International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
INFORMATION SECURITY LEVEL RECLASSIFICATION N.Duraipandian , C.Chellappan
1 2
pandiandurai@yahoo.com, cchell@hotmail.com
ABSTRAT:
Organizations are using computer networks in order
to have paperless office. Along with this increased
usage of computers comes the problem of protecting
information. The need for information protection is
very obvious in the business world. Protecting the
information is of paramount importance to the
organization’s progress and in some cases, their
survival too. The use of data classification schemes to
secure confidential and private information has been
in use for long time. The importance of information
changing over time is seen in many real world
situations. This necessitates the dynamic update of
the security classification level of the information to
avoid misuse. This dynamic update is not available
which leads to mass misuse of information by
unauthorized users. In this paper we are proposing a
method which will dynamically change the
information security classification level which
reduces the misuse of the information. For this we
have used the information usage profile and
organization specific data to perform the dynamic
update.
KEYWORDS:Access Control, Intrusion,
Reclassification, Policy Management
1. INTRODUCTION: The rapid proliferation of the
Internet and the cost-effective growth of its key
enabling technologies are revolutionizing
information technology and creating unprecedented
opportunities for developing large scale distributed
applications. At the same time, there is a growing
concern over the security of Web-based
applications, which are rapidly being deployed over
the Internet. For example, ecommerce—the leading
Web-based application— has already become a
security nightmare for both customers and business
enterprises as indicated by the recent episodes
involving unauthorized access to credit card
information. Other leading Web-based applications
with considerable information security and privacy
issues include telemedicine-based health-care
services, Education services and online services or
businesses involving both public and private sectors.
Protecting the information is of paramount
ISSSIS 2009
1 2
importance to the organization’s progress and in
some cases, their survival too.
The use of data classification schemes to secure
confidential and private information has been in use
for long time. Before the advent of computers,
securing confidential information consisted of
making the physical medium (normally paper) as
confidential or secret and access is given to only
those individuals who have the rights to view the
information. This control of confidential information
has become exponentially more difficult over the last
50 years with the advent of personal computer and
the spread of the Internet. Information is stored as
digital documents & it is easy to copy and distribute
information to others. The challenge to protect
confidential information has continued to escalate, as
the technology that interconnects the computing
facilities becomes more sophisticated. The
introduction of wireless networks, personal digital
assistants, cell phones and seemingly unlimited entry
points to the internet all poses significant additional
risk in the protection of confidential information.
The importance of a file changing over time is seen
in many real world situations. For example,
organizational changes occur all the time as users are
moved from one domain to another, from one group
to another and from one project to another. New
projects are regularly added and old ones are either
finished or are shelved. In all these situations file
classification has to be changed manually to prevent
unauthorized use. Similarly, file contents keep
changing in a continuing project. Even if they do not
change, topics that were previously considered
general such as a market study on a product might be
considered of more value if the organization were to
enter the market with a product related to the study.
Hence a file whose initial static classification might
have been “general” might change to “secret” and
vice versa. The way in which a file is being used also
affects its classification.
Rest of the paper is organized as follows. Section 2
discusses the related works in the problem. Section 3
discusses different Information classification levels.
Section 4 discusses the requirements of the
classification level change. Section 5 discusses the
components of the proposed architecture. Section 6
discusses the new method of calculating the
information security level and algorithms, Section 7
NS | 1
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
discusses the results and section 8 concludes.
2. RELATED WORKS
Policies are written & enforced in an organization to
say what would be allowed and how security
mechanism should work. Policies are normally
implemented using DAC [Sandhu et al. 1994],
MAC[Biba 1977][Martzahn 2003] , RBAC[Ferariolo
et al. 1992]models. Each has their own advantages.
But in all these models dynamic classification
changes have not been done.
Today’s scenario warrants information definition &
resource access policies should adapt to network and
situational threat conditions. In one method [Gupta et
al. 2003] RBAC is added with an alert priority
scheme to develop counter measure against attacks.
Federated security management for dynamic coalition
project at Tilcordia technologies suggests the use of
coalition policies when networks form a coalition to
provide multiple services[Bhatt et al. 2003].
Nicolls [Nicolls] believed that information is an asset
of an enterprise, but different information has
different values to the enterprise, and information
should be classified based on their importance.
According to the concept of information lifecycle
management, Du [Du 2005] noted that different data
have different levels of importance, the value of the
same data may also be different in different
lifecycles, and data of different values should get
different levels of protection. The work of Mathkour,
et. al. [Mathkour et al. 2005] revealed that
information classification depends on the impact of
information exposure on the information users .
[Xianliang et al. 2007] Xianliang has developed the
V-S axis method for information classification based
on the in-depth analysis of information value and
sensitivity. This method can be used for quantitative
classification of information, and is highly practical.
Due to the increasing amount of information present
on the Web, Automatic Document Classification
(ADC) has become an important research topic
[Fernando et al. 2008] ADC usually follows a
standard supervised learning strategy, where authors
first buiild a model using pre-classified documents
and then use it to classify new unseen documents.
3. INFORMATION CLASSIFICATION
LEVELS
To protect information, information is classified into
four levels based on their values and using any access
control methods, access to sensitive information can
be controlled. The information can be classified [AH
2003][Lindsay DEC][Bob, SANS] as a.. Public
information
This applies to information that has been approved by
the company for release to the public. Data on these
systems could be made public without any
ISSSIS 2009
implications for the company (i.e. the data is not
confidential). Data integrity is not vital. Loss of
service due to malicious attacks is an acceptable
danger.
Examples: Test services without confidential data,
certain public information services, and product
brochures widely distributed data available in the
public domain anyway.
b. Internal use only information
External access to this data is to be prevented, but
should this data become public, the consequences are
not critical (e.g. the company may be publicly
embarrassed). Internal access is selective. Data
integrity is important but not vital.
Examples of this type of data are found in
development groups (where no live data is present),
certain production public services, certain Customer
Data, "normal" working documents and
project/meeting protocols, Telephone books.
c. Confidential information
Data in this class is confidential within the company
and protected from external access. If such data were
to be accessed by unauthorized persons, it could
influence the company's operational effectiveness,
cause an important financial loss, provide a
significant gain to a competitor or cause a major drop
in customer confidence. Data integrity is vital.
Examples: Data centers normally maintain this level
of security. Salaries, Personnel data, Accounting
data, passwords, information on corporate security
weaknesses, very confidential customer data and
confidential contracts.
d. Highly Confidential Information Unauthorized
external or internal access to this data would be
critical to the company. Data integrity is vital. The
number of people with access to this data should be
very small. Very strict rules must be adhered to in the
usage of this data.
Examples: Military data, secret contracts.
4. REQUIREMENTS FOR
CLASSIFICATION LEVEL CHANGE
Any method claiming to suggest the changes in
classification level of a file is required to consider
various essential information sources such as file
usage data, organization specific data etc. In this
section, we discuss and describe these necessary
information sources for building a successful system,
which can suggest Classification Level change for a
file. The requirements for classification level changes
are:
1. File usage data (or file profile) is very useful in
determining the importance of a file. They provide
information about the frequency of using file, number
of users accessing it. This information contains useful
statistics about type of actions being performed on
NS | 2
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
files and what level of users (medium or high) is
performing the actions.
2. Organizational data plays an important role when
determining the change in the usage. The usage of
files may change due to the increase or decrease in
the number of users associated with them.
Organizational data provides information about the
files related to a particular project and can thus
explain the increase or reduction in usage of these
files.
3. A reasoning module is required to unify the
information from file usage data and organizational
data to make a decision about the change. This
reasoning module combines the information and
based on the defined algorithms, comes up with
suggestions for classification level change
5. PROPOSED ARCHITECTURE
Files are stored in the file server of organization.
Users can make a request for a particular file. The file
server on getting a request from the user sends a
request to policy server for verifying whether the said
user has the required
privileges to access the
file. If the user has
required rights, the file is
sent to the
user and the actions user can perform on that file.
This policy enforcement is done at the client machine
where user works. The operations performed on the
file by user is collected and used for developing a file
profile. In this way file profile is collected daily and
along with organization data a decision on whether
any classification level is to be done or not is taken.
The reasoning module does this.
COMPONENTS OF THE
ARCHITECTURE
A Policy Server
A policy server is used for specifying static policies
on each document in the pool. It validates the access
permissions when the documents are requested from
ISSSIS 2009
the file server. U1 and U2 in Figure 1 are two users
requesting documents from the file server. This
request is first validated through the policy server and
then the document is sent to the user machines. The
policy server keeps a tabular data about users and
associated documents, along with the usage cost
B. File Profile
The information in an organization is divided in to
highly confidential, confidential, for internal use only
& public. Also the users accessing this information
are classified into various classes such as low,
medium, high according to their roles in the
organization. Similarly actions performed on
information are classified as low, medium, high.
These classifications are based on importance of
action. Read is considered as a low level action,
append a medium level action, delete & print high
level actions. Modeling file usage pattern over a
period of time provides better understanding of the
deviation from its initial classification. The user
activities on a file can be modeled in terms of user
level and action level. The set of these user activities
on certain file are considered as file profile.
DISCUSSION Due to the unavailability of real data
sets containing user actions on documents we have
generated our own data set to test our architecture.
We considered file profile based on three-user level
(low, medium, high) and three levels of action on
documents (low, medium high). We assumed that no.
of actions performed on a files is random. Filet
profile is generated based on random. The value
changed of a file are plotted over a two-week period
and plotted. We have used JAVA to compute the
values of the equation1.
RFUL RFUM RFUH RILow RIMedium RIHigh
RFAL RFAM RFAH
0.698795 0.855422 1.052257 0.963855 0.975904
1.028103 0.771084 0.662651 1.06133 1.050931
0.977974 0.594714 1.055755 0.885463 0.621145
1.033814 0.700441 1.032294 0.907317 1.032573
0.951219 0.878049 1.05354 0.8675 0.834146
0.980488 1.035127 1 1 1 0.679012 1.037346
0.987456 1.040424 0.728395 1 0.307087 1.112995
1.0233 1.025794 1.04856 0.88888 0.8976 1.040678
1.037721 1.040641 0.775 0.957888 0.875 1.027562
1.028891 0.90786 0.5 0.65 0.634855 1.030685
1.100001 0.423237 1.041098 1.0456 0.93545
1.026687 1.03208 1.043642 0.901554 1.1234
1.044675 1.028759 1.03456 0.98675 0.637306
NS | 3
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

