Computer Security and Reliability - Science topic

Dear Mustapha Anis Younes These articles can answer your question.

Also, I'm looking for a solution If you please,

is there any solution for that?

… Read more

Want the encryption and decryption time complexity when used by pallier cryptosystem

C/N = 20 log 10 [Vc/ Vn]

you can see this exemple for kpabe toolkit in Java using ipbc , in

I think, cloud forensic, and cloud security in general, have the issues rooted to a large extent in the weaknesses of the current human users' authentication credentials which allow for numerous attack vectors.

This problem existed well before the clouds' initiative was adapted, and got exacerbated with the clouds proliferation.

Really secure human authentication credentials are seemingly easy to design, but usually they do not satisfy criteria of being really non-detectable by attack vectors, non-reusable by intruders, cheap, simple to use, and easy to remember. So that user credentials' technology is to be subordinated to, or commensurate with economic and usability requirements making this problem extremely difficult to resolve, as those criteria used to be perpendicular to each other.

User authentication technology is not the only clouds' security problem but it is a fundamental one in security of clouds and many other domains.  

I believe the fastest software implementation ever published was our "Realm of the pairings" paper on SAC 2013, source code included on RELIC. The fastest hardware implementation appears to be Fan et al. using the RNS representation for field arithmetic.

No, the video standards do not have built in encryption, and compression is not encryption (easy to decompress, view etc.).

Encryption of files/ videos typically has a private shared key that prevents viewing the file not like compression that is a public transformation.

See:

See some commercial sites:

Maybe the comparative performance analysis about ECC-technology in the paper at https://www.researchgate.net/publication/310049571_Secure_Whitelisting_of_Instant_Messages might help you.

Cloud is mainly used to store large amount of data and to for analysis on the stored data. Security of data and information while in transit over an unsecured medium like internet is critical for every application. Due to the volume of data, it is time consuming to implement asymmetric encryption for communication. Symmetric encryprion is more faster than asymmetric. But both parties in communication should be aware of the symmetric key. So we make use of asymmetric encryption to secuely transfer the symmetric key. This key is  used for encrypting the further communications.

Rajamenakhsi, Rabat, Muneer, yes we can collect packet traces using different simulators such as wireshark, gns3 and many other simulator tools but whether it is significant to collect the traces for traffic management? If we will collect the traffic traces, it will be only for that environment and that time period. E.g. traces collected during regular class time, vacation and exam time will in an university differ significantly.Please suggest some idea for real time traffic management. 

Dear Keerthipati,

here are some more references from 2016.

Cheers,

Günter

Dear Sara,

I am not expert in security but u can contact to Dr Rajkumar Buyya from University of Melbourne. This university have a Cloud lab. You can contact to Dr Buyya. If you have any doubt to cnnect him. Kindly fallow the http://www.buyya.com/ . Hi will definitely guide you

Another approach is to obscure key user data when sent to the cloud provider so that even if the provider has the data .   The Bluecoat Cloud Protection Gateway (link to data sheet below) substitutes randomly generated tokens for key pieces of user data when users user it to interact with Cloud SaaS service providers.  For example, the name Jeff might be substituted for abc123 when stored at a Service provider, but the name abc123 comes back (usually through a web page), it gets translated back to Jeff.  This is done transparently to the end user.

Hi, it depends  on the honey pot you are using. In general if you are on  linux platform, you can analyse the server logs (secure.log, message.log) and the output of simple tool such as last and lastb. The annalysis is not difficult with some minor sh/bash or python scripting skills.

The is also possibility to capture all ssh traffic and store it in PCAP (tcpdump on linux) format for further analysis (Wireshark).

@ Rivalino, Nils Ulltveit-Moe, Peter Breuer

Sir, let me make things more clear. 

Suppose a person makes a C/C++ based code and does not want people to see the contents of the code. He proceeds by making an .exe (executable) file and gives it others. Clients can run it only by querying it and getting output without knowing anything else about the underlying code.

while Querying; client can only input  Digital Signature (eg. RSA) signed by some Authentic authority's private key for his identity. The signature is verified by public key of authority (embedded into) .exe file. If signature is verified the output will be returned.

So, the restriction is that a client can only input Digital signature (DS)  for his identity to the .exe file. and he will get the output if DS is verified.  For inputs other than the DS no output is returned. A query of even 100 times by a same DS will result in a same output. 

My question is that ; Are .exe files (standalone files) are secure enough for this purpose or not?  What about the query based attacks  or any other sort of attacks that are possible on this exe to make it not suitable for use in this scenario.

