and it provides fine-grained unpredictable interleaving of execution.

The protection of the processor status word of the PDP-11/60

This work discusses the protection of the Processor Status Word of the PDP-11/60 computer and shows how a non-privileged user can modify the processor priority and execute his programs at PR7 priority level, that is, with all interrupts blocked. It also suggests some possible solutions to this problem. Finally, it considers how the problem is solved in the VAX-11.