Use Of Public Key Infrastructure Research Articles

Man in the Middle - Hacker's Playground

AbstractThere has been an increase in potential sources of threats to the security of information systems and dataof governments, companies and individuals in the present day, due to the growing number ofinformation systems types and devices, the expanding availability of freely-downloadable open sourcetools, the degree of interconnectivity made possible by the internet, and the concentration of more selfhelppower in the hands of individual end users. A numerically-insignificant number of the totalpopulation of information systems end users is made up of black hat users who have caused significanteconomic losses and reputational damages for organizations and governments through exploitation ofsecurity vulnerabilities. One of the most common and widespread security threats is that of Man-in-the-Middle (MitM), which has remained a major source of concern to security professionals for many years,and continues to pose a threat to information security as the focus of attack continues to be data, and theblack hat users continue to look for new ways to circumvent security safeguards implemented forexisting technologies and countermeasures planned for new and emerging technologies. Many papershave been written about Man-in-the-Middle attack, that have described different kinds of such attacksand explained solutions to the attacks but not illustrated how the attack can be carried out and showedhow the risks arising from such attacks can be mitigated. This paper presents a step-by-step account ofone way in which MitM attack can be realized and how the confidentiality and integrity of data can beprevented from being compromised through use of PKI (Public Key Infrastructure).

A Novel Collaborative PKI Framework in Public Cloud

Public Key Infrastructure (PKI) is a repository and management system for digital certificates. It can be the centralized or decentralized PKI system for issuing, managing, storing, verifying and distributing the key pairs, public key and private key, or one of the public key certificates. In public cloud, Data Owners and Data Users can upload or download their encrypted data along with services, resources and infrastructures in the hands of Cloud Service Provider. It creates the big security concerns in terms of data security and data privacy for the user and Cloud Service Provider is the sole responsibility to provide the Access Control Policy to restrict the cloud services centrally. With the emergence of cloud computing, Public Key Infrastructure (PKI) technology enables the secure communications in between systems. X.509 certificates are based on the centralized PKI and suffers so many issues in the public cloud. Gnu Privacy Guard (GnuPG) certificates are based on the decentralized PKI system. Imagine a world with decentralized PKI system in which each Kerberos is also a Central Authority for issuing certificates to the system or users. This proposed collaborative PKI framework describes the use of PKI in public cloud, proposed algorithm for Kerberos SSO token and provides acquisition of Public Key certificates from the client via Kerberized Central Authorities.

PSAP: Pseudonym-Based Secure Authentication Protocol for NFC Applications

Nowadays, near field communication (NFC) has been widely used in electronic payment, ticketing, and many other areas. NFC security standard requires the use of public key infrastructure (PKI) to implement mutual authentication and session keys negotiation in order to ensure communication security. In traditional PKI-based schemes, every user uses a fixed public/private key pair to implement authentication and key agreement. An attacker can create a profile based on user’s public key to track and compromise the user’s privacy. Recently, He et al. and Odelu et al. successively proposed pseudonym-based authentication key and agreement protocols for NFC after Eun et al. ’s protocol (2013), which is first claimed to provide conditional privacy for NFC. They respectively claimed that their scheme can satisfy the security requirements. In this paper, first, we prove that their protocols still have security flaws, including the confusion of the user’s identity and the random identity. Then, we propose a pseudonym-based secure authentication protocol (PSAP) for NFC applications, which is effective in lifetime and includes time synchronization-based method and nonce-based method. In our scheme, trusted service manager issues pseudonyms but does not need to maintain verification tables and it could reveal the user’s identity of internal attackers. Furthermore, security and performance analysis proves that PSAP can provide traceability and more secure features with a little more cost.

Integrity monitoring implementation for the operating system image loaded through a network to the thin clients

The paper deals with the problem of protection for the process of operating system loading from the server to the diskless workstation through a network and the analysis of the existing ways of integrity monitoring for information transferred under network protocols. Within the scope of research, solution is proposed making it possible to perform integrity monitoring of the operating system loaded image before control is transferred to it. For security protection of loading, key information elements are marked which integrity needs to be guaranteed. The developed solution, as an information security product, should meet the requirements of information security and at the same time be compatible to other hardware and software tools used for protection of the automated systems. The proposed solution implements the algorithm of integrity monitoring for an operating system designed with the use of public key infrastructure. Analysis of hardware configuration for the projected solution from the point of view of its usability and administration ease is provided, and possibilities of intruder’s attacks to the protected information are estimated, as well.

