Search

This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Prefix Aggregate without Labeled data). GAMPAL does not require labeled data to achieve general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Border Gateway Protocol Routing Information Base), GAMPAL introduces prefix aggregate. The BGP RIB entries are classified into prefix aggregates, each of which is identified with the first three AS (Autonomous System) numbers in the AS_PATH attribute. GAMPAL establishes a prediction model for traffic sizes based on past traffic sizes. It adopts a LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model that focuses on the periodicity of the Internet traffic patterns at a weekly scale. The validity of GAMPAL is evaluated using real traffic information, BGP RIBs exported from the WIDE backbone network (AS2500), a nationwide backbone network for research and educational organizations in Japan, and the dataset of an ISP (Internet Service Provider) in Spain. As a result, GAMPAL successfully detects anomalies such as increased traffic due to an event, DDoS (Distributed Denial of Service) attacks targeted at a stub organization, a connection failure, an SSH (Secure Shell) scan attack, and anomaly spam.

Secure shell is a network protocol for the creation of encrypted connections. In its original and purest form, it is used to open a remote terminal and execute commands. However, the protocol can also be used for file transfer (SCP, SFTP); as an encrypted transport protocol for other, possible less strongly secured protocols; and for port forwarding—the redirection of requests for certain ports to ports on other servers—a technique often used to allow machines on different sides of a firewall to communicate.

The advances in quantum computing present a threat to public key primitives due to their ability to solve hard cryptographic problems in polynomial time. To address this threat to critical Internet security protocols like the Transfer Layer Security (TLS), and Secure Shell (SSH), the National Institute of Standards and Technology (NIST) is currently working on the new generation of quantum-resistant key encapsulation and authentication schemes. In this paper, we evaluate protocol handshake performance when both post-quantum key exchange and authentication are integrated into TLS and SSH. Our experiments consider realistic network conditions and reveal that the introduced handshake latency ranges between 1-300% for TLS and 0.5-50% for SSH depending on the post-quantum algorithms used. In addition, we examine how the initial TCP window size affects post-quantum TLS and SSH performance, and show that even a small size increase can reduce the observed post-quantum slowdown by 50%. Finally, we discuss alternatives that can encourage the early adoption of post-quantum cryptography with minimum protocol performance degradation.

The traditional way of managing and configuring network devices is by using Command Line Interface (CLI) method with Secure Shell (SSH) protocol and Simple Network Management Protocol (SNMP). CLI has proven to be a very complex and ineffective solution, especially with fast development and more complexity in the computer networking area. To solve these issues, IETF (Internet Engineering Task Force) standard organization created in 2006 the NETCONF (Network Configuration Protocol) standard. Using the NETCONF standard should enable standardized, simpler, programmatic and more efficient configuration of R/S (router/switch) devices. Today, more than ten years after the creation of the NETCONF standard there is the question about the actual acceptance of the NETCONF protocol in current customers’ networks and about the actual maturity of the NETCONF standard. The scope of this paper is to show the results of the scientific research (qualitative or quantitative) made with major customers (partners and end customers) in Croatia with R/S network devices: in which networks and on which type of devices NETCONF is implemented, what are the reasons for NETCONF (non)implementation, their knowledge about the NETCONF standard, their view of availability of NETCONF training and documentation, etc.

The trend of internet of things (IoT) makes the cloud less effective because networked control systems need low latency while cloud have high latency for processing data from sensors and devices. In that kind of situation, fog computing is introduced as the complement of cloud computing. However, unlike cloud services, fog services are limited to certain geographical area. As a consequence, fog services handover is needed in order to accommodate user’s mobility. This paper is focusing on microservices handover that follows user’s movement. The microservices installed in the current fog node are sent to another service coverage of a new fog node for continuing the same service to the users. Fog node contains a docker that runs MySQL, python script, and busybox services. When it comes to handover, docker will freeze current session and convert it to a checkpoint file. The file is created by taking a snapshot of the container, which consists of processes in memory, volume or image. The file will be sent by using secure shell (SSH) or file transfer protocol (FTP). At the destination fog node, the file will be processed in order to resume the service. The results show that delay of SSH is always higher than FTP in all experiments, in which the largest delays are 484.026 seconds for SSH protocol and 146.41 seconds for FTP protocols. As for checkpoint and restore process, those delays tend to be similar with respect to both SSH and FTP protocols but they are still affected by the size of snapshot and checkpoint file.

