Security and Privacy in Communication Networks (eBook)

Preface 5
Organization 6
Table of Contents 9
Wireless Network Security I 9
Mitigating DoS Attacks on the Paging Channel by Efficient Encoding in Page Messages 12
Introduction 12
Paging Channel Operation 14
Paging Channel Operation 14
Paging Message Format 16
Paging Operation in Other Mobile Networks 17
Paging Channel Overload Problem 17
Efficient Encoding in Page Records 18
Approaches 19
Bandwidth Gain 22
Implementation Requirements 22
Advantages 22
Evaluation 23
Evaluation Based on Partial DoS Attack on Live Cellular Network 23
Simulating a Paging System 25
Related Work 28
Conclusion 30
References 30
FIJI: Fighting Implicit Jamming in 802.11 WLANs 32
Introduction 32
Background and PreviousWork 34
Performance Anomaly in 802.11WLANs 34
Jamming in Wireless Networks 36
FIJI to Combat the Implicit Jamming Attack 37
Detecting the Implicit-Jamming Attack 38
Shaping the Traffic at the AP to Alleviate Jammers 38
Implementation and Evaluation 41
The Implementation of FIJI 42
Experimental Set-Up and Methodology 42
Does FIJI Deliver? 44
The Scope of Our Study 48
Conclusion 49
References 50
Deny-by-Default Distributed Security Policy Enforcement in Mobile Ad Hoc Networks 52
Introduction 52
Threat Model 54
System Architecture 54
Feasibility 57
Capability Definition 57
Security Analysis 59
Related Work 59
Conclusions and Future Work 60
References 61
Network Intrusion Detection 9
Baiting Inside Attackers Using Decoy Documents 62
Introduction 62
Related Work 64
Threat Model - Level of Sophistication of the Attacker 66
Generating and Distributing Bait 67
Decoy Properties 67
The Decoy Document Distributor (D$^{3}$) System 72
Decoy Document Design 72
Evaluation 74
Masquerade Detection Using Decoy Documents as Bait 74
Beacon Implementation Tests 78
Conclusions 79
References 80
MULAN: Multi-Level Adaptive Network Filter 82
Introduction 82
Related Work 84
DoS Attacks 85
Notations and Definitions 86
The MULAN-Filter Design 86
Anticipated Traffic Behavior Profile 87
Data Structure 87
Special Levels for Specific Protocols 88
The Algorithm 89
Training Mode 89
Verification Mode 90
The Algorithm Parameters 91
Modeling Non-self-similar Traffic 93
Handling Short Attacks 94
Optimal Implementation 94
Experimental Results 96
Scalability 96
Accuracy 97
Controlling the Tree Size 99
Discussion and Future Work 100
References 100
Automated Classification of Network Traffic Anomalies 102
Introduction 102
Related Work 103
Anomaly Classification 104
Gathering Information 105
Classification 105
Validation 108
Data 109
Methodology 109
Results and Discussion 109
Conclusions 110
References 110
Security and Privacy for the General Internet 9
Formal Analysis of FPH Contract Signing Protocol Using Colored Petri Nets 112
Introduction 112
FPH Contract Signing Protocol 113
Ideal Features of a Contract Signing Protocol 113
Description of FPH Contract Signing Protocol 114
Informal Analysis of Fairness and Non-repudiation of FPH Protocol 115
Description of the Model Used for the Formal Analysis of Fair Exchange Protocols 116
Colored Petri Nets 116
General Assumptions and Methodology 117
Description of the Model 117
Query Functions 120
Formal Analysis of FPH Contract Signing Protocol 121
Evaluation of the Vulnerability to Previously Defined Attacks 121
Fairness Analysis 126
Conclusions and Future Work 129
References 130
On the Security of Bottleneck Bandwidth Estimation Techniques 132
Introduction 132
Bottleneck Bandwidth Estimation 134
Bandwidth Manipulation Attacks 136
System and Attacker Model 136
Attacks on Current Techniques 137
Demonstration of Delay Attacks 139
Trusted Infrastructure Support for Bandwidth Measurement 140
“Best-Effort” Solutions for Current Bandwidth Estimation Techniques 142
Mitigating Spoofing and Rushing Attacks 142
Alleviating Delay Attacks 142
Discussion and Outlook 149
Conclusions 150
References 150
An Eavesdropping Game with SINR as an Objective Function 153
Introduction 153
Problem Overview 155
Optimization with SINR as the Objective Function 155
An Eavesdropping Game with Unknown Gains 158
Either the Eavesdropper’s Channels Gains or the Main Channels Gains Are Unknown 161
The Worst Case for the Main Gains Are Known 162
The Optimization Problem with Unknown Noise and Eavesdropper’s Channel Gains 165
The Game with Unknown Noise in the Main Subchannels 166
Conclusion 168
References 168
A Appendix 169
Malware and Misbehavior 9
Ensemble: Community-Based Anomaly Detection for Popular Applications 174