1.027115 1.03677 0.744681 0.9567 0.93617 Environment”, SANS Institute, www.sans.org

1.046356 1.090807 1.0765 1.049298 1.02342 [Sandhu et al. 1994]R.S.Sandhu , P.Samarati,
1.057846 0.183099 1.0809 1.034165 0.478873 Access Control: Principles & practice, IEEE
communications 32(9), page 40-48, 1994 [Biba
1.1187 1.1165 1.039283 1.0987 1.038334 0.919149
1977]K.J.Biba, Integrity Constraints for secure
1.11111 1.061639 0.6 1.23432 1.2654 1.028748
computer systems, EST TR-76-372, ESD/AFSC,
0.982979 1.069084 0.623377 1.23987 1.061735 Hanscom AFB, Bedford, MA, April 1977 [Graham
0.948052 1.445632 1.2987 0.61039 0.7654 0.803922 et al. 1972] G.Graham, P.Denning, Protection –
1.031228 1.34526 1.028549 0.715686 1.54326 Principles and Practice, Spring Joint Computer
1.364209 0.970588 0.74653 0.89083 1.025439 Conference, AFIPS Conference Proceedings 40, pp.
1.45642 1.042052 0.825328 1.58976 1.40987 417 – 429, 1972
1.029557 0.71239
CONCLUSION
The main contribution for this work is the
development of automated framework for computing
the new security classification level of a file. This
value is calculated based on the file usage statistics
and organizational changes. This change will help the
administrator to reclassify the file thus preventing the
misuse of it.
REFERENCES
[Fernando et al. 2008] Fernando Mourão, Leonardo
Rocha, Renata Araújo,Thierson Couto, Marcos
Gonçalves, and Wagner Meira Jr. , “Understanding
Temporal Aspects in Document Classification “,
Proceedings of WSDM’08, February 11–12, 2008,
Palo Alto, California, USA. [Xianliang et al. 2007]
Xianliang Shil, Dong Li, Hailong Zhu, Wenjie
Zhang,”Research on Supply Chain Information
Classifi'cation Based on Information Value and
Information Sensitivity” IEEE Conference, 2007
[Nicolls] Nicolls, W., "Implementing company
classification policy with the S/MIME security
label”, http://www.ietf.org/frc/rfc3114.txt [Du 2005]
Du, G.Q., "Realize information lifecycle management
through classified storage," China
Telecommunication Industry, No. 2, pp72-73, 2005.
[Mathkour et al. 2005] Mathkour, H., Touir, A., Al-
Sanie W., Intelligent Information Processing and
Web Mining, New York: Springer, 2005 [AH
2003]Andy Ruth, Kurt Hudson, “Security+
Certification”, Microsoft, Prentice – Hall India, (pp
324 – 326), 2003 [Bhatt et al. 2003]S.Bhatt,
S.R.Rajagopalan, P.Rao, Federated Security
Management for Dynamic Coalitions, IEEE
proceedings of the DARPA Information Survivability
Conference & Exposition, April 22-24, 2003
[Martzahn 2003] T. Martzahn, Implementing the
Just Enough Privilege security model, SANS
Institute, Information security room, August,22,2003,
http://www.sans.org/rr/papers/56/1256.pdf [Lindsay,
DEC] D.Lindsay, Digital Equipment Corporation,
“An overview of leading Security issues”, Chapman
& Hall, (pp 11 – 19). [Bob, SANS]Bob Boyer,
“Making use of Data Classification in the Corporate

NS | 4
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

Secure Data Transmission over IP based WiMAX

Networks
B. Kaarthick1 Member IEEE1, N.Nagarajan2 , Rajeeev3 Senior Member IEEE1,Joanna Angeline4 ,
V. J.Yeshwenth5
1, 5,
Sri Krishna College of Engineering & Technology, Coimbatore, INDIA
2
Coimbatore Institute of Engineering and Information Technology, Coimbatore, INDIA
3
Wipro Technologies, Chennai India
4
TATA Consultancy Services, Chennai, INDIA
E-mail: kaarthick_cbe@yahoo.com, rajeev@ieee.org

Abstract- IEEE 802.16/WiMAX is one of the most promising feature set specifically targeted at the networking application
technologies for Broadband Wireless Access, both for fixed and domain [1], [2]. Network processors are typically software
mobile use. In reality, to successfully deploy WiMAX networks, programmable devices and would have generic
security is one of the major challenges that must be addressed characteristics similar to central processing unit. Network
[4],[5]. In this paper, we propose a network control framework
processors are special purpose, programmable hardware
to achieve secure data transmission over WiMAX. The
architecture was implemented using network processor and device that combines the low cost and flexibility of a RISC
tested for real time systems. The results clearly indicate that the processor with the speed and scalability of custom silicon
secure transmission has been achieved without affecting the (i.e., ASIC chips). Network processors are building blocks
throughput of the system drastically. used to construct network systems. A network processor
achieves flexibility by having packet processing specified
Keywords: WiMAX, IP, Security, Microengine
with software [3]. The ACESS SERVICE Network Gateway
I. INTRODUCTION of the WiMAX network is developed using a network
WiMAX is a recent wireless broadband standard that has processor to achieve security. Fig 1 illustrates the IP based
promised high bandwidth over long range transmission. In WiMAX Network Architecture.
the medium access control (MAC) layer, IEEE 802.16
supports two modes: point-to-multipoint (PMP) and mesh
[6]. The former organizes nodes into a cellular-like structure
consisting of a base station (BS) and subscriber stations
(SSs). PMP mode requires all SSs to be within the
transmission range and clear line of sight (LOS) of the BS.
On the other hand, in mesh mode an ad hoc network can be
formed with all nodes acting as relaying routers in addition
Fig 1. WiMAX Network Architecture
to their sender and receiver roles, although there may still be
nodes that serve as BSs and provide backhaul connectivity. Once the packets enters the AS gateway the processor
receives the packets and classifies the packets into their
Multihop is becoming more and more important to respective data types. The audio and video packets which
WiMAX system as it is a cost effective solution. To
require real time streaming are routed to the respective
successfully deploy multihop WiMAX networks, security is
destination ports. Encryption is performed only on the data
one of the major challenges that must be addressed Security
packets to achieve secure transmission and then is
challenges become more complicated during multihop transmitted to the output ports. RSA algorithm is used for
WiMAX networks because it does not have a mutual the encryption process. All the microengines in the network
authentication system i.e., the SS cannot authenticate the BS processor perform parallel processing thereby reducing
[4],[7]. So it is very easy for the external agent to hack the
delay in packet processing [8]. Fig 2 demonstrates the block
information In this paper, we propose a secure network
diagram of the operations performed in the network
framework for WiMAX networks whish makes it difficult
processor.
for external sources to hack the information during
transmission.
The frame work is modeled using a network processor. A
Network Processor is an integrated circuit which has a

NS | 5
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

Initialization:
REGISTER OFFSET NOTES

MSF_Rx_Control This control register defines a

0x0000 number of receive configuration
parameters.

MEs write to this register to add

Rx_Thread_Freelist_0 0x0030 a Context to the
Fig 2 Operations performed in the Network Processor.
Rx_Thread_Freelist.

Threads write to this address to

II. SYSTEM ARCHITECTURE
The first objective performed by the system designed is,
that it checks the integrity of the packets. The packets,
whose identity cannot be established, are immediately
discarded. The first Microengine of the processor receives
the packets and verifies the identity of the packet. The
packets are then classified into video, audio, image, and data
files and transferred to the respective microengines for
further processing.
The following tasks are performed by the respective
microengines.
Microengine 0:0 - Packet reception
Microengine 0:1 - Packet classification
Microengine 0:2 - Encryption on data packets.
Microengine 0:3 - Packet transmission
III. SYSTEM IMPLEMENTATION
The system is designed to achieve the functionality of
Active Networks in Real-Time using Intel’s IXP 2400
Network Processor. Microblocks are implemented to
perform the following tasks,
a. Receive the packets
b. Classification of the packets
c. Encrypt or Decrypt the packets using RSA
algorithm
d. Transmit the packets.
These Microblocks are assembly level codes, which
specify the microengines to do desired operations. This
system would serve as the first node of any active network.
Microengines 0 to 3 are utilized here for performing the
above mentioned tasks respectively. Encryption is performed
on all the data packets. The throughput of the system has
been increased up to 30Mbps though the system can handle
upto 40 Mbps.
A. Reception of Packets Microengine 0:0
The Packet Receive is a driver microblock that performs
frame-reassembly on the mpackets coming in on the POS-
PHY Level3 physical media interface. In this microblock
POS-PHY Level3 mode is used for the receiver device.
Here the MSF interfaces supports 32 bit-wide bus with
in-band addressing and up to 32 slave ports are supported,
with packet-level polling.
RBUF_Element_Done 0x0044 free up an RBUF element so
that it can be reused.
This register is used to
Rx_Up_Control_0 0x0080 configure various modes of
receiving (like SPHY, MPHY,
etc)
This microblock reassembles and writes the packet data to
a buffer in DRAM. The packet Receive microblock also sets
up per packet meta information such as offset, size etc which
are passed on either in a descriptor in SRAM or in the
microengine-microengine scratch ring itself.
Algorithm for reception of packets
Step 1: Initialize registers.
Step 2: Extract details such as, whether it Start Of
Packet (SOP) or Middle of Packet (MOP) or
End of Packet (EOP)
Step 3: If SOP
3.1. Transfer packet from RBUF to DRAM.
3.2. Put the starting address of DRAM into
scratch ring 0.
3.3. Update packet size and add the thread to
freelist.
3.4. Move DRAM pointer to corresponding
location.
Step 4: If MOP or EOP
4.1. Transfer packets to DRAM.
4.2. Update packet size and add the thread to
freelist.
4.3. Move DRAM pointer to corresponding
location.
B. Classification Microengine (M.E) 0:1
The Packet classification microblock receives DRAM
locations from the receive microblock through the scratch
ring. By performing atomic operations the source IP address,
the destination IP address, packet format, etc are retrieved
from the header.
The packets’ protocol information is compared with CAM
entries and the ‘hit’ or ‘miss’ is checked. If it is a ‘hit’ the
corresponding packet will be a data packet and it will be
transferred to the third microengine for encryption. The
packets which do not match protocol values are thus
identified and transferred to the output ports.

