Remote Access Communications Security: Analysis of User Authentication Roles in Organizations

Remote access is a means of accessing resources outside one’s immediate physical location. This has made employee mobility more effective and productive for most organizations. Remote access can be achieved via various channels of remote communication, the most common being Virtual Private Networks (VPNs). The demand for remote access is on the rise, especially during the Covid-19 pandemic, and will continue to increase as most organizations are re-structuring to make telecommuting a permanent part of their mode of operation. Employee mobility, while presenting organizations with some advantages, comes with the associated risk of exposing corporate cyber assets to attackers. The remote user and the remote connectivity technology present some vulnerabilities which can be exploited by any threat agent to violate the confidentiality, integrity and availability (CIA) dimensions of these cyber assets. So, how are users and remote devices authenticated? To what extent is the established connection secured? With employee mobility on the rise, it is necessary to analyze the user authentication role since the mobile employee is not under the monitoring radar of the organization, and the environment from which the mobile employee connects may be vulnerable. In this study, an experiment was setup to ascertain the user authentication roles. The experiment showed the process of 2FA in user authentication and it proved to be an effective means of improving user authentication during remote access. This was depicted via the use of what the user has (mobile phone/soft-token) as a second factor in addition to what the user knows, i.e. password. This authentication method overcomes the security weaknesses inherent in single-factor user authentication via the use of password only. However, the results also showed that though 2FA user authentication ensures security, the remote devices could exhibit further vulnerabilities and pose serious risks to the organization. Thus, a varied implementation was recommended to further enhance the security of remote access communication with regards to the remote user authentication.

Two Improved Digital Signature Schemes

In this paper, two improved digital signature schemes are presented based on the design of directed signature scheme. The peculiarity of the system is that only if the scheme is specific recipient, the signature is authenticated. Since the scheme adds the screen of some information parameters, the difficulty of deciphered keys and the security of digital signature system are increased.

OvBNN authentication based on cooperative signature for wireless sensor networks

The universality of the application of wireless sensor networks( WSN) makes more attention be paid on the security problem. Node authentication is not only the basis of network security,but also the premise of key management and secure routing protocol. Although the signature mechanism based on symmetric encryption is high in energy efficiency,it is vulnerable to be attacked and there is a time delay during authentication. Traditional public key encryption mechanism with improvement in security brings in complex algorithm and costs much time,which is not suitable for WSN. In this paper,a signature authentication mechanism,an optimized variant Bellare Namprempre Neven( OvBNN) is presented to quickly complete the authentication by mutual cooperation between nodes so as to make the nodes use the intermediate calculation results of their neighbor nodes directly.Simulation results show that the proposed mechanism is superior to traditional authentication mechanisms both in energy consumption and authentication time.

Dual Authentication Hashing for Security Enhancement in MANET

Mobile Ad hoc Network (MANET) is a collection of mobile hosts with wireless interfaces that form a temporary network without the aid of any fixed infrastructure or centralized administration. A MANET is a type of ad hoc network that can change locations and configure itself on the fly. The dynamic and cooperative behaviour of ad hoc networking without any centralized or unified controlling authority for authentication and monitoring is sensitive to attacks that damage or exploit the cooperative behaviour of ad hoc routing. Routing attacks lead to the most disastrous damage in MANET. The main objective of this paper is to enhance the security against routing attacks in MANETs. Intrusion detection based on DAHT (Dual Authentication Hash Technique) entirely depends on the end to end communication between the source and destination is employed here. The proposed technique identifies the misbehaving nature of current node and the previous node where it receives the information. DAHT is simulated with various parameters in NS2. The results obtained are compared with existing mechanism. The results show that malicious detection, overhead reduction and delay are better when compared to the existing system that is employed in protecting the routing information.

