Search

In 2010, Chen et al. focused at the vulnerability of smart card based authentication systems owing to leakage of secret information from smart card. They proposed a scheme with a view to boost the security of such authentication systems. However, in 2012, Truong et al. found Chen et al.'s scheme weak at resisting replay attack and spoofing attacks; thereby they proposed an improved scheme to counterfeit these weaknesses. Undoubtedly, the improved scheme by Truong et al. is free from defects pointed out on Chen et al.'s scheme, but here we show that problems like impersonation attacks, password guessing, etc are adhered with its design. We show that Truong et al.'s scheme violates Chen et al.'s aim to get rid of information-leak hazard from the smart card or mobile device based authentication schemes.

The three-party password-based authenticated key exchange (3PAKE) protocol allows two users to share a session key for future communication with the help of a trusted server in the public network. Recently, Zhao et al. [Zhao J., Gu D., Zhang L., Security analysis and enhancement for three-party password-based authenticated key exchange protocol, Security Communication Networks 2012; 5(3):273-278] proposed an efficient 3PAKE protocol using smart cards. They proved that their protocol can withstand various known attacks found in the previously published schemes. However, in this paper, we point out that their protocol is vulnerable to three kinds of attacks namely, off-line password-guessing attack, privileged insider attack and stolen smart card attack. Hence, Zhao et al.’s scheme is not recommended for practical applications.

The security and protection of biometric template has been the bottleneck of its applications due to permanent appearance of biometrics. Texture codes are important approaches for palmprint recognition; unfortunately, there is no ideal cancelable scheme for palmprint coding until now. We propose a novel cancelable palmprint template, called “PalmPhasor”, which is a set of binary code fusing the user-specific tokenised pseudo-random number (PRN) and multi-orientation texture features of PalmCodes. PalmPhasor is extended from one dimension to two dimensions to reduce computational complexity. Two dimensional (2D) PalmPhasor in row orientation has better performance than one dimensional (1D) PalmPhasor. Furthermore, 2D PalmPhasor fuses multi-orientation texture features in score level to enhance recognition performance. Besides, the number of orientations of texture features for fusion is also discussed in this paper. The experimental results on PolyU palmprint database show the feasibility and efficiency of 2D PalmPhasor enhanced by multi-orientation score level fusion.

The destruction due to computer security incidents warns organizations to adopt security measures. In addition to technological measures, individual’s information security awareness is also necessary. Different psychological theories have been proposed to make an effective information security awareness campaign. These information security awareness campaigns are limited in their ability in raising awareness of the participants of the campaign. Although much research has been done in the area of information security awareness, however, this paper considers the applications of healthcare awareness and environmental awareness strategies to make an effective information security awareness campaign. In this paper, we study some of the useful research work conducted in the healthcare and environmental safety awareness domains. These researches have been carried out by well-known researchers in the field of psychology. Finally, we apply these healthcare and environmental awareness best practices to propose an effective information security awareness campaign.

Covert channels constitute an important security threat because they are used to ex-filtrate sensitive information, to disseminate malicious code, and, more alarmingly, to transfer instructions to a criminal (or terrorist). This work presents zero day vulnerabilities and weak-nesses, that we discovered, in the Short Message Service (SMS) protocol, that allow the embedding of high capacity covert channels. We show that an intruder, by exploiting these SMS vulnerabilities, can bypass the existing security infrastructure (including firewalls, intrusion detection systems, content filters) of a sensitive organization and the primitive content filtering software at an SMS Center (SMSC). We found that the SMS itself, along with its value added services (like picture SMS, ring tone SMS), appears to be much more susceptible to security vulnerabilities than other services in IP-based networks. To demonstrate the effectiveness of covert channels in SMS, we have used our tool GeheimSMS that practically embeds data bytes (not only secret, but also hidden) by composing the SMS in Protocol Description Unit (PDU) mode and transmitting it from a mobile device using a serial or Bluetooth link. The contents of the overt (benign) message are not corrupted; hence the secret communication remains unsuspicious during the transmission and reception of SMS. Our experiments on active cellular networks show that 1 KB of a secret message can be transmitted in less than 3 minutes by sending 26 SMS without raising an alarm over suspicious activity. ispartof: pages:1-10 ispartof: Communications in Computer and Information Science vol:186 pages:1-10 ispartof: 8th FTRA International Conference on Secure and Trust Computing, Data Management, and Application (STA 2011) location:Loutraki: GREECE date:28 Jun - 30 Jun 2011 status: published

Malformed messages in different protocols pose a serious threat because they are used to remotely launch malicious activity. Furthermore, they are capable of crashing servers and end points, sometimes with a single message. Recently, it was shown that a malformed SMS can crash a mobile phone or gain unfettered access to it. In spite of this, little research has been done to protect mobile phones against malformed SMS messages. In this paper, we propose an SMS malformed message detection framework that extracts novel syntactical features from SMS messages at the access layer of a smart phone. Our framework operates in four steps: (1) it analyzes the syntax of the SMS protocol, (2) extracts syntactical features from SMS messages and represents them in a suffix tree, (3) uses well-known feature selection schemes to remove the redundancy in the features’ set, and (4) uses standard distance measures to raise the final alarm. The benefit of our framework is that it is lightweight-requiring less processing and memory resources-and provides a high detection rate and small false alarm rate. We evaluated our system on a real-world SMS dataset consisting of more than 5000 benign and malformed SMS messages. The results of our experiments demonstrated that our framework achieves a detection rate of more than 99% with a false alarm rate of less than 0.005%. Last, but not least, its processing and memory requirements are relatively small; as a result, it can be easily deployed on resource-constrained smart phones or mobile devices.

Authenticating remote users in wireless sensor networks (WSN) is an important security issue due to their un-attended and hostile deployments. Usually, sensor nodes are equipped with limited computing power, storage, and communication module, thus authenticating remote users in such resource-constrained environment is a critical security concern. Recently, M.L Das proposed a two-factor user authentication scheme in WSN and claimed that his scheme is secure against different kind of attacks. However, in this paper, we prove that M.L Das-scheme has some critical security pitfalls and is not recommended for real application. We point out that in his scheme: users cannot change/update their passwords, it does not provide mutual authentication between gateway node and sensor node, and is vulnerable to gateway node bypassing attack and privileged-insider attack.

Emerging trends in applications with the requirement of considerable computational performance and decreasing time-to-market have urged the need of multiprocessor systems. With the increase in number of processors, there is an increased demand to efficiently control the energy and power budget of such embedded systems. Dynamic Power Management (DPM) strategies attempt to control this budget by actively changing the power consumption profile of the system. This paper presents a novel DPM strategy for real time applications. It is based on the extraction of inherently present idleness in application’s behavior to make appropriate decisions for state-transition of processors in a multiprocessor system. Experimental results show that conventional DPM approaches often yield suboptimal, if not incorrect, performance in the presence of real time constraints. Our strategy gives better energy consumption performance under the same constraints by 10.40%. Also, it reduces the number of overall state transitions by 74.85% and 59.76% for EDF and LLF scheduling policies respectively.