NS | 6
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

ring1 by Classify Microblock

Initialization:
UNIT NOTES
CAM entries are compared in parallel, and the result of
CAM
the lookup is a 9 bit value which is written into the
specified destination register
Algorithm for Classification of packets
Step 1: Initialize CAM entries with different protocol
values.
Step 2: Form lookup table for output ports for
Forwarding and classifying the packets.
Step 3: Wait for entry in Scratch Ring0 from the
Receive microblock.
Step 4: Get DRAM starting address and packet size
and read the packet header into DRAM
Transfer Register.
Step 5: Do Atomic operation to extract Protocol,
Source IP, Destination IP, etc.
Step 6: Compare the protocol value with CAM entries
Step 7: Get the Lookup offset value.
Step 8: Form the descriptor in SRAM
Step 9: Pass the descriptor to Transmit microblock
through Scratch Ring2.
Step10: Move to Step 3
Step 3: Read the descriptor from SRAM using the
address in Scratch Ring1
Step 4: Receive the cipher text C.
Step 5: Calculate Plain text using P=CKs modulo N
Step 6: decode P to the Original data.
Step 7: Move to Step 2
D. TRANSMISSION OF PACKETS M.E 0:3
This block is designed to transmit the packets to the
respective ports after encryption/decryption over POS-PHY
Level3 physical interface. Hence it does the act of any
normal passive node. In the initialization part the transmit
device is configured to POS-PHY Level3 mode. In this
mode the MAC devise supports 32 ports and these ports
together share the 32 bit bus.
IV. RESULTS AND DISCUSSIONS
The proposed architecture is implemented in IXP2400
network processor in which ME’s 0-4 forms functional
pipeline of the four major modules. Fig.3 illustrates the
effective utilization of the various Microengines in the
functional pipeline.

C. Encryption/Decryption M.E 0:2

This microblock represents the Encryption process. All
the data packets are encrypted using RSA algorithm after
classifying the packets. Also it can decrypt the packets when
the system is integrated at the node prior to the destination
Fig 3 Microengine Utilization
system.
In this paper we have included some changes to the
security mechanisms of IEEE 802.16. These changes
Algorithm for Encryption of packets:
provide strong data confidentiality and these modifications
were achieved without affecting the throughput and other
Step 1: Initialize scratch ring and DRAM registers.
performance metrics of the network as explained in fig 4.
Step 2: Wait until an element is pushed into scratch
ring1 by Classify Microblock
Step 3: Read the descriptor from SRAM using the
address in Scratch Ring1
Step 4: Encode the data to be encrypted as a number to
create the plain text P.
Step 5: Calculate Cipher text using C=PKp modulo N
Step 6: Send C as the cipher text.
Step 7: Move to Step 2

Initialization:

REGISTER NOTES Fig.4 Throughput of the Network before and after Encryption

CTX_ENABLES This register is used by the context arbiter and is
also used for debugging.
Flowchart for Decryption of packets
Step 1: Initialize scratch ring and DRAM registers.
Step 2: Wait until an element is pushed into scratch
The red line in Fig 4 indicates that the throughput of the
network after encryption has dropped but it still remains at
an acceptable level thereby not affecting the performance of
the system.

NS | 7
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

V. CONCLUSION
Real time implementation of proposed architecture using
Network processor IXP2400 is achieved. A high degree of
security is achieved by encrypting the data packets using the
RSA algorithm in AS gateway. This paper also provides a
scope for the users to explore a cutting edge technology in
networking. As a future work we plan to work on the key
distribution scheme for group communication.

ACKNOWLEDGMENT
The authors wish to thank Intel Inc., for providing
facilities to implement and test the algorithms on routers
constructed using Intel IXP Network processors.

REFERENCES
[1] Samratt Bhattarcharjee et al, "An Architecture for Active Networking”
PROC. INFOCOM ‘97, April 1997
[2] David Wetherall, “Active network vision and reality – lessons from a
capsule-based system”, 17th ACM Symposium on Operating Systems
Principles (SOSP ’99)
[3] Douglas E. Comer, “Network System Design and Network
Processors”, Pearson Edition.
[4] Intel Network Processor IXP 2400 hardware and software reference
manual, 2004
[5] Wetherall, Tennenhouse, "The Active IP Option", Proc. 7th ACM
SIGOPS European Workshop, Connemara, Ireland, Sept. 1996
[6] Tennenhouse, Wetherall, "A Survey of Active Network Research”,
IEEE Communication ,Mag. ,January1997
[7] Stuart Eichart, Osman N. Ertugay, Dan Nessett, Suresh Vobbilisetty,
"Commercially viable Active Networking"
[8] Kenneth L. Calvert, Samratt Bhattarcharjee, Ellen Zegura, James
Sterbenz, "Directions in Active Networks"

NS | 8
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

Energy Aware Optimal Routing and Data

Security for Mobile Wireless Sensor
Networks
Dr.S.Chandramathi
Professor & Head,
Sri Krishna College of Engg & Tech,
Kuniamuthur, Coimbatore, 641008,India.
E mail: chandrasrajan@gmail.com
R.Raja kishore
Trainee Engineer,
ITI Industries, Wireless division,
Pune, Maharastra, India.
rajakishore_r@hotmail.com.

ABSTRACT maximize the life time of the sensor network. In this work,
to create the mobile environment in WSN, the GloMoSim
A major technical challenge for a mobile wireless
simulator is chosen and, the AODV protocol is suitably
sensor network lies in the energy constraint at each node,
modified to choose the shortest optimal path for the
which poses a fundamental limit on the network
destination, which consumes less energy and is called as
lifetime[1]. To over come this energy constraint, in this
Modified AODV (MAODV). Also tuning the transmitter
work, an energy aware optimal routing strategy is
energy based on distance between the two nodes is carried
implemented by modifying the AODV protocol, which is
out to conserve the energy between the nodes. To
termed as Modified AODV (MAODV) and also tuning of
implement the data security the AES algorithm is
energy is carried out at each transmitting node to ensure
implemented in MAODV and is termed as SAODV and is
minimum consumption of energy. The other important
simulated using GloMoSim. The performance of such
constraint is the data security. This data security is
SAODV will be compared with the MAODV and
augmented by applying an Advanced Encryption Standard
conventional AODV in terms of energy consumption per
(AES) for WSN. This AES algorithm is implemented in
packet, average energy consumption of nodes, packet
modified AODV and this is termed as Secured AODV
delivery ratio, Average end-to-end Delay for various pause
(SAODV). Since, the nodes are mobile in nature, to
time values and the number of nodes in GloMoSim.
implement the MAODV and SAODV the environment is
created using Global Mobile Information System
This paper is organized into five sections. The
Simulator (GLOMOSIM), and the simulation is carried
present section introduces the concept of sensor networks.
out for various pause time values and the number of nodes.
Section 2 introduces the sensor networks and security,
From simulation, it is observed that in MAODV, energy consumption and the various routing strategies being
the energy consumption per packet and the Average followed in sensor networks. Section 3 deals in depth the
energy consumption of the nodes are approximately 20% functioning of the Ad hoc On demand Distance Vector
less compared to conventional AODV and the Secured protocol (AODV) and the MAODV and AES Algorithm
AODV gives better packet delivery ratio when compared .Section 4 discusses the simulated results of the proposed
to MAODV. MAODV and SAODV and also shows the Performance
analysis of SAODV compared with the MAODV, and
Key words: WSN, Energy, Routing, Ad-Hoc
conventional AODV and Conclusions are given in section
Networks, AODV, AES.
5.
I. INTRODUCTION
II. AODV AND MODIFIED AODV ROUTING PROTOCOL
Mobile Wireless sensor networks combine simple
wireless communication, minimal computation facilities, and
The AODV protocol is composed of two mechanisms
some sort of sensing of the physical environment into a new
that work together to allow the discovery and maintenance
form of network that can be deeply embedded in our physical
of source routes in an ad hoc network are: Route discovery
environment, fueled by the low cost and the wireless
and Route Maintenance.[3]
communication facilities. Because of the small size of the
sensor node and its operation is in an unattended environment Route Discovery
have many challenges [1] [2]. The research areas in wireless When a node wishes to send a packet to some
sensor network include efficient energy consumption, destination node, it checks its route table to determine
localization, routing and security. The main objective of this whether it has a current route to that node. If so, it forwards
work is to propose an optimal energy aware routing for the the packet to the appropriate next node toward the
mobile wireless sensor network to minimize the energy to

