Secure IN Internetworking.

Alexander Herrigel,Xuejia Lai

DOI: https://doi.org/10.1007/978-0-387-34894-0_11

1994-01-01

Abstract:This paper presents a new approach for secure IN internetworking. Based on a threat analysis, an adequate cryptographic protocol is proposed to address the derived security concerns. The cryptographic protocol presented is based on the recently published standardization framework ISO/IEC CD11770-3.

What problem does this paper attempt to address?

Inter-domain authentication scheme for Pervasive Computing Environments

YAO Lin,FAN Qingna,KONG Xiangwei

DOI: https://doi.org/10.3778/j.issn.1002-8331.2011.06.023

2011-01-01

Abstract:As a result of the high mobility of the pervasive computing,the principles communicating with each other usually locate at different domains.To secure the service access and communications,the principles should authenticate each other and establish a fresh session key.A novel inter-domain authentication and key establishment protocol is proposed.The proposed protocol reduces the burden of certificates management by adopting the biometric encryption.After inter-domain mutual authentication,the two principles build a new session key using the signcryption technique.The protocol can defend lots of attacks and its correctness is proven by the SVO logic.
Toward Security-Enhanced In-band Network Telemetry in Programmable Networks

Dezhang Kong,Xiang Chen,Hang Lin,Zhengyan Zhou,Yi Shen,Hongyan Liu,Qiumei Cheng,Xuan Liu,Dong Zhang,Chunming Wu,Muhammad Khurram Khan

DOI: https://doi.org/10.1109/tnsm.2024.3504563

2024-01-01

IEEE Transactions on Network and Service Management

Abstract:In-band Network Telemetry (INT) is a widely used monitoring framework in modern large-scale networks. It provides packet-level visibility into network conditions by inserting telemetry data into packets, enabling unprecedented fine-grained network management. However, this mechanism also introduces new vulnerabilities that malicious attackers can exploit. In this paper, we present eight In-band Network Telemetry Manipulation Attacks that take advantage of INT’s weakness, demonstrating that attackers can cause severe damage with little effort by manipulating INT packets. To address this issue, we designed SecureINT, a security-enhanced INT prototype that provides encryption and integrity verification for INT packets. Specifically, SecureINT deploys Even-Mansour and SipHash for confidentiality and integrity, respectively. It also uses a zero-delay rotation mechanism, which enables administrators to dynamically change the version of the deployed Even-Mansour/SipHash running on programmable switches without the need to re-install new programs. In this way, SecureINT can provide lasting security for INT packets using the limited resources of programmable switches. According to the experiments, SecureINT can be deployed on programmable switches using a single pipeline. Besides, the overhead of the rotation mechanism running on the control plane is still minimal.
In-band Network Telemetry Manipulation Attacks and Countermeasures in Programmable Networks.

Dezhang Kong,Zhengyan Zhou,Yi Shen,Xiang Chen,Qiumei Cheng,Dong Zhang,Chunming Wu

DOI: https://doi.org/10.1109/IWQoS57198.2023.10188809

2023-01-01

Abstract:In-band Network Telemetry (INT) is a widely used monitoring framework in modern large-scale networks that provides fine-grained visibility into network conditions by inserting telemetry data into packets. However, this mechanism also introduces new vulnerabilities that malicious attackers can exploit. In this paper, we present four In-band Network Telemetry Manipulation Attacks that take advantage of INT's weakness, demonstrating that attackers can cause severe damage with little effort by manipulating INT packets. To address this issue, we design SecureINT, a novel INT prototype that ensures confidentiality and integrity for INT packets. To meet the stringent computational requirements of programmable switches, we comprehensively analyze possible attacks on the deployed encryption/hash algorithms and modify them accordingly without compromising their security. According to the experiments, SecureINT can be deployed on programmable switches using a single pipeline, providing encryption and integrity verification for INT packets with minimal overhead.
Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Qiang Wu,Ran Wang,Xincheng Yan,Chunming Wu,Rongxing Lu