Introduction 174
Related Work 175
Methodology 177
Profile Generation 178
The Environment Diversity Challenge 179
Anomaly Detection 179
Implementation 181
Generating Profiles and Anomaly Detection 182
Operational Model 182
Limitations of the Prototype 183
Evaluation and Experiments 183
Small Scale Real Deployment 183
Experimental Infrastructure 184
Local Profiles 185
Global Profiles 187
False Positives 188
False Negatives 190
Performance Evaluation 192
Limitations of Ensemble 193
Over-Generalization 193
Mimicry Attacks 193
Conclusions 194
References 194
Using Failure Information Analysis to Detect Enterprise Zombies 196
Introduction 196
An Empirical Survey of Application Failure Anomalies 198
Malware Trace Analysis 199
Failure Patterns of Normal Applications 202
On the Potential of Failure Analysis to Uncover Suspicious Activities 204
Architecture 204
System Overview 205
Building an FIA from Wireshark 205
L7-Based Automatic Protocol Inference 206
Multipoint Deployment 206
Correlation and Clustering Engine 207
Detecting Suspicious Hosts 208
Detecting Failure Groups 210
Evaluation 211
Classification and Detection Results 212
Related Work 214
Conclusion 215
References 215
Dealing with Liars: Misbehavior Identification via Rényi-Ulam Games 218
Introduction 218
Related Work 219
Network and Adversarial Models 221
Misbehavior Identification 222
Motivation and Problem Mapping 222
R/'{e}nyi-Ulam Inspired Auditing Strategies 223
Misbehaving Node Identification 230
Mobility 231
The Audit Mechanism 231
Performance Evaluation 232
Simulation Setup 232
Auditing Strategy Comparison 233
Comparison with Other Schemes 234
Conclusion 236
References 236
Wireless Network Security II, Sensor Networks 10
Multichannel Protocols for User-Friendly and Scalable Initialization of Sensor Networks 239
Introduction 239
Problem Statement and System Model 241
System Model 241
Attacker Model 241
Secret Key Deployment 242
Key Transmission and Verification 242
Sensor Node State Diagram 243
Initial Security Assessment 244
Public Key Deployment 245
Attacks on Visible Light Channel 246
“Public Key”–Based Deployment Protocol 248
Short Security Analysis 249
Implementation 250
Random Number Generator 250
Related Work 254
Conclusion 256
References 256
Aggregated Authentication (AMAC) Using Universal Hash Functions 259
Introduction 259
Preliminaries 260
Formal Definition of Aggregation and Related Work 260
MACs Based Upon Universal Hash Functions 262
New Designs 264
XOR Aggregation: How to Adapt the Krawczyk’s Approaches for WSNs 265
Aggregation over ${/mathbb F}_{p}$ 267
Security Analysis in the AMAC Model 269
Performance Comparison 270
LEACH: Low-Energy Adaptative Clustering Hierarchy 271
Different Scenarios and Evaluation Parameters 271
Simulation and Results 271
Conclusion 273
References 274
Sec-TMP: A Secure Topology Maintenance Protocol for Event Delivery Enforcement in WSN 276
Introduction 276
Related Work 278
System Assumptions and Notation 279
Threat Model 280
Protocol Overview 281
Protocol Description 282
Protocol Start-Up 282
Probing State 283
Working State 285
Sleeping State 286
Security Analysis 286
Sec-TMP Security Property 287
Sec-TMP Resilience to Standard TMPs Attacks 289
Sec-TMP to Thwart Node Replication Attack 290
Simulations and Discussion 290
Network Lifetime and Area Coverage 291
Start-Up Completion Time 292
Concluding Remarks 293
References 293
Hierarchical Self-healing Key Distribution for Heterogeneous Wireless Sensor Networks 296
Introduction 296
Related Work 297
Heterogeneous WSN Architecture 298
Model and Definition 299
Our Construction 301
Scheme Details 301
Efficiency 302
Security Analysis 303
Conclusion 305
References 305
Key Management, Credentials, Authentications 10
User–Centric Identity Using ePassports 307
Introduction 307
The ICAO ePassport 308
Logical Data Structure 308
Security Controls 309
Software for Accessing ePassports 310
User-Centric Identity 311
Enrolling at the Identity Provider 312
Using a Managed Card to Authenticate at the Relying Party 312
Combining ePassports and User-Centric Identity 313
Enrolling the ePassport at the Identity Provider 314
Using the ePassport to Authenticate at a Relying Party 314
Discussion of Lessons Learned 316
The Need for an Online Identity Provider 316
The Need to Trust the Identity Provider 317
Not a Global PKI for Online User Authentication 318
Concluding Remarks 319
References 320
Defending against Key Abuse Attacks in KP-ABE Enabled Broadcast Systems 322
Introduction 322
