Search

In this paper we report our experiment concerning new attacks detection by a neural network-based Intrusion Detection System. What is crucial for this topic is the adaptation of the neural network that is already in use to correct classification of a new "normal traffic" and of an attack representation not presented during the network training process. When it comes to the new attack it should also be easy to obtain vectors to test and to retrain the neural classifier. We describe the proposal of an algorithm and a distributed IDS architecture that could achieve the goals mentioned above., Comment: 9 pages, 3 figures, 4 tables

The Voice over Internet Protocol (VoIP) is becoming a more available and popular way of communicating for Internet users. This also applies to Peer-to-Peer (P2P) systems and merging these two have already proven to be successful (e.g. Skype). Even the existing standards of VoIP provide an assurance of security and Quality of Service (QoS), however, these features are usually optional and supported by limited number of implementations. As a result, the lack of mandatory and widely applicable QoS and security guaranties makes the contemporary VoIP systems vulnerable to attacks and network disturbances. In this paper we are facing these issues and propose the SecMon system, which simultaneously provides a lightweight security mechanism and improves quality parameters of the call. SecMon is intended specially for VoIP service over P2P networks and its main advantage is that it provides authentication, data integrity services, adaptive QoS and (D)DoS attack detection. Moreover, the SecMon approach represents a low-bandwidth consumption solution that is transparent to the users and possesses a self-organizing capability. The above-mentioned features are accomplished mainly by utilizing two information hiding techniques: digital audio watermarking and network steganography. These techniques are used to create covert channels that serve as transport channels for lightweight QoS measurement's results. Furthermore, these metrics are aggregated in a reputation system that enables best route path selection in the P2P network. The reputation system helps also to mitigate (D)DoS attacks, maximize performance and increase transmission efficiency in the network., Comment: Paper was presented at 7th international conference IBIZA 2008: On Computer Science - Research And Applications, Poland, Kazimierz Dolny 31.01-2.02 2008; 14 pages, 5 figures

In this paper we describe a new, lightweight security mechanism for PSTN-VoIP cooperation that is based on two information hiding techniques: digital watermarking and steganography. Proposed scheme is especially suitable for PSTN-IP-PSTN (toll-by-passing) scenario which nowadays is very popular application of IP Telephony systems. With the use of this mechanism we authenticate end-to-end transmitted voice between PSTN users. Additionally we improve IP part traffic security (both media stream and VoIP signalling messages). Exemplary scenario is presented for SIP signalling protocol along with SIP-T extension and H.248/Megaco protocol., Comment: 6 pages, 5 figures

The pervasiveness of wireless communication recently gave mobile ad hoc networks (MANET) a significant researchers' attention, due to its innate capabilities of instant communication in many time and mission critical applications. However, its natural advantages of networking in civilian and military environments make them vulnerable to security threats. Support for an anonymity in MANET is an orthogonal to security critical challenge we faced in this paper. We propose a new anonymous authentication protocol for mobile ad hoc networks enhanced with a distributed reputation system. The main its objective is to provide mechanisms concealing a real identity of communicating nodes with an ability of resist to known attacks. The distributed reputation system is incorporated for a trust management and malicious behavior detection in the network. The end-to-end anonymous authentication is conducted in three-pass handshake based on an asymmetric and symmetric key cryptography. After successfully finished authentication phase secure and multiple anonymous data channels are established. The anonymity is guarantied by randomly chosen pseudonyms owned by a user. Nodes of the network are publicly identified and are independent of users' pseudonyms. In this paper we presented an example of the protocol implementation., Comment: 12 pages, 10th Domestic Conference on Applied Cryptography ENIGMA, Warsaw, Poland, May 2006, The second author's last name was corrected

In this paper new security and control protocol for Voice over Internet Protocol (VoIP) service is presented. It is the alternative for the IETF's (Internet Engineering Task Force) RTCP (Real-Time Control Protocol) for real-time application's traffic. Additionally this solution offers authentication and integrity, it is capable of exchanging and verifying QoS and security parameters. It is based on digital watermarking and steganography that is why it does not consume additional bandwidth and the data transmitted is inseparably bound to the voice content., Comment: 8 pages, 4 figures, 1 table

This paper describes a new protocol for authentication in ad-hoc networks. The protocol has been designed to meet specialized requirements of ad-hoc networks, such as lack of direct communication between nodes or requirements for revocable anonymity. At the same time, a ad-hoc authentication protocol must be resistant to spoofing, eavesdropping and playback, and man-in-the-middle attacks. The article analyzes existing authentication methods based on the Public Key Infrastructure, and finds that they have several drawbacks in ad-hoc networks. Therefore, a new authentication protocol, basing on established cryptographic primitives (Merkle's puzzles and zero-knowledge proofs) is proposed. The protocol is studied for a model ad-hoc chat application that provides private conversations., Comment: 8 pages, 8 figures, this an extended version of paper accepted for IASTED conference CNIS'2005

