Pavlos Papadopoulos, Nikolaos Pitropakis, William J. Buchanan, Owen Lo · 5 authors
The Domain Name System (DNS) was created to resolve the IP addresses of the web servers to easily remembered names. When it was initially created, security was not a major concern; nowadays, this lack of inherent security and trust has exposed the global DNS infrastructure to malicious actors. The passive DNS data collection process creates a database containing various DNS data elements, some of which are personal and need to be protected to preserve the privacy of the end users. To this end, we propose the use of distributed ledger technology. We use Hyperledger Fabric to create a permissioned blockchain, which only authorized entities can access. The proposed solution supports queries for storing and retrieving data from the blockchain ledger, allowing the use of the passive DNS database for further analysis, e.g. for the identification of malicious domain names. Additionally, it effectively protects the DNS personal data from unauthorized entities, including the administrators that can act as potential malicious insiders, and allows only the data owners to perform queries over these data. We evaluated our proposed solution by creating a proof-of-concept experimental setup that passively collects DNS data from a network and then uses the distributed ledger technology to store the data in an immutable ledger, thus providing a full historical overview of all the records.
Budankailu Kumar Subudhi, Faruk Catal, Nikolay Tcholtchev, Kin Tsun Chiu · 7 authors
VoIP-based emergency communication is a promising approach to improving the safety of citizens worldwide. The transition required in this scope includes substituting the legacy PSTN/SS7 based emergency call system by Next Generation IP based components for call establishment and control. Thereby, SIP is used as a session control protocol and RTP as the means to transfer emergency data between the caller and the corresponding Public Safety Access Point (PSAP). The emergency data is not only restricted to voice communication but can cover a rich variety of data, which can be acquired by different means (including the end-user devices) and transmitted over IP. This includes video, geopositioning data, voice, Real-Time Text, and sensor data in line with emerging IoT architectures and approaches. A vital aspect in this scope is given by the performance of the underlying network, including its capability to establish calls in emergencies and to transfer the data required for serving the situation. Therefore, in this paper, we evaluate the computational performance of the most recent VoIP emergency system implementation, which was developed by the H2020-EMYNOS project as a realisation of the EENA NG112 Long Term Definition (LTD) vision. We perform a series of trials and evaluate the performance of the EMYNOS system in a multi-party lab environment established during the project. We evaluate the time needed to perform basic emergency call operations over IP, whilst in parallel generating Internet type of background traffic. Correspondingly, we worked out a methodology and implemented it in our testbed, both of which are presented in the current paper. The obtained numerical results lead to the conclusion that SIP-based emergency services stand a good chance to replace legacy systems when it comes to their performance. Additionally, we also provide a perspective on how the blockchain technology could potentially be put to use to enhance the quality of the next-generation emergency services. We propose the utilisation of blockchain technology for tracking emergency calls and enabling efficient recognition of fraud calls, which is a critical aspect for PSAP providers concerning the potential denial of service attacks. In this context, we provide evaluations and numerical results based on a private Ethereum based blockchain playground running at the premises of Fraunhofer FOKUS.
In order to deploy a secure WLAN mesh network, authentication of both users and APs is needed, and a secure authentication mechanism should be employed. However, some additional configurations of trusted third party agencies are still needed on-site to deploy a secure authentication system. This paper proposes a new block chain-based authentication protocol for WLAN mesh security access, to reduce the deployment costs and resolve the issues of requiring key delivery and central server during IEEE 802.11X authentication. This method takes the user’s authentication request as a transaction, considers all the authentication records in the mesh network as the public ledger and realizes the effective monitoring of the malicious attack. Finally, this paper analyzes the security of the protocol in detail, and proves that the new method can solve the dependence of the authentication node on PKI and CA.