NS | 9
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
destination. However, if the node does not have a valid route
to the destination, it must initiate a route discovery process. To
begin such a process, the node (call it the source) creates a
Route Request (RREQ) packet.
Route Request Process
The AODV protocol works complete by on demand,
which means that there are no periodic route updates in the
network. This means that if a node (Source) wants to send a
packet to another node (Destination), it first has to discover a
route to node (D). The first step in route discovery is that the
Source node (S) searches its own route cache for a route to the
Destination node (D). If there is a route to the target node,
then the source route uses this route to send its data package.
If there isn’t a route to the destination then the source node
sends a RREQ to its neighbors using broadcasting. This
RREEQ package identifies the initiator node and the target
node of the Route Discovery. Also the packet contains unique
request ID, determined by the initiator of the Route Discovery.
Route request process is illustrated in Fig 1.
When this Route Request is received by another node
the node first checks if it has already seen the combination of
the source node and the request ID of the Route Request
packet. If so, it discards the packet and not processes it further.
Otherwise it is checked if this node is the target node the route
is searched for. If so, the node returns a Route Reply Packet to
the source node of the Route Request containing the route
from the source to the target node given by the node list within
the Route Request Packet.
Fig.1 Route request process
Route Reply Process
If a node is the destination, or has a valid route to the
destination, it unicasts a route reply message (RREP) back to
the source [4]-[6]. When a node contains an up-to-date route
to a destination that is the target of a Route Request it
receives, or is the destination itself, it unicasts a Route Reply
(RREP) message back to the node from which it received the
Route Request. Route Reply process is shown in Fig 2.
Fig.2 Route reply process
ISSSIS 2009
Each node along the path that the Route Request
was propagated updates its routing table to mark the node
from where it received the Route Reply as the next hop for
the new route. As such, the Route Reply is propagated along
the reverse path all the way to the source of the original
Route Request and the routing table of each node along the
way is updated to reflect the next hop along the route.
In case the node replying to the Route Request was not
the destination but instead knew a valid route to the
destination, then this node also sends a needless Route
Reply to the destination along the path it knows to that
destination, such that the destination knows how to reply to
the source when it receives data from it, without having to
explicitly send out another Route Request to search for the
source.
3. PROPOSED MODIFICATION IN AODV PROTOCOL
Due to the ad-hoc nature of sensor networks and
severe battery energy limitations, energy efficient protocols
are required at all the layers of the protocol stack. Since a
sensor network is deployed with an objective of gathering
information, for a given initial battery energy, it is desired
that the network continues to function and provide data
updates for as long as possible. This is referred to as the
maximum lifetime problem in sensor networks. During each
data gathering phase, nodes spend a part of their battery
energy on transmitting, receiving and relaying packets.
Hence the routing algorithm should be designed to
maximize the time until the first battery expires, or a
fraction of the nodes have their batteries expired.
In the first phase of work, the shortest path is
calculated based on the distance between the source and
destination. Intermediate nodes on receiving request packet
checks in its cache whether route to the destination is
present or not. If route is present, it then gets the hop count
from the source to the destination. Shortest Route can not be
determined only based on the number of hop counts alone.
And so the distance between the nodes is calculated from
the time it takes for the RREP which takes minimum time to
reach the source from the destination. This ensures
conservation of the energy in the nodes. In order to reduce
the energy consumption per node, the transmitting nodes are
tuned based on the distance between the intermediate nodes
to conserve the minimum energy. In the second phase the
AES algorithm is applied for data security and is simulated
using GloMoSim. During, simulation first the energy aware
optimal routing algorithm is invoked and after finding the
optimal route the encrypted packets are transmitted along
this route.
Algorithm
The steps that are performed to tune the energy in the
source node in modified AODV are as follows:
NS | 10
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
Step 1: While transmitting the reply packet, check all the entries
in the route table at each node in the forward path.
Step 2: If the next node is source node then it will wait until the
timer expires and forward the information to the next
node.
Step 3: If the next node is not source node them it will calculate
the minimum energy (remaining energy) required to
transmit.
Step 4: Now the remaining energy is compared with the
received energy.
Step 5: If the remaining energy is not less than the received
energy go to the step 3.
Step 6: If the remaining energy is less than the received energy
then assign the received energy to the transmitter, and
then go to step 2.
AES Algorithm
For the AES algorithm, the length of the input block,
the output block and the State is 128 bits. This is represented
by Nb = 4, which reflects the number of 32-bit words (number
of columns) in the State [7][8]. The length of the Cipher Key,
K, may be 128, 192, or 256 bits. The key length is represented
by Nk = 4, 6, or 8, which reflects the number of 32-bit words
(number of columns) in the Cipher Key.
In AES algorithm, the number of rounds to be
performed during the execution of the algorithm is dependent
on the key size. The number of rounds is represented by Nr,
where Nr = 10 when Nk = 4, Nr = 12 when Nk = 6, and Nr =
14 when Nk = 8. The only Key-Block-Round combinations
that conform to this standard are given in Table 1.
Table.1 Key-Block-Round Combinations
For both its Cipher and Inverse Cipher, the AES
algorithm uses a round function that is composed of four
different byte-oriented transformations: 1) byte substitution
using a substitution table (S-box), 2) shifting rows of the State
array by different offsets, 3) mixing the data within each
column of the State array, and 4) adding a Round Key to the
State.
4. SIMULATION RESULTS AND DISCUSSIONS
AODV and modified AODV were implemented in
GloMoSim. The simulation time is kept at 900 seconds. The
nodes move with a maximum velocity of 20 m/s and
according to the random waypoint mobility model. In, this
model, a node randomly chooses a point in the simulation
area and the speed for the next move, which is uniformly
ISSSIS 2009
distributed between 0 and the maximal velocity.
Subsequently, the node drives to the selected point at
constant speed. After arriving at the end point the node
remains there for a certain time. Subsequently, the node
repeats the operation by selecting a new end point and a
new speed. When the pause time is 0 seconds, the nodes
move constantly. In contrast, when the pause time is 900
seconds the nodes do not move at all. Five pairs of source-
destination were taken for simulation with a transmitted
power of 15-dBm.Constant Bit Rate (CBR) traffic was
chosen for our simulation to ensure minimum delay.
COMPARISION OF MODIFIED AODV WITH AODV
To get a better idea of the performance of MAODV
protocol it is compared with the conventional AODV. The
performance metrics like Energy Consumption per Packet,
Average end-to-end Delay, Packet delivery ratio are
considered for evaluation purpose. The comparison between
AODV and MAODV was carried out in terms of the
average energy consumption, energy consumption per
packet. The snapshot of the node connections are shown in
Fig 3.
Fig.3 Snapshot of simulation for node connections
Energy Consumption per Packet
Energy consumption per packet is the ratio of total
energy consumed for generating the ‘n’ number of packets
to the number of packets reaching the destination.
Econsumed = E tsans-Etuned /no of packets received (1)
Route discovery mechanism in MAODV is
illustrated in Fig.4 in which node 1 is the source node and
node 5 is the destination node. Assume that all nodes are
transmitting the same energy. At time t when the source
initiates a route discovery, the available energy levels of the
nodes and their current required transmit power levels are
shown in Fig.4. The source initiates a route discovery by
broadcasting the RREQ packet. Node 2 and node 4 are
within the transmission range of node 1. Since intermediate
nodes 2 and 4 are not the destination, these two nodes add
NS | 11
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

their own node ids in the request packet and rebroadcast that
route request packet, with recalculated energy. The energy is
calculated, based on the transmitted energy and the received
energy and is given by the equation 2.

Erem =ET-ER (2)

Once the destination 5 receives the route request

packet, it sends a reply to the source 1 by reversing the path
through which it receives the request packet. When the area
increases energy consumption per packet also increases
because packets are traveling in larger network area, with Fig.6 Comparison of energy consumption per packet for
more number of hops and this is shown in Figures 5 and 6. 50 nodes with different terrain areas at zero pause
time and speed 20m/s.
These results are observed for 50 and 70 nodes. For example if
Etrans is the initial energy at the time of simulation , and after
simulation the received energy of each node is Etuned then Average Energy Consumption
Energy consumption per packet is calculated by using the
equation.1and from this it is observed that 20% energy is Average energy consumption is the ratio of total
saved in MAODV protocol. energy consumed by the node to the total number of nodes.
This can be calculated using equation.2.

Eavg =Etot / number of nodes (3)

For simulation the number of source and

destination pairs was assumed to be 25 and 30 and the
average energy consumption is carried out by simulation for
conventional AODV and MAODV and the results are
plotted in fig 7 and 8. MAODV gives better average energy
consumption compared with the conventional AODV. From
this it is shown that 20% energy is saved in MAODV
protocol.

Fig.4 Modified Route reply process

Fig .7 Comparison of average energy consumption for 50

Fig .5 Comparison of average energy consumption for nodes with different CBR connections at zero
70 nodes with different CBR connections at zero pause time, speed 20m/s
pause time, speed 20m/s

NS | 12
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

500 30.19841643 31.25462521

600 30.34282605 31.65235485
700 30.52520101 31.85652562
800 30.85451078 31.95266533
900 30.74707483 32.8572012

Table .3 variation of Average End to Eng delay for 50

nodes w.r.t different pause time

Fig.8 Comparison of average energy consumption for 70

nodes with different CBR connections at zero
pause time, speed 20m/s.

