Publications

Refine Results

(Filters Applied) Clear All

Tagged As

Information security for situational awareness in computer network defense

January 1, 2011
  |
Book Chapter
Author:
Uri Blumenthal
…
Published in:
Chapter Six, Situational Awareness in Computer Network Defense: Principles, Methods, and Applications, 2011, pp. 86-103.
Topic:
cryptography
R&D area:
R&D group:

Summary

Situational awareness - the perception of "what's going on" - is crucial in every field of human endeavor, especially so in the cyber world where most of the protections afforded by physical time and distance are taken away. Since ancient times, military science emphasized the importance of preserving your awareness of the battlefield and at the same time preventing your adversary from learning the true situation for as long as possible. Today cyber is officially recognized as a contested military domain like air, land, and sea. Therefore situational awareness in computer networks will be under attacks of military strength and will require military-grade protection. This chapter describes the emerging threats for computer SA, and the potential avenues of defense against them.
READ LESS

Summary

Situational awareness - the perception of "what's going on" - is crucial in every field of human endeavor, especially so in the cyber world where most of the protections afforded by physical time and distance are taken away. Since ancient times, military science emphasized the importance of preserving your awareness...

READ MORE
Information security for situational awareness in computer network defense

Secure channel establishment in disadvantaged networks: optimizing TLS using intercepting proxies

October 31, 2010
  |
Conference Paper
Author:
Joseph A. Cooley
…
Published in:
MILCOM 2010, IEEE Military Communications Conference , 31 October-3 November 2010.
Topic:
cryptography
R&D area:
R&D group:

Summary

Transport Layer Security (TLS) is a secure communication protocol that is used in many secure electronic applications. In order to establish a TLS connection, a client and server engage in a handshake, which usually involves the transmission of digital certificates. In this paper we present a practical speedup of TLS handshakes over bandwidth-constrained, high-latency (i .e. disadvantaged) links by reducing the communication overhead associated with the transmission of digital certificates. This speedup is achieved by deploying two specialized TLS proxies across such links. Working in tandem, one proxy replaces certificate data in packets being sent across the disadvantaged link with a short reference, while the proxy on the other side of the link restores the certificate data in the packet. Local or remote caches supply the certificate data. Our solution preserves the end-to-end security of TLS and is designed to be transparent to third-party applications, and will thus facilitate rapid deployment by removing the need to modify existing installations of TLS clients and TLS servers. Testing shows that this technique can reduce the overall bandwidth used during a handshake by 50% in test emulation and by over 20% of TLS session volume in practice. In addition, it can reduce the time required to establish a secure channel by over 40% across Iridium, a widely used satellite link in practice.
READ LESS

Summary

Transport Layer Security (TLS) is a secure communication protocol that is used in many secure electronic applications. In order to establish a TLS connection, a client and server engage in a handshake, which usually involves the transmission of digital certificates. In this paper we present a practical speedup of TLS...

READ MORE
Secure channel establishment in disadvantaged networks: optimizing TLS using intercepting proxies

GROK: a practical system for securing group communications

July 15, 2010
  |
Conference Paper
Author:
Joseph A. Cooley
…
Published in:
NCA 2010, 9th IEEE Int. Symp. on Network Computing and Applications, 15 July 2010, pp. 100-107.
Topic:
cryptography
R&D area:
R&D group:

Summary

We have designed and implemented a general-purpose cryptographic building block, called GROK, for securing communication among groups of entities in networks composed of high-latency, low-bandwidth, intermittently connected links. During the process, we solved a number of non-trivial system problems. This paper describes these problems and our solutions, and motivates and justifies these solutions from three viewpoints: usability, efficiency, and security. The solutions described in this paper have been tempered by securing a widely-used group-oriented application, group text chat. We implemented a prototype extension to a popular text chat client called Pidgin and evaluated it in a real-world scenario. Based on our experiences, these solutions are useful to designers of group-oriented systems specifically, and secure systems in general.
READ LESS

Summary

We have designed and implemented a general-purpose cryptographic building block, called GROK, for securing communication among groups of entities in networks composed of high-latency, low-bandwidth, intermittently connected links. During the process, we solved a number of non-trivial system problems. This paper describes these problems and our solutions, and motivates and...