DOI: https://doi.org/10.1109/MWC.001.2100251

IF: 12.777

2022-01-01

IEEE Wireless Communications

Abstract:Opening-up sharing has prompted the multi-tenancy architecture, whereby different vendors (including outsourcees) work together with network operators to form a vibrant service ecosystem, resulting in several advantages as well as risks. In particular, the static nature of existing architectures in network functions virtualization-based (NFV-based) clouds facilitate hacking. Thus, much attention has been focused on determining how to avoid the uncontrollable cloud security induced by complex production relations and non-trustworthy software/hardware sources when the two sets of security risks intersect. In this article, we investigate latent persistent threats against cloud environments and determine a high degree of complementarity and consistency between the NFV-based cloud environment and the dynamic defense concept. More specifically, new NFV-based cloud features provide an effective implementation for dynamic defense, while the generalized robustness of dynamic defense theory allows for high security gains. Intrinsic cloud security (iCS) is then proposed to align NFV-based clouds, mimicking defense and the moving target defense (MTD) paradigm to implement a seamless integration and symbiosis evolution between security and NFV-based clouds. We quantify the impact on system overhead to account for efficiency and cost issues. The simulation analysis demonstrates that the enhanced mode is able to consistently obtain a more beneficial and stable defense compared with the counterparts.
Efficiently Secure Architecture for Future Network

YANG Xin,LI Hui,QUE Jianming,MA Zhentai,LI Gengxin,YAO Yao,WANG Bin,JIANG Fuli

DOI: https://doi.org/10.11896/jsjkx.220600265

2023-01-01

Abstract:Traditional IP-based Internet offers an end-to-end data transport service and has developed rapidly in the past half-century.However,serious security incidents emerged from attacks based on traditional networks.Traditional security mechanisms(e.g.,firewalls,intrusion detection systems) enhance security.However,most of them only provide some remedial strategies rather than solve the address-security problem radically due to the lack of change in network design.The overall in-depth security of the networked system cannot be guaranteed without a fundamental change.In order to meet the development requirements of the next generation of an endogenous security network,one of the future networks,the multi-identifier network(MIN),is introduced as our research background.This paper proposes an efficient scheme in hieratical architecture that provides comprehensive protection by addressing the security aspects pertaining to the network and application layers.At the network layer,the proposed architecture develops a multi-identifier routing scheme with embedded identity-based authentication and packet signature mechanisms to provide data tamper-resistance and traceability.At the application layer,the proposed architecture designs a mimic defensive scheme combined with weighted network centrality measures.This scheme focuses on protecting the core components of the whole network to improve the service's robustness and efficiently resist potential attacks.This paper tests and evaluates the proposed scheme from a theoretical and practical perspective.An analytical model is built based on the random walk for theoretical evaluation.In experiments,the proposed scheme is developed in MIN as MIN-VPN.Then considering IP-VPN as a baseline,anti-attack tests are conducted on IP-VPN and MIN-VPN.The results of theoretical evaluations and experiments show that the proposed scheme provides excellent transmission performance and successful defense against various TCP/IP-based attacks with acceptable defensive cost,demonstrating this security mechanism's effectiveness.In addition,after long-period penetration testing in three international elite security contests,the proposed method is effectively immune to all TCP/IP-based attacks from thousands of professional teams,thus verifying its strong security.
Extended Internet Key Exchange Protocol Version 2 in Trusted Computing Environment