Average End to End delay

The term end-to-end delay is used as an average
measure of performance between nodes in a network. The
end-to-end delay is therefore the total delay that a packet
experiences as it is traveling through the network. By varying
the pause time values from 0 to 900ms for 50 and 70 nodes the
simulation was carried out for both MAODV and SAODV and
the simulated results are tabulated in table 2 and 3. The
tabulated values are plotted in fig 9 and 10 and from this it is
Fig .10 Variation of Average end-to-end delay with pause
clearly seen that average end to end delay is more in case of
time for 50 nodes
SAODV when compared to MAODV. This is due to
implementation of AES algorithm in MAODV which requires
Table .4 variation of Average End to Eng delay w.r.t
more processing time for encryption of data.
number of nodes

Number of
nodes MAODV SAODV
50 24.25698563 24.26542562
60 25.9022405 25.91254256
70 26.25698543 26.4562562
80 28.65985422 28.93652145
90 31.77823534 31.93562452
100 31.9856521 32.01254625
110 29.273709 30.2563252
Fi
g .9 Variation of Average end-to-end delay with pause
time for 70 nodes

Table .2 variation of Average End to Eng delay for 70

nodes w.r.t different pause time

Different Pause
times MAODV SAODV
0 23.85929692 24.6254852
100 26.27346181 27.25648568
200 28.09148871 29.25658458
300 28.20997351 29.9564585
Fig .11 Variation of Average end-to-end delay with
400 30.0508246 30.25458965 Number of nodes

NS | 13
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

Packet delivery ratio. The packet delivery ratio is the ratio
between the number of packets sent by constant bit rate
sources (CBR, “application layer”) and the number of received
packets by the CBR sink at destination. It describes percentage
of the packets which reaches the destination. Simulation is
carried out for 5 pairs of communicating nodes and the
number of nodes are assumed to be 50, and to be the pause
time varied from 0 to 900ms , the packet delivery ratio is
calculated for MAODV and SAODV and is plotted in figs 12
and 13 . From this it is shown that there is the slight
improvement in packet delivery ratio in the case of SAODV
compared to MAODV.
Fig.12 Variation of packet delivery ratio with Pause time
5. CONCLUSION
The proposed MAODV in this work which minimizes the
energy consumption and there by maximizes the lifetime of
the network. The performance of the proposed MAODV is
compared with the conventional AODV. The simulation
result shows that the MAODV performs much better under
different terrain scenarios. From the simulation results, it is
observed that in MAODV the energy consumption per
packet and average energy consumption per nodes are
reduced by 20%, and the throughput is improved. Hence the
MAODV performs better then that of the conventional
AODV. Secondly, the AES algorithm is applied for data
security and is simulated using GloMoSim. During,
simulation first the energy aware optimal routing algorithm
is invoked and after finding the optimal route the packets
are transmitted along this route. The performance of
MAODV without data security and SAODV with data
security is carried out in GloMoSim, and the results are
compared in terms of packet delivery ratio, Average end-to-
end Delay for various pause time values and for different
number of nodes. From, the simulation results it is observed
that the SAODV gives better packet delivery ratio when
compared to MAODV as the data is secured in the case of
SAODV.

REFERENCES

[1] F. L. Lewis “Wireless Sensor Networks”, the University of Texas

at Arlington John Wiley, New York, 2004.
[2] Holger Karl, Andreas Willig “A short survey of wireless sensor
networks”, Technical University Berlin Telecommunication
Networks Group TKN Technical Report , August 18, 2003.
[3] Charles E. Perkins, “Ad-hoc Networking”, Addison-Wesley
Professional Publishers, December 2001.
[4] C.E.Perkins, E.M.Royer, S.R.Das, “Ad hoc On-Demand Distance
Fig.13 Variation of loss of data with respect to the pause Vector Routing”, Internet Draft, draft-ietf-manet-aodv-12.txt, 15,
time November 2002.
URL:http://www.ietf.org/internet-drafts/draft-ietf- manet-aodv-
12.txt
Table .5 Average Packet delivery ratio Vs. Pause time for 5 [5] Guoliang Xing, Chenyang Lu, Ying Zhang and Qingfeng Huang.
communicating pairs of nodes “Minimum Power Configuration for Wireless Communication in
Sensor Networks”, ACM Transactions on Sensor Networks, Vol.
3, No. 2, Article 11, June 2007.
Average Packet delivery ratio for the 5 pairs of [6] Thomas Hou, Yi Shi, Jianping Pan, and Scott F.Midkiff
nodes “Maximizing the life time of wireless sensor networks through
Modified AODV Secured AODV optimal single-session flow routing ”, IEEE Transaction on mobile
computing, vol.5, No.9 September 2006.
Pause time % PDR % LOSS %PDR %LOSS [7] Boyle, D., Newe, T. “Security Protocols for use with Ad-Hoc
0 99.61042 0.389577 99.7995 0.200496 Wireless Sensor Networks: A Survey of Security Architectures’.
100 99.658 0.342 99.88862 0.111384 IEEE Third International Conference on Wireless and Mobile
Communications - ICWMC 2007. 4th to 9th March 2007,
200 99.70773 0.292275 99.91094 0.089062 Guadeloupe, French Caribbean, ISBN 07695-2796-5.
300 99.81026 0.18974 99.91089 0.089112 [8] Advance Encryption Standard, Federal Information Processing
Standards (FIPS), publication 197, Computer Security Resource
400 99.83256 0.167438 99.93316 0.06684 Center, National Institute for Standards and Technology (NIST),
500 99.88872 0.111284 99.93316 0.06684 Nov., 2001; [http://csrc.nist.gov/publications/fips/fips197/fips-
197.pdf.
600 99.88956 0.11044 99.93376 0.06624
800 99.8891 0.1109 99.93425 0.06575
900 99.89024 0.10976 99.9351 0.0649

NS | 14
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
Resisting Denial of service attacks in AODV
routing protocol for Mobile Ad Hoc networks
A. Sangheethaa Sukumaran, B. Esther Daniel

Abstract—Ad hoc networks are self organizing, self cooperating
networks in which each node acts as a router and forwards other
nodes’ data. AODV (ad-hoc on demand distance vector protocol) is a
routing protocol used in ad hoc networks. The properties of the
protocol are exploited by intruders to cause so many attacks
including Denial of Service (DoS) attacks. A DoS attack refers to
denying service to a legitimate user in the network, by disturbing
network services. The DoS attacks addressed in this paper are
flooding attack and rushing attack. This paper proposes solution to
both these attacks and also proposes the ways to minimize control
overhead in AODV protocol. Simulations will be done in ns2 to
compare the performance of existing AODV protocol with improved
AODV.
Keywords— Ad hoc Networks, Denial of Service attacks,
Routing protocols.
I. INTRODUCTION
W ith recent performance advancements in computer and
wireless communications technologies, advanced
mobile wireless computing is expected to see increasingly
widespread use and application. A mobile ad-hoc network
(MANET) is a self-configuring network of mobile routers (and
associated hosts) connected by wireless links, the union of
which forms an arbitrary topology. This ad hoc networking
technology provides “anytime” and “anywhere” services to the
users, in a potentially large infrastructure less wireless
network, based on the collaboration among individual network
nodes. The routers are free to move randomly and organize
themselves arbitrarily; thus, the network's wireless topology
may change rapidly and unpredictably. A MANET is an
autonomous system of mobile nodes. The system may operate
in isolation, or may have gateways to and interface with a fixed
network. There are many routing protocols that are evolving
for ad hoc networks. The main classification of routing
protocols is on demand and table driven. AODV [1,2] is an on
demand protocol. The paper is organized in to following
sections. The next section gives overview of AODV protocol.
Section 3 introduces DoS attacks in AODV. Section 4 gives
solutions to resist DoS in AODV.
A. Sangheethaa Sukumaran is with the SSN college of Engineering, India
(Mobile: 9443433804; e-mail: sangheethaas@ ssn.edu.in).
B. Esther Daniel, is with Karunya university, India (e-mail:
estherdaniel@gmail.com).
ISSSIS 2009
II. OVERVIEW OF AODV PROTOCOL
In AODV [1,2], path discovery is entirely on-demand.
When a source node needs to send packets to a destination to
which it has no available route, it broadcasts a RREQ (Route
Request) packet to its neighbors. Each node maintains a
monotonically increasing sequence number to ensure loop free
routing and supersede stale route cache. The source node
includes the known sequence number of the destination in the
RREQ packet. The intermediate node receiving a RREQ
packet checks its route table entries. If it possesses a route
towards the destination with greater sequence number than that
in the RREQ packet, it unicasts a RREP (Route Reply) packet
back to its neighbor from which it received the RREQ packet.
Otherwise, it sets up the reverse path and then rebroadcasts the
RREQ packet. Duplicate RREQ packets received by one node
are silently dropped. In this way, the RREQ packet is flooded
in a controlled manner in the network and it will eventually
arrive at the destination itself or a node that can supply a fresh
route to the destination, which will generate the RREP packet.
As the RREP packet is propagated along the reverse path to
the source, the intermediate nodes update their routing tables
using distributed Bellman-Ford algorithm with additional
constraint on the sequence number and set up the forward path.
AODV also includes the path maintenance mechanism to
handle the dynamics in the network topology. Link failures can
be detected by either periodic beacons or link layer
acknowledgments such as those provided by 802.11 MAC
protocol. Once a link is broken, an unsolicited RRER packet
with a fresh sequence number and infinite hop count is
propagated to all active source nodes that are currently using
this link. When the source node receives the notification of a
broken link, it may restart the path discovery process if it still
needs a route to the destination.
Flooding RREQ packets in the whole network will consume
a lot of resource of network. To reduce congestion in a
network, the AODV protocol adopts some methods. A node
cannot originate more than RREQ_RATELIMIT RREQ
messages per second. After broadcasting a RREQ, a node
waits for a RREP. If a route is not received within round-trip
milliseconds, the node may try again to discover a route by
broadcasting another RREQ, up to a maximum of retry times
at the maximum TTL value. Repeated attempts by a source
node at route discovery for a single destination must utilize a
binary exponential back-off. For the first time a source node
NS | 15
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

broadcasts a RREQ, it waits up to roundtrip time for the
reception of a RREP. If a RREP is not received within that
time, the source node sends a new RREQ. When calculating
the time to wait for the RREP after sending the second RREQ,
the source node must use a binary exponential back-off.
Hence, the waiting time for the RREP corresponding to the
second RREQ is 2 * round-trip time. The RREQ packets are
broadcast in an incrementing ring to reduce the overhead
caused by flooding the whole network. The packets are
flooded in a small area (a ring) first defined by a starting TTL
(time-to-live) in the IP headers. After RING TRAVERSAL
TIME, if no RREP has been received, the flooded area is
enlarged by increasing the TTL by a fixed value. The
procedure is repeated until a RREP is received by the
originator of the RREQ, i.e., the route has been found.
any further RREQs from this Route Discovery. When non-
attacking RREQs arrive later at these nodes, they will discard
those legitimate RREQs. As a result, the initiator will be
unable to discover any usable routes (i.e., routes that do not
include the attacker) containing at least two hops (three
nodes). In general terms, an attacker that can forward RREQs
more quickly than legitimate nodes can do so, can increase the
probability that routes that include the attacker will be
discovered rather than other valid routes. Whereas the
discussion above has used the case of nodes that forward only
the first RREQ from any Route Discovery, the rushing attack
can also be used against any protocol that predictably forwards
any particular REQUEST for each Route Discovery.