READ MORE
GROK: a practical system for securing group communications

ASE: authenticated statement exchange

December 7, 2009
  |
Conference Paper
Author:
Benjamin W. Fuller
…
Published in:
2010 9th IEEE Int. Symp. on Network Computing and Applications, 7 December 2009, pp. 155-161.
Topic:
cryptography
R&D area:
R&D group:

Summary

Applications often re-transmit the same data, such as digital certificates, during repeated communication instances. Avoiding such superfluous transmissions with caching, while complicated, may be necessary in order to operate in low-bandwidth, high-latency wireless networks or in order to reduce communication load in shared, mobile networks. This paper presents a general framework and an accompanying software library, called "Authenticated Statement Exchange" (ASE), for helping applications implement persistent caching of application specific data. ASE supports secure caching of a number of predefined data types common to secure communication protocols and allows applications to define new data types to be handled by ASE. ASE is applicable to many applications. The paper describes the use of ASE in one such application, secure group chat. In a recent real-use deployment, ASE was instrumental in allowing secure group chat to operate over low-bandwidth satellite links.
READ LESS

Summary

Applications often re-transmit the same data, such as digital certificates, during repeated communication instances. Avoiding such superfluous transmissions with caching, while complicated, may be necessary in order to operate in low-bandwidth, high-latency wireless networks or in order to reduce communication load in shared, mobile networks. This paper presents a general...

READ MORE
ASE: authenticated statement exchange

GROK secure multi-user chat at Red Flag 2007-03

November 17, 2008
  |
Conference Paper
Author:
Roger I. Khazan
…
Published in:
MILCOM 2008, 16-18 November 2008.
Topic:
cryptography
R&D area:
R&D group:

Summary

This paper describes the GROK Secure Chat experimental activity performed by MIT Lincoln Laboratory at USAF Red Flag 2007-03 exercises and its results.
READ LESS

Summary

This paper describes the GROK Secure Chat experimental activity performed by MIT Lincoln Laboratory at USAF Red Flag 2007-03 exercises and its results.

READ MORE
GROK secure multi-user chat at Red Flag 2007-03

Tuning intrusion detection to work with a two encryption key version of IPsec

October 29, 2007
  |
Conference Paper
Author:
Ahren M. Studer
…
Published in:
IEEE MILCOM 2007, 29-31 October 2007, pp. 3977-3983.
Topic:
cryptography
R&D area:
R&D group:

Summary

Network-based intrusion detection systems (NIDSs) are one component of a comprehensive network security solution. The use of IPsec, which encrypts network traffic, renders network intrusion detection virtually useless unless traffic is decrypted at network gateways. Host-based intrusion detection systems (HIDSs) can provide some of the functionality of NIDSs but with limitations. HIDSs cannot perform a network-wide analysis and can be subverted if a host is compromised. We propose an approach to intrusion detection that combines HIDS, NIDS, and a version of IPsec that encrypts the header and the body of IP packets separately ("Two-Zone IPsec"). We show that all of the network events currently detectable by the Snort NIDS on unencrypted network traffic are also detectable on encrypted network traffic using this approach. The NIDS detects network-level events that HIDSs have trouble detecting and HIDSs detect application-level events that can't be detected by the NIDS.
READ LESS

Summary

Network-based intrusion detection systems (NIDSs) are one component of a comprehensive network security solution. The use of IPsec, which encrypts network traffic, renders network intrusion detection virtually useless unless traffic is decrypted at network gateways. Host-based intrusion detection systems (HIDSs) can provide some of the functionality of NIDSs but with...

READ MORE
Tuning intrusion detection to work with a two encryption key version of IPsec

Making network intrusion detection work with IPsec

May 11, 2007
  |
Technical Report
Author:
Cynthia D. McLain
…
Published in:
MIT Lincoln Laboratory Report TR-1121
Topic:
cryptography
R&D area:
R&D group:

Summary

Network-based intrusion detection systems (NIDSs) are one component of a comprehensive network security solution. The use of IPsec, which encrypts network traffic, renders network intrusion detection virtually useless unless traffic is decrypted at network gateways. One alternative to NIDSs, host-based intrusion detection systems (HIDSs), provides some of the functionality of NIDSs but with limitations. HIDSs cannot perform a network-wide analysis and can be subverted if a host is compromised. We propose an approach to intrusion detection that combines HIDS, NIDS, and a version of IPsec that encrypts the header and the body of IP packets separately. We refer to the latter generically as Two-Key IPsec. We show that all of the network events currently detectable by the Snort NIDS on unencrypted network traffic are also detectable on encrypted network traffic using this approach. The NIDS detects network-level events that HIDSs have trouble detecting and HIDSs detect application-level events that can't be detected by the NIDS.
READ LESS

Summary

Network-based intrusion detection systems (NIDSs) are one component of a comprehensive network security solution. The use of IPsec, which encrypts network traffic, renders network intrusion detection virtually useless unless traffic is decrypted at network gateways. One alternative to NIDSs, host-based intrusion detection systems (HIDSs), provides some of the functionality of...