Moreover, If I am going in the wrong direction, what are your possible suggestions to me? 

Obviously we can't claim anything to be secure even if its proven secure today, may be it won't be secure by tomorrow.

Hi Sultan,

I think in this case you need to differentiate between  different security features. For example: Encryption, integrity and authentication. Some data might be very important but it does not necessary mean that it should be encrypted. Instead, it needs another security feature: Authentication.

Imagine your WSN is measuring temperature and sending this information to another entity. In this case, the information about the temperature is very important, but in most cases it does not need to be encrypted (there is no problem if someone reads the data about temperature from your network). However, it is very important that the data is not modified on its way. That is, the integrity of the data is important. Also, it is very important to know where the measurement of temperature comes from: That is, the data needs to be authenticated.

To summarise, if you consider 'secrecy' as the measure of security of your data, the temperature will be important but can be insecure.

Hope it helped.

Jhordany

Thanks for your help.

It is very simple to make a cloud or virtual machine as a faulty. You need to go through cloudsim tool and read the FaultTolerantExample.java file in depth and you can easily find your answer, Even though i am still working to make an algorithm for fault tolerant.

Here is a reading list for you.

thanks so much, but i got the same error ....there is difference , i use CRCN patch too and need print energy in this scenario .

best regards of you

Sensor Cloud

Dear, check this link:

You may follow the following links.....

Dear Themba.

Quantum teleportation allows a sender to share information with a receiver by encoding it into a quantum state that both parties can access.

This link may be useful for your work :

KDD99 should not be used for any real research , it is heavily skewed data. Try more realistic sources of data like www.secrepo.com https://stratosphereips.org/category/dataset.html

Dear Nikolaos:

   there are many books on Computational Complexity. I'm not sure what do you want.

As long as I remember, you have to traverse the M x N bytes of the image, making some bit manipulation. In this sense, and assuming bit manipulation can be done in constant time, then encoding would be quadratic in the size of the image O (n^2).

A similar analysis can be done for decryption of the message.

Is this what you want?

David

Electronic Medical records are sensitive pieces of information that requires extensive and strong protection. Taking an example of a bankrupt hospital may put some light on the matter. A cancer hospital dealing with all stages of cancer patients filed for bankrupcy and was taken over by a loan lending bank. After the take over was complete, the bank officials scrutinized all such patient details who were in their last stages of cancer, had extremely less chances of survival and had pending loans with the same bank. The loan accounts for these patients was closed and the loan amounts forfeited. As a solution, one could use steganographic protocols to hide patient medical records (which are primarily text) within medical report images. In this case, only an authorized doctor or medical personnel may have access to the records. To all others, the existence of the records remains concealed.

Hope this helps a bit

Don't mix ECC and DES they are two completely different things. DES, as well as AES (the new standard) are symmetric algorithms this means that there is only one key which is used for both encryption and decryption (like your door). On the other hand, you have public key encryption where you have two keys, one for encryption (public) and a different one, for decryption. Such algorithms are RSA and ECC. 

The most common set for transactions (not only financial) is AES, RSA and SHA (for hashing).

@Maria Abur

If there is an UserID then it is supposed to be unique and should be sufficient to identify any user, is not it?

Do u want to know what other alternate keys / key combinations exit?

Good question. I refer you to this article, which describes the asymmetric key approach, and what computations are necessary:

You will note, in 15.1.3 that the encryption step involves exponentials, relatively more CPU intensive than XOR commonly used in symmetric key encryption.

So, yes, asymmetric key is more computationally intensive than symmetric key. And furthermore, symmetric key block ciphers are "less efficient" than symmetric key stream ciphers. If for no other reason, you need to create blocks, which often involves padding the plaintext. With stream ciphers, the plaintext and the ciphertext can be identical in length (for instance, if you use XOR as one would typically do).

You will read many times in the literature something that makes a lot of sense intuitively. If you want to send encrypted data in bulk, and as fast as possible, your best bet is to use symmetric key encryption (and even better, a stream cipher). In order to distribute the necessary SECRET keys, for the symmetric key protocol, you would use an asymmetric key protocol. But this is needed infrequently, as a key exchange protocol. Let's say, once a day. Something of this nature. The frequency will depend on the update rate of those encrypted messages and the encryption algorithm.

In both methods, there will be some overhead involved in distributing the public key or the private key, depending whether you're using asymmetric or symmetric key. But if we are talking about bulk data encryption, that overhead would be minimal, in the greater scheme of things.

