Search

Cloud computing is an emerging data interactive paradigm to realize users’ data remotely stored in an online cloud server. Cloud services provide great conveniences for the users to enjoy the on-demand cloud applications without considering the local infrastructure limitations. During the data accessing, different users may be in a collaborative relationship, and thus data sharing becomes significant to achieve productive benefits. The existing security solutions mainly focus on the authentication to realize that a user’s privative data cannot be illegally accessed, but neglect a subtle privacy issue during a user challenging the cloud server to request other users for data sharing. The challenged access request itself may reveal the user’s privacy no matter whether or not it can obtain the data access permissions. In this paper, we propose a shared authority based privacy-preserving authentication protocol (SAPA) to address above privacy issue for cloud storage. In the SAPA, 1) shared access authority is achieved by anonymous access request matching mechanism with security and privacy considerations (e.g., authentication, data anonymity, user privacy, and forward security); 2) attribute based access control is adopted to realize that the user can only access its own data fields; 3) proxy re-encryption is applied to provide data sharing among the multiple users. Meanwhile, universal composability (UC) model is established to prove that the SAPA theoretically has the design correctness. It indicates that the proposed protocol is attractive for multi-user collaborative cloud applications. [ABSTRACT FROM PUBLISHER]

Secure authentication in roaming services is being designed to allow legal users to get access to wireless network services when they are away from their home location. Recently, to protect the location privacy of users, there have been researches on anonymous authentication. In particular, anonymous authentication without the participation of home servers has attracted considerable interest owing to its influence on the communication efficiency. Unfortunately, the previously proposed anonymous authentication schemes have serious practical shortcomings, such as high communication and computation costs and huge revocation lists. In this paper, we propose a novel three-round anonymous roaming protocol that does not require the participation of home servers. The proposed protocol uses a pseudo-identity-based signcryption scheme to perform efficient revocation with a short revocation list and efficient authentication. The use of a signcryption algorithm minimizes the number of pseudo-identities stored in a Subscriber Identification Module (SIM) card with limited storage capacity. The authentication efficiency is also higher than that of existing protocols. The proposed protocol is formally proved in the Canetti-Krawczyk (CK) model. [ABSTRACT FROM AUTHOR]

We motivate and present two designs for the composition of the authentication protocol, Kerberos, and the key transport protocol, Multimedia Internet KEYing (MIKEY) for authenticated transport of cryptographic keys for secure group-communication in enterprise and public-safety settings. A technical challenge, and our main contribution, is the analysis of the security of the composition. Towards this, we design our compositions to have intuitive appeal and thereby less prone to security vulnerabilities. We then employ protocol composition logic (PCL), a state-of-the-art approach for analyzing our composition. For this, we first articulate two properties that are of interest. Both properties are on the group key that is transported; we call them Group Key Confidentiality and Acquisition. Group Key Confidentiality is the property that if a principal possesses the key, then it is an authorized member of the group. Group Key Acquisition is the property that if a principal is a member of the group, then it is able to acquire the group key. In the course of our rigorous analysis, we discovered a flaw in our first design, which we point out, and which lead us to our second design. We have implemented both designs starting with the publicly available reference implementation of Kerberos, and an open-source implementation of MIKEY. Our implementations are available as open-source. We discuss our experience from the implementation, and present empirical results. [ABSTRACT FROM PUBLISHER]

As part of the security within distributed systems, various services and resources need protection from unauthorized use. Remote authentication is the most commonly used method to determine the identity of a remote client. This paper investigates a systematic approach for authenticating clients by three factors, namely password, smart card, and biometrics. A generic and secure framework is proposed to upgrade two-factor authentication to three-factor authentication. The conversion not only significantly improves the information assurance at low cost but also protects client privacy in distributed systems. In addition, our framework retains several practice-friendly properties of the underlying two-factor authentication, which we believe is of independent interest. [ABSTRACT FROM AUTHOR]

We present the design of an apparatus that creates a protected personal communication channel over computer-embedded devices. The prototype implementation of the apparatus demonstrates that it can securely and intuitively link devices with no contact with an online server while imposing low overhead. [ABSTRACT FROM PUBLISHER]

The Universal Serial Bus (USB) has become the most popular interface standard for hardware connection, and there has been an explosion in the number of USB peripheral devices. External USB storage devices, in particular, are finding widespread application. Unfortunately, because USB affords high transmission speeds and is extremely convenient, many workplaces and businesses have prohibited the use of USB devices to prevent confidential data from being extracted from computer systems via USB ports. However, this compromises the convenience of the USB connection and demonstrates a lack of flexibility in management. Therefore, finding a way to take the considerations of both convenience and management into account has become a significant issue. This study proposes a secure control protocol which provides mutual authentication and key agreement between client and server to solve this problem1. [ABSTRACT FROM AUTHOR]