XIAO Yue-lei,WU Jun-sheng,ZHU Zhi-xiang

DOI: https://doi.org/10.19304/j.cnki.issn1000-7180.2018.12.001

2018-01-01

Abstract:On the basis of the IKEv2, an extended IKEv2 in trusted computing environment based on ISO/IEC 9798-3:1998/Amd 1:2010 is proposed in this paper. It realizes mutual identity authentication and Platform-Authentication between an initiator and a responder, and establishes session keys between them, and is backward compatible with the IKEv2, where a trusted third party (TTP) is responsible for validating the identity and Attestation Identity Key (AIK) certificates of them, and evaluating the platform integrity of them, and the stored integrity measurement logs (SML) of them are encrypted and sent to the TTP. Thus, it is able to solve the problems of the existing extended IKE protocol for trusted computing environment effectively. Moreover, the extended IKEv2 is proved secure based on the strand space model for trusted network connect protocols.
An Efficient and Secure Authentication Scheme for In-vehicle Networks in Connected Vehicle.

Mengjie Duan,Shunrong Jiang,Liangmin Wang

DOI: https://doi.org/10.1007/978-981-10-8890-2_15

2017-01-01

Abstract:In-vehicle networks which were originally designed to operate in a closed environment without secure concerns are now being connected to external nodes/networks and providing useful services. However, communications with the external world introduce severe security threats to the vehicle. For connected vehicle, many attacks, which were only feasible with physical access to a vehicle, can now be carried out remotely over wireless networks. To overcome this problem, we propose a security protocol to protect in-vehicle networks based on current Controller Area Network specifications. First, we generate the secure in-vehicle networks by using a group key. Then, we make the gateway join the secure in-vehicle networks after authenticating it. Finally, we generate the pair-ware key to ensure the secure communication between the external node and the gateway. The security analysis and performance evaluation show that the proposed scheme is secure and practical.
Research on improvement of information-centric networking architecture for NetInf security

Jiefang Liu,Bin Zhao,Ning Zhou

DOI: https://doi.org/10.3969/j.issn.1001-3695.2015.11.051

2015-01-01

Abstract:Information-centric networking(ICN)has been a novel hotspot in the field of future Internet architecture.Aiming at NRS is vulnerable to masquerading and content poisoning attacks in the NetInf,because of invalid data registration,this pa-per proposed a registration stage,which integrated authentication and authorization scheme and took place before the publica-tion and retrieval.The stage authenticated hosts before they accessed the NetInf system.In addition,the registration stage used the capability-based access policies to solve the problem of unauthorized access.It formally verified the proposed schemes by using formal methods.The results show the schemes improves the security of the NetInf framework.
Research on Intrinsic Security in Future Internet Architecture

Zhong CHEN,Hongwei MENG,Zhi GUAN

DOI: https://doi.org/10.19363/j.cnki.cn10-1380/tn.2016.02.004

2016-01-01

Abstract:The characteristics of intrinsic security in the future Internet architecture have been used to conquer the secu-rity problems of current Internet. Self-certifying addresses are introduced in future Internet architecture (FIA) to enable the intrinsic security properties. However, without PKI, these approaches in FIA miss the intrinsic binding between user-level descriptor, network-level identifier and correspondent public key. To this end, a naming scheme of Self-Certifying Identi-fier in FIA based on Combined Public Key (CPK), named as SCI-CPK, is proposed in this paper. The use cases of identity authentication based on SCI-CPK in FIA designs are also given, including XIA, MobilityFirst and NDN. The analysis shows that the proposed method is benefit of ubiquitous access and vast mobility scenario in the future Internet.
Intranet security strategy based on a monitor system

Jia CHEN,Lei CHENG,Tiange SI,Yiqi DAI

DOI: https://doi.org/10.3321/j.issn:1000-0054.2007.04.040

2007-01-01

Abstract:To solve the problem of Intranet information leakage, this paper proposed a new Intranet security strategy. There are two characteristics in this strategy. In the first place, information is classified by hierarchical means. In the second place, a component called monitor is introduced. With exerting access control over the communication among the entities in the network, the monitor can dynamically isolate the physical connections among host computers involved in security. This new strategy not only ensures information security, but also improves resource utility efficiently. In addition, according to this strategy, a monitor system is also designed based on the Intel IXP2400 chip. Experimental results show that, by virtue of the powerful processing ability of IXP2400, the monitor system could efficiently process high-speed data stream in Gb/s-net.
Research on a New Infrastructure of Trustworthy Networks