Analysis of Security Issues in VoIP

The most common way of communication is obviously through voice exchange. There are mainly two ways by which voice can be easily transmitted over a network: PSTN (Public Switched Telephone Network) and VoIP (Voice over Internet Protocol). The VoIP is relatively new and is gaining more and more popularity as it offers a wide range of features and is much more cost effective as compared to the traditional PSTN. But the VoIP brings with it certain security threats which need to be resolved in order to make it a more reliable source of communication. One of the most concerning security threats of VoIP technology is VoIP Spoofing. Caller ID Spoofing is a technique in which a person takes the identity of a different person to make a call to a third party, thereby hiding his/her original identity. None of the existing protocols so far have been able to prevent Spoofing of calls. This research explains the fundamentals of the Session Initiation Protocol and the Asterisk Server. Also, a new system is proposed which makes use of Public Key Infrastructure which can be used to create digital certificates for the VoIP, thereby helping us to make VoIP calls which are more secure. The PKI is a form of Cryptography which is used to create and manage digital certificates. The PKI mainly consists of (i) a certificate authority that issues the certificates (ii) registration authority which helps in verifying the identity of users (iii) central directory to store the certificates. Also, this paper gives a brief overview of the Asterisk Server which is used to make calls over the Internet. The basic idea is to implement the SIP with the Asterisk Server and using the concepts of Public Key Infrastructure to provide the Asterisk Server with the desired Digital Certificates so as to authenticate the user which in turn will make calling over the Internet more secure.

KCI-resilient anonymous wireless link-layer authentication protocols

Recently, many works have been focusing on solving the problem of privacy protection at link-layer level by randomizing all bits of the frames at link layer so that it makes difficult for unintended recipients to associate sequences of packets to their source transmitters. Most existing schemes however assume either the pre-setup for shared secrets between communication entities or the use of public-key infrastructure. These requirements limit the use of the schemes. In this paper, we describe new techniques for protecting the privacy and security of communication entities at wireless link-layer level. Our techniques have a number of crucial advantages. They mitigate the requirement of a key setup or a public-key infrastructure. They provide not only the link-layer privacy, but also the required security properties, including key compromise impersonation resilience, impersonation resistance and forward secrecy. They are simple and relatively fast.

Building Trust In Cloud Using Public Key Infrastructure - A step towards cloud trust

Cloud services have grown very quickly over the past couple of years, giving consumers and companies the chance to put services, resources and infrastructures in the hands of a provider. There are big security concerns when using cloud services. With the emergence of cloud computing, Public Key Infrastructure (PKI) technology has undergone a renaissance, enabling computer to computer communications. This study describes use of PKI in cloud computing and provides insights into some of the challenges which cloud-based PKI systems face.

Efficient and provably secure password-based group key agreement protocol

This paper considers the issue on authenticated group key agreement protocol among n users broadcasting communication over an insecure public network. Many authenticated group Diffie-Hellman key agreement protocols have been proposed to meet the challenges. However, existing protocols are either limited by the use of public key infrastructure or by their scalability, requiring O(n) rounds. To overcome these disadvantages, we propose an efficient password-based group key agreement protocol resistant to the dictionary attacks by adding password-authentication services to a non-authenticated multi-party key agreement protocol proposed by Horng. The proposed protocol is very efficient since it only requires constant rounds to agree upon a session key, and each user broadcasts a constant number of messages and only requires four exponentiations. Under the Decisional Diffie-Hellman assumption, we will show the proposed protocol is provably secure in both the ideal-cipher model and the random-oracle model.

전방향 안전성을 갖는 RSA 전자서명 기법에 대한 연구

Many service systems use Public Key Infrastructure (PKI) to protect the service. But there arc problems with the use of PKI. One of the problems is that some services would require a function instantaneously to check public kel certificate, but PKI does not satisfy such request. To solve the problem, Bouch et al. first proposed the concept of mediated RSA (mRSA). Then Gene Tsudik proposed `weak` forward secure mRSA. In this paper, we analyze the weakness of these schemes and find the source of the vulnerabilitv. And we propose a new mRSA that is strong forward secure.

A public‐key based authentication and key establishment protocol coupled with a client puzzle

AbstractNetwork Denial‐of‐Service (DoS) attacks, which exhaust server resources and network bandwidth, can cause the target servers to be unable to provide proper services to the legitimate users and in some cases render the target systems inoperable and/or the target networks inaccessible. DoS attacks have now become a serious and common security threat to the Internet community. Public Key Infrastructure (PKI) has long been incorporated in various authentication protocols to facilitate verifying the identities of the communicating parties. The use of PKI has, however, an inherent problem as it involves expensive computational operations such as modular exponentiation. An improper deployment of the public‐key operations in a protocol could create an opportunity for DoS attackers to exhaust the server's resources. This paper presents a public‐key based authentication and key establishment protocol coupled with a sophisticated client puzzle, which together provide a versatile solution for possible DoS attacks and various other common attacks during an authentication process. Besides authentication, the protocol also supports a joint establishment of a session key by both the client and the server, which protects the session communications after the mutual authentication. The proposed protocol has been validated using a formal logic theory and has been shown, through security analysis, to be able to resist, besides DoS attacks, various other common attacks.

Public key infrastructure in mobile systems

In current mobile systems, some applications to some extent already use public key techniques and an underlying public key infrastructure (PKI) to provide end-to-end security, and such use is widely expected to grow. This paper provides an overview of the basic techniques and the entities that are involved in a PKI and describes how they are used in current mobile systems. The paper also highlights the envisaged use of PKI in future mobile systems and the challenges that brings, drawing on results of the European Union's SHAMAN project.