Research and Realization of Session Defined in PKCS#11

LIU Xiao-lei

DOI: https://doi.org/10.3969/j.issn.1671-0428.2008.02.006

IF: 5.105

2008-01-01

Computers & Security

Abstract:Discuss Session Mechanism Defined in PKCS#11 Standard, With USB Key's Middleware Development experiences ,Present a Optimized level Session Structure that bases on the original One.

What problem does this paper attempt to address?

AN IMPLEMENTATION OF USB KEY-BASED CSP

Liu Hanjia,Zhou Yujie

DOI: https://doi.org/10.3969/j.issn.1000-386X.2009.10.002

2009-01-01

Abstract:Microsoft CryptoAPL/CryptoSPI architecture is widely used in PKI(public key infrastructure) application.By making calls to public interface CryptoAPI,applications employ services provided by CSPs,which perform the real cryptographic work.USB KEY is a special class of smart card devices directly used on USB interface of personal computers,it is convenient in use,highly secure and strong in computation.In this paper it studies and designs a set of USB KEY-based CSP middleware module which offers high-strength security assurance to the application of PKI system.
Session authentication method and device

Yin Chuanwen,Wu Feng,Guo Wei

2019-01-01

Abstract:The invention discloses a session authentication method and device. The method comprises the following steps of obtaining a Token generated according to a preset operation and used for a session, segmenting the Token, and then carrying out a hierarchical verification operation; and analyzing a result obtained after the hierarchical processing operation to obtain the user information, and returningthe user information to complete the session authentication. According to the invention, the technical problems of session Token authentication anti-violence and anti-pressure performances are insufficient are solved. According to the invention, the session authentication based on the explosion-proof Token is realized. In addition, the method and the device are suitable for the session Token authentication scene of malicious requests or a large number of requests.
Session-based Security Enhancement of RFID Systems for Emerging Open-Loop Applications

Junyu Wang,Christian Floerkemeier,Sanjay E. Sarma

DOI: https://doi.org/10.1007/s00779-014-0788-x

2014-01-01

Personal and Ubiquitous Computing

Abstract:Radio frequency identification (RFID) is an important technique used for automatic identification and data capture. In recent years, low-cost RFID tags have been used in many open-loop applications beyond supply chain management, such as the tagging of the medicine, clothes, and belongings after the point of sales. At the same time, with the development of semiconductor industry, handheld terminals and mobile phones are becoming RFID-enabled. Unauthorized mobile RFID readers could be abused by the malicious hackers or curious common people. Even for authorized RFID readers, the ownership of the reader can be transferred and the owners of the authorized mobile reader may not be always reliable. The authorization and authentication of the mobile RFID readers need to take stronger security measures to address the privacy or security issues that may arise in the emerging open-loop applications. In this paper, the security demands of RFID tags in emerging open-loop applications are summarized, and two example protocols for authorization, authentication and key establishment based on symmetric cryptography are presented. The proposed protocols adopt a timed-session-based authorization scheme, and all reader-to-tag operations are authorized by a trusted third party using a newly defined class of timed sessions. The output of the tags is randomized to prevent unauthorized tracking of the RFID tags. An instance of the protocol A is implemented in 0.13-μm CMOS technology, and the functions are verified by field programmable gate array. The baseband consumes 44.0 μW under 1.08 V voltage and 1.92 MHz frequency, and it has 25,067 gate equivalents. The proposed protocols can successfully resist most security threats toward open-loop RFID systems except physical attacks. The timing and scalability of the two protocols are discussed in detail.
Analysis and Enforcement of Recognizing USB Token by Host

QIAN Min,CHEN Xiang-ning

DOI: https://doi.org/10.3969/j.issn.1002-2279.2007.02.036

2007-01-01

Microprocessors

Abstract:USB identity token is a widely used information carrier for network identity authentication.It communicates and exchanges user identity information with the host after being enumerated and recognized by host.This paper proposes a novel method to enhance the security of the USB token recognition by adding a special authentication protocol before any network identity information can be exchanged between the token device and host driver.The whole token identification course is elaborated by an example of PDIUSBD12-based USB identity token.
Research on Side Channel Attack for USB Key

