Search

ABSTRACT This paper addresses radio frequency identification (RFID) authentication and ownership transfer in offline scenarios. Four typical related works are reviewed in detail. A series of shortcomings and vulnerabilities of them are pointed out. A new RFID authentication protocol based on a novel tag-owner-assisting architecture is proposed, making a tag's owner an essential participant of the RFID authentication process. The proposed protocol is distinguished from existing works in providing ownership transfer, access control, and mutual authentication without any centralized database neither on a backend server nor in a reader. The security of the proposed protocol is verified by using automated validation of Internet security protocols and applications tool. The proposed protocol is server-less, simple, scalable, untraceable, and device-independent. These features are simultaneously achieved in a single RFID authentication protocol for the first time. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

In a wireless sensor network, we often require the deployment of new nodes to extend the lifetime of the network because some sensor nodes may be lost due to power exhaustion problem or they may be also malicious nodes. In order to protect malicious nodes from joining the sensor network, access control mechanism becomes a major challenging problem in the design of sensor network protocols. Existing access control protocols designed for wireless sensor networks require either high communication overheads or they are not scalable due to involvement of the base station during authentication and key establishment processes. In this paper, we propose a new access control scheme for large-scale distributed wireless sensor networks, which not only identifies the identity of each node but it has also ability to differentiate between old nodes and new nodes. The proposed scheme does not require involvement of the base station during authentication and key establishment processes, and it can be easily implemented as a dynamic access control protocol. In addition, our scheme significantly reduces communication costs in order to authenticate neighbor nodes among each other and establish symmetric keys between neighbor nodes as compared with existing approaches. Further, our scheme is secure against different attacks and unconditionally secure against node capture attacks. The simulation results of our scheme using the AVISPA (Automated Validation of Internet Security Protocols and Applications) tool ensure that our scheme is safe. [ABSTRACT FROM AUTHOR]

Abstract: There have been many security events in the Internet. Many of them are due to arbitrary access permissions to the network resources of the malicious users, especially their free sending packets to anywhere in the network. However, current existing solutions such as ingress filtering and network firewalls cannot solve the problem of malicious access to the network flexibly and effectively. In this paper, we present an efficient access control method based on host identifiers, in which a safe and bidirectional authentication process is introduced whenever the host begins to access the network. Meanwhile, all the succeeding information exchanges between the host and the network can be controlled through the encrypt scheme negotiated during the access authentication process. Through analysis and experiments, we find that the proposed method has the following merits. First, our method has the capability to support various end-nodes to access the Internet in a uniform way. Second, with our method, end-nodes and the core network can establish a mutual trustworthy relationship to avoid any spoof from the other side. Third, our method can support host mobility very well. [Copyright &y& Elsevier]

The IEEE 802.1X is utilized in mobile Worldwide Interoperability for Microwave Access (WiMAX) authentication. This procedure incurs a long delay in WiMAX handoff. To resolve this issue, this paper proposes a key caching mechanism to eliminate the nonnecessary IEEE 802.1X authentication cost in WiMAX handoff. This mechanism is investigated through analytic and simulation modeling. Our study indicates that the key caching scheme can effectively speed up the handoff process. [ABSTRACT FROM AUTHOR]

In an attempt to expand Public Key Infrastructure (PKI) usage to a ubiquitous and mobile computing environment, we found that the deployment of the PKI on a resource-constrained device such as an 8-bit microprocessor leads to user-obstructive latency or additional circuitry for the operations. To alleviate these limitations, we propose a new PKI-based authentication protocol and security infrastructure, namely, PKASSO, which is enhanced with the single sign-on and delegation technology that is used especially for mobile devices with restricted computation power. PKASSO offloads complex PKI operations from the mobile devices to the infrastructure so as to keep the hardware and software complexity of the devices as low as possible. In addition, even though a conventional delegation mechanism cannot support a nonrepudiation mechanism against malicious user behavior, PKASSO can provide such a mechanism by devising a referee server that, on one hand, generates binding information between a device and authentication messages and, on the other hand, retains the information in its local storage for future accusation. We present the detailed design and performance evaluation of PKASSO and offer a protocol analysis in terms of user authentication latency and the completeness of the protocol. According to the performance evaluation, the authentication latency of our infrastructure (which averages 0.082 second) is much shorter than the authentication latency of a conventional PKI-based authentication latency (which averages 5.01 seconds). [ABSTRACT FROM AUTHOR]

Abstract: One aim of pervasive computing is to allow users to share their resources so that they seem to be part of a single pervasive computer. This is just an illusion, the result of the synergy between different systems and resources. SHAD, introduced in PerCom 2007, is the first architecture that offers actual Single Sign-On to avoid authentication obtrusiveness and maintain the illusion of a single, pervasive computer. This paper describes how SHAD allows users to securely share their resources in a easy, natural, and intuitive way. It also describes its role-based Human-to-Human architecture, the threat model, and the protocols involved. Last but not the least, it presents results of further evaluation for our working implementation. [Copyright &y& Elsevier]