Search

The performance of public-key cryptosystems is mainly appointed by the underlying finite field arithmetic. Among the basic arithmetic operations over finite field, the multiplicative inversion is the most time consuming operation. In this paper, a fast inversion algorithm over GF(2m) with the polynomial basis representation is proposed. The proposed algorithm executes in about 27.5% or 45.6% less iterations than the extended binary gcd algorithm (EBGA) or the montgomery inverse algorithm (MIA) over GF(2163), respectively. In addition, we propose a new hardware architecture to apply for low-complexity systems. The proposed architecture takes approximately 48.3% or 24.9% less the number of reduction operations than [4] or [8] over GF(2239), respectively. Furthermore, it executes in about 21.8% less the number of addition operations than [8] over GF(2163). [ABSTRACT FROM AUTHOR]

ID-based public key cryptosystem can be a good alternative for certificate-based public key setting. The protocol for fair exchange of signatures can be widely used in signing digital contracts, e-payment and other electronic commerce. This paper proposes an efficient ID-based verifiably encrypted signature scheme from pairings. Using this new scheme as kernel, we provide an efficient ID-based optimistic fair signature exchange protocol. We offer arguments for the fairness, efficiency and security proof of our new protocol. Our new protocol provides an efficient and secure solution for the problem of fair exchange of signatures in ID-based cryptosystem. [ABSTRACT FROM AUTHOR]

In this paper, we present an attack to break WEP that avoids weak IVs used in the FMS attack. Our attack is a known IV attack that doesn't need the specific pattern of the IVs. This attack transforms most IVs of WEP into weak IVs. If we attempt to avoid all weak IVs used in our attack, the rate at which IVs are avoided is too large to use practical. When using a 128-bit session key, the efficiency of our attack is 272.1 in the most effective case. This implies that our attack can recover a 128-bit session key within realistically possible computational times. [ABSTRACT FROM AUTHOR]

Fast realization of RSA algorithm by hardware is a significant and challenging task. In this paper an ameliorative Montgomery algorithm that makes for hardware realization to actualize the RSA algorithm is proposed. This ameliorative algorithm avoids multiplication operation, which is easier for hardware realization. In the decryption and digital signature process, a combination of this ameliorative Montgomery algorithm and the Chinese remainder theorem is applied, which could quadruple the speed of the decryption and digital signature compared to the encryption. Furthermore, a new hardware model of the encryption kernel based on the ameliorative Montgomery is founded whose correctness and feasibility is validated by Verilog HDL in practice. [ABSTRACT FROM AUTHOR]

In this paper, we focus on the Condorcet voting scheme in which each voter votes with the full order of the candidates according to preference, and the result of the election is determined by one-on-one comparisons between each candidate. We propose the Condorcet electronic voting scheme that is secure, universally verifiable and satisfying one-on-one comparison privacy. Furthermore the result of the election can be determined without revealing the order of the candidates which each voter specified. We use a matrix to represent the order of all the candidates according to preference, and satisfy one-on-one comparison privacy using homomorphic property. [ABSTRACT FROM AUTHOR]

In this paper, the distribution of the shortest linear recurring sequences in Z /(p) is studied. It is found that the shortest linear recurrent length is always equal to n / 2 when n is even and is always equal to n / 2+1 when n is odd for any sequence whose length is n. In other words, the shortest linear recurring length is always equal to the half of the length of the given sequence. The probability of finding the distribution of the shortest linear recurring length of two sequences in Z / (p) field is also given. [ABSTRACT FROM AUTHOR]

In this paper we show that the new Cellular Automata Cryptosystem (CAC) is insecure and can be broken by chosen-plaintexts attack with little computation. We also restore the omitted parts clearly by deriving the rotating number δ of plaintext bytes and the procedure of Major CA. The clock circle Δ of Major CA and the key SN are also attacked. [ABSTRACT FROM AUTHOR]