The Software Defined Network (SDN) provides higher programmable functionality for network configuration and management dynamically. Moreover, SDN introduces a centralized management approach by dividing the network into control and data planes. In this paper, we introduce a deep learning enabled intrusion detection and prevention system (DL-IDPS) to prevent secure shell (SSH) brute-force attacks and distributed denial-of-service (DDoS) attacks in SDN. The packet length in SDN switch has been collected as a sequence for deep learning models to identify anomalous and malicious packets. Four deep learning models, including Multilayer Perceptron (MLP), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM) and Stacked Auto-encoder (SAE), are implemented and compared for the proposed DL-IDPS. The experimental results show that the proposed MLP based DL-IDPS has the highest accuracy which can achieve nearly 99% and 100% accuracy to prevent SSH Brute-force and DDoS attacks, respectively.

This document describes the specification for using Curve25519 and Curve448 key exchange methods in the Secure Shell (SSH) protocol.

This document describes the use of the Ed25519 and Ed448 digital signature algorithm in the Secure Shell (SSH) protocol.

Network-wide activity is when one computer (the originator ) touches many others (the targets ). Motives for activity may be benign (mailing lists, content-delivery networks, and research scanning), malicious (spammers and scanners for security vulnerabilities), or perhaps indeterminate (ad trackers). Knowledge of malicious activity may help anticipate attacks, and understanding benign activity may set a baseline or characterize growth. This paper identifies domain name system (DNS) backscatter as a new source of information about network-wide activity. Backscatter is the reverse DNS queries caused when targets or middleboxes automatically look up the domain name of the originator. Queries are visible to the authoritative DNS servers that handle reverse DNS. While the fraction of backscatter they see depends on the server’s location in the DNS hierarchy, we show that activity that touches many targets appear even in sampled observations. We use information about the queriers to classify originator activity using machine-learning. Our algorithm has reasonable accuracy and precision (70–80%) as shown by data from three different organizations operating DNS servers at the root or country level. Using this technique, we examine nine months of activity from one authority to identify trends in scanning, identifying bursts corresponding to Heartbleed, and broad and continuous scanning of secure shell.

Tor is the most widely used system for anonymous low-latency communication. However, the anonymity of TOr is not invulnerable according to a large amount of researches, even with the traffic obfuscation provided by pluggable transports. Concerned about security issues such as identity leakage, users deploy fronting servers as proxies that forward traffic to the entry node of Tor, and encrypted tunneling services such as secure shell (SSH) protocol are commonly used to connect users with proxies. To quantitatively analyze the plugin-based Tor traffic over encrypted tunnels, experiments involving the traffic identification and correlation are performed. Identification aims at recognizing tunneled Tor flows among background traffic at the client side, while correlation associates outward flows of Tor at the server side with corresponding inward flows at the client side. We access to the self-built server through the SSH proxy and Tor successively, capturing data flows generated by different pluggable transports and upper applications. Then identification and correlation techniques based on various machine learning algorithms are used to break anonymity. The accuracy and F1 scores reach above 95% while false positive rates approach 0% under certain conditions. The result demonstrates that Tor traffic encrypted by tunneling protocols is also at risk of anonymity revealing when confronted with traffic analysis.

Honeypots are effective network security systems built to study the tactics of attackers and their intents. In this paper, we deployed Kippo honeypot to analyze Secure Shell attacks. Both the dictionary attack and intrusion activities of attackers have been discussed. We collected usernames and passwords that are attempted by dictionary attack targeting Secure Shell service. We have traced the frequently attacking machines based on their IP addresses. We have also recorded the commands they executed after successful logins to the Secure Shell honeypot server. We logged vast amount of connection requests destined to number of ports originated from different locations of the world. From our honeypot system, we have collected attack data that enables us to learn common Secure Shell based attacks.

The widely-used Tor network has become the most popular anonymous network that supports circuit-based lowlatency internet connections. However, recent security breach incidents reveal SSH have been used to launch attacks by malicious users. Although a server-side blocking mechanism which can identify SSH connections individually has been proposed, we have found that it is restricted to certain Tor circuit protocol versions and not for all SSH protocol implementations. The prior method is based on the difference of latency in the Tor network which may be subject to hacker manipulation by circuit selection in the Tor network. In this paper, we first present a set of attributes that can be used to detect SSH connection through Tor for all SSH handshake between client and server, by observing the network packets exchanges of the SSH protocol. In the second half of this paper, we show that the geographical location of the nodes in Tor circuit has an impact on the effectiveness of our metrics. If hackers know our detection algorithm, they may be able to evade the detection. We demonstrate the effectiveness of our attacks detection by analyzing multiple Tor circuit selections. Finally, we identify and evaluate our detection algorithm and demonstrate that our algorithm achieves 98% accuracy under the most stringent condition.

