Developing of Multi-factor Authentication Method Based on Niederreiter-mceliece Modified Crypto-code System

Two-factor authentication methods to date, are considered by experts as authenticators resistance amplification mechanisms, while ensuring the authenticity services in various fields of high technology, financial and insurance sectors of the market, large banking institutions and public sector enterprises. Thus, authenticators based on OTP passwords and various types of tokens are typically used in the ABS. The suggested synergistic threat assessment approach revealed that attackers use a comprehensive approach to the implementation of threats, based on a combination of social engineering techniques with traditional methods, of disguise and infiltration. New types of cyber-attacks are also used to effectively embed malware on mobile communication devices, which in turn leads to a decrease in the profitability of the two-factor authentication methods based on SMS messages and OTP passwords in ABS. The proposed safety mechanisms based on modified crypto code Niederreiter and Mc-Eliece systems allow to ensure reliability (based on the use of elliptical error-correcting codes) and safety (proposed cryptosystem are secret models of provable resistance) of data transmitted. Their usage in the multi-factor authentication protocol ensures the security of the physical separation of transmission of the parts of authenticator of banking transactions through mobile lines (using the Niederreiter MCCS) and ABS (using the McEliece MCCS). The proposed mathematical model and algorithms of practical implementation of the Niederreiter MCCS allow, based on the error vector symbol shortening, to reduce the energy capacity of the group operations, reduce the power of the Galois field to GF 26–27, providing the required cryptographic resistance

Development of an Advanced Method of Video Information Resource Compression in Navigation and Traffic Control Systems

The Earth's aerospace monitoring (ASM) systems use state-of-the-art integrated information technologies that include radio-based detection and surveillance systems using telecommunications. One of the main tasks of ASM systems is to increase the efficiency of decision-making necessary for the timely prevention, detection, localization and elimination of crisis situations and their probable consequences. Modern conditions impose stricter requirements for efficiency, reliability and quality of the provided video data. To ensure compliance with the requirements, it is necessary to provide the appropriate capabilities of the onboard equipment. On the basis of the existing information and communication systems it is necessary to carry out: continuous or periodic assessment of a condition of objects of supervision and control; continuous (operational) collection, reception, transmission, processing, analysis and display of information resources. It is proposed to use UAVs (unmanned aerial vehicles) as a means to perform ASM tasks. The time of organizing communication sessions and delivery of information should vary from a few seconds to 2.5 hours. Untimely processing and delivery of a specific information resource in the management process leads to its obsolescence or loss of relevance, which contributes to erroneous decisions. One way to reduce time is to encode the data. To do this, it is proposed to use video compression algorithms. However, based on the analysis of the possibility of modern methods of video information compression, taking into account the specifics of the onboard equipment of the UAV, the coding problem is not completely solved. The research results show the expediency of using an improved method of video information compression to reduce the computing resources of the software and hardware complex of the onboard UAV equipment and to ensure the requirements for efficiency and reliability of data in modern threats to ASM systems as a whole

Construction of Hybrid Security Systems Based on the Crypto-code Structures and Flawed Codes

In order to ensure safety of SCCI, it is proposed to use hybrid crypto-code constructions based on the modified asymmetric crypto-code McEliece systems on flawed codes, which make it possible to obtain maximum quantity of emergent properties at minimal resource cost for initiating in the system the synergistic effect of security provision. The main difference from known approaches to the construction of hybrid cryptosystems is the use of MCCS instead of symmetric cryptosystems; to strengthen resistance and to "reduce" the alphabet power (dimensionality of field GF(26–28) to build the McEliece MCCS), the systems on flawed codes are employed.The algorithms proposed in present work for the formation and decryption of a cryptogram in the hybrid cryptosystem based on MCCS on flawed codes make it possible to practically implement HCCSFC. The study that we conducted into energy consumption of major operations in the hybrid cryptosystems and their stability on the basis of the proposed assessment procedure confirms efficiency of their application in order to provide basic requirements to service quality in IE

ОцінкА функціональноЇ ефективностІ корпоративноЇ науково-освітньоЇ мережІ нА основІ комплексниХ показникіВ якостІ обслуговуваннЯ

