Search

Abstract: The Internet today is a highly dynamic environment which frequently requires secure communication between peers that do not have a direct trust relationship. Current solutions for establishing trust often require static and application-specific Public Key Infrastructures (PKIs). This paper presents trusted directory services as a key infrastructural technology for setting up secure Internet connections, providing an alternative to application-specific PKIs. The directory securely binds public keys to peers through their names in a flexible way that matches the dynamic nature of the Internet. We elaborate on this concept by showing how the Domain Name System (DNS) and its security extensions (DNSSEC) can be leveraged for establishing secure Transport Layer Security (TLS) connections in a dynamic way. A simple enhancement of the TLS protocol, called Extended TLS (E-TLS), required for this purpose, is proposed. We describe our E-TLS implementation and we conclude with an evaluation of our results. [Copyright &y& Elsevier]

Abstract: A deniable authentication protocol enables a receiver to identify the true source of a given message, but not to prove the identity of the sender to a third party. This property is very useful for providing secure negotiation over the Internet. Consequently, many interactive and non-interactive deniable authentication protocols have been proposed. However, the interactive manner makes deniable protocols inefficient. In addition, a security hole is generated in deniable protocols that use the non-interactive manner if a session secret is compromised. Thus, there is no secure and efficient deniable authentication protocol as of now. In this paper, a new protocol based on the non-interactive manner is proposed to efficiently and securely achieve deniable authentication. This protocol can furthermore replace the underlying signature scheme in order to retain a secure status even if the previously used signature method is broken. [Copyright &y& Elsevier]

Abstract: The potentials of modern information technology can only be exploited, if the underlying infrastructure and the applied applications sufficiently take into account all aspects of IT security. This paper presents the platform architecture of the SicAri project, which aims to build a security platform for ubiquitous Internet usage, and gives an overview of the implicitly and explicitly used security mechanisms to enable access control for service oriented applications in distributed environments. The paper will introduce the security policy integration concept with a special focus on distribution of security policies within the service infrastructure for transparent policy enforcement. We describe in details our extensions of the COPS protocol to transport XACML payload for security policy distribution and policy decision requests/responses. [Copyright &y& Elsevier]

Abstract: The AVISPA Tool is a push-button tool for the Automated Validation of Internet Security Protocols and Applications. It provides a modular and expressive formal language for specifying protocols and their security properties, and integrates different back-ends that implement a variety of automatic protocol analysis techniques. Experimental results, carried out on a large library of Internet security protocols, indicate that the AVISPA Tool is a state-of-the-art tool for Internet security protocol analysis as, to our knowledge, no other tool exhibits the same level of scope and robustness while enjoying the same performance and scalability. [Copyright &y& Elsevier]

The article focuses on an addressing system called IP address and relates it with the privacy of personal computers. A proposal to improve the way information flows across the Internet has caused worries for privacy advocates that the design could be used to trace a person's identity. The proposal, an addressing system called IPv6, was created by the Internet Engineering Task Force, an international standards body, and would include a unique serial number for each computer's network connection as part of its expanded new IP address. Critics warn that, if adopted, the move could strip the anonymity and security of Internet users over traditional phone lines, allowing commercial sites to correlate these embedded serial numbers against a consumer's name, address, and other personal details, from clothing size to political affiliation. Today, most home computers are assigned a different IP address each time they connect. According to a lawyer of Washington-based Electronic Privacy Information Center, Marc Rotenberg, although IPv6 would not be widely used for years, there is no doubt there are serious privacy concerns.

Focuses on the security of computer network protocols, focusing on Internet protocol (IP). Information on Internet communication based on transmission control protocol; Advantages of having IP protocol security; Application of general-purpose protocols; Features of dial-up protocols.

This article presents tips on using the Internet and avoiding e-mail attacks. According to the author, it is advisable to assume any message as malicious. Next, use a new found paranoia to examine messages critically. Even messages that appear to come from firms where a user has an account, may not be real. Before clicking a link or taking any action requested in a message, determine for certain that the message is genuine. Return addresses, embedded links, and images can deceive. Look for dire warnings and other classic con techniques, undoubtedly accompanied by a link to a bogus Web site where the user will be asked to enter personal information. As a clue, the phishing message may be delivered to an e-mail address that the user don't use with that company or institution. The author emphasized that if a user get a message at an address he or she never registered with, the e-mail is fake. Intuition and a suspicious nature are a good start, but to separate real messages from bogus ones, the user also need to decipher their Web addresses. Another clue is the string of numbers following the URL prefix http://. It should be remembered that every Web site resides at a specific Internet Protocol address. INSET: Nvu Brings Free Web Authoring to the Firefox Browser.

This article informs that one of the most feature-rich ADSL modem routers on the market, the Vigor2600G from DrayTek Corp. is primed for business. The device supports up to 16 simultaneous PPTP, IPSec and L2TP VPN connections using DES, 3DES or AES encryption schemes, making it compatible with most enterprise firewalls. Rounding out the feature pool is 54Mbit/s Wi-Fi, which makes the DrayTek modem router a complete solution for getting your wireless, Internet-enabled home network UD and running securely.