Security is one of the most challenging issues in our day to day activities life. Mobile Ad-hoc Network (MANET) is an infra structure less, wireless and open medium. One of the main challenges here is self-organizing and self-healing network which causes the dynamic topology, it doesn't have any central infrastructure; also it is very much affected while transmitting the data. While forwarding the data from sender node to receiver node, there may be a packet loss during transmission this is called as “Black Hole Attack”. To overcome this, we are proposed a solution method called “Dual Cryptography Technique with secure Shell Protocol” which will help to secure the data with dual encryption and decryption algorithm with better result from the existing approaches. By using our technique, the security is safe and secure in order to gain confidentiality, availability and data integrity.

This memo updates RFCs 4252 and 4253 to define new public key algorithms for use of RSA keys with SHA-256 and SHA-512 for server and client authentication in SSH connections.

This memo updates RFCs 4251, 4252, 4253, and 4254 by defining a mechanism for Secure Shell (SSH) clients and servers to exchange information about supported protocol extensions confidentially after SSH key exchange.

This research presents a penetration testing approach to help secure OpenSSH service on Raspberry Pi 2. The study discusses a technique for penetrating Debian v7.1p2, installed on Raspberry Pi 2, using Kali Linux. We exploit the vulnerability found in SSH protocol exchange keys, which causes multiple CRLF injections in Raspberry Pi 2 Model B, allowing remote authenticated users to bypass intended shell-command restrictions via well crafted X11 data forwarding. We propose an innovative security model to solve the issues of allowing remote authentication access using SSH protocol exchange keys without affecting the encrypted protocols transmissions. We conclude with recommendations on how to securely mitigate MITM attacks using our secure proposed model.

In this chapter, you will learn how the secure shell (SSH) is used as a more secure method of remote access than Telnet. We’ll talk about the SSH model, features, and architectures.

Due to growth of Cloud computing usage, the need to apply encrypted protocols to provide confidentiality and integrity of data increases dramatically. Attacker can take advantage of these protocols to hide the intrusion and evade detection. Many traditional attack detection techniques have been proposed to provide security in the networks but none of them can be implemented properly in encrypted networks. This study investigates a popular attack in Secure Shell (SSH), known as brute force attack and provides an efficient method to detect this attack. Brute force attack is launched by implementing a client-server SSH model in a private Cloud environment and the traffics regarding attack and normal are captured on the server. Then, representative features of traffic are extracted and used by the Multi-Layer Perceptron model of Artificial Neural Network to classify the attack and normal traffic. Results gained by this method show that the proposed model is successfully capable to detect this attack with high accuracy and low false alarm.

Background/Objectives: The brute-force attack is one of popular cyber security threats in the secure shell (SSH) service environment. The SANS Institute has warned about SSH brute-force attacks against remote services. Methods/Statistical Analysis: We describe two brute-force attack detection methods are applied in the High Performance Computing (HPC) service environment which has been operated by KISTI in KOREA. The first way parses failed authentication logs of systems. The second way analyze dropped events of network firewalls. Findings: We analyze SSH brute-force attacks that are detected applying these methods in our service environment. The analysis results show that SSH brute-force attacks are classified ‘1:N’ or ‘N:1’ types of attack between source and destination IP address. And a duration of attacks that is generally the time it takes to execute attacks keeps enough long times. Improvements/Applications: Two detection methods which are deployed in our HPC multi-user service environment are complementary to each other. These methods will be also able to apply for other service environment.

Virtual Private Networks (VPNs) provide a secure encrypted communication between remote networks worldwide by using Internet Protocol(IP) tunnels and a shared medium like the Internet. End-to-end connectivity is established by tunneling. OpenVPN and OpenSSH are cross-platform, secure, highly configurable VPN solutions. The performance comparison however between OpenVPN and OpenSSH VPN has not yet been undertaken. This paper focuses on such comparison and evaluates the efficiency of these VPNs over Wide Area Network (WAN) connections. The same conditions are maintained for a fair comparison. To the best knowledge of the authors, this is the first reported test results of these two commonly used VPN technologies. Three parameters, namely speed, latency and jitter are evaluated. Using a real life scenario with deployment over the Linux Operating System, a comprehensive in-depth comparative analysis of the VPN mechanisms is provided. Results of the analysis between OpenSSH and OpenVPN show that OpenSSH utilizes better the link and significantly improves transfer times.