Qingshuang Han,Liji Wu,Xiangmin Zhang

DOI: https://doi.org/10.1109/cis.2016.0144

2016-01-01

Abstract:With the development of Public Key Infrastructure (PKI) information technology, USB Key are being more and more used. When the Side Channel Attacks (SCA) caused a huge threat to the smart card, we also concerned about the impact which will be given on USB Key's security. Because of the different implementation and interface protocols, the side channel security characteristics between them are different in collecting the information of side channel. This paper proposes a method for acquiring power trace of USB Key. The method is a kind of driving design, which involves three aspects: Bus driver, card Reader driver and USB Key device driver. In order to confirm the design, we collected power trace from four kinds of USB Key, then the SCA performed to prove that the information we collected can be used. Some specific experimental results will be demonstrated in this paper.
THE IMPROVEMENT ON SESSION ENTITIES AUTHENTICATION PROTOCOL FOR WEB SERVICE

Xu Feng,Huang Hao,Wang Zhijian

DOI: https://doi.org/10.3969/j.issn.1000-386X.2008.11.010

2008-01-01

Abstract:The archetype of session authentication protocol model is presented to solve the problem of communication security among ses- sion entities in Web services.The security technologies and the shortages of the protocol in key mechanism,anonymous instance and session management are analyzed,and then some improvements and extension are made over the archetype protocol based on DH algorithm.Finally, the new session authentication protocol is used for the management of the communication among session entities in a Web services transaction environment and the authentication in a testing system.The test result reveals that the new session entities authentication protocol can provide a trustful protection for the session process in Web services.
PKCS-Based Data Security Framework and Its Supporting Library Design

WANG Huai-bo,LI Lin,ZHANG Shen-sheng

DOI: https://doi.org/10.3321/j.issn:1006-2467.2000.06.024

2000-01-01

Abstract:A PKCSbased data security framework was proposed and its supporting library was implemented. At the bottom of the framework there is an I/O and coding module, which deals with the coding of BER/DER, Base 64 and I/O with various data repositories. It has a stream module structure to enable onepass processing. An algorithm foundation class library which covers all PKCSrelated algorithms forms the core of the framework. Above the classes library comes an X.509 certificate service module, as well as a PKCS#7 and PKCS#12 data protection module. As an integral part of the framework, environment management module of personal security maintains user's personal information such as password, private key and certificate. The presented work can give a reference to the research of the general data security framework.
Establishing Dynamic Secure Sessions for ECQV Implicit Certificates in Embedded Systems

Fikret Basic,Christian Steger,Robert Kofler

DOI: https://doi.org/10.23919/DATE56975.2023.10137025

2023-11-20

Abstract:Be it in the IoT or automotive domain, implicit certificates are gaining ever more prominence in constrained embedded devices. They present a resource-efficient security solution against common threat concerns. The computational requirements are not the main issue anymore. The focus is now placed on determining a good balance between the provided security level and the derived threat model. A security aspect that often gets overlooked is the establishment of secure communication sessions, as most design solutions are based only on the use of static key derivation, and therefore, lack the perfect forward secrecy. This leaves the transmitted data open for potential future exposures by having keys tied to the certificates rather than the communication sessions. We aim to patch this gap, by presenting a design that utilizes the Station to Station (STS) protocol with implicit certificates. In addition, we propose potential protocol optimization implementation steps and run a comprehensive study on the performance and security level between the proposed design and the state-of-the-art key derivation protocols. In our comparative study, we show that with a slight computational increase of 20\% compared to a static ECDSA key derivation, we are able to mitigate many session-related security vulnerabilities that would otherwise remain open.