The recent developments in the mobile technology (mobile phones, middleware) created a need for new methods of protecting the code transmitted through the network. The proposed mechanisms not only secure the compiled program, but also the data, that can be gathered during its "journey". The oldest and the simplest methods are more concentrated on integrity of the code itself and on the detection of unauthorized manipulation. Other, more advanced proposals protect not only the code but also the execution state and the collected data. The paper is divided into two parts. The first one is mostly devoted to different methods of securing the code and protecting its integrity; starting from watermarking and fingerprinting, up to methods designed specially for mobile agent systems: encrypted function, cryptographic traces, time limited black-box security, chained-MAC protocol, publicly-verifiable chained digital signatures The second part presents new concept for providing mobile agents with integrity protection, based on a zero-knowledge proof system., Comment: 11 pages, 2 figures

Problems with securing IP Telephony systems, insufficient standardization and lack of security mechanisms emerged the need for new approaches and solutions. In this paper a new, alternative security architecture for voice-systems is presented. It is based on digital watermarking: a new, flexible and powerful technology that is increasingly gaining more and more attention. Besides known applications e.g. to solve copyright protection problems, we propose to use digital watermarking to secure not only transmitted audio but also signaling protocol that IP Telephony is based on., Comment: 10 pages, 5 figures

In the paper we state and prove theorem describing the upper bound on number of the graphs that have fixed number of vertices |V| and can be colored with the fixed number of n colors. The bound relates both numbers using power of 2, while the exponent is the difference between |V| and n. We also state three conjectures on the number of graphs that have fixed number of vertices |V| and chromatic number n., Comment: 7 pages, submitted for journal publication

At the beginning some results from the field of graph theory are presented. Next we show how to share a secret that is proper n-coloring of the graph, with the known structure. The graph is described and converted to the form, where colors assigned to vertices form the number with entries from Zn. A secret sharing scheme (SSS) for the graph coloring is proposed. The proposed method is applied to the public-key cryptosystem called "Polly Cracker". In this case the graph structure is a public key, while proper 3-colouring of the graph is a private key. We show how to share the private key. Sharing particular n-coloring (color-to-vertex assignment) for the known-structure graph is presented next., Comment: 10 pages, 5 figures

In the paper we discuss how to share the secrets, that are graphs. So, far secret sharing schemes were designed to work with numbers. As the first step, we propose conditions for "graph to number" conversion methods. Hence, the existing schemes can be used, without weakening their properties. Next, we show how graph properties can be used to extend capabilities of secret sharing schemes. This leads to proposal of using such properties for number based secret sharing., Comment: 11 pages

We show a method how to convert any graph into the binary number and vice versa. We derive upper bound for maximum number of graphs, that, have fixed number of vertices and can be colored with n colors (n is any given number). Proof for the result is outlined. Next, graph coloring based check-digit scheme is proposed. We use quantitative result derived, to show, that feasibility of the proposed scheme increases with size of the number which digits are checked, and overall probability of digits errors., Comment: 7 pages, paper sumitted to Applied Mathematics Letters (Elsevier)

In the paper we propose general framework for Automatic Secret Generation and Sharing (ASGS) that should be independent of underlying secret sharing scheme. ASGS allows to prevent the dealer from knowing the secret or even to eliminate him at all. Two situations are discussed. First concerns simultaneous generation and sharing of the random, prior nonexistent secret. Such a secret remains unknown until it is reconstructed. Next, we propose the framework for automatic sharing of a known secret. In this case the dealer does not know the secret and the secret owner does not know the shares. We present opportunities for joining ASGS with other extended capabilities, with special emphasize on PVSS and proactive secret sharing. Finally, we illustrate framework with practical implementation. Keywords: cryptography, secret sharing, data security, extended capabilities, extended key verification protocol, Comment: 8 pages paper with 9 pages appendixes. Keywords: cryptography, secret sharing, data security, extended capabilities, extended key verification protocol

Secret sharing allows split/distributed control over the secret (e.g. master key). Verifiable secret sharing (VSS) is the secret sharing extended by verification capacity. Usually verification comes at the price. We propose "free lunch", the approach that allows to overcome this inconvenience., Comment: This is poster that was presented on ESORICS2002 conference in Zurich. It consists of 4 color pages, with proposal and flowcharts

In the paper we apply graph vertex coloring for verification of secret shares. We start from showing how to convert any graph into the number and vice versa. Next, theoretical result concerning properties of n-colorable graphs is stated and proven. From this result we derive graph coloring check-digit scheme. Feasibility of proposed scheme increases with the size of the number, which digits are checked and overall probability of errors. The check-digit scheme is used to build shares verification method that does not require cooperation of the third party. It allows implementing verification structure different from the access structure. It does not depend on particular secret sharing method. It can be used as long as the secret shares can be represented by numbers or graphs.