6to4 tunneling enables IPv6 hosts and routers to connect with other IPv6 hosts and routers over the existing IPv4Internet. The main purpose of IPv6 tunneling is to maintain compatibility with large existing base of IPv4 hosts and routers. OpenSSH VPN tunneling is said to have limitations with numerous IPv6 clients and therefore it is advisable to use OpenVPN. To the best knowledge of the authors, this is the first reported successful implementation of 6to4 tunneling over OpenSSH with more than one client. This proof-of-concept positions OpenSSH therefore as a potential alternative to conventional VPNs.

Identifying encrypted application traffic represents an important issue for many network tasks including quality of service, firewall enforcement and security. Solutions should ideally be both simple – therefore efficient to deploy – and accurate. This paper presents a machine learning based approach employing simple packet header feature sets and statistical flow feature sets without using the IP addresses, source/destination ports and payload information to unveil encrypted application tunnels in network traffic. We demonstrate the effectiveness of our approach as a forensic analysis tool on two encrypted applications, Secure SHell (SSH) and Skype, using traces captured from entirely different networks. Results indicate that it is possible to identify encrypted traffic tunnels with high accuracy without inspecting payload, IP addresses and port numbers. Moreover, it is also possible to identify which services run in encrypted tunnels.

A key exchange protocol enables two parties to share a common key for encrypting a large amount of data. Authentication is an essential requirement prior to the key exchange process in order to prevent man-in-the-middle attack. It is important to understand the capabilities and performance of the existing key exchange protocols before employing the protocols in our applications. In this paper, we compare Secure Socket Layer, Secure Shell, and Identity-based key exchange protocols by quantifying the performance, complexity, and level of security of each protocol. Detailed experiments and observations are conducted to examine the protocols in terms of disk usage, computation time, and data transmission time. The analysis shows that the identity-based key exchange maintains similar security level as the other protocols, while conveying better performance. General Terms Security, protocol, cryptography.

Communication security depends on security protocol such like secure shell or secure socket layer. One of the important features is authentication. Its correctness is strongly related with the whole of communication security. In this paper, we introduce three types of attack-models that can be actualized as their attack-scenarios, and provide an authentication protocol checker to apply the three types of the attack-scenarios. We also show some problems in security protocols.

With increasing demands of Electronics products in the domain of the industrial & Consumer application, it becomes necessary to come up with new ideas of electronic products. In the field of communication, present real-time communication audio transmission uses technologies like WiMax, IEEE 802.11, 3G and Bluetooth. But audio-streaming through Bluetooth or radio waves have drawbacks of range and not secure as intruders can get streamed feed. In this paper a fully-functional embedded device has been proposed which is able to stream or transmit audio in real-time over Wi-Fi (IEEE 802.11). This system uses a small credit card sized single board called Raspberry Pi, display, webcam, Wi-Fi and headphone/speakers. This system is a standalone system and does not require any single PC to take or receive the data from camera and headphone/MIC and send to another user. Operating speed of this platform is in 700MHz and it supports live audio streaming. As it has onboard Audio codec, it is possible to connect to user by just accessing the IP address of another user. SSH (Secure SHell) is used for secure data communication, remote command-line login, remote command execution, and other secure network services between two networked nodes. Open source Linux based OS is used to keep the cost low. Â

This paper presents an enhanced architecture for integrating cloud with wireless sensor networks to analyze weather data and notify SaaS users alert during weather disasters at low cost. The occurrence of natural disasters affects lives, damages property and changes our lives completely. Existing system does not support node and network level virtualization for weather sensors. The proposed system overcomes the above limitation by deployment of WSN infrastructure for multiple weather applications using virtual sensor and overlay concept. Monitoring weather data and providing SaaS and social network disaster alerts based on decision ID3 technique and provide cloud authentication using secure shell. These factors improve and provide high quality disaster alters to users and weather analysts at low cost.