Cryptography and Security
Dynamic quantum session key agreement protocol based on d-level mutually unbiased bases

Shuangshuang Luo,Zhihui Li,Xingjia Wei

DOI: https://doi.org/10.1007/s11128-024-04529-0

IF: 1.965

2024-11-28

Quantum Information Processing

Abstract:Session keys play an important role in practical communication. In this paper, we propose an efficient dynamic quantum session key agreement protocol based on d -level mutually unbiased bases via multi-party multiplication. In the initial phase, the trusted center detects the identity and number of participants who apply for the construction of session keys by one-to-one correspondence of hash values to avoid any fake attacks. In the encoding phase, all applied participants encrypt their private keys with the system key through location tokens and perform the unitary operation to encode the encryption results on a sequence of mutually unbiased basis quantum states and transmit them in the circle type. The security analysis shows that the proposed scheme is resistant to both external and internal attacks. In this paper, with the help of a predefined system key, the quadratic hash over a finite field is successfully applied to identity authentication for the first time, and allows an arbitrary number of participants to construct a session key dynamically, which is more pervasive compared with other schemes.

physics, multidisciplinary,quantum science & technology, mathematical
Secure session management for Web services

Shaohua Tang

2004-01-01

Journal of Information and Computational Science

Abstract:A secure session management protocol and a centralized session administration server are designed in this paper. The administration server is responsible for the setup of a session, the generation and distribution of the session key, and the maintenance of the session statuses. A DFA-based mechanism is designed for the administration server to manage the statuses of the session. The message confidentiality, authentication and integrity are guaranteed in the session management protocol. Therefore, Web Services can be applied to e-business workflow to achieve end-to-end multi-party secure collaboration by taking advantage of the session management mechanism presented in this paper.
Study on Hybrid Key Management Mechanisms of RFID System Based on PKI and CPK

ZHANG Bing,QIN Zhi-guang,WAN Guo-gen

DOI: https://doi.org/10.3969/j.issn.1001-0548.2015.03.017

2015-01-01

Abstract:The previous key management mechanisms in RFID systems are usually based on a certain layer, and lack of a common framework and a unified key management mechanism. In this article, a unified hybrid key management mechanism of RFID systems based on PKI and CPK is proposed. In the mechanism, the terminal nodes are identified according its tag, a unified identity space is established, and a unified key space is established. At the same time, PKI key management technology is used for the back-end devices of RFID systems to solve the compatibility problem of traditional Internet authentication and the existing security solutions; CPK key management technology is used for the front-end devices of RFID systems to implement the "centralized generation and distributed storage" management of the front-end key, and the security issues are solved because there are more processing objects in the RFID system, less resource in a single device, and need more direct proof of identification of the authenticity of the device without the third party. The presented techniques can be used in the RFID applications that require large-scale deployment of equipment, equipment direct certification and offline certification requirements.
An Implementation Method of Secure Isolation and Data Exchange Based on USB

LU Zhenyu,PAN Li,NI Yousheng

DOI: https://doi.org/10.3969/j.issn.1000-3428.2006.03.057

2006-01-01

Abstract:Nowadays,methods of network attack change significantly from one year to the next.In this situation,there comes a new technology called secure network GAP,which cuts off the direct connection in datalink layer,exchanges data in its own control,and therefore it resolves the conflict between secure isolation and data exchange effectively.This paper describes a method of implementing network secure isolation and data exchange system based on USB,which has been promoted in the network construction of Shanghai E-government network.
Secure Execution of Distributed Session Programs