I think this varies greatly, depending on the type of crypto algorithm and whether it's done in hardware or software. This is an interesting piece:

Note that part about how the crypto key was reconstructed for RSA, by measuring power requirement (so-called "side channel attack").

Symmetric key stream ciphers should be the least power hungry of all, and they also do not increase the length of the message. My bet is that one can devise a symmetric key stream cipher that would require a negligible amount of extra power. I haven't actually tried measuring this, but it should be straightforward enough to run your own experiment.

So, one technique you can use to save computing time and energy, use an asymmetric key cipher to transmit the secret key, then use a symmetric key cipher for the messaging itself.

A long post, considering I didn't answer the question.

provable data possession(PDP)is an algorithm for proving data integrity in  cloud computing

Did you mean 2D DWT along with PCA is more efficient??

Other question: ns2 is a simulator, why would you like to encrypt traffic in the simulation? Perhaps a clever simulation setup can avoid the extra overhead of encryption and still keep the simulation results valid.

It usually takes at least two pieces of PII (excluding a social security number, drivers license number, etc) to identify someone.

Symmetric key decryption needs the key, once you have the key you can decrypt.

Now, you are asking about local decryption (partial one) for this you need to derive "chunk" key and open only that key. You can start from a master key and derive a binary tree of keys E(k,0) and E(k,1) for the left and right side keys and keep on doing it to build a tree of keys, at the leaves are the chunk keys with which you encrypt/ decrypt the data. You can always derive the chunk key specifically and use it to decrypt the chunk (and nothing else) other keys are pseudorandomly independent.

I am not sure if you are after something like this, but this is one possible solution to partial decryption with partial key only. Note that chunk key derivation is logarithmic in the number of chunks. I assume that you can delegate the chunk keys or even complete subtree key (for a sequence of consecutive chunks).

Good question. Dr. Peter has shown a good method for your problem and Dr.martin also done the same. But if I am not wrong you need a three-keys system. so we have private-key and public key systems. However, you need a nother system whih is more than a public key system. If the same encrypted data decrypted with one key you will get an ansewer. However, if you decrypt the data with the third key the result will be different. And both results are true. One result is complete the second is partial. Such system does not exsist for the best of my knowledge. you can trick it as the given methods. To construct this system, start with RSA and modify its steps. May be you will find interesting results

Good luck

Yes, with the RFID chip embedded in newer passports, I would expect that a passport reader of the immediate future should use the same technology as a credit card reader, no? And there's more.

When I recently had to renew my passport, I had the option, for a few extra $, of also receiving something called a "passport card." So, why not? Send me one!

It's only usable in a handful of border crossings, so far at least, but the card looks much like a credit card, with the chip, although the graphic design is much like the old fashioned passport picture page.

Which leads to wonder, why are we bothering with paper passports anymore? Whatever information is needed, including your individual visas and your past border crossings, is far better stored "in the cloud," than in a paper booklet, I would think.

A verbose response to say, in my opinion, rather than spending a lot of effort to scan and read/decode paper passports, it might be more fruitful to migrate to an electronic system.

i have written an open source library , but the scheme is pretty old , feel free to check it out 

For better understanding of the current schemes , Seny Kamara writes excellent blogs on this topic , they are very good tutorials 

Hi Navjyotsinh

This research field is active, and has been for many years. It was originally proposed by Goldrich and Ostrovsky many years before Cloud came about. With modern hardware in HPC situations, it offers some interesting peformance gains and good obfuscation of what is going on in the system. I have added a list of a few papaers from my research collection to get you started.

Regards

Bob

enc

Accidental configuration errors (non-malicious insider attacks) are easier to protect against, although if you have a mechanism to protect against the malicious attack, you've solved both problems.

The best example I can come up with on the spur of the moment would be to protect routing protocol messages, in an IP network.

Take a look at RFC 2453, for Routing Information Protocol (RIP) Version 2.

Section 4.1. describes a simple authentication scheme. In the packet overhead, one includes a plaintext, 16-byte password. This is a simple defense against misconfiguration. A router would check the password of any routing message, to verify the message comes from the router identified in the layer 3 header.

Next, take a look at RFC 4822.

Now you have a variable length encrypted authentication header, where the length depends on the algorithm used. A secret key is now needed to create and then to verify the authentication header. So this defends not only against simple configuration errors, but also against a deliberate routing protocol spoofing attack, designed to disrupt network operation.

I have some experience testing biometric authentication products. The risk is always that one jumps too early into ad hoc testing before an experiment design is made. So I agree with the previous answers. make sure the use case is clear and that there are acceptance/success criteria *before* you start testing.

