Pattern recognition for detecting distributed node exhaustion attacks in wireless sensor networks

Malicious attacks when launched by the adversary-class against sensor nodes of a wireless sensor network, can disrupt routine operations of the network. The mission-critical nature of these networks signifies the need to protect sensory resources against all such attacks. Distributed node exhaustion attacks are such attacks that may be launched by the adversarial class from multiple ends of a wireless sensor network against a set of target sensor nodes. The intention of such attacks is the exhaustion of the victim’s limited energy resources. As a result of the attack, the incapacitated data-generating legitimate sensor nodes are replaced with malicious nodes that will involve in further malicious activity against sensory resources. One such activity is the generation of fictitious sensory data to misguide emergency response systems to mobilize unwanted contingency activity. In this paper, a model is proposed for such an attack based on network traffic flow. In addition, a distributed mechanism for detecting such attacks is also defined. Specific network topology-based patterns are defined to model normal network traffic flow, and to facilitate differentiation between legitimate traffic packets and anomalous attack traffic packets. The performance of the proposed attack detection scheme is evaluated through simulation experiments, in terms of the size of the sensor resource set required for participation in the detection process for achieving a desired level of attack detection accuracy. The results signify the need for distributed pattern recognition for detecting distributed node exhaustion attacks in a timely and accurate manner.     

基于动态授权的信任度证明机制

提出一种基于动态授权的信任证明机制（proof of trust,简称PoT）,并在该机制的基础上修正了现有区块生成策略中存在的诸如权益粉碎攻击和贿赂攻击等问题.PoT将网络中的节点分为矿工节点和基本权益代表（stakeholder）节点,根据节点参与创建区块的行为赋予其相应的信任度,stakeholder节点对区块进行签名操作并赋予区块信任度,最终根据区块所获得信任度权重竞争上链.同时,还针对贿赂攻击和常见的权益累积攻击的攻击成本以及系统对于攻击的反应进行了分析.仿真实验的结果表明,PoT机制在应对权益粉碎攻击、贿赂攻击以及权益累积攻击方面相比于传统权益证明机制有着显著优势.     

An efficient improvement remote user mutual authentication and session key agreement scheme for E-health care systems

The E-health care systems allow patients to gain the health monitoring facility and access medical services remotely. A secure mechanism for mutual authentication and session key agreement is the most important requirements for E-Health Care Systems. Recently, Amin et al.’s proposed a mutual authentication and session key agreement protocol and claimed that their scheme is secure against all possible attacks. In this paper, we show that not only their scheme is vulnerable to privileged-insider attack, replay attack, session key disclosure attack, but also does not provide patient untraceability and backward secrecy. In order to withstand the mentioned security weaknesses, we propose an efficient remote mutual authentication scheme for the systems which are using ECC and Fuzzy Extractor. The proposed scheme not only resists against different security attacks, but it also provides an efficient registration, login, mutual authentication, session key agreement, and password and biometric update phases. During the experimentation, it has been observed that the proposed scheme is secure against various known attacks. Beside, our scheme is robust against privileged-insider attack that it rarely checked in security analysis. The informal analysis will ensure that our scheme provides well security protection against the different security attacks. Furthermore, we analyzed the security of the scheme using AVISPA software and Random Oracle Model. The formal analysis results and performance evaluation vouch that our scheme is also secure and efficient in computation and communication cost.     

抗电路板级物理攻击的操作系统防御技术研究

计算设备处理和存储日益增多的敏感信息,如口令和指纹信息等,对安全性提出更高要求.物理攻击技术的发展催生了一种通过攻击电路板级硬件组件来获取操作系统机密信息的攻击方法：电路板级物理攻击.该类攻击具有工具简单、成本低、易流程化等特点,极容易被攻击者利用形成黑色产业,是操作系统面临的新安全威胁和挑战.在处理器上扩展内存加密引擎可抵抗该类攻击,但是目前大部分计算设备并未配备该硬件安全机制.学术界和产业界提出软件方式抗电路板级物理攻击的操作系统防御技术,该类技术已成为近年来的研究热点.深入分析了该类技术的研究进展,总结其技术优势和不足,并探讨其发展趋势.首先,介绍了电路板级物理攻击的定义、威胁模型、现实攻击实例.之后,介绍软件方式抗电路板级物理攻击的操作系统防御技术所依赖的一些基础技术.然后,对该类防御技术的研究进展按照保护范围进行分类总结和归纳.最后,分析了该类防御技术的优势与不足,给出工程实现建议,并探讨该类防御技术未来的研究趋势.     

