The present invention features a system and method for establishing a secure communication channel between a client and an application server. In one embodiment, a ticket service generates a ticket having an identifier and a session key. A communications device obtains the ticket from the ticket service and transmits the ticket to a client over a secure communication channel. The client transmits the identifier of the ticket to an application server over an application communication channel. The application server then obtains a copy of the session key of the ticket from the ticket service. Communications exchanged between the client and the application server over the application communication channel are then encrypted using the session key to establish the application communication channel as a secure communication channel.

A system and method of exploiting the security of a secure communication channel to secure a non-secure communication channel

Secure key agreement protocols for three-party against guessing attacks

A method for enabling strong mutual authentication between two computers or devices in a communication system. A user attempting to gain access to a first computer transmits login information to the first computer. The first computer transmits a first message, including a first key encrypted by a second key, to the second computer. The first computer then transmits a second message to a third device. The second message includes the second key needed by the second computer to decrypt the first message. The third device uses the user's login information to obtain the user's private key, which the third device uses to obtain the second key. The third device transmits the second key in a third message to the second computer. The second computer then uses the second key to decrypt the first message and obtain the first key. Once the second computer obtains the first key, the second computer switches the role of the keys from the first message by encrypting the second key with the first key into a fourth message. The second computer transmits the fourth message to the server, and the first computer decrypts the fourth message using its first key. If the received second key is the same as the generated second key, the second computer is authenticated to the first computer.

Strong mutual authentication of devices

Research in authentication protocols has focused largely on developing and analyzing protocols that are secure against certain types of attacks There is little and only scattered discussion on protocol efficiency This paper presents results on the lower bounds on the numbers of messages, rounds, and encryptions required for network authentication For each proven lower bound, an authentication protocol achieving the bound is also given, thus proving that the bound is a tight bound if the given optimal protocol is secure Moreover, we give impossibility results of obtaining protocols that are simultaneously optimal with respect to the numbers of messages and rounds

Efficient network authentication protocols: lower bounds and optimal implementations

Three-party EKE was proposed to establish a session key between two clients through a server However, three-party EKE is insecure against undetectable on-line and off-line password guessing attacks In this paper, we first propose an enhanced three-party EKE to withstand the security risk in three-party EKE We also propose a verifier-based three-party EKE that is more secure than a plaintext-equivalent mechanism in which a compromise of the server's database will not result in success in directly impersonating clients

Efficient Three-Party Authentication and Key Agreement Protocols Resistant to Password Guessing Attacks

To establish secure network communications, a common practice requires that users authenticate one another and establish a temporary session key based on their passwords. Since users often use passwords that are easy to remember, attackers can correctly guess the passwords simply by searching through a relatively small space of "weak" passwords. In this paper, we present a new set of efficient protocols that can establish secure communications while protecting passwords from any feasible guessing and replay attacks. Our protocols avoid the use of timestamps altogether and minimize the use of nonces (random numbers). We examine some common attacks to existing protocols, and show how our protocols can be secure against such attacks. Our protocols apply to both secure peer-to-peer and multicast communications.

Efficient protocols secure against guessing and replay attacks

Many large-scale scientific and engineering computations, e.g., some of the Grand Challenge problems, spend a major portion of execution time in their core loops computing band linear recurrences (BLRs). Conventional compiler parallelization techniques cannot generate scalable parallel code for this type of computation because they respect loop-carried dependences (LCDs) in programs, and there is a limited amount of parallelism in a BLR with respect to LCDs. For many applications, using library routines to replace the core BLR requires the separation of BLR from its dependent computation, which usually incurs significant overhead. In this paper, we present a new scalable algorithm called the Regular Schedule, for parallel evaluation of BLRs. We describe our implementation of the Regular Schedule and discuss how to obtain maximum memory throughput in implementing the schedule on vector supercomputers. We also illustrate our approach, based on our Regular Schedule, to parallelizing programs containing BLR and other kinds of code. Significant improvements in CPU performance for a range of programs containing BLR implemented using the Regular Schedule in C over the same programs implemented using highly optimized coded-in-assembly BLAS routines [11] are demonstrated on Convex C240. Our approach can be used both at the user level in parallel programming code containing BLRs, and in compiler parallelization of such programs combined with recurrence recognition techniques for vector supercomputers.

/pdf/computing-programs-containing-band-linear-recurrences-on-52mirqkmnh.pdf

Computing programs containing band linear recurrences on vector supercomputers

Presents a new scalable algorithm, called the 'regular schedule', for parallel evaluation of band linear recurrences (BLRs), i.e. mth-order linear recurrences for m>1. Its scalability and simplicity make it well suited for vector supercomputers and massively parallel computers. We describe our implementation of the regular schedule on two types of machines: the Convex C240 and the MasPar MP-2. The scalability of our scheduling techniques is demonstrated on the two machines. Significant improvements in CPU performance for a range of programs containing BLRs implemented using the regular schedule in C over the same programs implemented using the highly-optimized coded-in-assembly BLAS routines are demonstrated on the Convex C240. We also demonstrate the scalability of this schedule on the MasPar MP-2 with up to 2000 processors. Our approach can be used both at the user level, in parallel programming code containing BLRs, and in compiler parallelization of such programs combined with recurrence recognition techniques for massively parallel and vector supercomputers. >

S. Keung

Papers

Efficient protocols secure against guessing and replay attacks

Computing programs containing band linear recurrences on vector supercomputers

Scalable techniques for computing band linear recurrences on massively parallel and vector supercomputers