基于区块链的城市智能交通网络均衡分配方法

为了提高城市智能交通网络的应用效率,有效分配网络中存在的资源,同时保证网络资源分配的均衡度。因此,提出区块链技术下城市智能交通网络均衡分配方法。通过建立城市智能交通网络模型,分析用户在交通网络中的资源需求。根据用户的需求,采用区块链技术分配网络中的资源,通过引入椭圆曲线数字签名算法,对需求和资源的发布信息加密处理,并根据资源需求与资源供应之间的匹配,完成城市智能交通网络资源的均衡分配。实验结果表明,所提方法的用户吞吐率高,且Jain公平指数在0.8以上,表明所提方法的资源分配合理性高。

基于BIP安全通道的iOS系统安全便捷身份认证方案

针对iOS系统应用软件与移动安全加密智能芯片间无法直接交互的问题,提出一种BIP安全通道通信方案,进而为iOS系统应用软件提供一种安全便捷的身份认证解决方案。该方案包括客户端与BIP服务器安全通信、BIP与移动安全加密智能芯片安全通信以及客户端与移动安全加密智能芯片安全通信三个模块。方案利用移动安全加密智能芯片提供的数字签名技术为iOS客户端APP提供安全便捷的身份认证服务。通过对该方案进行安全性分析及对客户端进行性能测试,结果表明,该方案既具有安全便捷的应用效果,又具备低开销和低延迟特性。目前已应用于手机银行和信息加密领域中,具有广阔的应用前景。

基于区块链分级存储与国产商用密码技术的高校图书馆信息系统网络安全保障

为了提升图书馆信息系统网络安全保障能力,确保图书馆信息系统安全稳定运行,对数字图书馆信息系统面临的身份假冒、数据泄露、数据篡改、数据破坏、重要操作难以溯源等突出网络安全问题进行研究,提出了解决思路和方法,包括基于区块链分级存储实现图书馆信息系统数据存储安全,基于国产商用密码技术实现图书馆信息系统身份认证、数据加密保护、数据完整性保护、操作真实性和抗抵赖保护,对建设完善有效的图书馆信息系统网络安全整体保障体系、提升图书馆信息系统网络安全保障能力具有指导意义。

基于区块链的GEO/LEO卫星网络安全认证技术研究

由于卫星网络高暴露、高时延的特点,不同系统星座组网进行遥控指令发布及遥测信息回传时,容易受到其他卫星恶意接入导致信息泄露。卫星网络安全认证成为天基测控实现过程中必须解决的技术问题。面向高轨和低轨双层卫星网络场景下的安全组网需求,提出了一种基于区块链的星间组网认证技术,该技术包括基于区块链的卫星身份认证和星间消息认证。研究设计将卫星临时身份登记上区块链,通过比对链上信息完成卫星的身份认证。为进一步增强消息传输安全性,采用椭圆曲线数字签名算法对星间消息进行签名验证。通过仿真分析,验证了所提技术能够以较小的时间开销满足卫星在组网认证阶段的多种安全需求。

数字签名的车联网安全体系架构设计研究

车联网构建了“车-云-路-人”的互联传输体系,而非法网络入侵和攻击使得车联网多通信场景存在巨大的安全隐患。基于数字签名技术设计了车联网安全体系架构,对云端、路侧设施端、移动终端、车端4个部分的架构进行了设计,同时搭建了数字签名的车联网安全架构。通过所设计的车联网安全体系架构,为车联网终端身份认证安全性提供了保障,确保了车联网的安全。

基于数字签名的无线通信网络视频数据安全传输方法

常规的无线通信网络视频数据传输方法丢包率较高,因此,该文基于数字签名,设计一种全新的无线通信网络视频数据安全传输方法。构建视频数据安全传输模型,利用数字签名生成通信网络视频数据安全传输框架,实现无线通信网络视频数据的安全传输。实验结果表明,无线通信网络视频数据安全传输方法的传输丢包率较低,传输效果较好,可靠性较高,有一定的应用价值。

