Search

Forward secrecy is an important feature for modern cryptographic systems and is widely used in secure messaging such as Signal and WhatsApp as well as in common Internet protocols such as TLS, IPSec, or SSH. The benefit of forward secrecy is that the damage in case of key-leakage is mitigated. Forward-secret encryption schemes provide security of past ciphertexts even if a secret key leaks, which is interesting in settings where cryptographic keys often reside in memory for quite a long time and could be extracted by an adversary, e.g., in cloud computing. The recent concept of puncturable encryption (PE; Green and Miers, IEEE S&P’15) provides a versatile generalization of forward-secret encryption: it allows to puncture secret keys with respect to ciphertexts to prevent the future decryption of these ciphertexts.

This paper presents an application of security protocol based-on mu-tual authentication procedure between involved entities that providing data and network security in wireless sensor environment communication. Through WSN, a user can access base station of wireless sensor networks and gets the data. This paper proposes a secure authentication protocol where involved enti-ties are mutual strongly verified before accessing the data. The proposal pro-vides secure features standards such as data integrity, mutual authentication and session key establishment. Furthermore, an extensive analysis shows that the proposed scheme possesses many advantages against popular attacks, achieves better efficiency and can be safeguard to real wireless sensor network applications.

This paper concentrates in the privacy protection in Internet of things. It firstly focuses on the security issues and attack risks of Internet of things from four aspects, which are perception layer, transport layer, application layer and the integrated networking system. And it puts forward some proposals on wireless sensor network and RFID (Radio Frequency Identification) security system structure. The researches are theoretical basis in security defense of Internet of things. Furthermore, in order to reduce the security risks in Internet of things communication process, this paper puts forward key-changed mutual authentication protocol. The protocol integrates random number generator in the tag and reader, and adopts the one-way Hash function, key refresh in real time, key backup and other mechanisms. The analysis shows that this protocol is able to be well applied to low cost Internet of things system and effectively prevent the network from replay, replication, denial of service, spoofing and tag tracking attacks.

The Internet Protocol Version 6 (IPv6) usage is booming up in recentyears due to the address scarcity of existing protocol. This protocol faces various security threats and is under research for few decades. Although IPsec is mandated for security over IPv6 end-to-end communication, it does not support link local communication. Link local security issues are considered to be important during autoconfiguration. The existing mechanism SeND used to provide security during autoconfiguration faces issues related to algorithmic complexity, router functionality implications, key generation etc. The paper proposes a privacy extension method for link local address generation by using the internal hardware states of the system, thus overcoming the existing issues. The prototype is implemented in a real time system and compared with SeND. The proposed method has proven to outperform the existing methods in terms of algorithmic strength and thereby reduce the complexity and time delay during implementation.

IPSec is IP security protocol made by IETF which is designed for the next generation network, and is the mandatory part of IPv6 protocol stack. In this paper, the IPSec protocol and the Netfilter mechanism of Linux are introduced briefly. Then a new design idea and system design scheme is presented in detail, the final realization of IPSec protocol which is based on the Netfilter mechanism shows this scheme properly, efficiently and stability, which sets up the basis for the development of security route, VPN, next generation network.

This paper summarises the issues created when deploying a virtual private network in broadband satellite systems. These issues are related to protocol enhancing, overhead, fragmentation, mobility, quality of service and network address translation. Solutions for these issues are proposed from the point of view of the satellite operator, since most depend on what degree of control it has over the network. More specifically, this paper explains which solutions can be applied when the satellite links an airplane with the ground.

We present the Plug-and-Play IP Security (PnP-IPsec) protocol. PnP-IPsec automatically establishes IPsec security associations between gateways, avoiding the need for manual administration and coordination between gateways, and the dependency on IPsec public key certificates - the two problems which are widely believed to have limited the use of IPsec mostly to intra-organization communication.