ZHANG Min,LUO Guang-chun

DOI: https://doi.org/10.3969/j.issn.1001-0548.2007.06.012

2007-01-01

Abstract:The application security problem of Internet is far from being completely solved. In this paper, some basic concepts and critical issues in trustworthy computer network are first introduced. Then an architecture of trustworthy network, and host Identity Protocol as end system identity, is proposed to make sure communicate trustworthy.
ICN-based Communication Security Service Mechanism for Smart Industrial Control

Zheng CHEN,Xing-jian ZHANG,Yong SHI,Zhi XUE

DOI: https://doi.org/10.3969/j.issn.1002-0802.2018.03.028

2018-01-01

Abstract:The development of intelligent industrial control is closely related with the innovation and evolution of communication technology. With the development of new industrial control, such as Industry 4.0 and intelligent manufacturing, the open industrial control system faces more and more threats from the Internet. As a new type of communication network, the communication model of ICN in the information center network takes the information as the center, instead of the address - centered approach in the TCP/IP network. Therefore, the communication mode evolves from host-to-host to host-to-network, and the security mechanism is built up on information itself, while the forwarding mechanism evolves from storage and forwarding to cache forwarding. In view of this, a new smart industrial control communication service mechanism based on the ICN architecture is designed. Aiming at the defects and deficiencies in the design of TCP/IP, the fundamental solution to the design of the network architecture is proposed. Finally, security analysis and simulation experiments indicate the effectiveness of the proposed mechanism. The experiment result is of good theoretical value and application prospects in improving the safety of intelligent industrial control.
A Security Certification Scheme for Information-Centric Networks

M. Anisetti,Filippo Berto,C. Ardagna,E. Damiani

DOI: https://doi.org/10.1109/TNSM.2022.3165144

2022-09-01

IEEE Transactions on Network and Service Management

Abstract:Information-Centric Networking is an emerging alternative to host-centric networking designed for large-scale content distribution and stricter privacy requirements. Recent research on Information-Centric Networking focused on the protection of the network from attacks targeting the content delivery protocols, while assuming genuine content can always be retrieved from trustworthy nodes. In this paper, we depart from the assumption of the trustworthiness of network nodes and propose a novel certification methodology for information-centric networks that supports continuous security verification of non-functional properties. Our methodology provides a complete and detailed view of the network security status, increasing the trustworthiness of the network and its services. The proposed approach builds on an enhanced certification model capturing the evolution of the system over time. It also defines certification services that fully integrate with existing networks to collect evidence on the target of certification and carry out the certification process. It finally proposes two certification processes, centralized and decentralized, balancing the impact on the network and the system performance. Efficiency, performance, and soundness of our approach are experimentally evaluated in a simulated Named Data Networking (NDN) network targeting property availability.

Computer Science
A Framework and It's Application for Security Architecture of Computer Networks

Haixin Duan,Jianping Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2000.05.008

2000-01-01

Abstract:The definitions of some concepts related to security architecture for computer networks are presented firstly in this paper, and then, a framework is proposed from the aspect of security requirements. Based on the analysis of dependence among security services, a method is presented for classifying and rating network security according to se curity services and mechanisms. After the analysis of security mechanisms in TCP/IP protocol including IPSec and SSL, a protocol layered entity model is presented for implementation of security services and security management. From the aspect of entity unit, all kinds of security technologies are organized into to four layers. The place of security management in the architecture and content of management activities for large networks are described. At the end of this paper, further research directions are pointed about the security architecture.
A General Authentication and Key Agreement Framework for Industrial Control System

