HoneyPAKEs

We combine two security mechanisms: using a Password-based Authenticated Key Establishment (PAKE) protocol to protect the password for access control and the Honeywords construction of Juels and Rivest to detect loss of password files. The resulting construction combines the properties of both mechanisms: ensuring that the password is intrinsically protected by the PAKE protocol during transmission and the Honeywords mechanisms for detecting attempts to exploit a compromised password file. Our constructions lead very naturally to two factor type protocols. An enhanced version of our protocol further provides protection against a compromised login server by ensuring that it does not learn the index to the true password

Passive security threats and consequences in IEEE 802.11 wireless mesh networks

The Wireless Mesh Network (WMN) is ubiquitous emerging broadband wireless network. However, the open wireless medium, multi-hop multi-radio architecture and ad-hoc connectivity amongst end-users are such characteristics which increases the vulnerabilities of WMN towards many passive and active attacks. A secure network ensures the confidentiality, integrity and availability of wireless network. Integrity and availability is compromised by active attacks, while the confidentiality of end-users traffic is compromised by passive attacks. Passive attacks are silent in nature and do not harm the network traffic or normal network operations, therefore very difficult to detect. However, passive attacks lay down a foundation for later launching an active attack. In this article, we discuss the vulnerable features and possible passive threats in WMN along with current security mechanisms as well as future research directions. This article will serve as a baseline guide for the passive security threats and related issues in WMNs

Efficient time synchronized one-time password scheme to provide secure wake-up authentication on wireless sensor networks

In this paper we propose Time Synchronized One-Time-Password scheme to provide secure wake up authentication. The main constraint of wireless sensor networks is their limited power resource that prevents us from using radio transmission over the network to transfer the passwords. On the other hand computation power consumption is insignificant when compared to the costs associated with the power needed for transmitting the right set of keys. In addition to prevent adversaries from reading and following the timeline of the network, we propose to encrypt the tokens using symmetric encryption to prevent replay attacks.Comment: International Journal Of Advanced Smart Sensor Network Systems (IJASSN), Vol 3, No.1, January 2013 http://airccse.org/journal/ijassn/papers/3113ijassn01.pd

LPKI - A Lightweight Public Key Infrastructure for the Mobile Environments

The non-repudiation as an essential requirement of many applications can be provided by the asymmetric key model. With the evolution of new applications such as mobile commerce, it is essential to provide secure and efficient solutions for the mobile environments. The traditional public key cryptography involves huge computational costs and is not so suitable for the resource-constrained platforms. The elliptic curve-based approaches as the newer solutions require certain considerations that are not taken into account in the traditional public key infrastructures. The main contribution of this paper is to introduce a Lightweight Public Key Infrastructure (LPKI) for the constrained platforms such as mobile phones. It takes advantages of elliptic curve cryptography and signcryption to decrease the computational costs and communication overheads, and adapting to the constraints. All the computational costs of required validations can be eliminated from end-entities by introduction of a validation authority to the introduced infrastructure and delegating validations to such a component. LPKI is so suitable for mobile environments and for applications such as mobile commerce where the security is the great concern.Comment: 6 Pages, 6 Figure