Performance Enhancing Proxies (PEPs) are used in satellite networks for better performance of the TCP/IP applications. Multi-layer IPSec (ML-IPSec) resolves the conflict between end-to-end security in standard IPSec and operation of PEPs. Previous Ml-IPSec solution has issues of limited application scope and increased complexity to implement and process the ML-IPSec protected data. This paper presents a new dynamic ML-IPSec protocol which addresses these issues. The paper also analyzes the protocol with reference to previous ML-IPSec protocol and presents the experiment performed to analyze the network performance while running IPSec and ML-IPSec.

With the society constantly information-making and networking, the demand of network equipments also increase. Against the security problems, this paper realizes IPSec protocol by using network processor, and uses the FPGA chip to do data encryption, and then design the hardware and software structure of the security router. All in all, the system owns advantages of low price, strong performance, high universality and good extensibility.

In this paper, we focus on a feasible security solution to WLAN. We first analyzed EAP-TLS and the IPSec support mechanism in Linux. Secondly, we implemented EAP-TLS authentication and VPN gateways. This paper illustrates the configuration of STA, AP and RADIUS server and the application of ipsec-tool. It also summarizes the security considerations of the solution associating EAP-TLS with IPSec VPN.

With the rapid development of the RFID systems in the Internet of Things, many significant security concerns have been raised. This paper proposes a new Secure Data Exchange Protocol. This protocol combines Hash and stream cipher encryption algorithms. The analysis shows that this protocol involves no computationally intensive cryptographic operations and relatively little storage.

While the details of the Next-generation IPv6 protocol are now reaching maturity,the next hurdle in realizing the promises of IPv6 is the need for deployment on a wider scale.The process of transitioning from IPv4 to IPv6 is currently being extensively studied with a goal to achieve high level compatibility and clear procedure for easy and an autonomous deployment of IPv6.IPv6 offers variety of enhancements including increased Addressing capabilities,QoS control,Mobility,Built in IPSec and Improved routing efficiency which are seen as potential improvements to IPv4 and serve as main drivers for adopting it. We Proposed Parallel Computing based diminution tree with list ranking based BD-TTCS as a new innovative IPv4/IPv6 transition mechanism and it also acts as a research challenge with other IETF IPv6 transition mechanisms and discusses the various potential key performance issues like throughput, end-to-end delay, Jitter, Packet loss, RTT etc. In order to plot bar graph and Line Graph we used Matlab 7.11.0(R2010b).

The issue of securing control signaling in mobility management is still an unsolved concern. To offer enhanced security, features in the recent mobile IP protocols rely on the use of IP Security (IPSec) Security Association (SA). However, the SA itself will cease to be valid if a mobile node moves or a network moves. This paper proposes secure mobile IP (SecMIP) scheme based on one-time transaction key agreements instead of using the pre-generated IPsec SA. In the proposed scheme, the mobile node is responsible for relaying its blind key information from the Home Agent (HA) to the Foreign Agent (FA) while the relating secret value is securely kept in its HA. Receiving the Binding Update (BU) message that contains the FA's blind key, the HA can calculate the same transaction key as the FA. We analyze the time required for the enemy to succeed to attack our SecMIP scheme on integrity and authentication. Based on the analysis results, we suggest the optimum use of the operational parameters in our SecMIP scheme relating to the length of the secret value and the length of the prime number q in digit. The derived dimensions can guarantee an average of 1 year required for exhaustive key searching by brute force approaches while maintaining a maximum addition of 200 millisecond time latency for the HA and the FA to process the secured BU message.

The IEEE 802.16 standard, which is known as Worldwide Interoperability for Microwave Access (WiMAX), is one of the latest technologies in the wireless world. The main goal of WiMAX is to deliver wireless communications with guaranteed quality of service (QoS), security and mobility. Multimedia applications are bandwidth demanding and error sensitive, whereas wireless medium is unreliable and bandwidth limited. In this paper, we evaluate the performance of secure video transmission over WiMAX networks. We mainly illustrate the results of the simulations. To this end we depict the processing time and the throughput introduced when IP Security (IPSec) is applied over WiMAX. The most commonly used cryptographic algorithms and Hashed-Message Authentication Codes (HMAC), such as Advanced Encryption Standard (AES), Data Encryption Standard (DES), 3DES, Secure Hash Algorithm 1 (SHA-1) and Message Digest 5 (MD-5) are considered for this study.