Shan Gao,Junjie Chen,Bingsheng Zhang,Kui Ren,Xiaohua Ye,Yongsheng Shen

DOI: https://doi.org/10.23919/cje.2023.00.192

IF: 1.019

2024-01-01

Chinese Journal of Electronics

Abstract:In modern industrial control systems (ICSs), when user retrieving the data stored in field device like smart sensor, there exists two main problems: one is lack of the verification for identification of user and field device; the other is that user and field device need exchange a key to encrypt sensitive data transmitted over the network. We propose a comprehensive authentication and key agreement framework that enables all connected devices in an ICS to mutually authenticate each other and establish a peer-to-peer session key. The framework combines two types of protocols for authentication and session key agreement: The first one is an asymmetric cryptographic key agreement protocol based on transport layer security handshake protocol used for Internet access, while the second one is a newly designed lightweight symmetric cryptographic key agreement protocol specifically for field devices. This proposed lightweight protocol imposes very light computational load and merely employs simple operations like one-way hash function and exclusive-or (XOR) operation. In comparison to other lightweight protocols, our protocol requires the field device to perform fewer computational operations during the authentication phase. The simulation results obtained using OpenSSL demonstrates that each authentication and key agreement process in the lightweight protocol requires only 0.005 ms. Our lightweight key agreement protocol satisfies several essential security features, including session key secrecy, identity anonymity, untraceability, integrity, forward secrecy, and mutual authentication. It is capable of resisting impersonation, man-in-the-middle, and replay attacks. We have employed the Gong-Needham-Yahalom (GNY) logic and automated validation of Internet security protocols and application tool to verify the security of our symmetric cryptographic key agreement protocol.
Secure Access to Private Services in Intranet for Mobile Clients

Li Kuang,Yingjie Xia,Caijun Sun,Jiaming Wu,Liangdi Bao

DOI: https://doi.org/10.19026/rjaset.5.4738

2013-01-01

Abstract:With wide adoption of Service Computing and Mobile Computing, people tend to invoke services with mobile devices, requiring accurate and real-time feedback from services at any time and any place. Among these services, some are private to limited users and require identity authorization before use; hence secure access control in wireless network should be provided. To address the challenge, in this study, we propose the architecture and protocols of a system of access to private services for mobile clients, which combines the technologies of trusted computing, Diffie-Hellman key agreement protocol, digital certificate, DES data encryption algorithm and twice verification. We further show the implementation of the proposed system, in which we have realized the authentication and authorization of mobile clients and then secure data transfer between mobile clients in the unsafe Internet and private services in the Intranet. © 2013 Maxwell Scientific Organization.
Establish the Intrinsic Binding in Naming Space for Future Internet Using Combined Public Key.

Hongwei Meng,Zhong Chen,Jian-bin Hu,Zhi Guan

DOI: https://doi.org/10.1145/2935663.2935676

2016-01-01

Abstract:In order to enable intrinsic security without the Public Key Infrastructure (PKI) deployment, flat self-certifying addresses have been involved into the future Internet architecture (FIA) designs. In contrast to deriving a self-certifying address from hashing of a correspondent prepared public key, we build up this self-certifying relationship along the reverse path using Combined Public Key (CPK). Our design develop the chain of trust embedded in the Internet name/address registration and allocation process for domains, hosts, services and content, to establish intrinsic bindings between three different identities: user-level human-readable names, network-level routable flat identifiers and the correspondent public keys. This binding connects the accountability between real-world space and network space. The use cases of our design are also given in named data networking (NDN) and identity/locator splitting network architecture, i.e. XIA and MobilityFirst. The analysis also shows that identity authentication based on CPK is capable of resource-constrained nodes in large-scale networks without scalability tradeoffs.
SIP-based Inter-domain Network Conference Security Framework

SHAN Linwei,SHAN Xiuming,REN Yong

DOI: https://doi.org/10.3969/j.issn.1000-3428.2006.14.047

2006-01-01

Abstract:Multimedia network conference is an important network application.The security support of implementing the network conference is necessary.Tiffs article firstly introduces the session initiation protocol and the inter-domain network conference model;then,it analyzes the security framework principles and presents the full design;finally,it combines the security framework with the network conference management functions and presents an example of signaling flow.
A Layered Encryption Mechanism for Networked Critical Infrastructures.