基于HotStuff的高效量子安全拜占庭容错共识机制

经典区块链中拜占庭容错共识机制使用的公钥数字签名在量子计算机的指数级加速下暴露出脆弱性,存在一定的安全风险。针对拜占庭容错共识机制不具有量子安全性的问题,提出了基于HotStuff的高效量子安全拜占庭容错共识机制EQSH(Efficient Quantum-Secured HotStuff)。首先,为解决现有无条件安全签名(Unconditionally Secure Signatures,USS)通信复杂度高的问题,提出了一种高效的多方环形量子数字签名(Efficient Multi-party Ring Quantum Digital Signatures,EMRQDSs)方案,该方案基于一种环形量子网络,在保证量子安全性、不可伪造性、不可抵赖性以及可转移性的同时,通信复杂度为O(n)。其次,为了消除量子敌手对门限签名的安全威胁,对HotStuff中使用的门限签名进行替换,提出了一种基于密钥分发中心的签名收集方案,该方案可以实现与门限签名同样的效果,通信复杂度为O(n),同时保证了量子安全性。最后,将上述两个方案相结合,应用于HotStuff中,提供了量子安全性;设计了一个起搏器保证了活性;简化了共识信息格式,使用流水线共识流程提高了共识效率。EQSH中没有使用量子纠缠等成本较高的技术,可在现有技术条件下实现,实用价值较高。相较于HotStuff,EQSH具有量子安全性。相较于其他非纠缠型量子安全拜占庭容错共识机制,EQSH首次将通信复杂度降为O(n),具有更佳的性能表现,且对于客户端量子线路数量的需求更低,有利于降低量子网络的架设成本。

基于零信任体系的数字身份安全平台设计与研究

高校在统一身份认证和访问控制方面的防控仍较薄弱,面对层出不穷的网络安全威胁显得力不从心。为此,提出基于零信任体系的数字身份安全平台解决方案。引入零信任SDP技术搭建高校零信任安全架构,重构统一身份认证与访问授权平台,按功能划分DMZ微隔离区,实现用户身份统一管理、平台多因素多维认证、服务端口和设备信息对外动态隐藏、访问链接动态授权。结合四网融合场景分析校内外5G用户、校内Wi-Fi用户、校园网用户和校外互联网用户访问数字身份安全平台的准入方式。研究成果极大地丰富了智慧校园研究内容,也为高校重构和升级统一身份认证和访问授权平台提供一种全新的解决思路。

基于网络安全的移动支付系统设计

研究旨在设计一个基于网络安全的移动支付系统,解决当前移动支付领域中存在的安全隐患。基于需求分析,提出包括注册登录、支付和账单管理在内的多项功能设计,采用数据加密、用户认证和安全监控技术加固系统安全性,对系统的功能、性能和安全方面进行了运行测试,系统运行正常。

基于RADIUS和数字证书的无线网络接入认证技术研究

随着网络技术的发展,无线网络接入认证技术的应用越来越广泛。通过远程认证拨入用户服务(Remote Authentication Dial In User Service,RADIUS)和数字证书配合使用,可以实现较为安全完善的无线网络接入认证。介绍RADIUS和数字证书的相关概念,概述使用RADIUS和数字证书进行无线网络接入时的网络拓扑与接入认证过程,给出RADIUS代理服务器、认证服务器以及数字证书的配置方法同时,给出验证该无线网络接入认证技术的方法,也是Linux客户端进行网络接入认证的方法。通过搭建RADIUS网络接入环境,使用数字证书作为认证凭证,实现客户端对无线网络的接入认证。

Lattice-Based Double-Authentication-Preventing Ring Signature for Security and Privacy in Vehicular Ad-Hoc Networks

Amidst the rapid development of the Internet of Things (loT), Vehicular Ad-Hoc NETwork (VANET), a typical loT application, are bringing an ever-larger number of intelligent and convenient services to the daily lives of individuals. However, there remain challenges for VANETs in preserving privacy and security. In this paper, we propose the first lattice-based Double-Authentication-Preventing Ring Signature (DAPRS) and adopt it to propose a novel privacy-preserving authentication scheme for VANETs, offering the potential for security against quantum computers. The new construction is proven secure against chosen message attacks. Our scheme is more efficient than other ring signature in terms of the time cost of the message signing phase and verification phase, and also in terms of signature length. Analyses of security and efficiency demonstrate that our proposed scheme is provably secure and efficient in the application.

Enhancement in Ad hoc on Demand Distance Vector (AODV) Routing Protocol Security

Ad-hoc networking has mainly been associated with military battlefield networks. Security has received considerably less attention and the issue needs to be addressed before any successful applications will appear. Due to the insecure nature of the wireless link and their dynamically changing topology, wireless ad-hoc networks require a careful and security-oriented approach for designing routing protocols. In this paper, an AODV-based secure routing protocol- ENAODV is presented. A speed-optimized digital signature algorithm is integrated into the routing protocol. The protocol algorithm is implemented with NS-2. The security of the protocol is analyzed. The simulating results show that the performances of ENAODV protocol, such as average node energy consumption, packet delay and packet delivery is nearly the same as standard AODV protocol.

