Role based specification and security analysis of cryptographic protocols using asynchronous product automata

2004 ◽  
Author(s):  
S. Gurgens ◽  
P. Ochsenschlager ◽  
C. Rudolph
Keyword(s):  
Security Analysis ◽  
Cryptographic Protocols ◽  
Role Based

Security Analysis of Wireless Authentication Protocols

2019 ◽  
Vol 9 (2) ◽  
pp. 247-252 ◽  
Author(s):  
Ashish Joshi ◽  
Amar Kumar Mohapatra
Keyword(s):  
Execution Time ◽  
Communication Systems ◽  
Security Analysis ◽  
Cryptographic Protocols ◽  
Command Line ◽  
Time Analysis ◽  
Authentication Protocols ◽  
Replay Attack ◽  
Peer Communication ◽  
Digital Communication Systems

Background & Objective: Cryptographic protocols had been evident method for ensuring con dentiality, Integrity and authentication in various digital communication systems. However the validation and analysis of such cryptographic protocols was limited to usage of formal mathematical models until few years back. Methods: In this paper, various popular cryptographic protocols have been studied. Some of these protocols (PAP, CHAP, and EAP) achieve security goals in peer to peer communication while others (RADIUS, DIAMETER and Kerberos) can work in multiparty environment. These protocols were validated and analysed over two popular security validation and analysis tools AVISPA and Scyther. The protocols were written according to their documentation using the HLPSL and SPDL for analysis over AVISPA and Scyther respectively. The results of these tools were analysed to nd the possible attack an each protocol. Afterwards The execution time analysis of the protocols were done by repeating the experiment for multiple iterations over the command line versions of these tools.As the literature review suggested, this research also validates that using password based protocols (PAP) is faster in terms of execution time as compared to other methods, Usage of nonces tackles the replay attack and DIAMETER is secure than RADIUS. Results and Conclusion: The results also showed us that DIAMETER is faster than RADIUS. Though Kerberos protocol was found to safe, the results tell us that it is compromisable under particular circumstances.

scholarly journals A Role-Based Access Control Model in Modbus SCADA Systems. A Centralized Model Approach

Sensors ◽  
2019 ◽  
Vol 19 (20) ◽  
pp. 4455 ◽  
Author(s):  
Figueroa-Lorenzo ◽  
Añorga ◽  
Arrizabalaga
Keyword(s):  
Performance Analysis ◽  
Access Control ◽  
Control Systems ◽  
Security Analysis ◽  
Control Model ◽  
Transport Layer ◽  
Role Based Access Control ◽  
Access Control Model ◽  
Modbus Protocol ◽  
Role Based

Industrial Control Systems (ICS) and Supervisory Control systems and Data Acquisition (SCADA) networks implement industrial communication protocols to enable their operations. Modbus is an application protocol that allows communication between millions of automation devices. Unfortunately, Modbus lacks basic security mechanisms, and this leads to multiple vulnerabilities, due to both design and implementation. This issue enables certain types of attacks, for example, man in the middle attacks, eavesdropping attacks, and replay attack. The exploitation of such flaws may greatly influence companies and the general population, especially for attacks targeting critical infrastructural assets, such as power plants, water distribution and railway transportation systems. In order to provide security mechanisms to the protocol, the Modbus organization released security specifications, which provide robust protection through the blending of Transport Layer Security (TLS) with the traditional Modbus protocol. TLS will encapsulate Modbus packets to provide both authentication and message-integrity protection. The security features leverage X.509v3 digital certificates for authentication of the server and client. From the security specifications, this study addresses the security problems of the Modbus protocol, proposing a new secure version of a role-based access control model (RBAC), in order to authorize both the client on the server, as well as the Modbus frame. This model is divided into an authorization process via roles, which is inserted as an arbitrary extension in the certificate X.509v3 and the message authorization via unit id, a unique identifier used to authorize the Modbus frame. Our proposal is evaluated through two approaches: A security analysis and a performance analysis. The security analysis involves verifying the protocol's resistance to different types of attacks, as well as that certain pillars of cybersecurity, such as integrity and confidentiality, are not compromised. Finally, our performance analysis involves deploying our design over a testnet built on GNS3. This testnet has been designed based on an industrial security standard, such as IEC-62443, which divides the industrial network into levels. Then both the client and the server are deployed over this network in order to verify the feasibility of the proposal. For this purpose, different latencies measurements in industrial environments are used as a benchmark, which are matched against the latencies in our proposal for different cipher suites.

Sign in / Sign up

Export Citation Format

Share Document