Internet key exchange (IKE) is an automated key exchange mechanism that is used to facilitate the transfer of IPSec security associations (SAs). Public key infrastructure (PKI) is considered as a key element for provi...Internet key exchange (IKE) is an automated key exchange mechanism that is used to facilitate the transfer of IPSec security associations (SAs). Public key infrastructure (PKI) is considered as a key element for providing security to new distributed communication networks and services. In this paper, we concentrate on the properties of the protocol of Phase 1 IKE. After investigating IKE protocol and PKI technology, we combine IKE protocol and PKI and present an implementation scheme of the IKE based on PKI. Then, we give a logic analysis of the proposed protocol with the BAN-logic and discuss the security of the protocol. The result indicates that the protocol is correct and satisfies the security requirements of Internet key exchange.展开更多
Public Key Infrastructure (PKI) is a comprehensive information security framework for providing secure information and communication over the internet. Its need and use has grown over the years and continually grows. ...Public Key Infrastructure (PKI) is a comprehensive information security framework for providing secure information and communication over the internet. Its need and use has grown over the years and continually grows. This research work examines the current PKI framework’s validation process as operated by vendors and subscribers to identify the drawbacks and propose enhanced approaches to its validation mechanism. Using an approach of reviewing secondary data, critical weaknesses of integrity, proof of trust and single point-of-failure were identified with the current PKI framework. This study therefore advances proposed solutions to address the identified weaknesses by specifically introducing multiple Certificate Authorities, storage, visibility and searchability of subscriber information in public repository. A comprehensive detail of its implementation is proposed to address the identified weaknesses of uncertain integrity, trust for certificate authorities and prevent a single point of failure. Furthermore, the proposed enhancements are validated with the protection motivation theory and a framework for empirically testing the enhancements is suggested. Further research would be required to factor in multi-factor authentication without compromising performance.展开更多
In the proposed photo certificate, the principal component is the image, for example, the user＇s photo. User-related fields, such as the subject＇s name, the issuer＇s name, and the expiration period, which are meani...In the proposed photo certificate, the principal component is the image, for example, the user＇s photo. User-related fields, such as the subject＇s name, the issuer＇s name, and the expiration period, which are meaningful to users, are embedded into the surface of the photo by using a visible watermark algorithm, so that the reader can capture this information without the requirement for special software. The remaining fields in the certificate are embedded into a marked photo. Later, the whole photo certificate is eryptographically signed by certification authority （CA） private key to guarantee the integrity of our photo certificate. By such arrangement, the eertificate＇s verification is divided into two layers. The first layer is human visual system oriented and the second layer is the software-oriented. User can determine whether the user＇s photo and its subject＇s name are consistent and cheek whether the expired period is valid first. The second layer＇s verification is lunched only when the first layer＇s verification is passed. To sum up, the proposed photo certificate not only inherits the functions of a traditional certificate, but also provides a friendlier operational environment of X.509 certificate.展开更多
文摘Internet key exchange (IKE) is an automated key exchange mechanism that is used to facilitate the transfer of IPSec security associations (SAs). Public key infrastructure (PKI) is considered as a key element for providing security to new distributed communication networks and services. In this paper, we concentrate on the properties of the protocol of Phase 1 IKE. After investigating IKE protocol and PKI technology, we combine IKE protocol and PKI and present an implementation scheme of the IKE based on PKI. Then, we give a logic analysis of the proposed protocol with the BAN-logic and discuss the security of the protocol. The result indicates that the protocol is correct and satisfies the security requirements of Internet key exchange.
文摘Public Key Infrastructure (PKI) is a comprehensive information security framework for providing secure information and communication over the internet. Its need and use has grown over the years and continually grows. This research work examines the current PKI framework’s validation process as operated by vendors and subscribers to identify the drawbacks and propose enhanced approaches to its validation mechanism. Using an approach of reviewing secondary data, critical weaknesses of integrity, proof of trust and single point-of-failure were identified with the current PKI framework. This study therefore advances proposed solutions to address the identified weaknesses by specifically introducing multiple Certificate Authorities, storage, visibility and searchability of subscriber information in public repository. A comprehensive detail of its implementation is proposed to address the identified weaknesses of uncertain integrity, trust for certificate authorities and prevent a single point of failure. Furthermore, the proposed enhancements are validated with the protection motivation theory and a framework for empirically testing the enhancements is suggested. Further research would be required to factor in multi-factor authentication without compromising performance.
文摘In the proposed photo certificate, the principal component is the image, for example, the user＇s photo. User-related fields, such as the subject＇s name, the issuer＇s name, and the expiration period, which are meaningful to users, are embedded into the surface of the photo by using a visible watermark algorithm, so that the reader can capture this information without the requirement for special software. The remaining fields in the certificate are embedded into a marked photo. Later, the whole photo certificate is eryptographically signed by certification authority （CA） private key to guarantee the integrity of our photo certificate. By such arrangement, the eertificate＇s verification is divided into two layers. The first layer is human visual system oriented and the second layer is the software-oriented. User can determine whether the user＇s photo and its subject＇s name are consistent and cheek whether the expired period is valid first. The second layer＇s verification is lunched only when the first layer＇s verification is passed. To sum up, the proposed photo certificate not only inherits the functions of a traditional certificate, but also provides a friendlier operational environment of X.509 certificate.