When considering information security and privacy issues most of the attention has previously focussed on data protection and the privacy of personally identifiable information (PII). What is often overlooked is consideration for the operational and transactional data. Specifically, the security and privacy protection of metadata and metastructure information of computing environments has not been factored in to most methods. Metadata, or data about data, can contain many personal details about an entity. It is subject to the same risks and malicious actions personal data is exposed to. This paper presents a new perspective for information security and privacy. It is termed Meta Privacy and is concerned with the protection and privacy of information system metadata and metastructure details. We first present a formal definition for meta privacy, and then analyse the factors that encompass and influence meta privacy. In addition, we recommend some techniques for the protection of meta privacy within the information systems. Further, the paper highlights the importance of ensuring all informational elements of information systems are adequately protected from a privacy perspective. [ABSTRACT FROM AUTHOR]

In [7] Vaudenay demonstrated side-channel attacks on CBC-mode encryption, exploiting a "valid padding" oracle. His work showed that several uses of CBC-mode encryption in well-known products and standards were vulnerable to attack when an adversary was able to distinguish between valid and invalid ciphertexts. In [2][5] [6], Black, Paterson,Taekeon et al.generalized these attacks to various padding schemes of CBC-mode encryption and multiple modes of operation. In this paper, we study side-channel attacks on the CFB, CBC CBC, CFBCFB, CBCCBCCBC, CFBCFBCFB modes under the error oracle models, which enable an adversary to determine the correct message with knowledge of ciphertext. It is shown that an attacker can exploit an oracle to efficiently extract the corresponding position plaintext bits of any block if the target plaintext contains some fixed bits in a known position of one block. [ABSTRACT FROM AUTHOR]

Traditional certificate based cryptosystem requires high maintenance cost for certificate management. Although, identity based cryptosystem reduces the overhead of certificate management, it suffers from the drawback of key escrow. Certificateless cryptosystem combines the advantages of both certificate based and identity based cryptosystems as it avoids the usage of certificates and does not suffer from key escrow. In this paper, we propose a pairing based certificateless signature scheme that is efficient than the existing scheme. [ABSTRACT FROM AUTHOR]

Restrictive blind signatures allow a recipient to receive a blind signature on a message not know to the signer but the choice of message is restricted and must conform to certain rules. Partially blind signatures allow a signer to explicitly include necessary information (expiration date, collateral conditions, or whatever) in the resulting signatures under some agreement with receiver. Restrictive partially blind signatures incorporate the advantages of these two blind signatures. The existing restrictive partially blind signature scheme was constructed under certificate-based (CA-based) public key systems. In this paper we follow Brand's construction to propose the first identity-based (ID-based) restrictive blind signature scheme from bilinear pairings. Furthermore, we first propose an ID-based restrictive partially blind signature scheme, which is provably secure in the random oracle model. [ABSTRACT FROM AUTHOR]

A secure group signature is required to be anonymous, that is, given two group signatures generated by two different members on the same message or two group signatures generated by the same member on two different messages, they are indistinguishable except for the group manager. In this paper we prove the equivalence of a group signature's anonymity and its indistinguishability against chosen ciphertext attacks if we view a group signature as an encryption of member identity. Particularly, we prove ACJT's group signature is IND-CCA2 secure, so ACJT's scheme is anonymous in the strong sense. The result is an answer to an open question in literature. [ABSTRACT FROM AUTHOR]

In this paper, we present a method of running-mode to analyze the fairness of two-party optimistic fair exchange protocols. After discussing the premises and assumptions of analysis introduced in this technique, we deduce all the possible running modes that may cause attack on the protocols. Then we illustrate our technique on the Micali's Electronic Contract Signing Protocol (ECS1), and the checking results show that there are three new attacks on the protocol. [ABSTRACT FROM AUTHOR]

Very recently, Byun and Lee suggested two provably secure group Diffie-Hellman key exchange protocols using n participant's distinct passwords. Unfortunately, the schemes were found to be flawed by Tang and Chen. They presented two password guessing attacks such as off-line and undetectable on-line dictionary attacks by malicious insider attacker. In this paper, we present concrete countermeasures for two malicious insider attacks, and modify the two group Diffie-Hellman key exchange protocols to be secure against malicious insider password guessing attacks. Our countermeasures do not require additional round costs, hence they are efficient. [ABSTRACT FROM AUTHOR]