Virtual Private Networks (VPNs) are increasingly used to build logically isolated networks. However, existing VPN designs and deployments neglect the problem of traffic analysis and covert channels. Hence, there are many ways to infer information from VPN traffic without decrypting it. Many proposals were made to mitigate network covert channels, but previous works remained largely theoretical or resulted in prohibitively high padding overhead and performance penalties.

The implications and challenges of security in vehicular ad-hoc networks are huge for several reasons and, basically, for human safety effects and due to the complex and highly dynamic setting. Additionally security, being a cross-layer topic, can be managed at different layers of the network stack (e.g. at MAC-level - with encryption and authentication, at network-layer - as with IPsec, at transport-layer TLS, SSL). A rich scientific literature has addressed the issue of vanet security, however, all the proposed solutions (i) focus on a specific layer and (ii) offer either robust but not scalable solutions (such as the PKI infrastructure, hardly managed under mobility for all the nodes and services) or weak ones (at least weak if applied to human safety). For this reason, in the present paper, security for vanet is faced with a layered approach which lets envisage several solutions, properly and hierarchically differentiated for distinct services. Additionally, what introduces an even stronger novelty, the dissertation covers both CSMA/CA and slotted MAC protocols, having the latter recently encountered a certain scientific favour.

Access control policies play a critical role in the security of enterprise networks deployed with variety of policy-based devices (e.g., routers, firewalls, and IPSec). Usually, the security policies are configured in the network devices in a distributed fashion through sets of access control lists (ACL). However, the increasing complexity of access control configurations due to larger networks and longer policies makes configuration errors inevitable. Incorrect policy configuration makes the network vulnerable to different attacks and security breaches. In this paper, we present an imperative framework, namely, ConfigLEGO, that provides an open programming platform for building the network security configuration globally and analyzing it systematically. The ConfigLEGO engine uses Binary Decision Diagram (BDD) to build a Boolean model that represents the global system behaviors including all possible interaction between various components in extensible and scalable manner. Our tool also provides a C/C++ API as a software wrapper on top of the BDD engine to allow users in defining topology, configurations, and reachability, and then analyzing in various abstraction levels, without requiring knowledge of BDD representation or operations.

Due to security protocols be Proven “safety" are few use in internet of things now, and design and analysis them is a very difficult thing, this paper research on the establishment of wireless sensor network security protocol in internet of things(IOT), the protocol provide a variety of services such as the mutual authentication of communication agents, the distribution extemporaneous public key, the encryption and decryption of dates and the sending or receiving of acknowledgement and so on in the environment of IOT, so security protocols must satisfy relational security properties, firstly, this paper analyses the architecture of internet of things and abstracts the communication agents satisfied the physical characteristics and the requirements of application of internet of things, and then put forward a security protocol(WSNIT) based on the requirements and characteristics of communication agents in internet of things, the lastly, testified this security protocol satisfied the SK security in AM model.

Providing secure, reliable communications is a big challenge to guarantee confidentiality, integrity, and anti-replay protection, especially between endpoints in current Internet. As one of the popular secure communication protocol, IPsec usually limits the throughput and increases the latency due to its heavy encryption/decryption processing. In this paper, we propose a hardware solution to accelerate it. To achieve high performance processing, we have successfully designed and implemented IPsec on Cavium OCTEON 5860 multi-core network processor platform. We also compare the performance under different processing mechanisms and discover that pipleline works better than run-to-completion for different sizes of packets in our experiments. In order to achieve the best performance, we select different encryption algorithms and core numbers. Experimental results on 5860 processors show that our work achieves 20 Gbps throughput with AES128 encryption, 16 cores for 512-byte packet traffic.