III. DOS ATTACKS ON AODV

DoS [5, 6] attack refers to denying service to a valid node.
An intruder can try to overload the network by sending
unnecessary packets, so that a valid node is not able to get
required service. There are many ways by which service can be
denied. This paper discusses 2 such methods. One is flooding
Figure 1. Example for rushing attack
attack and another is rushing attack.
A. Flooding Attack A rushing attacker need not have access to vast resources.
In AODV the route request packet when sent by source On-demand routing protocols delay RREQ forwarding in two
ways. First, Medium Access Control (MAC) protocols
node should be broadcasted by the neighboring nodes. It is
generally impose delays between when the packet is handed to
possible for an intruder to flood the network with RREQ
the network interface for transmission and when the packet is
packets for which there will not be any route. For Example the
actually transmitted. In a MAC using time division, for
intruder can send route requests to some invalid IP addresses. example, a node must wait until its time slot to transmit,
The other nodes not knowing that it is a fake address continues whereas in a MAC using carrier-sense multiple access, a node
to broadcast the packet. Thus network is flooded with generally performs some type of back-off to avoid collisions;
unnecessary packets protocols like IEEE 802.11 also impose an inter-frame spacing
B. Rushing Attack time before transmission actually begins. Second, even if the
MAC layer does not specify a delay, on-demand protocols
Rushing attack [5] acts as an effective denial-of-service
generally specify a delay between receiving a RREQ and
attack against all currently proposed on-demand ad hoc
forwarding it, in order to avoid collisions of the RREQ
network routing protocols, including protocols that were
packets. In particular, because RREQ packets are broadcast
designed to be secure. In an on-demand protocol, a node
and collision detection for broadcast packets is difficult,
needing a route to a destination floods the network with RREQ
routing protocols often impose a randomized delay in RREQ
packets in an attempt to find a route to the destination. To limit
forwarding. An attacker ignoring delays at either the MAC or
the overhead of this flood, each node typically forwards only
routing layers will generally be preferred to similarly situated
one RREQ originating from any Route Discovery. In
non-attacking nodes.
particular, existing on-demand routing protocols, such as
AODV [1, 2], DSR [3, 4], only forward the RREQ that arrives
IV. RESISTING DOS ATTACKS IN AODV
first from each Route Discovery. In the rushing attack, the
attacker exploits this property of the operation of Route A. Resisting Flooding Attack
Discovery We now describe the rushing attack in terms of its
To avoid this type of attacks simply we can inform the
effect on the operation of AODV Route Discovery; In the
network shown in Figure 1, the initiator node initiates a Route network nodes about the valid IP addresses. But this work will
Discovery for the target node. If this RREQ forwarded by the be tedious because if a new node enters into the network, or a
attacker is the first to reach each neighbor of the target (shown node leaves the network then, list of valid IP addresses has to
in gray in the figure), then any route discovered by this Route be changed. In a dynamic network like ad hoc network this
Discovery will include a hop through the attacker. That is, solution will not be proper. Also, if the number of nodes in the
when a neighbor of the target receives the rushed REQUEST network is more, then it is difficult and time consuming to
from the attacker, it forwards that RREQ, and will not forward check all the nodes’ addresses before broadcasting RREQ