Next to that: the terms to use for authentication are False Accept and False Reject. Those give the False accept rate (FAR) and the False reject rate (FRR). But they are of course the same as FP and FN.

Normally authentication methods that need to be tested, like biometric systems, produce a score for every authentication attempt. (trust score). One of the aspects of the biometric system is that you set a threshold depending on the functional requirements. But that is the actual appication. To measure the performance of an authenticator regardless of the trhreshold setting, you need to create the FAR and FRR curves. Or better the Detection error trade-off curve (DET). 

There is no tool except for R, SPSS and python :-)

About significance (and how many tests you need) is discussed a bit in "Common Criteria - Common Methodology for Information Technology Security Evaluation - Biometric Evaluation Methodology Supplement [BEM]" from British government ( http://www.cesg.gov.uk, site has maintenance issues at the moment of writing)

good luck

I suggest that you act as ethical hacker and conduct penetration tests with all instanced objects and applications of your framework.

Please let me intimate two approaches to you!

   

combining both cryptographic and analysing network characterstics like peak,burst,thruput wecan develop novel policy to prevent whitewashing in p2p.

Thank you Amit Kumar for your suggestions.

I think the best storage area network design for an institution will take into consideration a number of critical issues: uptime needs, scalability, security and disaster recovery.

For more information please refer to this link:

Sure, you can take a look for SONORA, MobiCloud, and CloudSim Projects. Also, if you have some of those resources please let me know 

@ Janos Follat

thanks for pointing at Thomas Page's PhD thesis "The application of hash chains and hash structures to cryptography" 2009. Interesting reading. Obviously there are indeed useful applications of combining hashes in various ways.

My comment about hash chains was directed at the fact that hash chaining reduces the input length of h2...hx from 'unlimited' to the length of h1'th output.

If you chain for example FNV32 Hash functions (please note that the original question did not mention cryptographic secure algorithms) the input length from h2..h7 is 32 bits only. Thus when chaining hash functions with an output length smaller than the first original input, distribution width within a chain will decrease in relation to the original variability.

Furthermore the collision probability of the total chain h1->h2->...hx might increase. Thomas Page referred to this at p.43 & p.44 (3.1.4.3 ff.). If simply chaining hash functions like h1->h2->h2...->hx  security might decrease therefore in relation to their onetime usage.

you can use user behavior profiling and decoy technique  

Privacy is often a mis-understood paradigm.  If data was collected, it will be used ... and abused.  Therefore, while collecting data, it is a good practice to make sure it is collected in a way it cannot be co-related without adequate efforts and only by those who can potentially understand what it is.  Also, any extra directly co-relating parameters should strictly be left uncollected.  Otherwise data will be innate with privacy risk.

Try using the capabilities-list of C-List.

Since each subject has his or her own C-List, he or she should also send the list to the "deputy" when asking it to do something. This way the "deputy" will know whether or not the subject has the right to do so.

Faraday cages are always very popular! See also: https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr200810sf2.pdf&mode=show_pdf

Thanks guys for the great input. 

I still see resilience as one of the most important security objectives. What does a fully secure system help if it does not work. In case of distributed computing, network outages easily cause split brain situations. Thus, recovering from them is obviously a crucial area of research, especially for real time applications.

Could you shade more light on what you mean by "Real time issues of privacy..."? I am assuming you are taking about Privacy in Temporal Information Retrieval. If that is the case, there is a good beginning resource that lists a number of research articles on the subject -http://en.wikipedia.org/wiki/Temporal_information_retrieval 

The challenge would be incorporating various privacy algorithms in temporal information retrieval systems.

For this type of research I typically turn to R.  For Bayesian networks, you can use the either the 'gRain' library or the 'bnlearn' library.  R also has a fairly impressive collection of other libraries including implementations for neural networks, genetic algorithms and more.

Reliance on digital signatures for other than short lived transactions is problematic. There are legal issues as well as technology escrow issues.  For example, if a signature was valid 3 years ago, but the keys used are no longer valid or the technology used to generate the signature is deprecated, how can one convince a court of the veracity of the signature?  

On the technical side, most SIM cards contain only a symmetric key which is used as a shared secret with carriers to generate and respond to challenges as a mechanism to prevent cloning, so the existing keys and algorithms available on existing SIM cards are likely lacking for this purpose if you are really contemplating a cryptographic digital signature. More promising is the study of mobile payment systems currently used in Africa.  Clearly, it seems to be working, though flaws may exist.