In this paper we show that three potential security vulnerabilities exist in the strong password-only authenticated key exchange scheme due to Jablon. Two standardised schemes based on Jablon's scheme, namely the first password-based key agreement mechanism in ISO/IEC FCD 11770-4 and the scheme BPKAS-SPEKE in IEEE P1363.2 also suffer from some of these security vulnerabilities. We further show that other password-based key agreement mechanisms, including those in ISO/IEC FCD 11770-4 and IEEE P1363.2, also suffer from these security vulnerabilities. Finally, we propose means to remove these security vulnerabilities. [ABSTRACT FROM AUTHOR]

In this paper, based on bilinear pairings, we would like to construct an identity based proxy signature scheme and an identity based proxy signcryption scheme without secure channel. We also analyze the two proposed schemes from efficiency point of view and show that they are more efficient than the existed ones. What's more, our proposed schemes satisfy all of the security requirements to proxy signature and proxy signcryption schemes assuming the CDH problem and BDH problem are hard to solve. [ABSTRACT FROM AUTHOR]

This paper designs a secure identity-based threshold signcryption scheme from the bilinear pairings. The construction is based on the recently proposed signcryption scheme of Libert and Quisquater [6]. Our scheme not only has the properties of identity-based and threshold, but also can achieve semantic security under the Decisional Bilinear Diffie-Hellman assumption. It can be proved secure against forgery under chosen message attack in the random oracle model. In the private key distribution protocol, we adopt such method that the private key associated with an identity rather than the master key is shared. In the threshold signcryption phase, we provide a new method to check the malicious members. This is the first identity-based threshold signcryption scheme that can simultaneously achieve both semantic security and others security, such as unforgeability, robustness, and non-repudiation. [ABSTRACT FROM AUTHOR]

A token based single sign-on protocol for distribution systems is proposed in this paper. When a user C logs on a system, a centralized authentication server A will authenticate C and issue C a token which is signed by A and includes a session key generated by A as well as a time stamp. C can use the token to access any application server S.S will send the C's request to the A. Then A will verify the validity of the token. There are two advantages of this protocol: 1) Time synchronization between severs S and the user C is not necessary. 2) All authentication state information such as session key is stored in the token rather than in the memory of A, thus the performance of A can be promoted effectively.We have used SVO logic to do formal analysis of this protocol. [ABSTRACT FROM AUTHOR]

In this paper we propose two compilers which are designed to transform a group key exchange protocol secure against any passive adversary into an authenticated group key exchange protocol with key confirmation which is secure against any passive adversary, active adversary, or malicious insider. We show that the first proposed compiler gives protocols that are more efficient than those produced by the compiler of Katz and Yung. [ABSTRACT FROM AUTHOR]

In this paper, we introduce the definition of insiderimpersonation -MIM attack for tripartite key agreement schemes and show that almost all of the proposed schemes are not secure under this attack. We present a new protocol which is much more efficient than the existential secure protocol [13] in terms of computational efficiency and transmitted data size. Moreover, our protocol is the first scheme for multiple keys which means that not only a large number of keys but also various kinds of keys can be generated by applying our scheme. [ABSTRACT FROM AUTHOR]

Many single points of failure exist in an intrusion detection system (IDS) based on a hierarchical architecture that does not have redundant communication lines and the capability to dynamically reconfigure relationships in the case of failure of key components. To solve this problem, we propose an IDS inspired by the human immune system based upon several mobile agents. The mobile agents act similarly to white blood cells of the immune system and travel from host to host in the network to detect any intrusions. As in the immune system, intrusions are detected by distinguishing between "self" and "non-self", or normal and abnormal process behavior respectively. In this paper we present our model, and show how mobile agent and artificial immune paradigms can be used to design efficient intrusion detection systems. We also discuss the validation of our model followed by a set of experiments we have carried out to evaluate the performance of our model using realistic case studies. [ABSTRACT FROM AUTHOR]

In the long term usage of the network, users will form certain types of habit according to their specific characteristics, individual hobbies and given restrictions. On the burst-out of worms, the overwhelming flow caused by random scanning will temporarily alter the behavior representation of users. Therefore, it is reasonable to conclude that the statistics and classification of the user habit can contribute to the detection of worms. On the basis of analysis about both users and worms, we construct the model of user-habit and propose a new approach for the early warning of worms. This paper possesses strong direction significance due to its broad applicability since extended models can be derived from the model proposed in this paper. [ABSTRACT FROM AUTHOR]

