Formal Security Analysis and Performance Evaluation of the Linkable Anonymous Access Protocol

Part 2: The 2014 Asian Conference on Availability, Reliability and Security, AsiaARES 2014International audienceThe introduction of e-Health applications has not only brought benefits, but also raised serious concerns regarding security and privacy of health data. The increasing demands of accessing health data, highlighted critical questions and challenges concerning the confidentiality of electronic patient records and the efficiency of accessing these records. Therefore, the aim of this paper is to provide secure and efficient access to electronic patient records. In this paper, we propose a novel protocol called the Linkable Anonymous Access protocol (LAA). We formally verify and analyse the protocol against security properties such as secrecy and authentication using the Casper/FDR2 verification tool. In addition, we have implemented the protocol using the Java technology to evaluate its performance. Our formal security analysis and performance evaluation proved that the LAA protocol supports secure access to electronic patient records without compromising performance

Toward a Broader View of Security Protocols

Computer and network security researchers usually focus on the security of computers and networks. Although it might seem as if there is more than enough insecurity here to keep all of us fully occupied for the foreseeable future, this narrow view of our domain may actually be contributing to the very problems that we are trying to solve. We miss important insights from, and opportunities to make contributions to, a larger world that has been grappling with security since long before the computer was invented

Verifying parameterized timed security protocols

Quantitative timing is often explicitly used in systems for better security, e.g., the credentials for automatic website logon often has limited lifetime. Verifying timing relevant security protocols in these systems is very challenging as timing adds another dimension of complexity compared with the untimed protocol verification. In our previous work, we proposed an approach to check the correctness of the timed authentication in security protocols with fixed timing constraints. However, a more difficult question persists, i.e., given a particular protocol design, whether the protocol has security flaws in its design or it can be configured secure with proper parameter values? In this work, we answer this question by proposing a parameterized verification framework, where the quantitative parameters in the protocols can be intuitively specified as well as automatically analyzed. Given a security protocol, our verification algorithm either produces the secure constraints of the parameters, or constructs an attack that works for any parameter values. The correctness of our algorithm is formally proved. We implement our method into a tool called PTAuth and evaluate it with several security protocols. Using PTAuth, we have successfully found a timing attack in Kerberos V which is unreported before.No Full Tex

TAuth: Verifying timed security protocols

Quantitative timing is often explicitly used in systems for better security, e.g., the credentials for automatic website logon often has limited lifetime. Verifying timing relevant security protocols in these systems is very challenging as timing adds another dimension of complexity compared with the untimed protocol verification. In our previous work, we proposed an approach to check the correctness of the timed authentication in security protocols with fixed timing constraints. However, a more difficult question persists, i.e., given a particular protocol design, whether the protocol has security flaws in its design or it can be configured secure with proper parameter values? In this work, we answer this question by proposing a parameterized verification framework, where the quantitative parameters in the protocols can be intuitively specified as well as automatically analyzed. Given a security protocol, our verification algorithm either produces the secure constraints of the parameters, or constructs an attack that works for any parameter values. The correctness of our algorithm is formally proved. We implement our method into a tool called PTAuth and evaluate it with several security protocols. Using PTAuth, we have successfully found a timing attack in Kerberos V which is unreported before.No Full Tex

Test of the weak cosmic censorship conjecture with a charged scalar field and dyonic Kerr-Newman black holes

A thought experiment considered recently in the literature, in which it is investigated whether a dyonic Kerr-Newman black hole can be destroyed by overcharging or overspinning it past extremality by a massive complex scalar test field, is revisited. Another derivation of the result that this is not possible, i.e. the weak cosmic censorship is not violated in this thought experiment, is given. The derivation is based on conservation laws, on a null energy condition, and on specific properties of the metric and the electromagnetic field of dyonic Kerr-Newman black holes. The metric is kept fixed, whereas the dynamics of the electromagnetic field is taken into account. A detailed knowledge of the solutions of the equations of motion is not needed. The approximation in which the electromagnetic field is fixed is also considered, and a derivation for this case is also given. In addition, an older version of the thought experiment, in which a pointlike test particle is used, is revisited. The same result, namely the non-violation of the cosmic censorship, is rederived in a way which is simpler than in earlier works.Comment: 18 pages, LaTe