Search

Session Initiation Protocol (SIP) is the most widely used signalling protocol for controlling communication, establishing, maintaining, and terminating sessions on the Internet. However, since sensitive information is often transmitted through open channels, a security authentication scheme is essential. Recently, Islam et al. proposed an authentication scheme for SIP, and argued that the scheme is immune to known attacks. However, we discover that their scheme fails to achieve user anonymity, and it cannot even resist impersonation attack. Therefore, this study proposes an enhanced mutual authentication scheme to eliminate the drawbacks of the scheme proposed by Islam et al. In addition, our proposed scheme is based on extended chaotic map, which avoids computationally expensive elliptic curve point multiplication. Then, we use Burrows-Abadi-Needham logic to prove that the proposed scheme achieves secure mutual authentication, and we use the Real-Or-Random model to analyze the formal security verification of the session key. Finally, we compare the performance and the security features of the proposed scheme with some existing schemes. Therefore, we provide better safety and efficiency than related schemes and the proposed scheme is suitable for SIP.

Under the Internet of Things (IoT), the coexistence proof of multiple RFID tagged objects becomes a very useful mechanism in many application areas such as health care, evidences in court, and stores. The yoking-proof scheme addresses this issue. However, all existing yoking-proof schemes require two or more rounds communication to generate the yoking-proof. In this paper, we investigate the design of one-round yoking-proof schemes. Our contributions are threefold: (1) to confirm the coexistence of the RFID tag pair, we propose a one-round offline yoking-proof scheme with privacy protection. (2) We define a privacy model of the yoking-proof scheme and enhance Moriyama's security model for the yoking-proof scheme. The security and the privacy of the proposed scheme are proved under our models. (3) We further extend the yoking-proof scheme for the coexistence of m RFID tags, where m>2. The extended scheme maintains one-round. In addition, the proposed technique has efficiency advantage, compared with previous work.

Recently, pairing based cryptography has drawn a lot of attention since it is the key technology to construct identity based encryption schemes. Major operations of pairing are elliptic curve computations defined upon finite field arithmetic. Hardware implementation of large prime field operation is critical to improve the practicality of pairing based cryptography. In this paper, we present a parallel processing architecture of cryptoprocessor for optimal ate pairings over BN-curves in prime field. The proposed design contains two arithmetic processing engines to complete prime field operations in parallel. Each engine is designed by the unified Fp arithmetic unit to save hardware resources. This architecture can also be used to implement RSA and ECC cryptography schemes in parallel to satisfy industry demand. The design is implemented on a Virtex-5 FPGA device. The result shows our design consumes 10592 Slices and computes optimal-ate pairing within 283,111 clock cycles, achieving a better balance between speed and area than other designs.

In this paper, we propose an architecture security evaluation method to identify potential risks of architecture. We model security features of web applications from two different but complementary points of view using AADL, build an AADL security model which contribute to detect risks of architecture. With the help of a tool, we can automatically convert the AADL security model to an architecture security model. Then, an integration process applies analytic hierarchy process (AHP) and fuzzy evaluation analysis to the architecture security model. In the end, we can get security conclusions of the architecture and improve security measures based on security conclusions. The experiment demonstrates that the method not only improves efficiency of the evaluation, but also makes security evaluation process more objective and accurate.

RSA key generation is of great concern for implementation of RSA cryptosystem on embeded system due to its long processing latency. In this paper, a novel architecture is presented to provide high processing speed to RSA key generation for embedded platform with limited processing capacity. In order to exploit more data level parallelism, Residue Number System (RNS) is introduced to accelerate RSA key pair generation, in which these independent elements can be processed simultaneously. A cipher processor based on Transport Triggered Architecture (TTA) is proposed to realized the parallelism at the architecture level.In the meantime,division is avoided in the proposed architecture,which reduces the expense of hardware implementation remarkably. The proposed design is implemented by Verilog HDL and synthesized in a 0.18µm CMOS process. A rate of 3 pairs per second can be achieved for 1024-bit RSA key generation at the frequency of 100 MHz.

Various promising distributing computing paradigms such as Grids, P2P and Clouds have emerged over Internet. How to build the trust relationship among principals in such an open computing environment has become an important issue. Automated trust negotiation (ATN) approach aims to gradually build trust relationship between strangers through the interactively disclosing of credentials and security policies. In this paper, we propose a hybrid tree model which can embed both policies and credential sets in the tree nodes, and is able to describe fine-grained security policy with attributes or negotiation context information. Based on the hybrid tree model, we design a negotiation tree building algorithm. We have designed a HiTrust System and experimental results demonstrate that the HiTrust service has a good scalability.

For providing the login service in multi-server environments, Fan, Xu, and Li presented a remote user authentication scheme using smart cards. In this paper, we demonstrate that Fan-Xu-Li's scheme is vulnerable to the parallel session attack. That is, when a legal user logs in a server, an adversary without knowing any secret information can easily impersonate the user to log in other authorized servers. It means that a serious security flaw exists in Fan-Xu-Li's scheme. In addition to being practical, it is desirable to avoid relying on timestamps for security in their scheme. We therefore propose an improved scheme to overcome above disadvantages. As a unilateral authentication mechanism, our improved scheme is more suitable for real-life cryptographic applications than Fan-Xu-Li's scheme.