Real-Time intrusion detection system (IDS) based on traffic analysis is one of the highlighted topics of network security researches. Restricted by computer resources, real-time IDS is computationally infeasible to deal with gigantic operations of data storage and analyzing in real world. As a result, the sampling measurement technique in a high-speed network becomes an important issue in this topic. Sampling distance analysis of gigantic data mining for IDS is shown in this paper. Based on differential equation theory, a quantitative analysis of the effect of IDS on the network traffic is given firstly. Secondly, a minimum delay time of IDS needed to detect some kinds of intrusions is analyzed. Finally, an upper bound of the sampling distance is discussed. Proofs are given to show the efficiency of our approach. [ABSTRACT FROM AUTHOR]

In the present network security management, improvements in the performances of Intrusion Detection Systems(IDSs) are strongly desired. In this paper, we propose a network anomaly detection technique which can learn a state of network traffic based on per-flow and per-service statistics. These statistics consist of service request frequency, characteristics of a flow and code histogram of payloads. In this technique, we achieve an effective definition of the network state by observing the network traffic according to service. Moreover, we conduct a set of experiments to evaluate the performance of the proposed scheme and compare with those of other techniques. [ABSTRACT FROM AUTHOR]

In this paper, we propose an intrusion detection and prevention system using sensor objects that are a kind of trap and are accessible only by the programs that are allowed by the system. Any access to the sensor object by disallowed programs or any transmission of the sensor object to outside of the system is regarded as an intrusion. In such case, the proposed system logs the related information on the process as well as the network connections, and terminates the suspicious process to prevent any possible intrusion. By implementing the proposed method as Loadable Kernel Module (LKM) in the Linux, it is impossible for any process to access the sensor objects without permission. In addition, the security policy will be dynamically applied at run time. Experimental results show that the security policy is enforced with negligible overhead, compared to the performance of the unmodified original system. [ABSTRACT FROM AUTHOR]

This paper presents a new statistical model for detecting signs of abnormality in static-priority scheduling networks with differentiated services at connection levels on a class-by-class basis. The formulas in terms of detection probability, miss probability, probabilities of classifications, and detection threshold are proposed. Keywords: Anomaly detection, real-time systems, traffic constraint, static-priority scheduling networks, differentiated services, time series. [ABSTRACT FROM AUTHOR]

Security and privacy are two primary concerns in RFID adoption. In this paper we focus on security issues in general and data tampering in particular. Here we present a conceptual framework to detect and identify data tampering in RFID tags. The paper surveys the existing literature and proposes to add a tamper detection component in the existing RFID middleware architecture. The tamper detection component is supported by mathematical algorithm to embed and extract secret information which can be employed to detect data tampering. [ABSTRACT FROM AUTHOR]

Recent works have shown that Internet traffics are self- similar over several time scales from microseconds to minutes. On the other hand, the dramatic expansion of Internet applications give rise to a fundamental challenge to the network security. This paper presents a statistical analysis of the Internet traffic Histogram Feature Vector, which can be applied to detect the traffic anomalies. Besides, the Variant Packet Sending-interval Link Padding based on heavy-tail distribution is proposed to defend the traffic analysis attacks in the low or medium speed anonymity system. [ABSTRACT FROM AUTHOR]

Since the surveillance cameras are usually covering wide area, human faces appear quite small. Therefore, their features are not identifiable and their skin color varies easily even under the stationary lighting conditions so that the face region cannot be detected. To emphasize the detection of small faces in the surveillance systems, this paper proposes the three stage algorithm: a head region is estimated by the DCFR(Detection of Candidate for Face Regions) scheme in the first stage, the face region is searched inside the head region using the MCC(major color component) in the second stage and its faceness is tested by the LDA(Linear Discriminant Analysis) scheme in the third stage. The MCC scheme detects the face region using the features of a face region with reference to the brightness and the lighting environment and the LDA scheme considers the statistical features of a global face region. The experimental results have shown that the proposed algorithm shows the performance superior to the other methods' in detection of small faces. [ABSTRACT FROM AUTHOR]