A Secured Message Transmission Protocol for Vehicular Ad Hoc Networks

Vehicular Ad hoc Networks(VANETs)become a very crucial addition in the Intelligent Transportation System(ITS).It is challenging for a VANET system to provide security services and parallelly maintain high throughput by utilizing limited resources.To overcome these challenges,we propose a blockchain-based Secured Cluster-based MAC(SCB-MAC)protocol.The nearby vehicles heading towards the same direction will form a cluster and each of the clusters has its blockchain to store and distribute the safety messages.The message which contains emergency information and requires Strict Delay Requirement(SDR)for transmission are called safety messages(SM).Cluster Members(CMs)sign SMs with their private keys while sending them to the blockchain to confirm authentication,integrity,and confidentiality of the message.A Certificate Authority(CA)is responsible for physical verification,key generation,and privacy preservation of the vehicles.We implemented a test scenario as proof of concept and tested the safety message transmission(SMT)protocol in a real-world platform.Computational and storage overhead analysis shows that the proposed protocol for SMT implements security,authentication,integrity,robustness,non-repudiation,etc.while maintaining the SDR.Messages that are less important compared to the SMs are called non-safety messages(NSM)and vehicles use RTS/CTS mechanism for NSM transmission.Numerical studies show that the proposed NSM transmission method maintains 6 times more throughput,2 times less delay and 125%less Packet Dropping Rate(PDR)than traditional MAC protocols.These results prove that the proposed protocol outperforms the traditional MAC protocols.

Security Analysis for a VANET Privacy Protection Scheme

Vehicular ad hoc network(VANET)is a self-organizing wireless sensor network model,which is extensively used in the existing traffic.Due to the openness of wireless channel and the sensitivity of traffic information,data transmission process in VANET is vulnerable to leakage and attack.Authentication of vehicle identitywhile protecting vehicle privacy information is an advantageous way to improve the security of VANET.We propose a scheme based on fair blind signature and secret sharing algorithm.In this paper,we prove that the scheme is feasible through security analysis.

基于MD5算法的无线传感网络用户身份分簇节点安全认证方法

为防止恶意的中间节点截获、篡改和干扰信息的传输,以及反馈延迟导致认证密钥丢失等问题的出现,提出基于MD5算法的无线传感网络用户身份分簇节点安全认证方法。预处理无线传感网络用户身份分簇节点数据,将数据加密参量转换为MD5的512位标准;根据用户分簇节点对应的MD5变换参量对其认证规则加以定义,用于MD5算法优化规则制定;通过MD5算法对请求数据进行数据融合压缩,解析交互认证过程密钥,完成对应节点数据簇头信息的安全认证。实验结果表明:该方法收发成功率均在97%以上,开销率最高在50%。该方法在多种条件环境下均有效可行,其所得各项指标数据均为最佳,能够在满足相关指标要求的基础上保持连续稳定运行,具有一定的应用推广价值。

无人机网络中数控分离的安全传输机制

数据和飞控指令的安全性是无人机网络安全性的一个重要方面。针对现有的无人机网络安全机制中的不足,本文提出了一种数控分离的安全传输机制。针对无人机向地面站发送的数据采用基于高级加密标准的计数器和密文分组链接消息认证码(AES-CCM)认证加密机制的数据安全传输协议,保证数据的机密性和完整性,针对地面站向无人机发送的飞控指令设计了基于一次签名的飞控广播认证协议,保证飞控指令的完整性。通过安全性分析,证明所提出的方案能够保护数据的机密性和完整性,以及飞控指令的完整性。最后,通过仿真试验分析了所提出方案的性能,结果表明,所提出的数据安全传输协议发送100B和1KB的消息时,平均每个消息的认证加密时间和解密验证时间均不超过1ms;所提出的飞控广播认证协议在使用不同的哈希函数时,对1MB的飞控指令生成签名和验证签名的时间为1~2.7ms,在实际应用中具有高效性。