Nuno Alves,Raymond Hu,Nobuko Yoshida,Pierre-Malo Deniélou

DOI: https://doi.org/10.4204/EPTCS.69.1

2011-10-19

Abstract:The development of the SJ Framework for session-based distributed programming is part of recent and ongoing research into integrating session types and practical, real-world programming languages. SJ programs featuring session types (protocols) are statically checked by the SJ compiler to verify the key property of communication safety, meaning that parties engaged in a session only communicate messages, including higher-order communications via session delegation, that are compatible with the message types expected by the recipient. This paper presents current work on security aspects of the SJ Framework. Firstly, we discuss our implementation experience from improving the SJ Runtime platform with security measures to protect and augment communication safety at runtime. We implement a transport component for secure session execution that uses a modified TLS connection with authentication based on the Secure Remote Password (SRP) protocol. The key technical point is the delicate treatment of secure session delegation to counter a previous vulnerability. We find that the modular design of the SJ Runtime, based on the notion of an Abstract Transport for session communication, supports rapid extension to utilise additional transports whilst separating this concern from the application-level session programming task. In the second part of this abstract, we formally prove the target security properties by modelling the extended SJ delegation protocols in the pi-calculus.

Distributed, Parallel, and Cluster Computing,Cryptography and Security,Networking and Internet Architecture,Programming Languages
An Enhanced Authentication Scheme Based Remote User Password Using Smart Card

Ahmed Yaser Fahad Alsahlani,Songfeng Lu

2016-01-01

Abstract:Authentication using smart card is a mechanism to verify the legitimacy of the user over insecure communication. Recently, Chen et al. figured out some weaknesses in previously published schemes, they proposed a robust smart card based remote user password authentication scheme. They claimed that, their scheme is efficient and can ensure the session key forward secrecy. We analyzed their scheme, we found that, it cannot detect incorrect password within login phase. Furthermore, the user required to communicate with the server to change or update his/her password. Besides, it cannot securely forward the secrecy. In this paper, we propose a scheme to overcome the aforesaid weaknesses and produce an enhanced authentication scheme based remote user password using smart card. We use a TRPT (Temporary Registration Password Technique) within registration phase to secure user's password. Our proposed scheme can resist various malicious attacks, achieve mutual authentication, user can choose and change his/her password freely without need to communicates with the server, securely forward secrecy, and the login password never been exposed or transferred over channel. We show that, our proposed scheme achieved the goal, and it is more legible to practical use compared to the other related schemes.
A Mutual Authentication Improvement for Traditional Unidirectional ECDLP-Based RFID Authentication Protocols

Zehua Chen,Linsen Li,Yue Wu,Xinglei Zhang

DOI: https://doi.org/10.1109/ICEICE.2012.448

2012-01-01

Abstract:As the RFID technology and application in many different fields continue to evolve and mature, the security and privacy issues about RFID application also become more and more important. However, the traditional unidirectional ECDLP-based authentication protocol cannot satisfy the security demands under various attacks on the RFID system. In this paper, we present a mutual authentication improvement proposal for traditional unidirectional ECDLP-Based RFID Authentication protocols by using the Diffie-Hellman key exchange and the randomized key method. The randomized key method is our former research on this research direction. Our security analysis shows that the proposed improved protocols get better security and privacy performance respectively.
Design and Implementation of Transparent Encrypted and Decrypted File System Based on UsbKey

LIU Wei-peng,HU Jun,LIU Yi

DOI: https://doi.org/10.3969/j.issn.1002-137X.2008.11.026

2008-01-01

Computer Science

Abstract:Encrypted file system is an effective method to protect sensitive data of system and user from disclosing on operating system level.This paper first investigates several famous encrypted file system and points out their limits,such as use method,key protection,management and performance,then discusses a scheme of transparent encrypted and decrypted file system based on UsbKey from design objective,architecture,and implementation.This scheme is based on Linux operating system,at the same time,uses UsbKey to storage and protect key.Using LSM framework and redirecting the "read" and "write" operation of inode implement transparent encrypted and decrypted function.This paper gives some lights on the research and implementation of transparent encrypted and decrypted file system in Linux.
Research and Design of Driverless USBKey COS