Optical flow and background subtraction are important methods for detecting motion in video sequences. This paper integrates the advantages of these two methods. Firstly, proposes a high precise algorithm for optical flow computation with analytic wavelet and M-estimator to solve the optical flow restricted equations. Secondly, introduces the extended accumulative optical flow and also provides its computational strategies, then obtains a robust motion detection algorithm. Furthermore, combines a background subtraction algorithm based on the double background model with the extended accumulative optical flow to give an abnormity alarm in time. All obvious proofs of experiments show that, our algorithm can precisely detect moving objects, no matter slow or little, preferably solve the occlusions as well as give an alarm fast. [ABSTRACT FROM AUTHOR]

One of problems of virus throttling algorithm, a worm early detection technique to reduce the speed of worm spread, is that it is too sensitive to burstiness in the number of connection requests. The algorithm proposed in this paper reduces the sensitivity and false alarm with weighted average queue length that smoothes sudden traffic changes. Based on an observation that normal connection requests passing through a network has a strong locality in destination IP addresses, the proposed algorithm counts the number of connection requests with different destinations, in contrast to simple length of delay queue as in the typical throttling algorithm. The queue length measuring strategy also helps reduce worm detection time and false alarm. [ABSTRACT FROM AUTHOR]

Anomaly detection has emerged as an important approach to computer security. In this paper, a new anomaly detection method based on Hidden Markov Models (HMMs) is proposed to detect intrusions. Both system calls and return addresses from the call stack of the program are extracted dynamically to train and test HMMs. The states of the models are associated with the system calls and the observation symbols are associated with the sequences of return addresses from the call stack. Because the states of HMMs are observable, the models can be trained with a simple method which requires less computation time than the classical Baum-Welch method. Experiments show that our method reveals better detection performance than traditional HMMs based approaches. [ABSTRACT FROM AUTHOR]

Network intrusion detection system (NIDS) is an active field of research. With the rapidly increasing network speed, the capability of the NIDS sensors limits the ability of the system. The problem is more serious for the backbone network intrusion detection system (BNIDS). In this paper, we apply parallel optimization technologies to BNIDS using 4-way SMP server as the target system. After analyzing and testing the defects of the existed system in common use, the optimization policies of using fine-grained schedule mechanism at connection level and avoiding lock operations in thread synchronization are issued for the improved system. Through performance evaluation, the improved system shows more than 25 percent improvement in CPU utilization rate compared with the existed system, and good scalability. [ABSTRACT FROM AUTHOR]

Correlation of intrusion alerts is a major technique in attack detection to build attack scenario. Rule-based and data mining methods have been used in some previous proposals to perform correlation. In this paper we integrate two complementary methods and introduce fuzzy clustering in the data mining method. To determine the fuzzy similarity coefficients, we introduce a hierarchy measurement and use weighted average to compute total similarity. This mechanism can measure the semantic distance of intrusion alerts with finer granularity than the common similarity measurement . The experimental results in this paper show that using fuzzy clustering method can reconstruct attack scenario which are wrecked by missed attacks. [ABSTRACT FROM AUTHOR]

CBR is one of the most important artificial intelligence methods. In this paper, it is introduced to detect the variation of known attacks and to reduce the false negative rate in rule based IDS. After briefly describes the basic process of CBR and the methods of describing case and constructing case base by rules of IDS, this paper focuses on the CBR engine. A new CBR engine adapting to IDS is designed because the common CBR engines cannot deal with the specialties of intrusion cases in IDS. The structure of the new engine is described by class graph, and the core class as well as the similarity algorithm adopted by it is analyzed. At last, the results of testing the new engine on Snort are shown, and the validity of the engine is substantiated. [ABSTRACT FROM AUTHOR]

Application of agent technology in Intrusion Detection Systems (IDSs) has been developed. Intrusion Detection (ID) agent technology can bring IDS flexibility and enhanced distributed detection capability. However, the security of the ID agent and methods of collaboration among ID agents are important problems noted by many researchers. In this paper, coordination among the intrusion detection agents by BlackBoard Architecture (BBA), which transcends into the field of distributed artificial intelligence, is introduced. A system using BBA for information sharing can easily be expanded by adding new agents and increasing the number of BlackBoard (BB) levels. Moreover the subdivided BB levels enhance the sensitivity of ID. This paper applies fuzzy logic to reduce the false positives that represent one of the core problems of IDS. ID is a complicated decision-making process, generally involving enormous factors regarding the monitored system. A fuzzy logic evaluation component, which represents a decision agent model of in distributed IDSs, considers various factors based on fuzzy logic when an intrusion behavior is analyzed. The performance obtained from the coordination of an ID agent with fuzzy logic is compared with the corresponding non-fuzzy type ID agent. [ABSTRACT FROM AUTHOR]