International audience; Communicating entities in distributed systems and large scale applications require specific message exchange protocols which can be adjusted for multiple networks. Some secure networking protocols exist and provide different security properties. Such protocols include Transport Layer Security (TLS) and Secure Shell (SSH). We propose here a more specific approach for constructing a new model of distribution using connectors which implement a protocol as a support for securing exchanges over heterogeneous networks used for distributed applications. The Secure Virtual Connector (SVC) protocol provides enhanced security for exchanges between components of distributed applications. This protocol avoids existing shortcomings within existing secure communications protocols which have been designed to fit a wide variety of situations. This flexibility leads to potential vulnerabilities, most of which are avoidable. We consider here a full set of essential security properties for large distributed application such as confidentiality, authenticity, and a certain form of privacy. Other considerations include the use of heterogeneous networks, as well as the mobility of users using secure virtual connectors. The SVC protocol proposed here provides all the required security properties while keeping a low performance overhead which makes it efficient for both fixed and mobile networks. As such SVC is a suitable alternative to existing secure communication protocols.

This paper details how to setup and test the new tunneling features of OpenSSH to establish an enhanced SSH Layer 3 VPN between three computers in a Wide Area Network (WAN) environment. The OpenSSH security feature will be explored to provide secure tunneling and different authentication methods. Using OpenSSH to built VPN will cater for security by encrypting the data transmitted across the public network to private networks. OpenSSH VPN is said to have limitations with numerous clients and therefore it is advisable to use OpenVPN when dealing with more than one clients. To the best knowledge of the authors, this is the first reported successful implementation of a wide-area network VPN using OpenSSH tunnels with multiple clients. This proof-of-concept positions OpenSSH therefore as a potential alternative to the more conventional OpenVPN.

Most Linux computers operate in a connected world. Therefore, configuring the network board is of highest importance. In this chapter, you’ll first learn how to give your computer an IP address and related information. You’ll also learn about some useful tools that will help you in analyzing and troubleshooting a failing network connection. The last part of this chapter is about Secure Shell (SSH), which helps you make secured connections to other computers.

Researchers often have non-privileged access to a variety of high-performance computer (HPC) systems in different administrative domains, possibly across a wide-area network. Consequently, the security infrastructure becomes an important component of an overlay metacomputer: a user-level aggregation of HPC systems. The Trellis security infrastructure (TSI) is layered on top of the widely-deployed secure shell (SSH) and systems administrators only need to provide unprivileged accounts to the users. The contribution of TSI is in demonstrating that a single sign-on (SSO) system, for a variety of use-case scenarios, can be implemented without requiring a completely new security infrastructure. We describe the use of TSI for a Canada-wide overlay metacomputer, for computational workloads (i.e., CISS-3) that spanned 22 administrative domains, at its peak had over 4000 concurrent jobs, and included a new distributed file system (i.e., Trellis NFS).

The high popularity and availability of Internet and intranets allows easy creation of distributed control systems. One of the very important condition distributed system has to comply is security, especially when the Internet is used as data transmission medium. It is necessary to protect transmitted data from unprivileged access or change. There are several approaches to transmission security: VPN (Virtual Private Network) standard, SSL (Secure Socket Layer) library. This paper focuses on another solution – TCP connections tunneling using well known SSH protocol. Opposite to above mentioned solutions, use of SSH client application requires almost no user privileges on client system, and client applications need not to be modified – so this is zero-cost solution. To accomplish this task – universal tool for TCP/IP data tunneling has been built. It allows to establish secure connection between two parts of automatic control system connected via TCP/IP-based computer network. This paper presents tool for securing measurement/control data transmission, secure operation on remote PLCs, data acquisition servers and use of SCADA system connected to the installation through the Internet, using TCP/IP connection forwarding via SSH tunnel. Presented example shows also simplicity of this solution.

Many research projects and implementations related to QoS (Quality of Service) management technologies for providing stable network services have been undertaken. To perform QoS management, traffic classes are required. Generally, traffic is classified by setting priorities for packets, and the methods of setting those priorities include passive admission control in which clients set priorities and active admission control in which network edge routers check traffic and set priorities. To perform active admission control, identification information such as a TCP or UDP header must be inspected. However, with existing security protocols such as ESP (Encapsulating Security Payload) or SSH (Secure Shell), these kinds of information cannot be inspected because they are encrypted. Based on the point of view that active admission control should be performed to simplify QoS management of IP networks, the authors of this paper propose a security protocol named ESPQ (ESP considered QoS) for constructing active admission controllable packets and investigate the stability of that protocol. They also perform implementation experiments to show that existing control equipment such as routers can perform QoS management of ESPQ packets. © 2004 Wiley Periodicals, Inc. Electron Comm Jpn Pt 2, 87(2): 47–58, 2004; Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/ecjb.10215

Today's networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure fromcentral offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKDsystems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.

