11647123
Non-repudiation protocols for multiple entities
Non-repudiation is a security service that provides cryptographic evidence to support the settlement of disputes. In this paper, we introduce the state-of-the-art of non-repudiation protocols for multiple entities. We extend an existing multi-party non-repudiation (MPNR) protocol to allow an originator to send different messages to many recipients in a single transaction. We further propose an optimistic multi-party non-repudiation protocol for exchange of different messages. The performance of our protocols with enhanced functionalities is still promising in comparison with existing MPNR protocols.
3850135
Classifying Public Key Certificates
In spite of the fact that there are several companies that (try to) sell public key certificates, there is still no unified or standardized classification scheme that can be used to compare and put into perspective the various offerings. In this paper, we try to start filling this gap and propose a four-dimensional scheme that can be used to uniformly describe and classify public key certificates. The scheme distinguishes between (i) who owns a certificate, (ii) how the certificate owner is registered, (iii) on what medium the certificate (or the private key, respectively) is stored, and (iv) what type of functionality the certificate is intended to be used for. We think that using these or similar criteria to define and come up with unified or even standardized classes of public key certificate is useful and urgently needed in practice.
7361494
A Representation Model of Trust Relationships with Delegation Extensions
Logic languages establish a formal framework to solve authorization and delegation conflicts. However, we consider that a visual representation is necessary since graphs are more expressive and understandable than logic languages. In this paper, and after overviewing previous works using logic languages, we present a proposal for graph representation of authorization and delegation statements. Our proposal is based on Varadharajan et al. solution, though improve several elements of that work. We also discuss about the possible implementation of our proposal using attribute certificates.
2929437
Efficient detection of failure modes in electronic commerce protocols
The design of key distribution and authentication protocols has been shown to be error-prone. These protocols constitute the part of more complex protocols used for electronic commerce transactions. Consequently, these new protocols are likely to contain flaws that are even more difficult to find. In this paper, we present a search method for detecting potential security flaws in such protocols. Our method relies on automatic theorem proving tools. Among others we present our analysis of a protocol recently standardized by the German standardization organization DIN to be used in digital signature applications for smart cards. Our analysis resulted in the standard being supplemented with comments that explain the possible use of cryptographic keys.
11225099
Casual virtual private network
Virtual Private Networks (VPNs) [1] allow individuals and business to create and maintain secure communication channels between their own local networks using public and insecure networks, like Internet, instead of private and leased lines. The main purpose of a VPN is to securely and transparently connect two or more remote networks to form virtually a single network. Network architectures defined by VPNs are inherently more scalable and flexible than pure private networks because they allow organizations to add and remove branch offices in an easier way. Other benefits of VPNs include obtaining almost the same capabilities of private or leased lines at much lower cost, and providing roaming users (or “Road-Warriors”) with secure connections to their corporate or personal networks whenever they need them. VPNs achieve the same level of protection as private networks using security mechanisms like encryption and authentication schemes. Those security mechanisms are centrally managed by a pre-defined security policy, which controls all communications inside the VPN by dictating when and how the protection is applied. In most cases, for security reasons, VPN users cannot change the security policy, and they cannot dynamically choose whether their communications are going to be protected or not. This high level of protection and connectivity achieved by VPNs, although desirable and necessary, is not useful for networks which do not want to provide transparent access to their resources within their networks, but only want to provide temporary secure access to internal services based on users’ demands. Although it is possible to provide protection for every service using modified clients and protocols, it could be useful to have an architecture that provides a userinitiated, transparent and secure connection between networks without securing every individual service. We call the
3098775
A First Approach to Provide Anonymity in Attribute Certificates
This paper focus on two security services for internet ap- plications: authorization and anonymity. Traditional authorization solu- tions are not very helpful for many of the Internet applications; however, attribute certificates proposed by ITU-T seems to be well suited and provide adequate solution. On the other hand, special attention is paid to the fact that many of the operations and transactions that are part of Internet applications can be easily recorded and collected. Consequently, anonymity has become a desirable feature to be added in many cases. In this work we propose a solution to enhance the X.509 attribute certifi- cate in such a way that it becomes a conditionally anonymous attribute certificate. Moreover, we present a protocol to obtain such certificates in a way that respects users' anonymity by using a fair blind signature scheme. We also show how to use such certificates and describe a few cases where problems could arise, identifying some open problems.
467068
Run-Time Support for Adaptive Heavyweight Services
By definition, a heavyweight network service requires a significant amount of computation to complete its task. Providing a heavyweight service is challenging for a number of reasons. First, since the service can typically not be provided in a timely fashion using a single server at the remote site, multiple hosts at both the server and client sites must be employed. Second, the available compute and network resources change with respect to time. Thus, an effective service must be adaptive in the sense that it is able to transparently aggregate the available resources and react to the changing availability of these resources. In this paper we present a framework that allows us to build these kinds of adaptive heavyweight services. Experimental results with a distributed visualization service suggest that the cost imposed by the new capability is reasonable.
1101949
Preliminary Report on the Design of a Framework for Distributed Visualization
The paper is a preliminary report on the de- sign of a framework, called Dv, for building interactive distributed visualizations on computational grids. The framework is based on a form of mobile object, called an active frame, that consists of application data and a pro- gram that manipulates the data. The system provides a flexible framework for building distributed applications that are performance-portable in the presence of hetero- geneous resources and that adapt to dynamic changes in the status of system resources such as processor cycles and network bandwidth.