Розглядається методика оцінки функціональної ефективності обміну даними в корпоративної науково-освітньої мережі, яка ґрунтується на простому багатофакторному аналізі, в якій враховуються як технічні показники мережі, показники безпеки технічних засобів захисту інформації, так і економічні параметри. Такий підхід дозволяє інтегровано оцінити, як технічну, так і інформаційну ефективність якості обслуговування користувачів корпоративної науково-освітньої мережі, отримати кількісні показники для оцінки відповідності послуг, що надаються висунутим вимога

Development of Mceliece Modified Asymmetric Crypto-code System on Elliptic Truncated Codes

Symmetric and asymmetric cryptographic algorithms, providing the required level of cryptographic strength are generally used to ensure security in modern communication systems, and error-correcting coding techniques - to ensure reliability. The use of asymmetric crypto-code systems enables integrated (with one mechanism) provision of the required levels of reliability, security and efficiency in the processing and transmission of confidential information via open channels of telecommunication systems. The research confirms that their usage provides high performance on the level of symmetric encryption algorithms with BSSH, provable cryptographic strength based on theoretical and complexity problems in arbitrary code decoding (1030 – 1035 group operations are provided), and reliability through the use of a shortened algebra-geometric code (Рош10-9 – 10-12 is provided). A major disadvantage of the use of the McEliece cryptographic system are large amounts of critical data (to provide the required cryptographic strength it is necessary to build a system in the GF (210 –213). In order to reduce the volume of key data (public key), we propose to use shortened codes, that enables to reduce the GF(26 –28), while maintaining a cryptographic strength level, by introducing the character location entropy at initialization vector

The Development of the Method of Multifactor Authentication Based on Hybrid Crypto­code Constructions on Defective Codes

The proposed security mechanisms in hybrid-crypto-code systems, based on Niederreiter and McEliece modified asymmetric crypto-code systems on flawed codes allow further use of the methods of strict two-factor authentication on OTP passwords (OTP based 2FA). To ensure the required security and efficiency in the multi-factor authentication protocol, the McEliece and Niederreiter modified asymmetric crypto-code systems, allowing integrated reliability provision in information transmission on the basis of error-correction coding on elliptic codes are used. The use of the MV2 algorithm ensures an increase in the total entropy of the key and the physical separation of the transmission of the authenticator parts by various mobile/Internet communication channels based on multi-channel cryptography systems on flawed codes. The proposed mathematical models and algorithms for the practical implementation of the Niederreiter and McEliece HCCSFC make it possible to significantly reduce the energy capacity of group operations by reducing the power of the Galois field to GF 24–26 by additional transformations based on the MV2 algorithm, ensuring the required cryptographic strengt

Development and Analysis of Game-theoretical Models of Security Systems Agents Interaction

A game-theoretic approach is presented, which claims to be a universal method for solving most problems in the field of cybersecurity. As arguments to confirm the superiority of game theory, mathematical validity and provability of the optimality of decisions made, unlike the widely used heuristics, the possibility of developing reliable protection based on analytical results, ensuring a timely response to cyberattacks in conditions of limited resources, as well as distributed nature of decision making are highlighted.The definitions of the basic concepts used in security tasks based on game-theoretic models are introduced.The features of the application of game theory methods in the field of cybersecurity are listed and the limitations of research in this area are formulated, namely: a restriction on game strategies, simultaneous moves of players in the behavior patterns of security system agents, uncertainty in the time the players take the move, uncertainty in the final goal of the enemy, unpredictability of further player moves, lack of players' assessment of enemy resources. as well as its ultimate goals, the inability to timely assess the current state of the game.The game-theoretic models are aligned with the listed security problems, and the main solutions obtained as a result of using the corresponding models are also determined.Many methods of game theory have been formed, for each of which a relationship is determined between the game model, its scope, simulation result and security services that the method under consideration supports.The limitations of the classical representation of game theory models are determined, the need to overcome which follows from the requirements for providing basic security services. Such limitations include: the ability of the defender to detect attacks, the certainty of the probabilities of a change of state before the start of the game, the synchronism of the players' moves, the inability to scale the model due to the size and complexity of the system under consideration.Models of the main tasks of the interaction of antagonistic agents of security systems have been developed. The resulting models made it possible to obtain solutions to two of the most common tasks in the field of cybersecurity, namely, the interaction of the system administrator and the attacker in organizing the protection of information resources. The tasks are solved for various conditions – the game matrix contains cost estimates of resources and the matrix reflects the probability of threat realization. Pure and mixed strategies are defined for various initial conditions, which allows to exclude from the consideration strategies that are not included in the solution.A synergistic approach to the use of game-theoretic modeling was formed taking into account the behavior of agents of security systems, based on an analysis of the diversity and characteristics of game-theoretic models, their inherent limitations and scop