刘红明,周玉洁

DOI: https://doi.org/10.3969/j.issn.1009-8054.2009.09.041

2009-01-01

Abstract:USBKey, as a kind of security product and for its small size, portability, safety, has been widely used. Now, most USBKey products in the market need to install usb driver, and this causes inconvenience to users and increases the bank's issuance cost. This paper bives the design of USBKey COS, which is based on Mass Storage protocol. So this USBKey doesn't demand installation of usb driver when used, and thus is quite convenient for the user.
A novel session key agreement algorithm

Hongzhou Ning,Yun Liu,Dequan He

DOI: https://doi.org/10.3321/j.issn:1002-0470.2005.11.003

2005-01-01

Abstract:After expanding the definition of Chebyshev polynomials, the Chebyshev polynomials on finite fields Zp are formed. Using their one-way and semi-group properties on the finite fields, a novel session key agreement algorithm is presented. The algorithm has the fairness of the session key agreement. Compared with Diffie-Hellman algorithm, the algorithm does not need to look for primitive element in running, but select common integer number. And the attack to the algorithm is more complex. Finally, the security of the session key agreement algorithm is analyzed and it is concluded that any polynomials, which have semi-group property on real fields, can be used to construct session key agreement algorithm.
Design of CSP Based on USB and SD Interface Smart Card

Lou Xiaojin,Chen Gongliang,Yang Shutang

DOI: https://doi.org/10.3969/j.issn.1009-8054.2007.01.083

2007-01-01

Abstract:The CSP based on smart card can provide cryptograph service of good reliability and security. Because of the portability of smartcard, it can be used on many different kinds of terminal device, such as cell phone, Pocket PC, PC and so on. This paper introduces the architecture of a CSP, which is based on smart card with USB and SD IO interface, including file system in smart card and module of command stream. Its most important characteristic is that it can easily integrate many kinds of smart card.
The Realization of Key Extraction Based on USRP and OFDM Channel Response

Wei Cheng,Aidong Xu,Yixin Jiang,Hong Wen,Huanhuan Song,Kai Ouyang,Xiping Zhu

DOI: https://doi.org/10.1109/cns.2017.8228665

2017-01-01

Abstract:The reciprocity of the wireless and the randomness of channel characteristic is the basis of physical layer key generation technology based on the channel. The complete key generation technologies include five steps that channel probing, channel feature extraction, quantification, reconciliation and privacy application. There are many theories and simulation prove the feasibility of key extraction and in this paper, the first four steps of key extraction are realized by using MIMO-OFDM system established by the USRP radio devices. This paper summarizes the physical layer key generation process, and introduces the method of extracting key from different literatures is used to realize the key extraction, so as to provide an important reference for further research on key generation technology.

Research and Realization of Session Defined in PKCS#11

AN IMPLEMENTATION OF USB KEY-BASED CSP

Session authentication method and device

Session-based Security Enhancement of RFID Systems for Emerging Open-Loop Applications

Analysis and Enforcement of Recognizing USB Token by Host

Research on Side Channel Attack for USB Key

THE IMPROVEMENT ON SESSION ENTITIES AUTHENTICATION PROTOCOL FOR WEB SERVICE

PKCS-Based Data Security Framework and Its Supporting Library Design

Establishing Dynamic Secure Sessions for ECQV Implicit Certificates in Embedded Systems

Dynamic quantum session key agreement protocol based on d-level mutually unbiased bases

Secure session management for Web services

Study on Hybrid Key Management Mechanisms of RFID System Based on PKI and CPK

An Implementation Method of Secure Isolation and Data Exchange Based on USB

Secure Execution of Distributed Session Programs

An Enhanced Authentication Scheme Based Remote User Password Using Smart Card

A Mutual Authentication Improvement for Traditional Unidirectional ECDLP-Based RFID Authentication Protocols

Design and Implementation of Transparent Encrypted and Decrypted File System Based on UsbKey

Research and Design of Driverless USBKey COS

A novel session key agreement algorithm

Design of CSP Based on USB and SD Interface Smart Card

The Realization of Key Extraction Based on USRP and OFDM Channel Response