Finally, if one looks at the history of certificate issuing authorities, one comes away somewhat depressed since it seems anyone can become an issuing authority and if your trusted certificate list contains any dubious issuing authorities, then that is a problem.

 The only way I have seen this used effectively is when one uses one's own certificate authority to sign the keys of trusted devices and then uses this as part of the connection requirement for the device via a mutually authenticated TLS or SSL connection.  This effectively limits all traffic from other than a device having an appropriately signed X.509 certificate and is an effective deterrent in this respect.  However, one would need to be able to generate and store the key material securely and would need to set up a strategy for generating and installing the certificates.  Symantec and others have cloud services that could facilitate this to scale, and would be worth a look.

I confirm the answer: asymmetric encryption.

Symmetric encryption is not really good scalable for large sized and changing network topologies. (n * (n-1) ) / 2 key pairs would be required.

PacketPig based on Apache Hadoop and Snort is probably your best starting point for now: http://hortonworks.com/blog/big-data-security-part-one-introducing-packetpig/

When you have this up and running, then you can experiment using anomaly based detection methods on top of it.

It should be possible to do so - shouldn't be any problem opening multiple concurrent tcprelay instances. Alternatively you could take multiple pcap files and merge them using Wireshark, then use a single tcpreply instance to replay the merged file. Please let me know if this helps?

Hi Ighoroje,

There are numerous big data security tools in the market - one of them I know better is HP ArcSight software which can help collect, enrich, search, store & analyze the big data which include:

1) detecting account abuse by insiders & advanced persistent threats (threats which follow a low & slow attack profile that is difficult to distinguish from normal legitimate activity)

2) pinpointing data exfiltration by advanced persistent threats

3) alerting big data user of new program execution

Some of the ArcSight features include: speed, real-time threat evaluation, pattern matching, statistical correlation, monitor and respond etc. Of course, there are other big data security tools as well from IBM, Symantec, BlueCoat etc.  You can do an internet search to find out more.  Following are some links you might want to try.  All the best:

Regards,

Fung

There is no straight forward answer , check OWASP top 10 , SANS Top 10 . Check CWE , CAPEC details on MITRE

the best way is to use google schoolar or scopus search engine filtered by year

To be honest I can hardly imagine any connection between your research goal 'testing the trust of people' and your request for 'downloading a container, include a secret and pick a strong password'.

What do you want to evaluate?

If users put in a 'real secret' or just some random data?

How do you want to appraise if the data is a secret or not?

One of the many ways I guess companies go about is with SIEM systems that log and track everything that happens on the network. Products like NetWitness, LogLogic etc log and correlate data coming in from various points in the network to report DoS or DDoS attacks. This is of course with respect to regular networks. If you have a deployment of a SDN etc, then approaches such as cSAMP (that do collaborative network monitoring), OpenSketch etc will help you identify and combat a DDoS attack.

Any further explanations will of course need to be substantiated with what use case you are looking at, what your architecture is etc.

Handbook of Applied Cryptography

Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone

please consider concepts of iptables in linux to have better understanding. hope it helps.

IBE is affected by key escrow problem, and based on cryptographic primitives making it less performant than other encryption schemes.

The NIST Statistical Test Suite (STS) is one of the gold standards for PRNG testing, though you do have to compile the binary. You don't, however, have to build your generator into their program. You can feed STS a set of files and have STS analyze them and give the same report as with it's built-in generators. I don't remember having any problems getting STS to build.

code and doc at http://csrc.nist.gov/groups/ST/toolkit/rng/documentation_software.html

I believe I also have a python script to parse the STS output and summarize it or make a csv or something, but it was fairly specific to the experiments I was running.

I think i really know what you want to say. In one single data center, we can build enough redundant paths between two nodes, then it can be assumed that there is always a live path. But for wide area network settings, there are no such redundant paths. Thanks.

Allocate all data structures in units of a multiple of the size of the cache block and you will get no false sharing, provided you separate data that is not genuinely shared.

Rather than randomize memory I would consider encrypting (RW’s post goes that way even if the main drift is off track). Decrypting, while computationally costly, can to some extent be covered by time take for page faults if done right.

Actually the Digital Library Of India is providing this facility for Ancient books like Philosophy, Literature etc... But to develop our own Cloud Computing means what to do?

Yes it is possible to remove the trusted third party completely. For that purpose only we use public key cryptography system. The session key that is generated by sender is shared securely with receiver using public private key pair.

There is a simple criterion based on the Walsh Hadamard transform. Check Massey Xiao on google.