Public key infrastructure (PKI) is the foundation and core of network security construction. Blockchain (BC) has many technical characteristics, such as decentralization, impossibility of being tampered with and forged, which makes it have incomparable advantages in ensuring information credibility, security, traceability and other aspects of traditional technology. In this paper, a method of constructing PKI certificate system based on permissioned BC is proposed. The problems of multi-CA mutual trust, poor certificate configuration efficiency and single point failure in digital certificate system are solved by using the characteristics of BC distribution and non-tampering. At the same time, in order to solve the problem of identity privacy on BC, this paper proposes a privacy-aware PKI system based on permissioned BCs. This system is an anonymous digital certificate publishing scheme., which achieves the separation of user registration and authorization, and has the characteristics of anonymity and conditional traceability, so as to realize to protect user's identity privacy. The system meets the requirements of certificate security and anonymity, reduces the cost of CA construction, operation and maintenance in traditional PKI technology, and improves the efficiency of certificate application and configuration.
Domain name systems and certificate authority systems may have security and trust problems in their implementation. This article summarizes how these systems work and what the implementation problems may be. There are blockchain-based decentralized solutions that claim to overcome those problems. We provide a brief explanation on how blockchain systems work, and their strengths are explained. DNS security challenges are given. Blockchain-based DNS solutions are classified and described in detail according to their services. The advantages and feasibility of these implementations are discussed. Last but not least, the possibility of the decentralized Internet is questioned.
As a brand-new network structure, WLAN Mesh network is a distributed network with large capacity, fast speed and wide coverage. However, the security problems caused by the characteristics of wireless connection are not negligible. This paper proposes a new blockchain-based WLAN Mesh design method, including user encryption module, blockchain authentication module and kernel space module. Using the blockchain technology, each user's access authentication request is treated as a transaction, and all authentication records in the mesh network are treated as public ledgers. This method based on blockchain enables secure access to the network and prevents malicious attacks.
В роботi дослiджена чинна проблема взаємної автентифiкацiї (Peer-to-Peer Authentication) в мережi VoIP. Розглянуто найбiльш небезпечнi типи атак на VoIP мережу та розроблено механiзм протидiї цим атакам за допомогою взаємної автентифiкацiї. Взаємна автентифiкацiя реалiзована на основi криптографiчних протоколiв: «Zero-knowledge proof» та «Secret sharing». В результатi створено тестовий застосунок, який на основi протоколу SIP iмiтує встановлення з’єднання та проведення взаємної автентифiкацiї за запропонованими принципами
In a hybrid network system which combines a wired network adopting PKI authentication and a wireless network adopting IBE authentication,it is difficult to authenticate other nodes in view of the different security polices and cryptosystem.To solve this problem,a cross-domain authentication scheme based on zero knowledge proof is proposed.An agency node is settled between the two heterogeneous trustworthy domains to certificate nodes'commitments in the zero knowledge proof.Then a authentication protocol between heterogeneous trustworthy domains is designed to realize the authentication between nodes in different domains,and the correctness,security and efficiency of the protocol are analyzed.The results show that the proposed protocol is feasible and effective.
Thomas Elsner, Nhung T. H. Nguyen, Björn Scheuermann
WiFi sharing communities offer an attractive alternative to commercial hot-spots and cellular networks for users who seek Internet access while being away from home. The growing number of mobile devices with Internet usage capabilities has formed a basis for the establishment and growth of several such communities. However, critical security problems exist in all current WiFi sharing approaches because they employ a central operator. We show how to overcome these issues by decentralizing the community's organization structure and present radioActive WiFi, a system that implements this approach.
The recent development in the mobile technology (mobile phones, middleware, wireless networks, etc.) created a need for new methods of protecting the code transmitted through the network. The oldest and the simplest mechanisms concentrate more on integrity of the code itself and on the detection of unauthorized manipulation. The newer solutions not only secure the compiled program, but also the data, that can be gathered during its “journey,” and even the execution state. Some other approaches are based on prevention rather than detection. In this chapter we present a new idea of securing mobile agents. The proposed method protects all components of an agent: the code, the data, and the execution state. The proposal is based on a zero-knowledge proof system and a secure secret sharing scheme, two powerful cryptographic primitives. Next, the chapter includes security analysis of the new method and its comparison to other currently more widespread solutions. Finally, we propose a new direction of securing mobile agents by straightening the methods of protecting integrity of the mobile code with risk analysis and a reputation system that helps avoiding a high-risk behavior.Request access from your librarian to read this chapter's full text.