一个新的SYN Flood攻击防御模型的研究

针对现有的SYN Flood攻击防御方法的不足,本文提出了一个基于TCP连接三次握手的新的防御模型。当系统检测到SYN Flood攻击后,立即把那些占用系统资源的带有典型攻击特征的第一次握手请求永久抛弃,以保证新的正常请求能够被接受;而把其他带有疑似攻击特征的第一次握手请求暂时抛弃,尔后启动自适应学习模块来修正现有的入侵模式,最后再启动SYN Flood攻击检测模块来进一步精确判定。在此基础上设计实现了一套新的SYN Flood攻击防御系统。实验测试结果表明,本入侵防御系统能有效地帮助整个系统提高对抗SYN Flood攻击的能力。     

Immunity against Correlation Attack on Quantum Stream Cipher by Yuen 2000 Protocol

This paper presents the security analysis on the quantum stream cipher so called Yuen-2000 protocol (or αη scheme) against the fast correlation attack, the typical attack on stream ciphers. Although the security of a very simple experimental model of the quantum stream cipher without a randomization may be reduced to a complexity based security against the correlation attacks under a large number of known plaintexts, it is not a basic feature of Yuen 2000 protocol. In fact, we clarify that there exists a randomization scheme which attains the perfect correlation immunity against such attacks under an approximation. And in this scheme, the running key correlation from the second randomization that determines the mapping patterns is broken off also by quantum noise. In such a case, any fast correlation attack does not work on the quantum stream cipher.      

Enhanced Dynamic Authentication Scheme (EDAS)

With non-stop growth in network environments, communication security is necessary. A strong protocol guarantees that users and service providers are secure against many kinds of attacks, such as impersonation and replay attack. Sood et al. proposed an authentication scheme based on dynamic identity to prevent transactions from being intercepted by malicious users. Although they claimed that their scheme has advantages over previous schemes with the same approach, we prove that their scheme is vulnerable to impersonation attack and stolen verification attack, and can be affected by clock synchronization. Therefore we propose a novel authentication scheme to enhance security and overcome limitations existing in Sood’s scheme. Our security analysis shows that our proposed method can efficiently resist known types of attacks. Experimental results also show that the method can be implemented and processed in real-time thus applicable for not only regular computers but also mobile devices.     

Treatment of the initial value in Time-Memory-Data Tradeoff attacks on stream ciphers

Time-Memory Tradeoff (TMTO) attacks on stream ciphers are a serious security threat and the resistance to this class of attacks is an important criterion in the design of a modern stream cipher. TMTO attacks are especially effective against stream ciphers where a variant of the TMTO attack can make use of multiple data to reduce the off-line and the on-line time complexities of the attack (given a fixed amount of memory).In this paper we present a new approach to TMTO attacks against stream ciphers using a publicly known initial value (IV): We suggest not to treat the IV as part of the secret key material (as done in current attacks), but rather to choose in advance some IVs and apply a TMTO attack to streams produced using these IVs. We show that while the obtained tradeoff curve is identical to the curve obtained by the current approach, the new technique allows to mount the TMTO attack in a larger variety of settings. For example, if both the secret key and the IV are of length n, it is possible to mount an attack with data, time, and memory complexities of ²4n/5, while in the current approach, either the time complexity or the memory complexity is not less than n².     

AKC攻击研究:攻击方式、转换算法和实例分析

攻击者获取某主体（actor）的长期私钥后,利用该私钥伪装成其他主体欺骗actor或获取保密信息的行为被称为AKC（Actor Key Compromise）攻击.除密钥交换协议外,AKC攻击在其他类型的协议研究中较少受关注.本文强调了AKC攻击问题的重要性,并对其攻击方式和应对策略进行系统研究.通过实验总结出4类AKC攻击方式,并对应提出3类抵制AKC攻击的协议模型和设计原则.在此基础上,给出了将一般协议转换为AKCS协议（在AKC攻击下保持安全性质的协议）的启发式算法.在实例分析中,将算法应用在Email、SET、Kerberos等协议上.实验表明,上述协议受AKC攻击,但在算法的转换下,协议不再受AKC攻击影响.     