NS | 16
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
packet.
Flooding attacks can easily be overcome by setting up a
threshold value for the number of RREQ that could be
originated by a node. Whenever a node receives the RREQ
from another node, this node has to check whether the
threshold level is reached. If so it should not forward the
RREQ. Threshold can be set as a common value for the entire
network based on previous behavior of the network. Each node
should calculate the rate at which the neighboring node is
sending the RREQ, if it exceeds the threshold limit, and then
simply drops the packet otherwise forwards to neighbor. The
node which tries to do flooding attack is put in black list and
packets from that node will not be forwarded the neighbors
thus isolating the intruder form the network.
Algorithm 1: Calculate rate of RREQ packets
Step1. Receive RREQ;
Step2. If the RREQ is forwarded then quit;
Step3. Look up node ID who sends the RREQ in the table of
Rate_RREQ;
Step4. Find node ID and RREQ_rate: =RREQ_rate+1;
To calculate the rate of RREQ and find the intruder, the
Algorithm 2 is run one time every second.
Algorithm 2: isolate intruder from network.
For every item of Rate_RREQ do
If RREQ_rate > threshold then put Node_ID into Blacklist
and RREQ_rate: =0; Else RREQ_rate:=0;
Because RREQ_rate sets up 0 every second, it can stand for
rate which every neighbor node originates. If the time exceeds
the threshold, we may make a judge that it is intruder. When
node receives a packet, node firstly look up source ID of
packet. If source ID is in Blacklist, node directly discards the
packet. If source ID is not in Blacklist, node disposes the
packet by normal process. The threshold is the maximum of
originating RREQ in a period time, such as 1 second. If the
frequency of originating RREQ of the attacker exceeds the
threshold, the node will not receive the RREQ from the
attacker any more.
B. Resisting Rushing Attack
One way to thwart an attacker that rushes is to remove the
delays at both the MAC and routing layers, but this approach
does not work against all types of rushing attackers and is not
general. For example, in a dense network using a CSMA MAC
layer, if a node A initiates a Route Discovery, and B is two
hops away from A, and C and D are neighbors of both A and B,
then then B will likely not receive the RREQ due to a collision
between RREQs forwarded by C and D. In a dense network,
such collisions may often prevent the discovery of any
nontrivial routes (routes longer than a direct link), which is
even more severe than the rushing attack, which prevents the
discovery of routes longer than two hops. Randomized
selection of the RREQ message to forward, which replaces
ISSSIS 2009
traditional duplicate suppression in on-demand route
discovery, ensures that paths that forward RREQs with low
latency are only slightly more likely to be selected than other
paths. In traditional RREQ forwarding, the receiving node
immediately forwards the RREQ and suppresses all subsequent
RREQs.
In our modified flooding, a node first collects a number of
RREQs, and selects a RREQ at random to forward. There are
thus two parameters to our randomized forwarding technique:
first, the number of RREQ packets to be collected, and second,
the algorithm by which timeouts are chosen. each forwarding
node would collect the maximum possible number of RREQs
before forwarding one, since this approach provides the most
effective defense against a rushing attack. However, when the
number of RREQs is chosen to be too large, randomized
forwarding will heavily rely on the timeout to trigger RREQ
forwarding, increasing latency and possibly reducing security.
In a real network, perfect information is generally not
available; as a result, initiators can include in each Route
Discovery the number of RREQs to buffer before forwarding
one, and can adjust this parameter adaptively, based on the
REPLY latency and on the parameters chosen by other nodes.
Alternatively, this number can be chosen as a global
parameter, or locally using an adaptive algorithm. When
perfect topology information is available, the choice of timeout
should be based on the number of legitimate hops between the
initiator and the node forwarding the RREQ; closer nodes
should choose shorter timeouts than far-away nodes. This
topological information can be approximated by location
information; that is, nodes that are geographically closer
should choose smaller timeouts than nodes that are
geographically farther away. When geographic information is
not available, nodes can randomly choose timeouts; however,
this approach reduces security by favoring nodes choosing
shorter timeouts.
Also a node has to check the neighbor list whenever it
receives a RREQ, if the node is in its neighborhood, then it can
forward the request. Otherwise it can drop the request. Thus by
checking whether the sending node is its neighbor list, the
forwarding node can identify an intruder and avoid rushing
attack.
C. Reducing Communication Overhead in AODV network
One more improvement that we propose in AODV is a
method to reduce the communication overhead. Consider the
working of AODV protocol, when a node receives RREQ it
checks whether it have route for the particular destination in its
cache, if so and if it is a fresh route (found based on sequence
number in the RREQ), this node can give a reply to the source
instead of again broadcasting it to other nodes. But the other
nodes are not informed about this route discovery by
intermediate nodes, so they will continue broadcasting. To
avoid this, the intermediate node which has route for the
destination can send an indication to the neighboring nodes
that route is found for this RREQ, so that packet need not be
NS | 17
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
forwarded by other nodes. This will reduce the communication
overhead considerably. For example consider the following
example network. Source 1 sends a RREQ to find route to
destination 15 to all its neighbors as a broadcast. Nodes 6,5,
and 2 receives this RREQ and rebroadcasts it. Nodes 10, 4 and
3 receives the RREQ from their neighboring nodes. Node 10 is
having a cached route to destination 15. Now it can send a
Route Reply packet RREP to source node (1). Node 1 will
receive reply from 10, and can start using it for
communication. But by now the other nodes 4 and 3 which
does not have route to 15 would rebroadcast it further flooding
the network with control packets. This can be avoided since
the route is already available at 1 from 10. The unnecessary
rebroadcast by 4 and 3 can be controlled by sending another
control packet with limited TTL(Time to Live) to neighbors of
10. When 10 identifies that it is having a route for reaching the
destination along with sending a reply to source, it also should
send another control packet to its neighbors informing that
route reply for a particular RREQ is already sent, so these
nodes need not rebroadcast the RREQ further top other nodes.
On receiving this control packets neighbors of 10 will stop
broadcasting RREQ further. Thus reducing control overhead in
the network. But of course this approach limits the number of
backup paths that are received by the source.
Figure 2. Example for route discovery in AODV
IV CONCLUSION
Thus in this paper we have seen the two main DoS attacks
that exploits the properties of AODV, Rushing attack and
Flooding attack. This paper also gives a method to reduce the
control overhead in communication. The solutions suggested
in this paper will be simulated using ns2[8,9] and results will
show that definitely the solutions can overcome DoS attacks.
ISSSIS 2009
REFERENCES
[1] Charles E. Perkins, Elizabeth M. Belding-Royer, and Samir R. Das. Ad
Hoc On Demand Distance Vector (AODV) Routing. Internet-Draft,
draft-ietf-manet aodv-10.txt, January 2002.
[2] Charles E. Perkins and Elizabeth M. Royer. Ad-Hoc On-Demand
Distance Vector Routing. In Proceedings of the Second IEEEWorkshop
on Mobile Computing Systems and Applications (WMCSA’99), pages
90–100, February 1999.
[3] David B. Johnson and David A. Maltz. Dynamic Source Routing in Ad
Hoc wireless Networks. In Mobile Computing, edited by Tomasz
Imielinski and Hank Korth, chapter 5, pages 153–181. Kluwer
Academic Publishers, 1996.
[4] David B. Johnson, David A. Maltz, Yih-Chun Hu, and Jorjeta G.
Jetcheva.The Dynamic Source Routing Protocol for Mobile Ad Hoc
Networks (DSR).
[5] YihChun Hu, Adrian Perrig, David B. Johnson “Rushing Attacks and
Defense in Wireless Ad Hoc Network Routing Protocols” in
proceedings of the 2nd ACM workshop on Wireless security, 2003.
[6] R. Praveen Sam, Dr. B. Stephen Charles, Dr. P. Chandrasekhar Reddy
Denial of Service attack through compromised nodes in Mobile Ad-
Hoc Networks from Academic Open Internet Journal volume 21, 2007.
[7] www.isi.edu/nsnam/ns/ns-tutorial/tutorial-02
[8] www.cs.vigina.edu/ncs757/slidepdf/cs751/ns2-tutorial
/exercise.pdf
NS | 18
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
Study On Integration of Zero Knowledge
Protocols in Kerberos Authentication
Jeyamala.C, Lecturer, Thiagarajar College of Engineering
Abstract — Kerberos is a ticket-based network authentication
protocol utilizing symmetric crytography, software that will
add to the ability of operating systems (Windows, Mac, etc.) to
authenticate users and servers, and manage session-level
security and encryption. It is a single sign-on technology.
However, Kerberos does not provide any guarantee if the
computers being used are vulnerable: the authentication
servers, application servers (imap, pop, smtp, telnet, ftp, ssh ,
AFS, lpr, ...) and clients must be kept constantly updated so
that the authenticity of the requesting users and service
providers can be guaranteed. Kerberos' strategies are useless if
someone who obtains privileged access to a server, can copy
the file containing the secret key. Indeed, the intruder will put
this key on another machine, and will only have to obtain a
simple spoof DNS or IP address for that server to appear to
clients as the authentic server. Also, Kerberos requires
continuous availability of a central server. When the Kerberos
server is down, no one can log in. To overcome the above
drawbacks, this work studies the feasibility of integration of
Zero Knowledge protocols for authenticating the client with
the authentication server in Kerberos environment. A zero
knowledge protocol allows a proof of the truth of an assertion
without conveying no information whatsoever about the
assertion itself rather than its actual truth. Employing Zero
Knowledge protocols eliminates the need for password
management at the server and travel of unencrypted passwords
over an untrusted network. Since the passwords are not in the
database of the authentication server, activities trying to
compromise the server will not raise any security threats.
Keywords— Kerberos Authentication, Open Distributed
Environment, Security Protocols, Zero Knowledge protocols.
I. INTRODUCTION
Kerberos is a network authentication protocol for
client/server applications by using secret-key cryptography.
Many of the protocols used in the Internet do not provide any
security. Tools to "sniff" passwords off of the network are in
common use by malicious hackers. Thus, applications which
send an unencrypted password over the network are extremely
vulnerable. Worse yet, other client/server applications rely on
The Author is with Department of Information Technology at Thiagarajar
College of Engineering,, India phone: 94420 94289 e-mail: jeyamala@tce.edu;
rcjayamaala@yahoo.co.in.
ISSSIS 2009
the client program to be "honest" about the identity of the user
who is using it. Other applications rely on the client to restrict
its activities to those which it is allowed to do, with no other
enforcement by the server. Some sites attempt to use firewalls
to solve their network security problems. Unfortunately,
firewalls assume that "the bad guys" are on the outside, which
is often a very bad assumption. Most of the really damaging
incidents of computer crime are carried out by insiders.
Firewalls also have a significant disadvantage in that they
restrict how your users can use the Internet. Kerberos was
created by MIT as a solution to these network security
problems [1]. The Kerberos protocol uses strong cryptography
so that a client can prove its identity to a server (and vice versa)
across an insecure network connection. After a client and
server has used Kerberos to prove their identity, they can also
encrypt all of their communications to assure privacy and data
integrity as they go about their business[3].
1.1 WORKING OF KERBEROS PROTOCOL
The security of the protocol relies heavily on participants
maintaining loosely synchronized time and on short-lived
assertions of authenticity called Kerberos tickets [1]. The
following abbreviations will be used:
AS = Authentication Server
TGS = Ticket Granting Server
SS = Service Server
TGT = Ticket Granting Ticket
Briefly, the client authenticates to AS using a long-term
shared secret and receives a ticket from the AS. Later the
client can use this ticket to get additional tickets for SS
without resorting to using the shared secret. These tickets can
be used to prove authentication to SS.
1.1.1 User Client-based Logon Steps:
1) A user enters a username and password on the client
machine.
2) The client performs a one-way function (Hash mostly) on
the entered password, and this becomes the secret key of
the client/user.
1.1.2 Client Authentication Steps:
NS | 19
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
The client sends a clear text message to the AS requesting
services on behalf of the user. Sample message: "User
XYZ would like to request services". Note: Neither the
secret key nor the password is sent to the AS.
a. The AS checks to see if the client is in its database. If
it is, the AS sends back the following two messages
to the client:
 Message A: Client/TGS Session Key
encrypted using the secret key of the
client/user.
 Message B: Ticket-Granting Ticket (which
includes the client ID, client network
address, ticket validity period, and the
client/TGS session key) encrypted using the
secret key of the TGS.
b. Once the client receives messages A and B, it
decrypts message A to obtain the Client/TGS Session
Key. This session key is used for further
communications with TGS. (Note: The client cannot
decrypt Message B, as it is encrypted using TGS's
secret key.) At this point, the client has enough
information to authenticate itself to the TGS.
1.1.3 Client Service Authorization Steps:
a. When requesting services, the client sends the
following two messages to the TGS:
 Message C: Composed of the Ticket-
Granting Ticket from message B and the ID
of the requested service.
 Message D: Authenticator (which is
composed of the client ID and the
timestamp), encrypted using the Client/TGS
Session Key.
b. Upon receiving messages C and D, the TGS retrieves
message B out of message C. It decrypts message B
using the TGS secret key. This gives it the
"client/TGS session key". Using this key, the TGS
decrypts message D (Authenticator) and sends the
following two messages to the client:
 Message E: Client-to-server ticket (which
includes the client ID, client network
address, validity period and Client/Server
Session Key) encrypted using the service's
secret key.
 Message F: Client/server session key
encrypted with the Client/TGS Session Key.
1.1.4 Client Service Request Steps:
ISSSIS 2009
a. Upon receiving messages E and F from TGS, the
client has enough information to authenticate itself to
the SS. The client connects to the SS and sends the
following two messages:
 Message E from the previous step (the
client-to-server ticket, encrypted using
service's secret key).
 Message G: a new Authenticator, which
includes the client ID, timestamp and is
encrypted using client/server session key.
b. The SS decrypts the ticket using its own secret key to
retrieve the Client/Server Session Key. Using the
sessions key, SS decrypts the Authenticator and sends
the following message to the client to confirm its true
identity and willingness to serve the client:
 Message H: the timestamp found in client's
Authenticator plus 1, encrypted using the
Client/Server Session Key.
c. The client decrypts the confirmation using the
Client/Server Session Key and checks whether the
timestamp is correctly updated. If so, then the client
can trust the server and can start issuing service
requests to the server.
d. The server provides the requested services to the
client.
1.2 DRAW BACKS IN KERBEROS
Kerberos requires continuous availability of a central
server. Since the secret keys for all users are stored on the
central server, a compromise of that server will compromise
all users' secret keys [2]. The administration protocol is not
standardized and differs between server implementations. A
compromised client will compromise the user's password.
When the Kerberos server is down, no one can log in.
Kerberos requires the clocks of the involved hosts to be
synchronized. The tickets have a time availability period and
if the host clock is not synchronized with the Kerberos server
clock, the authentication will fail [3]. The default
configuration requires that clock times are no more than 10
minutes apart. In practice Network Time Protocol daemons
are usually used to keep the host clocks synchronized.
II.PROPOSED INTEGRATION
This work explores the feasibility and effectiveness of Zero
Knowledge Proofs of Identity in an open distributed
environment environment. In theory, Zero Knowledge Proofs
(ZKPs) provide an elegant solution to one of the most
challenging aspects of security in open networks - node
Authentication [7]. In addition, ZKPs typically require
NS | 20
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
significantly less computing power than traditional
identification paradigms, which makes them especially
appealing for small wireless devices. [5] Unfortunately, little
work has been done to implement ZKP algorithms and validate
their completeness and soundness on a practical level
[12].Zero Knowledge Protocols are instances of Interactive
Proof Systems, wherein a prover and a verifier exchange
challenges and responses, typically dependent on random
numbers (ideally, the outcomes of fair coin tosses) which they
are allowed to keep secret.[7] The proofs in this context are
probabilistic rather than absolute as in the mathematical sense.
These proofs need only be correct with a certain bounded
probability. The client proves its identity with the
Authentication server based on Guillou – Quisquater protocol
[5] [6] and is as follows:
A trusted third party chooses two large primes p and q to
calculate the value of n =p x q. It also chooses an exponent e,
which is co prime with Φ = (p-1) x (q-1). The values of n and
e are announced to be public; the values of p and q are kept to
be secret. The trusted party chooses two numbers for each
entity, v is public and s which is secret such that s e x v ≡ 1
mod n. The three exchanges constitute a round; verification is
repeated several times with a random value of c between 1 and
e. The client must pass the test in each round to be verified. If
it fails, the process is aborted and it is not authenticated else it
is granted with the ticket that is encrypted with the public key
of the client using RSA algorithm. The figure shows one
round.
The Client Service Authorization Steps with the Ticket
Granting server and Client Service Request Steps with the
server (That provides the required service) are the same as in
original Kerberos environment.
ISSSIS 2009
2.1 PERFORMANCE ANALYSIS OF INTEGRATION
The integration of Zero Knowledge Protocols in Kerberos
environment enlists the following merits:
• The Authentication server cannot learn anything from the
protocol. The AS does not learn anything in the process of the
proof that he could derive from public information by himself.
This is the central concept of zero knowledge, i.e., zero amount
of knowledge is transferred.
• The Client cannot cheat the Authentication server. If the
client doesn’t know the secret, it can only fool AS with an
incredible amount of luck. The odds that an impostor can cheat
the AS can be made as low as necessary by increasing the
number of rounds executed in the protocol.
• The AS cannot cheat the Client. The AS cannot get any
information out of the protocol, even if it doesn’t stick to the
rules. The only thing AS can do is decide when it accepts that
the client actually knows the secret. The client will always
reveal one solution of many; by doing this it insures that the
secret remains intact.
• The AS cannot pretend to be the Client to a third party. As
stated earlier, no information flows from client to
Authentication server. This precludes AS from trying to
masquerade as the client to a third party. Nevertheless, some
ZKP protocols are vulnerable to man-in-the-middle attacks, in
which an eavesdropper relays traffic to achieve the desired
impersonation effect.
III.CONCLUSION
The use of Zero Knowledge protocols for authentication of
the client with the Authentication server does not report any
degradation with usage. [9] Zero Knowledge protocols are also
resistant to chosen text attacks. [10] Most Zero Knowledge
and Public key protocols depend on the unproven assumptions
(quadratic residuosity, factoring, discrete log, etc). The use of
Zero knowledge protocols completely eliminates the
drawbacks of password Authentication. With a negligible
amount of downtime, any machine can be configured to act as
authentication server. No points of vulnerability can be
reported for compromising the Authentication server. However,
ZK protocols are usually less efficient than PK protocols. This
is an important factor to consider in certain application
environments where (hard or soft) real time computations are
to be ensured. Further enhancements could be done for
reducing the computational power required in Guillou
quisquater protocol which is three times higher than Feige Fiat
Shamir protocol[13]. Future Work can be focused upon the
design of algorithm that could generate the session key to be
shared between the client and the Authentication server based
on the challenge Response interactions.
REFERENCES
[1] web.mit.edu/Kerberos/
[2] en.wikipedia.org/wiki/Kerberos_protocol
[3] www.kerberos.info
[4]Hannu A. Aronsson, Zero knowledge protocols and small systems.
Technical report, Helsinki University of Technology. 2000
NS | 21
 International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