The Secure Shell (SSH) protocol is widely used to provide secure remote access to servers, making it among the most important security protocols on the Internet. We show that the signed-Diffie--Hellman SSH ciphersuites of the SSH protocol are secure: each is a secure authenticated and confidential channel establishment (ACCE) protocol, the same security definition now used to describe the security of Transport Layer Security (TLS) ciphersuites. While the ACCE definition suffices to describe the security of individual ciphersuites, it does not cover the case where parties use the same long-term key with many different ciphersuites: it is common in practice for the server to use the same signing key with both finite field and elliptic curve Diffie--Hellman, for example. While TLS is vulnerable to attack in this case, we show that SSH is secure even when the same signing key is used across multiple ciphersuites. We introduce a new generic multi-ciphersuite composition framework to achieve this result in a black-box way.

In this chapter, you’ll learn all there is to know about networking in SLES. We’ll cover the required information about manual network configuration, which makes clear which commands to use and which not to. Then you’ll read how to perform configuration automated from YaST. You’ll also learn which configuration files are related. Next, you’ll read how the completely new wicked tool is used to configure network settings, as an alternative to the approach that can be taken using YaST. At the end of the chapter, you’ll discover how to set up and work with Secure Shell (SSH), for secure remote network connections.

Modern networking architecture is designed with high scalability in mind. Different protocols can be encapsulated to support different systems. Machine identifiers (IP and MAC addresses) in network packets can be modified easily. This modification prevents servers from determining whether the connecting machines are allowed to communicate. Cryptographic functions have been used in protocols such as Secure Shell (SSH) to establish network node authenticity, but they can be circumvented by social engineering and brute force attacks. This research effort created a new classifier that processes network telemetry to determine authenticity of SSH clients in a control system's network. The developed classifier, within the control system's network, was able to differentiate with a 100% accuracy SSH connections from machines that were transmitting identical MAC and IP addresses, and had the same RSA key for authentication.

Numerous communications security standards - including IP security (IPsec), secure shell (SSH), and various forms of e-mail encryption - now exist to protect information in transit. However, businesses have come to realize that the mishandling of stored data - information at rest - is also a significant threat to them and their customers. Whether data is stolen, lost, or discarded, the results are the same: Information that should be confidential may no longer be. To address this deficiency, the IEEE Computer Society's Security in Storage Working Group (http://siswg.org) is developing Project 1619, Standard Architecture for Encrypted Shared Storage Media. P1619's goal is to enable the interoperable encryption of storage devices, provide methods for information owners to transfer key material, and facilitate product certification. The standard currently includes encryption at the physical level of disk and tape drives, and future efforts will extend it to objects and file systems.

Cloud computing is making a new revolution in the computing world. Elasticity is one of the key features of the cloud which makes cloud computing further fashionable. Cloud is still in its infant stages and it faces a wide range of security threats. The security downtime of cloud is relatively slowing down the spreading up of cloud computing. This paper focuses on the security threats faced by the web lets during their migration between the cloud and the mobile devices. Web let migration is an important task during the implementation of elasticity in the cloud. As a primary step, a secure communication channel is designed for the web let migration by deploying secure shell protocol. Herein, the vulnerabilities in some authentication mechanisms are highlighted and a better way of authenticating the web lets with SFTP (Secure File Transfer Protocol) is suggested. Finally, managing the traffic effectively in the designed channel with the aid of back pressure technique is also covered in this paper.

Port knocking is a technique by which only a single packet or special sequence will permit the firewall to open a port on a machine where all ports are blocked by default. It is a passive authorization technique which offers firewall-level authentication to ensure authorized access to potentially vulnerable network services. In this paper, we present performance evaluation and analytical comparison of three widely used port knocking (PK) algorithms, Aldaba, FWKNOP and SIG-2. Comparative analysis is based upon ten selected parameters; Platforms (Supported OS), Implementation (PK, SPA or both), Protocols (UDP, TCP, ICMP), Out of Order packet delivery, NAT (Network Address Translation), Encryption Algorithms, Root privileges (For installation and operation), Weak Passwords, Replay Attacks and IPv6 compatibility. Based upon these parameters, relative performance score has been given to each algorithm. Finally, we deduce that FWKNOP due to compatibility with windows client is the most efficient among chosen PK implementations., 3rd WNM in conjunction with 14th HPCC-2012, Liverpool, UK

