• 한국컴퓨터정보학회논문지
• /
• 제22권9호
• /
• pp.49-55
• /
• 2017

Despite the Openflow's switch migration occurs after the channel was established in secure manner (optional), the current cryptography protocol cannot prevent the insider attack as the attacker possesses a valid public/private key pair. There are methods such as the certificate revocation list (CRL) or the online certificate status protocol (OCSP) that tries to revoke the compromised certificate. However, these methods require a management system or server that introduce additional overhead for the communication. Furthermore, these methods are not able to mitigate power abuse of an insider. In this paper, we propose a role-based identity-based cryptography (RB-IBC) that integrate the identity of the node along with its role so the nodes within the network can easily mitigate any role abuse of the nodes. Besides that, by combining with IBC, it will eliminate the need of exchanging certificates and hence improve the performance in a secure channel.

• ETRI Journal
• /
• 제37권3호
• /
• pp.512-522
• /
• 2015

Recent developments in identity-based cryptography (IBC) have provided new solutions to problems related to the security of mobile ad hoc networks (MANETs). Although many proposals to solve problems related to the security of MANETs are suggested by the research community, there is no one solution that fits all. The interdependency cycle between secure routing and security services makes the use of IBC in MANETs very challenging. In this paper, two novel methods are proposed to eliminate the need for this cycle. One of these methods utilizes a key pool to secure routes for the distribution of cryptographic materials, while the other adopts a pairing-based key agreement method. Furthermore, our proposed methods utilize threshold cryptography for shared secret and private key generation to eliminate the "single point of failure" and distribute cryptographic services among network nodes. These characteristics guarantee high levels of availability and scalability for the proposed methods. To illustrate the effectiveness and capabilities of the proposed methods, they are simulated and compared against the performance of existing methods.

• 융합보안논문지
• /
• 제15권5호
• /
• pp.3-8
• /
• 2015

모바일 클라우드 컴퓨팅 시스템은 일반적으로 데이터 보호와 상호 인증을 위하여 공개키 암호화 기법을 사용하고 있는데 최근 전통적인 공개키 암호화 기술의 변형인 ID-기반 암호화(IBC)가 주목받고 있다. IBC의 증명서-무통제 접근은 클라우드 환경의 동적인 성격에 더 적합하지만, 모바일 장치에 대하여 처리 오버헤드를 최소화하는 보안 프레임워크가 필요하다. 본 논문에서는 모바일 클라우드 컴퓨팅에서의 계층적 ID-기반 암호화(HIBE)의 사용을 제안한다. HIBE는 사용자 인증과 개인키 생성 등의 권한을 위임하여 최상위 공개키 생성기의 업무량을 감소시킬 수 있으므로 모바일 네트워크에 적합하다. 모바일 클라우드 시스템에서 ID-기반 인증과 ID-기반 신분확인 기법을 제안하고, 또한 안전한 데이터처리를 위한 ID-기반 인증 스킴에 대하여 기술하였다. 제안된 스킴은 단방향 해쉬 함수와 XOR 연산으로 설계하여 모바일 사용자를 위한 저 계산 비용을 갖는다.

• Journal of Communications and Networks
• /
• 제11권6호
• /
• pp.615-625
• /
• 2009

Worldwide inter-operability for microwave access (WiMAX) is a promising technology that provides high data throughput with low delays for various user types and modes of operation. While much research had been conducted on physical and MAC layers, little attention has been paid to a comprehensive and efficient security solution for WiMAX. We propose a hybrid security solution combining identity-based cryptography (IBC) and certificate based approaches. We provide detailed message exchange steps in order to achieve a complete security that addresses the various kind of threats identified in previous research. While attaining this goal, efficient fusion of both techniques resulted in a 53% bandwidth improvement compared to the standard's approach, PKMv2. Also, in this hybrid approach, we have clarified the key revocation procedures and key lifetimes. Consequently, to the best of knowledge our approach is the first work that unites the advantages of both techniques for improved security while maintaining the low overhead forWiMAX.

• Journal of Communications and Networks
• /
• 제12권6호
• /
• pp.592-599
• /
• 2010

In recent years, significant improvements have been made to the techniques used for analyzing satellite communication and attacking satellite systems. In 2003, a research team at Los Alamos National Laboratory, USA, demonstrated the ease with which civilian global positioning system (GPS) spoofing attacks can be implemented. They fed fake signals to the GPS receiver so that it operates as though it were located at a position different from its actual location. Moreover, Galileo in-orbit validation element A and Compass-M1 civilian codes in all available frequency bands were decoded in 2007 and 2009. These events indicate that cryptography should be used in addition to the coding technique for secure and authenticated satellite communication. In this study, we address this issue by using an authenticated key-exchange protocol to build a secure and authenticated communication channel for satellite communication. Our protocol uses identity-based cryptography. We also prove the security of our protocol in the extended Canetti-Krawczyk model, which is the strongest security model for authenticated key-exchange protocols, under the random oracle assumption and computational Diffie-Hellman assumption. In addition, our protocol helps achieve high efficiency in both communication and computation and thus improve security in satellite communication.

• 대한전자공학회논문지TC
• /
• 제46권1호
• /
• pp.112-120
• /
• 2009

본 논문은 VANET(Vehicular Ad-hoc Network)의 V2I 환경을 위해 ID 기반의 비대화형 키 분배 기법을 적용한 세션키 분배 기법을 제안한다. 기존 VANET에서는 V2I 환경의 무선 구간에 IEEE 802.11i를 적용하여 안전한 데이터 통신을 지원하고 있다. 그러나 IEEE 802.11i의 경우 차량이 여러 RSU/AP를 핸드오버 할 때마다 새로운 세션키 공유를 위해 4-way handshake 과정을 반복함으로 커뮤니케이션 오버헤드와 지연시간이 증가하는 문제점이 있다. 제안 기법은 ID 기반의 비대화형 키 분배 알고리즘을 적용하여 차량이 여러 RSU/AP를 핸드오버 할 경우 세션키 생성을 위한 메시지 교환 없이 상대 노드의 ID 정보를 통해 세션키를 생성하고 공유할 수 있게 하였으며, 기존 IEEE802.11i에 비해 세션키 교환시 발생하는 커뮤니케이션 오버헤드와 지연시간을 줄였다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제7권5호
• /
• pp.1291-1312
• /
• 2013

Cloud computing changes the service models of information systems and accelerates the pace of technological innovation of consumer electronics. However, it also brings new security issues. As one of the important foundations of various cloud security solutions, entity authentication is attracting increasing interest of many researchers. This article proposes a layered security architecture to provide a trust transmission mechanism among cloud systems maintained by different organizations. Based on the security architecture, four protocols are proposed to implement mutual authentication, data sharing and secure data transmission in federated cloud systems. The protocols not only can ensure the confidentiality of the data transferred, but also resist man-in-the-middle attacks and masquerading attacks. Additionally, the security properties of the four protocols have been proved by S-pi calculus formal verification. Finally, the performance of the protocols is investigated in a lab environment and the feasibility of the security architecture has been verified under a hybrid cloud system.