READ MORE
Making network intrusion detection work with IPsec

Securing communication of dynamic groups in dynamic network-centric environments

October 23, 2006
  |
Conference Paper
Author:
Roger I. Khazan
…
Published in:
IEEE MILCOM 2006, 23-25 October 2006.
Topic:
cryptography
R&D area:
R&D group:

Summary

We developed a new approach and designed a practical solution for securing communication of dynamic groups in dynamic network-centric environments, such as airborne and terrestrial on-the-move networks. The solution is called Public Key Group Encryption (PKGE). In this paper, we define the problem of group encryption, motivate the need for decentralized group encryption services, and explain our vision for designing such services. We then describe our solution, PKGE, at a high-level, and report on the prototype implementation, performance experiments, and a demonstration with GAIM/Jabber chat.
READ LESS

Summary

We developed a new approach and designed a practical solution for securing communication of dynamic groups in dynamic network-centric environments, such as airborne and terrestrial on-the-move networks. The solution is called Public Key Group Encryption (PKGE). In this paper, we define the problem of group encryption, motivate the need for...

READ MORE
Securing communication of dynamic groups in dynamic network-centric environments

A wide area network simulation of single-round group membership algorithms

July 27, 2005
  |
Conference Paper
Author:
Roger I. Khazan
…
Published in:
NCA 2005: 4th IEEE Int. Symp. on Network Computing and Applications, 27-29 July 2005, pp. 159-168.
Topic:
cryptography
R&D area:
R&D group:

Summary

A recent theoretical result proposed Sigma, a novel GM protocol that forms views using a single-round of message exchange. Prior GM protocols have required more rounds in the worst-case. In this paper, we investigate how well Sigma performs in practice. We simulate Sigma using WAN connectivity traces and compare its performance to two leading GM protocols, Moshe and Ensemble. Our simulations show, consistently with theoretical results, that Sigma always terminates within one round of message exchange, faster than Moshe and Ensemble. Moreover, Sigma has less message overhead and produces virtually the same quality of views. We also observe that view-oriented GM in dynamic WAN-like environments is practical only in applications where GM need not respond to every disconnect immediately when detected. These applications are able, and prefer, to delay GM response and ignore transient disconnects, avoiding frequent futile view changes and associated overhead. We reference some applications in this category.
READ LESS

Summary

A recent theoretical result proposed Sigma, a novel GM protocol that forms views using a single-round of message exchange. Prior GM protocols have required more rounds in the worst-case. In this paper, we investigate how well Sigma performs in practice. We simulate Sigma using WAN connectivity traces and compare its...

READ MORE
A wide area network simulation of single-round group membership algorithms

Robust collaborative multicast service for airborne command and control environment

October 31, 2004
  |
Conference Paper
Author:
Roger I. Khazan
…
Published in:
IEEE MILCOM 2004, Vol. 3, 31 October - 3 November 2004, pp. 1666-1674.
Topic:
communications
R&D area:
R&D group:

Summary

RCM (Robust Collaborative Multicast) is a communication service designed to support collaborative applications operating in dynamic, mission-critical environments. RCM implements a set of well-specified message ordering and reliability properties that balance two conflicting goals: a)providing low-latency, highly-available, reliable communication service, and b) guaranteeing global consistency in how different participants perceive their communication. Both of these goals are important for collaborative applications. In this paper, we describe RCM, its modular and flexible design, and a collection of simple, light-weight protocols that implement it. We also report on several experiments with an RCM prototype in a test-bed environment.
READ LESS

Summary

RCM (Robust Collaborative Multicast) is a communication service designed to support collaborative applications operating in dynamic, mission-critical environments. RCM implements a set of well-specified message ordering and reliability properties that balance two conflicting goals: a)providing low-latency, highly-available, reliable communication service, and b) guaranteeing global consistency in how different participants perceive...

READ MORE
Robust collaborative multicast service for airborne command and control environment
21-30 of 35