298 research outputs found
Security Analysis of Yang et al.s' Practical Password-Based Two-Server Authentication and Key Exchange Systems
No full textTypical protocols for password-based authentication assumes a single server which stores all the passwords necessary to authenticate users. If the server is compromised, user passwords are disclosed. To address this issue, Yang et al. proposed a practical password-based two-server authentication and key exchange protocol, where a front-end server, keeping one share of a password, and a back-end server, holding another share of the password, cooperate in authenticating a user and, meanwhile, establishing a secret key with the user. In this paper, we present two ``half-online and half-offline'' attacks to Yang et al.'s protocol. By these attacks, user passwords can be determined once the back-end server is compromised. Therefore, Yang et al.'s protocol has no essential difference from a password-based single-server authentication protocol
Validating denial of service vulnerabilities in web services
Get PDFThe loosely-coupled and dynamic nature of web\ud
services architectures has many benefits, but also leads to an\ud
increased vulnerability to denial of service attacks. While many\ud
papers have surveyed and described these vulnerabilities, they\ud
are often theoretical and lack experimental data to validate\ud
them, and assume an obsolete state of web services technologies.\ud
This paper describes experiments involving several denial of\ud
service vulnerabilities in well-known web services platforms,\ud
including Java Metro, Apache Axis, and Microsoft .NET. The\ud
results both confirm and deny the presence of some of the\ud
most well-known vulnerabilities in web services technologies.\ud
Specifically, major web services platforms appear to cope well\ud
with attacks that target memory exhaustion. However, attacks\ud
targeting CPU-time exhaustion are still effective, regardless of\ud
the victim’s platform
Automatic generation of assertions to detect potential security vulnerabilities in C programs that use union and pointer types
Get PDFType unions, pointer variables and function pointers are a long standing source of subtle security bugs in C program code. Their use can lead to hard-to-diagnose crashes or exploitable vulnerabilities that allow an attacker to attain privileged access over classified data. This paper describes an automatable framework for detecting such weaknesses in C programs statically, where possible, and for generating assertions that will detect them dynamically, in other cases. Exclusively based on analysis of the source code, it identifies required assertions using a type inference system supported by a custom made symbol table. In our preliminary findings, our type system was able to infer the correct type of unions in different scopes, without manual code annotations or rewriting. Whenever an evaluation is not possible or is difficult to resolve, appropriate runtime assertions are formed and inserted into the source code. The approach is demonstrated via a prototype C analysis tool
A portable infrastructure supporting global scheduling of embedded real-time applications on asymmetric MPSoCs
No full textMultiprocesso system-on-chip (MPSoC) open notable perspectives in the design of highly targeted embedded solutions for real-time multi-tasking applications. The eterogeneity of available platforms, however, often hinders plain applicability of efficient schedulng policies, particularly in the case of loosely-coupled architectures which do not provide any support for inter-processor task migration. In this paper we present a portable software nfrastructure addressing the global scheduling of periodic real-time tasks on such platforms. We show that global scheduling policies, under the restricted-migration model, are applicable also on asymmetric multiprocessing systems and experimentally evaluate the validity of the approach using different FPGA-based confiurations that recall manifold architectures of commercial MPSoCs
A messaging-based system for remote server administration
No full textThe most common method of system administration is accessing the remote system through the network by means of some client-server protocol, giving access to a privileged service always listening on the target system. There are important security and flexibility limitations deriving from the usage of a predictable access port for such a critical application, which can be summarized as the impossibility of attaining a satisfactory trade-off between attack rejection capability and service availability. This work illustrates an alternative solution based on the presence of an intermediate system, acting as a meeting place in between the remote server and its administrator. The resulting architecture eliminates the predictable management port on the server, enhances the availability of the management service by exploiting widespread communication platforms that are likely to be accessible from anywhere, and exhibits a modular structure enabling promising future extensions aimed at overcoming many other issues of the current administration techniques
Optimized Two Party Privacy Preserving Association Rule Mining Using Fully Homomorphic Encryption
No full textIn two party privacy preserving association rule mining, the issue to securely compare two integers is considered as the bottle neck to achieve maximum privacy. Recently proposed fully homomorphic encryption (FHE) scheme by Dijk et.al. can be applied in secure computation. Kaosar, Paulet and Yi have applied it in preserving privacy in two-party association rule mining, but its performance is not very practical due to its huge cyphertext, public key size and complex carry circuit. In this paper we propose some optimizations in applying Dijk et.al.’s encryption system to securely compare two numbers. We also applied this optimized solution in preserving privacy in association rule mining (ARM) in two-party settings. We have further enhanced the two party secure association rule mining technique proposed by Kaosar et.al. The performance analysis shows that this proposed solution achieves a significant improvement.\u
A principled approach to grid middleware:status report on the minimum intrusion grid
No full textThis paper provides an overview of MiG, a Grid middleware for advanced job execution, data storage and group collaboration in an integrated, yet lightweight solution using standard software. In contrast to most other Grid middlewares, MiG is developed with a particular focus on usability and minimal system requirements, applying strict principles to keep the middleware free of legacy burdens and overly complicated design. We provide an overview of MiG and describe its features in view of the Grid vision and its relation to more recent cloud computing trends.This paper provides an overview of MiG, a Grid middleware for advanced job execution, data storage and group collaboration in an integrated, yet lightweight solution using standard software.In contrast to most other Grid middlewares, MiG is developed with a particular focus on usability and minimal system requirements, applying strict principles to keep the middleware free of legacy burdens and overly complicated design. We provide an overview of MiG and describe its features in view of the Grid vision and its relation to more recent cloud computing trends.<br/
A Multi-agent Security Architecture
Get PDFThis paper presents a multi-agent security architecture, which utilizes the agent characteristics to cater for security processes in online communications. The multilayer communication approach (MLC) is used to determine the security processes, which uses cryptography protocols to secure data and communication channel. Agents are skilled to perform certain tasks. At the sender's host, agents interact with each other to secure a message to be sent to the recipient, including encryption, digital signature, and hash code. A mobile agent is used to carry the encrypted messages as well as the agent's code to the recipient's host. Our approach also provides mechanisms to verify the authenticity, confidentiality and the integrity of the code and data that arrived at the recipient's host. The message and the code are authenticated, the code is executed to perform tasks to recover the plaintext
- …
