Search

Copyright of Journal of Engineering Research (2307-1877) is the property of Kuwait University, Academic Publication Council and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Modal logics have proven invaluable for authorization in distributed systems. The logics devised so far, however, are inadequate to meet the requirements of pervasive environments. Such environments are, in general, characterized as open systems in which computing and communication facilities are provided to human users in a dynamic manner. These features suggest the need for the modification of existing logics in two directions. First, users' capabilities being intrinsic to pervasive computing should be incorporated into the underlying modal logic. Second, the logic should be equipped with appropriate machinery so that it can deal with the imperfection in the information required for authorization. This paper has contributions in both directions. We present a logic that reflects how the capabilities of users change in different contexts. Nonmonotonicity is then added to the logic so that earlier decisions based on imperfect information can be retracted. The usefulness of our formulation is demonstrated through the added capacity it provides for specifying and enforcing access control policies in real-life environments. We also present a minimal model semantics that reflects nonmonotonicity through the way it gives meaning to the formulas of the logic. Finally, we propose a sound and complete decision procedure based on semantic tableaux. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

ABSTRACT Analyzing the executable code, instead of the high-level model, of security protocols has received attention in recent years. To this end, a number of security type systems have already been proposed. These type systems are sound but incomplete. That is, a well-typed protocol is certainly secure, whereas no judgment can be made about the protocol whose type-annotated code is ill typed. In fact, the type-based analysis of a protocol would have no result unless we are able to find a well-typed code that represents both the protocol and the attacker's capabilities. As there is a very large space of possible type annotations and adversary models, this requires a profound knowledge of the rationale behind the underlying type system as well as the components of the protocol being analyzed. The problem is aggravated when the protocol runs in environments containing compromised principals. These issues have rendered the use of such type systems somewhat impractical. This paper is an attempt to resolve the problem for authentication protocols in environments containing Dolev-Yao attackers. We concretize our ideas in F5, a security type checker, and suggest effective type annotations and so-called attacker interfaces representing the capabilities of a general adversary. Copyright © 2013 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

ABSTRACT Defense mechanisms against distributed denial-of-service (DDoS) attacks usually mitigate the attack by filtering out the excess traffic targeted at the victim. These defenses should be able to discriminate the attack from the legitimate traffic so that filtering can be selectively applied. The problem is exacerbated when spoofed addresses are used in attack packets. This paper proposes traceback-based distributed packet filter (TDPF), a novel distributed packet filtering mechanism that employs IP traceback as a means for traffic discrimination. In this defense mechanism, packet filters are relocated to the routers nearer the attack sources whenever the traceback algorithm adds such nodes to the attack tree. The filtering probabilities at packet filters are also dynamically adjusted to the volume of traffic the victim receives from each filtering router. In this way, TDPF is able to achieve a high throughput of legitimate traffic while blocking malicious flows. The burden it imposes on a participating router is negligible as well. Moreover, unlike the earlier traceback-based defenses, it can defend against intense DDoS attacks. Experimental results show that TDPF is effective in different attack scenarios. Copyright © 2013 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

A promising method to stimulate cooperation among the nodes of a self-organizing mobile ad hoc network is the application of reputation systems. In these systems, usually, a node uses the recommendations made by the others when evaluating the reputation of the node under consideration. This renders such systems vulnerable to the Sybil attack in which an attacker forges several identities and uses them to recommend itself as a well-behaved node. In this paper, we propose a multistage-game strategy for reputation systems that discourages Sybil attacks. The underlying notion in devising such a strategy is that a Sybil identity, to remain trustworthy, should be active and sincere in recommending the others. Thus, for an effective attack, the attacker should incur the cost of maintaining the trustworthiness of its Sybil identities. This feature can be exploited to design a reputation system in such a way that the attack becomes more costly than cooperation. It is shown that the proposed strategy makes a subgame-perfect equilibrium, which justifies its deployment in real-life networks. [ABSTRACT FROM PUBLISHER]

The existence of selfish nodes, who do not cooperate in routing and forwarding, menaces the applicability of mobile ad hoc networks (MANETs). In this paper, we propose a novel price-based method for stimulating cooperation among the nodes of a MANET. This method utilizes the game-theoretic notion of core to distribute the earnings of a cooperation coalition among its members in an optimal manner. In this way, a stable costefficient route is established between communicating parties. [ABSTRACT FROM AUTHOR]

We develop a framework for the analysis of Denial of Service (DoS) attacks in computer networks. In this framework, we identify the components and resources that collectively and in time, construct a service that may become unavailable due to the unavailability of those resources as a result of a DoS. We also construct the notion of service resilience pre-ordering to compare the effectiveness of solutions proposed to improve a system's resilience against DoS. We apply our framework and methods to some cases, and show their usefulness and applicability in practice. [ABSTRACT FROM AUTHOR]