基于直方图调整的抗几何攻击图像水印

几何攻击被公认为是数字图像水印技术走上商用的瓶颈之一。本文根据图像几何变换过程中灰度值统计特征的稳定性原理,提出了一种基于直方图调整的抗几何攻击数字图像水印算法。首先根据图像灰度均值选取一个灰度区间,然后通过调整位于该灰度区间内的图像直方图来嵌入水印信息。在提取水印时无需提供原始图像,实现盲检测。实验结果表明本算法不仅具有很好的隐蔽性,而且对诸如旋转、缩放、平移、仿射变换、剪切等几何攻击和常规信号处理均具有很强的鲁棒性。     

A password based authentication scheme for wireless multimedia systems

In this digital era, where Internet of Things (IoT) is increasing day by day, use of resource constrained devices is also increasing. Indeed, the features such as low cost, less maintenance, more adaptive to hostile environment, etc. make the wireless multimedia devices to be the best choice as the resource constrained devices. For the security, the end user device requires to establish the session key with the server before transferring the data. Mobile is one of the device having more and more usage as wireless multimedia device in recent years. In 2013, Li et al. proposed an efficient scheme for the wireless mobile communications and claimed it to be secure against various attacks. Recently, Shen et al. claimed that the scheme of Li et al. is still vulnerable to the privileged insider attack, the stolen verifier attack and finally proposed a scheme to withstand the mentioned and other attacks. However, in this paper we claim that the scheme of Shen et al. is still susceptible to the user anonymity, the session specific temporary information attack and the replay attack. In addition, Shen et al.’s scheme requires more time due to many operations. Further, we propose an efficient scheme that is secure against various known attacks and due to reduced time complexity our scheme is a preferred choice for the wireless mobile networks and hence for wireless multimedia systems.     

On hash functions using checksums

We analyse the security of iterated hash functions that compute an input dependent checksum which is processed as part of the hash computation. We show that a large class of such schemes, including those using non-linear or even one-way checksum functions, is not secure against the second preimage attack of Kelsey and Schneier, the herding attack of Kelsey and Kohno and the multicollision attack of Joux. Our attacks also apply to a large class of cascaded hash functions. Our second preimage attacks on the cascaded hash functions improve the results of Joux presented at Crypto’04. We also apply our attacks to the MD2 and GOST hash functions. Our second preimage attacks on the MD2 and GOST hash functions improve the previous best known short-cut second preimage attacks on these hash functions by factors of at least 2²⁶ and 2⁵⁴, respectively. Our herding and multicollision attacks on the hash functions based on generic checksum functions (e.g., one-way) are a special case of the attacks on the cascaded iterated hash functions previously analysed by Dunkelman and Preneel and are not better than their attacks. On hash functions with easily invertible checksums, our multicollision and herding attacks (if the hash value is short as in MD2) are more efficient than those of Dunkelman and Preneel.     

An improved preimage attack against HAVAL-3

Hash functions play an important role in constructing cryptographic schemes that provide security services, such as confidentiality in an encryption scheme, authenticity in an authentication protocol and integrity in a digital signature scheme and so on. Such hash function is needed to process a challenge, a message, an identifier or a private key. In this paper, we propose an attack against HAVAL-3 hash function, which is used in open source Tripwire and is included in GNU Crypto. Under the meet-in-the-middle (MITM) preimage attack framework proposed by Aoki and Sasaki in 2008, the one-wayness of several (reduced-)hash functions had been broken recently. However, most of the attacks are of complexity close to brute-force search. Focusing on reducing the time complexity of such MITM attacks, we improve the preimage attacks against HAVAL-3 hash function to within lower time complexity and memory requirement, compared with the best known attack proposed by Sasaki and Aoki in ASIACRYPT 2008. Besides the 256-bit variant of HAVAL-3, similar improvements can be applied to some truncated variants as well. Interestingly, due to the low complexity of our attack, the preimage attack applies to the 192-bit variant of HAVAL-3 for the first time.     

A new steganography algorithm using polar decomposition

Nowadays, the security of communication becomes very important with the rapid development of network technology. So, the transmission and distribution of the several digital information must be protected and secured against other users. Many steganography techniques have been proposed for embedding secret digital data in other digital data. In this article, we propose a new steganography algorithm based on a linear algebraic tool that is the polar decomposition (PD) for hiding secret data in an image. A host image is selected and divided into blocks of size 2 × 2, a PD is applied on each block, and the secret data are embedded in suitable blocks. Experimental results show that our proposed algorithm gives a higher hiding capacity, achieves good imperceptibility, and also provides a high degree of security against common types of attacks such as compression attack with quality 10%, gamma correction attack, and impulse noise attack.     