More than a year ago, on June 24, 2003, Microsoft Corp. chairman and chief software architect Bill Gates sent to subscribers an e-mail technology update titled "Toward a Spam-Free Future." Just a few weeks ago, on June 28, another e-mail update was distributed, titled "Preserving and Enhancing the Benefits of E-mail--A Progress Report." The solutions to spam and e-mail abuse will come from customers selecting products that address their filtering needs and abandoning vendors that don't meet those needs. The words of the vendors and the needs of the customers too often sound like distinct and nontranslatable languages. The reason for the insecurity lies in greed and design. The design of SMTP was never meant to accommodate e-mail on the scale of its current use. The inherent openness of the protocol encouraged greed, giving spammers, hackers and their assorted brethren a massive platform upon which they can launch their dirty deeds. E-mail appliances are getting a lot of attention from companies such as Brightmail Inc., Good Technology Inc. and IronPort Systems Inc. The appliances reside at the edge of the corporate network and eradicate unwanted e-mail before it enters the mail system.

Regardless of any other computer network management strengths that a virtual private network (VPN) may offer, any VPN is fundamentally an encryption-based aid to computer network security. The entire case for any VPN is the belief that encrypting data makes it safe to send across a public network and that the security thus gained is worth associated costs in bandwidth and processing. During August 19, 2003 Ziff Davis Media Inc. Webcast eSeminar on VPN challenges several attendees asked questions about justification for higher cost of a VPN based on Internet Protocol Security or Secure Sockets Layer compared with lighter-weight Point-to-Point Tunneling Protocol that's supported in a wider range of Windows and that enables a greater number of connections for same amount of server processing power.

Addresses security threats to Internet Protocol-based information superhighway. Means of routing the packets where information is stored; Cost of the damages caused by computer security breaches in the U.S. in 2001; Change in the nature of the Internet.

The article reports on the network-based monitoring systems, which will detect and block outbound traffic containing sensitive data. The problem is not just the content within e-mail messages, but the explosion of alternative communication mechanisms that employees are using, including instant messaging, blogs, File Transfer Protocol transfer, Web mail and message boards. Network-based content monitoring and control tools take a broad-brush approach, examining all crosses the network unlike security tools that protect specific applications such as e-mail or instant messaging. INSET: Block That Swap.

The article discusses the concerns among some security experts that denial-of-service (DoS) attacks could be launched against core routers and switches which were raised upon the disclosure in April 2004 of two serious flaws in widely used Internet technologies. One of the vulnerabilities involves Cisco Systems' implementation of the Simple Network Management Protocol in its Internetworking Operating System. The flaw could allow remote attackers to cause vulnerable systems to repeatedly restart when processing specific SNMP requests, eventually leading to DoS conditions. According to Amit Yoran, director of the U.S. Department of Homeland Security's National Cyber Security Division, the flaw is particularly dangerous because it affects a wide range of Cisco's routers and switches and is very easy to exploit. Meanwhile, a US-CERT advisory warned of a critical flaw in the Internet's core Transmission Control Protocol (TCP). The flaw allows remote attackers to create DoS conditions against TCP connections, with sustained attacks capable of disrupting portions of the Internet, the advisory stated. The flaw was disclosed by Great Britain's National Infrastructure Security Co-ordination Centre and involved a long-known weakness in TCP that allows attackers to constantly reset routers by guessing a unique 32-bit number needed for the process.

Discusses the application of Internet Protocol security (IPsec) for client/server information technology infrastructure. Application of IPsec for virtual private network; Implications of the proliferation of Web-based technology; Computer devices affected by the application of Secure Sockets Layer protocol.

The article reports that Cisco Systems Inc. has issued a security advisory over the potential vulnerabilities in using OpenSSL open source data encryption software with some of its products. The OpenSSL project advised users of potential problems in October 2005 and Cisco has now confirmed which products are affected and when remedies will be available. Users of most affected products will not be fully protected when using OpenSSL until spring 2006. The flaws in Cisco's products potentially allow remote attackers to capture data and execute arbitrary code on users' systems. OpenSSL is an open source version of Secure Sockets Layer, which is used by browsers to protect data transmitted over the Internet. Cisco said six of its products were affected, ranging from network management systems to wireless controllers.

The article discusses the two computer security problems which threaten the entire Internet. The easy one to fix is in Cisco routers and switches; Cisco has a patch that blocks the problem. The other vulnerability is with the Transmission Control Protocol (TCP), the TCP in TCP/IP. Put simply, the TCP vulnerability makes it possible for an attacker to shut down a TCP session after guessing a random number. It could be used to shut down communication between two routers on an Internet backbone. That, in turn, could knock out whole chunks of the Internet until the routers recover and rebuild their routing tables. There are several fixes for this such as IPsec, RFC 1948, and RFC 2385. Some use encryption. But they all require trade-offs. With regards to the TCP flaw, the Internet backbone is largely at risk because the routers running it don't have the computing power to run encryption-based protocols like IPsec, which could block not only number-guessing attacks but many other threats as well. The authors says that what it would take to roll in faster hardware for all of the Internet's backbone routers is just money. The author concludes that if money is not appropriated for this problem, then there's no one else to blame when some number-guessing attacker brings down the Internet.