Secure Shell (SSH) is a multi-channel security protocol running over the Transmission Control Protocol (TCP), which offers channels for several services over a secured connection, such as remote shells and connection forwarding. In this paper we introduce a method for using SSH over the Stream Control Transmission Protocol (SCTP), a transport protocol supporting multi-homing and multi-streaming. We examine benefits of this adaptation, which can be made available to generic applications with SSH's connection forwarding without further changes. The results also apply to other application protocols supporting a concept similar to channels.

Traditional low-latency anonymization techniques apply non-standardized, complex, and often even proprietary protocols. Apart from poor performance, the high development effort leads to the existence of at most one single implementation. This in turn increases the risk of creating so-called software monocultures, where failures in the single implementation can compromise the overall security. In this paper we introduce SOR -- a novel approach for anonymization that is completely based on standardized, well tested, and performance-tuned protocols. It utilizes out-of-the-box nested SSH connections to achieve an exhaustive state-of-the-art anonymization system based on onion routing. Our approach supports both sender and receiver anonymity. Besides of many audited implementations, the SSH protocol itself is mature and has been thoroughly analyzed with respect to security issues. The results of our evaluation show that our approach outperforms existing alternatives by a factor of up to nine without sacrificing the degree of anonymity. Moreover, SOR can be easily implemented which increases the chances of having many alternative clients available.

Secure SHell(SSH) [1] provides TCP/IP port forwarding for any Application-layer protocols. It is useful in protecting the privacy of users, but it can lead to the illegal use of some forbidden protocols. Because of the encryption, the Deep Payload Inspection (DPI) technique is ineffective in classifying the network traffic. This paper introduces how to employ the statistical pattern recognition method, Maximum Likelihood Classification [2, 3], to classify the SSH tunneled traffic, i.e. to decide which protocols is tunneled in the encrypted tunnels. It is very important to find out the boundary of a tunneled flow in processing the originate data. So we proposed a method for detecting the boundaries of SSH tunneled traffic.

The use of application-layer tunnels has become more popular nowadays. By using encrypted tunnels for prohibited application such as peer-to-peer file sharing it is easy to gain access to restricted networks. Application-layer tunnels provide a possibility to bypass network defenses which is even more useful for malicious users trying to avoid detection. The accurate identification of application flows in encrypted tunnels is important for the network security and management purposes. Traditional network traffic classification methods based on port numbers or pattern-matching mechanisms are practically useless in identifying application flows inside an encrypted tunnel, therefore another approach is needed. In this paper, we propose a two-phased method for classifying SSH tunneled application flows in real time. The classification is based on the statistical features of the network flows. The first classification phase identifies the SSH connection while the second classification phase detects the tunneled application. A simple K-Means clustering algorithm is utilized in classification. We evaluated our method using manually generated packet traces. The results were promising; over 94% of all flow samples were classified correctly, while untrained application flow samples were detected as unknown at high precision. (12 refs.)

Publisher Summary During a penetration test (PenTest), once access has been achieved on a target system, penetration testers need to maintain that access. This chapter discusses methods and tools used by testers to maintain constant access to their target network. The use of backdoors is very common in a penetration test. Backdoors can slip past defense obstacles, such as firewalls or access control lists, giving the professional penetration unfettered access to the compromised system. Backdoors can also speed up access to a server. The Open Source tool netcat is an effective application that can be used to create communication channels between two systems. With a little scripting, netcat can be used to create a reverse shell that will connect back to our attack system at any interval of time. The disadvantage to using netcat is all communication between attack server and the victim is sent in cleartext, which could be identified and terminated by an intrusion prevention system. To avoid detection, another mode of communication is used—encrypted tunnels. An Open Secure Shell (SSH) allows malware and additional exploits to be placed onto the victim system without being seen by network detection systems, because all the traffic between the attack system and the victim is encrypted. SSH tunnel can be configured as a direct or reverse shell depending on the accessibility of the target server by the attack system. A few other tunnel applications exist that use different types of encryption, including Cryptcat, Matahari, Proxytunnel, Socat, and Stunnel.