Our Contribution 324
Related Work 325
Preliminaries 326
Bilinear Maps 326
Complexity Assumptions 326
Definitions and Models 327
Description of AFKP-ABE 327
Security Definition 327
Our Construction 329
Main Idea 329
AFKP-ABE Scheme 330
Security Proof 333
Efficiency Analysis 335
Application Scenarios of Our Scheme 335
Conclusion and Future Work 335
References 336
Appendix 337
Breaking and Building of Group Inside Signature 341
Introduction 341
Preliminaries 343
Bilinear Pairing 343
Cryptanalysis of Certificateless GIS and BGOS Schemes 343
Cryptanalysis of Certificateless GIS Scheme [5] 343
Cryptanalysis of Another Certificateless GIS Scheme [6] 344
Cryptanalysis of Broadcast Group Oriented Signature [7] 345
Cryptanalysis of Identity Based ADGS Scheme [8] 347
New ADGS Scheme(N-ADGS) 348
Security Proof for N-ADGS 349
Conclusion 350
References 350
Use of ID-Based Cryptography for the Efficient Verification of the Integrity and Authenticity of Web Resources 351
Introduction 351
Background 352
Supporting Identity Based Cryptography (IBC) on the Internet 352
Digital Signatures for Web Resources 353
IBC for Web Resources 353
Mediated RSA (mRSA) 354
Creating an Identity Based Infrastructure for Resource Authenticity 354
IBC over the Existing Web Infrastructure 356
IBC over the Existing Web Protocols 356
Scenarios for IBC Deployment on the Web 358
Conclusions and Further Work 359
References 360
Wireless Network Security III 10
Self-organized Anonymous Authentication in Mobile Ad Hoc Networks 361
Introduction 361
Related Work 363
Preliminaries 364
System Model 364
Threat Model 364
Problem Statement 364
Self-organized Anonymous Authentication 365
Overview 365
Anonymous Authentication with Ring Signatures 366
Anonymous Communications 367
Anonymity Analysis 368
Attack Description 368
Graph-Theoretic Model 369
Ring Construction Problem 371
Ring Construction Strategies 372
Random Graphs 373
K$^{out}$ Graphs 374
Geometric Graphs 375
Discussion 378
Untraceability 378
Sybil Attacks and Revocation 379
Cost 379
Conclusion 380
References 381
A Proof of Theorem 1 383
An Active Global Attack Model for Sensor Source Location Privacy: Analysis and Countermeasures 384
Introduction 384
An Active Global Adversary Model 386
Modeling of Network 386
Modeling of Events 387
Investigation of Attacker 387
Case Studies 390
The SSSA Scheme 390
The $k$-Anonymity Scheme 393
A Dynamic Source Anonymity Scheme 394
Problem Definitions 395
Scheme Description 396
Discussions 401
Related Work 401
Conclusion and Future Work 402
References 402
Rogue Access Point Detection Using Innate Characteristics of the 802.11 MAC 405
Introduction 405
Related Work 407
Problem with Magnitude-Based Classification 408
Scheme I – DCF Based Detection 409
Analysis 410
Classification Scheme 414
Experimental Setup and Validation of Wired-Side Approach 415
Accuracy Measures 416
Scheme II – Rate Adaptation Based Detection 417
Analysis 418
Classification Scheme 420
Experimental Setup and Validation of Wired-Side Approach 421
Accuracy Measures 422
Consolidated Model 422
Analysis 423
Classification Scheme 423
Experimental Setup 423
Accuracy Measures 424
Measure of Robustness and Scalability 424
Conclusion and Future Work 425
References 426
Secure Multicast, Emerging Technologies 11
A Novel Architecture for Secure and Scalable Multicast over IP Network 428
Introduction 428
Overview 430
Group Membership Management 430
Intra-domain Management 430
Inter-domain Management 431
Discussion 433
Group Key Management 434
Local Key Management 435
Global Key Management 435
Inter-domain Multicast Protocol 435
Preliminary Work 436
Construction of Hierarchical Dissemination Tree 436
Shim Header and Shim Payload 437
Tree Encoding on Source MA 438
Tree Decoding and Updating on Transit MAes 438
Discussions 439
Simulation Result 441
Link Stress 442
Protocol Overhead 443
Bandwidth Cost 443
Related Work 444
Conclusion 445
References 445
Reliable Resource Searching in P2P Networks 448
Introduction 448
Resource Location Authentication 451
Content Retrieval Authentication 454
References 457
The Frog-Boiling Attack: Limitations of Anomaly Detection for Secure Network Coordinate Systems 459
Introduction 459
Background 461
Network Coordinate Systems 461
Existing Attacks 462
Countermeasures 462
Proposed Attacks 463
Experimental Setup 464
Attack Evaluations 465
Previous Attacks 465
Basic-Targeted Attack 465
Aggressive Frog-Boiling 466
Network-Partition Attack 466
Closest-Node Attack 467
Conclusion 468
References 468
Author Index 470