一种新的DDoS攻击方法及对策

分布式拒绝服务攻击(DDoS)利用了网络协议的弱点,其攻击方式简单,但危害巨大。该文通过分析一种新出现的DDoS攻击方法-利用反弹技术实现的DDOS攻击,讨论其工作原理,提出了一种新的抗攻击方案。该方案不仅对这种新的攻击方法有效,而且同样适用于其他的DDoS攻击。     

A Flow Monitoring Scheme to Defend Reduction-of-Quality (RoQ) Attacks in Mobile Ad-hoc Networks

ABSTRACT

Reduction-of-Quality (RoQ) attack is a type of Distributed Denial-of-Service (DDoS) attack that is difficult to detect in current computing systems and networks. These RoQ attacks throttle the throughput heavily and reduce the Quality of Service (QoS) to end systems gradually rather than refusing the clients from the services completely. In this paper, we propose to develop a flow monitoring scheme to defend against such attacks in mobile Ad-hoc networks. Our proposed defense mechanism consists of a flow monitoring table (FMT) at each node to identify the attackers. If the channel continues to be congested because some sender nodes do not reduce their sending rate, it can be found by the destination using the updated FMT. Once the attackers are identified, all packets from those nodes will be blocked. By simulation results, we show that our proposed scheme achieves higher throughput and packet delivery ratio with reduced packet drop for legitimate users.     

Modified moment-based image watermarking method robust to cropping attack

Developing a watermarking method that is robust to cropping attack is a challenging task in image watermarking. The moment-based watermarking schemes show good robustness to common signal processing attacks and some geometric attacks but are sensitive to cropping attack. In this paper, we modify the moment-based approach to deal with cropping attack. Firstly, we find the probability density function (PDF) of the pixel value distribution from the original image. Secondly, we reshape and normalize the pdf of the pixel value distribution (PPVD) to form a two dimensional image. Then, the moment invariants are calculated from the PPVD image. Since PPVD is insensitive to cropping, the proposed method is robust to cropping attack. Besides, it also has high robustness against other common attacks. Theoretical analysis and experimental results demonstrate the effectiveness of the proposed method.     

Invariant image watermarking using multi-scale Harris detector and wavelet moments

Desynchronization attack is known as one of the most difficult attacks to resist, which can desynchronize the location of the watermark and hence causes incorrect watermark detection. It is a challenging work to design a robust image watermarking scheme against desynchronization attacks. Based on multi-scale Harris detector and wavelet moment theory, we propose a new content based image watermarking algorithm with low computational complexity, good visual quality and reasonable resistance toward desynchronization attacks in this paper. Firstly, the steady image feature points are extracted from the origin host by using multi-scale Harris detector, and the local feature regions (LFRs) are constructed adaptively according to the feature scale theory. Then, the LFRs are image normalized, and significant regions are obtained from the normalized LFRs by utilizing the invariant centroid theory. Finally, the digital watermark is embedded into the LFRs by modifying wavelet moment invariants of the significant regions. By binding the watermark with the geometrically invariant image features, the watermark detection can be done without synchronization error. Experimental results show that the proposed image watermarking is not only invisible and robust against common image processing operations as sharpening, noise adding, and JPEG compression etc, but also robust against the desynchronization attacks such as rotation, translation, scaling, row or column removal, cropping, and local random bend etc.     

A new SVM-based image watermarking using Gaussian-Hermite moments

Geometric attack is known as one of the most difficult attacks to resist, for it can desynchronize the location of the watermark and hence causes incorrect watermark detection. It is a challenging work to design a robust image watermarking scheme against geometric attacks. Based on the support vector machine (SVM) and Gaussian-Hermite moments (GHMs), we propose a robust image watermarking algorithm in nonsubsampled contourlet transform (NSCT) domain with good visual quality and reasonable resistance toward geometric attacks in this paper. Firstly, the NSCT is performed on original host image, and corresponding low-pass subband is selected for embedding watermark. Then, the selected low-pass subband is divided into small blocks. Finally, the digital watermark is embedded into host image by modulating adaptively the NSCT coefficients in small block. The main steps of digital watermark detecting procedure include: (1) some low-order Gaussian-Hermite moments of training image are computed, which are regarded as the effective feature vectors; (2) the appropriate kernel function is selected for training, and a SVM training model can be obtained; (3) the watermarked image is corrected with the well trained SVM model; (4) the digital watermark is extracted from the corrected watermarked image. Experimental results show that the proposed image watermarking is not only invisible and robust against common image processing operations such as filtering, noise adding, JPEG compression, etc., but also robust against the geometric attacks.