Huayang Cao,Peidong Zhu,Xicheng Lu,Andrei Gurtov

DOI: https://doi.org/10.1109/mnet.2013.6423186

IF: 10.294

2013-01-01

IEEE Network

Abstract:Networked critical infrastructures improve our lives, but they are attractive targets for adversaries. In such infrastructures, to secure sensitive data is vital, as the information system is a foundation of today¿s critical infrastructures, and data security is a main concern in such systems. Cryptography is an approach for data security, but this method should be altered according to various features of infrastructure networks. Since complex and distributed critical infrastructures usually spread over large geographic areas, different parts of those infrastructures have different levels of perimeter defense. Devices in weakly protected zones are more likely to be captured than those in well protected zones. If an adversary captures devices, s/he can bypass cyber security measures and obtain secret information directly. Such a threat requires a layered security mechanism that can prevent adversaries from invading the whole infrastructure network from these weak zones. In this article, we propose a layered encryption mechanism based on hash chain technology for protecting sensitive data. Besides showing the layered defense, the mechanism is also lightweight and has convenient key management. It can be used independently or as a supplement to existing security measures. We evaluate performance of the proposed mechanism over different kinds of devices.
Design and implementation of the Node Identity Internetworking Architecture

Simon Schütz,Henrik Abrahamsson,Bengt Ahlgren,Marcus Brunner

DOI: https://doi.org/10.1016/j.comnet.2009.10.015

IF: 5.493

2010-05-01

Computer Networks

Abstract:The Internet Protocol (IP) has been proven very flexible, being able to accommodate all kinds of link technologies and supporting a broad range of applications. The basic principles of the original Internet architecture include end-to-end addressing, global routeability and a single namespace of IP addresses that unintentionally serves both as locators and host identifiers. The commercial success and widespread use of the Internet have lead to new requirements, which include Internetworking over business boundaries, mobility and multi-homing in an untrusted environment. Our approach to satisfy these new requirements is to introduce a new Internetworking layer, the node identity layer. Such a layer runs on top of the different versions of IP, but could also run directly on top of other kinds of network technologies, such as MPLS and 2G/3G PDP contexts. This approach enables connectivity across different communication technologies, supports mobility, multi-homing, and security from ground up. This paper describes the Node Identity Architecture in detail and discusses the experiences from implementing and running a prototype.

computer science, information systems,telecommunications,engineering, electrical & electronic, hardware & architecture

Secure IN Internetworking.

Inter-domain authentication scheme for Pervasive Computing Environments

Toward Security-Enhanced In-band Network Telemetry in Programmable Networks

In-band Network Telemetry Manipulation Attacks and Countermeasures in Programmable Networks.

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Efficiently Secure Architecture for Future Network

Extended Internet Key Exchange Protocol Version 2 in Trusted Computing Environment

An Efficient and Secure Authentication Scheme for In-vehicle Networks in Connected Vehicle.

Research on improvement of information-centric networking architecture for NetInf security

Research on Intrinsic Security in Future Internet Architecture

Intranet security strategy based on a monitor system

Research on a New Infrastructure of Trustworthy Networks

ICN-based Communication Security Service Mechanism for Smart Industrial Control

A Security Certification Scheme for Information-Centric Networks

A Framework and It's Application for Security Architecture of Computer Networks

A General Authentication and Key Agreement Framework for Industrial Control System

Secure Access to Private Services in Intranet for Mobile Clients

Establish the Intrinsic Binding in Naming Space for Future Internet Using Combined Public Key.

SIP-based Inter-domain Network Conference Security Framework

A Layered Encryption Mechanism for Networked Critical Infrastructures.

Design and implementation of the Node Identity Internetworking Architecture