The Canetti-Krawczyk (CK) model is a formal method to design and analyze of key agreement protocols, and these protocols should have some desirable security attributes. In this paper, the relationship between the CK model and the desirable security attributes for a key agreement protocol is analyzed. The conclusions indicate that: (1) protocols designed and proved secure by the CK model offer almost all the security attributes, such as perfect forward secrecy (PFS), loss of information, known-key security, key-compromise impersonation and unknown key-share, but the attribute of key control; (2) loss of information and key-compromise impersonation can be guaranteed by the first requirement of the security definition (SK-security) in the CK model, while PFS and known-key security by the second requirement, and unknown key-share can be ensured by either the requirement. Thereafter, the advantages and disadvantages of the CK model are presented. [ABSTRACT FROM AUTHOR]

Flooding-based distributed denial-of-service (DDoS) attack presents a very serious threat to the stability of the Internet. In this paper, we propose a novel global defense architecture to protect the entire Internet from DDoS attacks. This architecture includes all the three parts of defense during the DDoS attack: detection, filtering and traceback, and we use different agents distributed in routers or hosts to fulfill these tasks. The superiority of the architecture that makes it more effective includes: (i) the attack detection algorithm as well as attack filtering and traceback algorithm are both network traffic-based algorithms; (ii) our traceback algorithm itself also can mitigate the effects of the attacks. Our proposed scheme is implemented through simulations of detecting and defending SYN Flooding attack, which is an example of DDoS attack. The results show that such architecture is much effective because the performance of detection algorithm and traceback algorithm are both better. [ABSTRACT FROM AUTHOR]

This paper focuses on covert channel identification in a nondiscretionary secure system. The properties of covert channels are analyzed by channel types. Information flow characteristics are utilized to optimize channel identification with the Share Resource Matrix method adopted for demonstration, and a general framework for channel identification founded on information flow analysis is presented. At last, timing channels are also discussed. [ABSTRACT FROM AUTHOR]

This paper considers a real-time risk assessment method for information systems and networks based on observations from networks sensors such as intrusion detection systems. The system risk is dynamically evaluated using hidden Markov models, providing a mechanism for handling data from sensors with different trustworthiness in terms of false positives and negatives. The method provides a higher level of abstraction for monitoring network security, suitable for risk management and intrusion response applications. [ABSTRACT FROM AUTHOR]

As demands for secure communication bandwidth grow, efficient processing of cryptographic server at the host has become a constraint that prevents the achievement of acceptable secure services at large e-commerce and e-governments. To overcome this limitation, this paper proposes an innovative design in cryptographic server architecture, which based on the hardware of high performance and programmable secure crypto module. The architecture provides a well scalability framework by using a general device API, as well as obtains high performance by carrying cryptography computations in parallel between crypto chips in crypto modules. The system is implemented on an IBM Services345 and hardware of crypto modules. Preliminary measurements are also performed to study the trade-off between numbers of crypto modules parallel computing and performance of generate 1024-bit RSA digital signature. Results indicate that the system implemented by the architecture with high performance and scalability. [ABSTRACT FROM AUTHOR]

To evaluate the security situation of Windows systems for different users on different security attributes, this paper proposes a quantitative assessment method based on vulnerability relationship graph (VRG) and an index-based assessment policy. Through introducing the correlative influences of vulnerabilities, VRG can be used to scientifically detect high risk vulnerabilities which can evoke multistage attacks although their threats on surface are very little. Analysis of 1085 vulnerabilities indicates that for trusted remote visitors, the security of Windows systems is lower while for distrusted remote visitors, they are relatively secure. But there is no obvious difference of the security risk on confidentiality, authenticity and availability of Windows systems. In several known versions, the security of Windows NT is almost lowest. [ABSTRACT FROM AUTHOR]

This paper presents a color image authentication algorithm based on convolutional coding. The message of each pixel is convolutional encoded with the encoder. After the process of parity check and block interleaving, the redundant bits are offset embedded in the image. The tamper can be detected and restored without accessing the original image. The experimental results show that the authentication algorithm based on convolutional coding has a good performance in the tamper detection, localization and the image reconstruction. [ABSTRACT FROM AUTHOR]