Enhancement of Productivity of Random Sequences Generation for Information Protection Systems

The ways of enhancement of productivity of generation of random sequences, derived from physical sources for information protection systems were substantiated. This is necessary because today there is a rapid growth of technological capabilities and of rate indicators of implementation of various information services and applications, required by community. One of the main issues of the safe use of these services is to ensure information security, which requires the use of effective high­rate information protection systems and high­performance generation of random data sequences. In the course of conducting research with the aim of enhancing productivity, the features of conversion of actual noise processes, taking into consideration their non­stationarity and deviations from the probability distribution were analyzed. We proposed the ways to improve the methods of analog­to­digital conversion with the optimization of the scale dynamic range quantization and the pitch of discretization of a noise process over time. With a view to aligning statistical characteristics, the possibility of using the processing methods that enhance its statistical quality with economy of high­rate losses was explored. These are the method of sampling equally probable combinations (von Neumann – Elias –Ryabko – Matchikina) and the method of code processing (Santha – Vazirani) that provide an increased effectiveness due to code extension and involve conversion of the sequence: in the first method, with the use of equally probable combinations with rejection of unnecessary data; in the second method, without their rejection with the possibility of linear conversion. In order to optimize the conversion parameters at both stages of generation and to adapt these parameters to the peculiarities and changeability of characteristics of converted random processes, it was proposed to use feedbacks of converters' outputs with previous conversion elements. The adjustment of the specified parameters can be made during the generation based on the results of statistical analysis of the outputs of conversion stages. The obtained results are quite important, since their implementation in modern information protection systems will enable guaranteeing information security and safe usage of applications of the modern information service and the introduction of new applications

Improvement of Project Risk Assessment Methods of Implementation of Automated Information Components of Non-commercial Organizational and Technical Systems

The results of a study using the methodological apparatus of the theory of fuzzy logic and automation tools for analyzing input data for risk assessment of projects for the implementation of automated information components of organizational and technical systems are presented. Based on the model of logistics projects for motor transport units, the method for assessing the risks of projects implementing automated information components of non-commercial organizational and technical systems has been improved. To do this, let's analyze the peculiarities of implementing ERP projects as commercial ones and investigate the specifics of the activities of state institutions, when successful tasks, and not economic indicators, lay the foundation for the assessment. It is considered that it is possible to formulate a system of risk assessment indicators for reducing the effectiveness of projects for implementing automated information systems in non-commercial organizational and technical systems. A meaningful interpretation of the fuzzy approach is carried out regarding the formalization of the risk assessment process for projects of automated information systems of public institutions. A tree of fuzzy inference is constructed based on the results of a study of the description of indicators and expert assessments on the risk assessment of the implementation of the project of such an automated information system.The improved method differs from the known ones by the use of hierarchical fuzzy inference, which makes it possible to quantify, reduce the time to evaluate project risks and improve the quality of decisions. An increase in the number of input variables leads to an increase in complexity (an increase in the number of rules) for constructing a fuzzy inference system. The construction of a hierarchical system of fuzzy inference and knowledge bases can reduce complexity (the number of rules). The development of a software module based on the algorithm of the method as part of corporate automated information systems of non-commercial organizational and technical systems will reduce the time for risk assessment of projects for the implementation of automated information systems