Mobile Virtual Private Networking (VPN) solutions based on the Internet Security Protocol (IPSec), Transport Layer Security/Secure Socket Layer (SSL/TLS), Secure Shell (SSH), 3G/GPRS cellular networks, Mobile IP, and the presently experimental Host Identity Protocol (HIP) are described, compared and evaluated. Mobile VPN solutions based on HIP are recommended for future networking because of superior processing efficiency and network capacity demand features. Mobile VPN implementation issues associated with the IP protocol versions IPv4 and IPv6 are also evaluated. Mobile VPN implementation experiences are presented and discussed.

Secure SHell is a TCP based protocol designed to enhance with security features telnet and other insecure remote management tools. Due to its versatility, it is often exploited to forward applications (i.e. HTTP, SCP, etc.) into encoded TCP traffic flows. The point which makes challenging the identification of the uses of SSH is that packets are enciphered and instruments based on deep packet inspection (DPI) cannot achieve this task. We approached the problem of early SSH classification with k-means based machine by studying statistical behavior of IP traffic parameters, such as length, arrival time and direction of packets. In this paper we describe tools and networks designed to collect SSH remote administration traffic as well as relevant results obtained for its classification. In particular, our tool identifies remote management traffic out of other SSH encoded applications with accuracy up to 90.34

The secure shell protocol (SSH) is widely deployed to access command line interfaces of network devices and host systems over an insecure network. Recently, the IETF has produced specifications how to run network management protocols such as NETCONF or SNMP over SSH. SSH computes new session keys whenever a new SSH session is established. This computationally expensive operation causes significant latency and processor load on low end devices and thus makes short-lived connections very expensive. To address this problem, we describe a session resumption feature that allows clients to resume sessions without having to compute new session keys.

ParaView is a very powerful visualization tool used by many in the Department of Defense (DoD) high performance computing (HPC) community. It is both fast and flexible. It performs well on a user’s desktop, but it can also scale to take advantage of clusters and large shared memory machines. Recently, ParaView has been adapted to run on the Linux clusters at the US Army Research Laboratory DoD Supercomputing Resource Center (ARL DSRC) using the Load Sharing Facility (LSF) batch queues. This method makes heavy use of Secure Shell (SSH) port forwarding to move data between the cluster nodes and the user’s desktop. The method is fast, convenient, and secure. Unfortunately, not everyone can use SSH port forwarding. For example, some users may not have access to servers that allow port-forwarded traffic. Also, there are users that are specifically banned from initiating a port forward from their desktop. To solve this problem, we have developed a version of ParaView that does not use TCP/IP sockets between the client and the server. Instead, the data is passed through the SSH standard in/out. If the user wishes to use a batch queue, a helper script handles the communication between the login node and the nodes that are allocated to the user. This paper describes the implementation of an SSHenabled ParaView. It then empirically compares our version to various other methods of running ParaView in the DoD HPC environment. Finally, it helps guide HPC users to determine the method that best fits their needs. This work benefits the DoD HPC community by making ParaView client/server available to users that have been previously unable to use it.

System security is a crucial constraint for Secure Transfer of data. Because of the nature of the SSH Protocol, anyone with access to the central server can manipulate files, it is imperative that only authorized users be able to access the central server. Secure Transfer has taken steps that will discourage several common attempts to forcefully gain access to the system. These steps include implementing a port knocking protocol, limiting access to only authorized machines and users, and keeping persistent logs. The Secure Shell (SSH) protocol is one of the most popular cryptographic protocols on the Internet. Secure Shell Protocol (SSH) uses the standard algorithms namely DES, AES and the RSA. Any user normally can use these algorithms which is being specified by the SSH protocol. As it is an OpenSSH, it is possible for the hackers to break the security during transmission of data. The idea behind the paper was when we allow the users to specify their own encryption techniques, which is not known to others can improve their security and also from hackers breaking the code. This will helps the user to create their encryption standards in the SSH protocol which provides more security to the users network and known only to the users.

It is generally agreed that there is no valid reason to use a long connection chain for remote login such as SSH connection. Most of the stepping-stone detection algorithms installed on a host were designed to protect the victim of a third party downstream from where the algorithm is running. It is much more important for a host to protect itself from being a victim. This project uses an approximated round-trip time to distinguish a long connection chain from a short one. Several measures were studied to distinguish long chains from short ones. An estimated roundtrip time was defined to measure the chain length. Preliminary result suggests shows that the proposed algorithm can distinguish long connection chains from short ones with relatively low false rate.