For high data rate, new MAC mechanisms such as Block Ack in IEEE 802.11e and frame aggregation in IEEE 802.11n are being currently discussed and these mechanisms need short response time in each MPDU processing. In this paper, we propose a design of cipher engine for IEEE 802.11i to support these new mechanisms. We reduce the processing overhead of RC4 key scheduling by means of using the dual S-Box scheme. In CCMP design, parallel structure is proposed, and as a result, we reduce the processing time to 1/2 in comparison with the sequential structure and the response time independent of the size of the payload and only dependent on the clock frequency. In addition, we can expect to decrease power consumption in CMOS design process because the clock frequency reduces to 1/5 and the area doubles compared to the typical designs. [ABSTRACT FROM AUTHOR]

In this paper, we first construct a security model for delegation-by-warrant ID-based proxy signcryption schemes and formalize notions of security for them. To the best of our knowledge, no related work has been done. Then we present such a scheme based on the bilinear pairings, and show that it is provably secure in the random oracle model. Specifically, we prove its semantic security under the DBDH assumption and its unforgeability under the BDH assumption. [ABSTRACT FROM AUTHOR]

The security requirements in the software life cycle has received some attention recently. However, it is not yet clear how to build security requirements. This paper describes and illustrates a process to build application specific security requirements from state transition diagrams at the security threat location. Using security failure data, we identify security threat locations which attackers could use to exploit software vulnerabilities. A state transition diagram is constructed to be used to protect, mitigate, and remove vulnerabilities relative to security threat locations. In the software development process, security requirements are obtained from state transition diagrams relative to the security threat location. [ABSTRACT FROM AUTHOR]

The iSCSI protocol is becoming an important protocol to enable remote storage access through the ubiquitous TCP/IP networks. This paper analyzes the security and performance characteristics of the iSCSI protocol, points out the limitation of the security iSCSI scheme based on IPSec, and presents the security iSCSI scheme based on SSH. With application of SSH port forwarding, a secure tunnel can be built in TCP layer to ensure the security of iSCSI session. Experiments show that throughput of the security iSCSI based on SSH rises up 20% and CPU utilization greatly lowers 50% with the same encryption algorithm, compared with the security iSCSI based on IPSec. So the performance of the security iSCSI based on SSH is obviously superior to the one based on IPSec. [ABSTRACT FROM AUTHOR]

Trust has been recognized as an important factor for scheduling in Grid. With a trust-aware model, task scheduling is crucial to achieving high performance. In this paper, a trust model adapted to the Grid environment is proposed and a scheduling algorithm based on the trust mechanism is developed. In the trust model, trust value is computed based on the execution experiences between users and resources. Based on the trust model Min-min algorithm are enhanced to ensure the resource and application security during the scheduling. Simulation results indicate that the algorithm can remarkably lessen the risks in the task scheduling, improve the load balance and decrease the completion time of tasks, therefore it is an efficient scheduling algorithm in trust aware Grid system. [ABSTRACT FROM AUTHOR]

The RFID (Radio Frequency Identification) technology has drawn much attention for not only its efficiency in inventory and production management, such as WMS, ERP, but also its significant potential for improving our daily lives. Also mobile phone combined RFID reader will popular and widely using device in our ubiquitous society. Mobile RFID technology holds great promise, but it also raises significant security and privacy concerns for the ubiquitous world. This paper suggests a new architecture for mobile RFID service, which support secure RFID service and uses the privacy aware access control for collection or gathering of tagged information in RFID system. [ABSTRACT FROM AUTHOR]

In recent years, network worms that had a dramatic increase in the frequency and virulence of such outbreaks have become one of the major threats to the security of the Internet. This paper provides a worm propagation model based on the SEIR deterministic model. The model adopts the birth rate and death rate so that it can provide a more realistic portrait of the worm propagation. In the process of defending worm, dynamic quarantine strategy, dynamic infecting rate and removing rate are adopted. The analysis shows that the worm propagation speed can be efficiently reduced to give people more precious time to defend it. So the negative influence of the worm can be reduced. The simulation results verify the effectiveness of the model. [ABSTRACT FROM AUTHOR]