http://www.tml.hut.fi/Opinnot/Tik-110.501/1995/zeroknowledge.html,
[5] L. C. Guillou, et al., Advances in Cryptology—Eurocrypt '88, pp. 123-
128, A Practical Zero-Knowledge Protocol Fitted to Security
Microprocessor Minimizing Both Transmission and Memory, May 25-27,
1988.
[6] J-J. Quisquater, et al., Electronics Letters, vol. 18, No. 21, pp. 905-907,
Fast Decipherment Algorithm for RSA Public-Key Cryptosystem, Oct. 14,
1982.
[7] Gerardo I. Simari, A Primer on Zero Knowledge Protocols, Universidad
Nacional del Sur - June 27, 2002
[8] G.Gaskel and M.Loi, Integrating SmartCards into Authentication Systems,
Procedings of Cryptography Poliyand Algorithms Confernce
vSpringerVerlag, Lecture Notes in Computer Sience,July195, pages270-
281.
[9] Joan Boyar, Katalin Friedl, and Carsten Lund. Practical zero-knowledge
proofs: Giving hints and using deficiencies. Lecture Notes in Computer
Science, 434:155-, 1990.
[10] Ronald Cramer and Victor Shoup. A practical public key cryptosystem
provably secure against adaptive chosen ciphertext attack. Lecture Notes
in Computer Science, 1462:13-, 1998.
[11] Bruce Schneier. Applied Cryptography, Wiley & Sons, 1994, ISBN 0-471-
59756-2, 1994.
[12] Brandt, et al., Advances in Cryptology—Crypto '88 Proceedings, pp. 583-
588, ―Zero-Knowledge Authentication Scheme with Secret Key
Exchange‖,Aug.21-25,1988.
[13] Fiat, et al., Advances in Cryptology—Crypto '86 Proceedings, pp. 186-
194, ―How to Prove Yourself: Practical Solutions to Identification and
Signature Problems‖, Aug. 11-15, 1986.

NS | 22
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
An Efficient Clustering Approach for Secure Multicast Key
Distribution in Mobile Ad Hoc Networks
D. Suganya Devi1, Dr. G. Padmavathi2,
1
Sr.Lecturer, Dept. of Computer Applications, SNR SONS College, Coimbatore.
2
Prof. and Head, Dept. of Computer Science, Avinashilingam University, Coimbatore.
Abstract
Many applications in mobile adhoc
networks involve group-oriented communication.
Multicast is an efficient way of supporting group
oriented applications, mainly in mobile environment
with limited bandwidth and limited power. For using
such applications in an adversarial environment as
military, it is necessary to provide secure multicast
communication. Key management is the fundamental
challenge in designing secure multicast
communications. Multicast key distribution has to
overcome the challenging element of “1 affects n”
phenomenon. To overcome this problem, multicast
group clustering is the best solution. This paper
proposes an efficient clustering approach for secure
multicast key distribution in mobile adhoc networks.
This approach proposes an efficient construction of
clusters, based on localization and mobility of nodes.
The efficiency is validated through simulation in
terms of average latency of key delivery, energy
consumption and key delivery ratio. Thus this
approach ensures a fast and efficient clustering
approach for secure multicast key distribution in
mobile adhoc networks.
Keywords: Key Management, Multicast, Security
and MANET
I. INTRODUCTION
A MANET (Mobile AdHoc NETwork) is an
autonomous collection of mobile users that offers
infrastructure-free communication over a shared
wireless medium. It is formed spontaneously without
any preplanning. MANETs are an ideal technology
for creating instant communication networks for
military battlefields and rescue operations.
Multicasting is a fundamental communication
paradigm for group-oriented communications such as
video conferencing, discussion forums, frequent
stock updates, video on demand (VoD), pay per view
programs, and advertising. One main advantage of
multicast communication is to save network
resources.
1
ISSSIS 2009
The combination of an ad hoc environment with
multicast services induces new challenges towards
the security infrastructure to enable acceptance and
wide deployment of multicast communication in
mobile adhoc environment. Indeed, even several
sensitive applications based on multicast
communications have to be secured within adhoc
environments. For example military applications such
as group communication in a battlefield and also
public security operations involving fire brigades and
policemen have to be secured.
In order to secure group communication, security
services such as authentication, data integrity, access
control and group confidentiality are required.
Among which group confidentiality is the most
important service for several applications. These
security services can be facilitated if group members
share a common secret, which in turn makes key
management a fundamental challenge in designing
secure multicast and reliable group communication
systems.
Most of these security services rely generally on
encryption using Traffic Encryption Keys (TEKs).
The Key management includes creating, distributing
and updating the keys then it constitutes a basic block
for secure group communication applications. Group
confidentiality requires that only valid users could
decrypt the multicast data. This can be done using
key distribution rules.
Non-group confidentiality: users that are never part
of the group, should not have access to any key that
can decrypt any multicast data sent to the group.
Forward secrecy: users, which left the group, should
not have access to any future key. This ensures that a
member cannot decrypt data after it leaves the group.
Backward secrecy: a new user that joins the session
should not have access to any old key. This ensures
that a member cannot decrypt data sent before it joins
the group.
Collusion freedom: any set of fraudulent users should
not be able to deduce the current used key.
Each member holds a key to encrypt and decrypt
the multicast data. When a member joins and leaves a
group, the key has to be updated and distributed to all
group members in order to meet the above
requirements. The process of updating the keys NS and
| 23
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
distributing them to the group members is called
rekeying operation. Rekeying is required in secure
multicast to ensure that a new member cannot
decrypt the stored multicast data (before its joining)
and prevents a leaving member from eavesdropping
future multicast data.
A critical problem with any rekey technique is
scalability. The rekey process should be done after
each membership change, and if the membership
changes are frequent, key management will require a
large number of key exchanges per unit time in order
to maintain both forward and backward secrecies.
The number of TEK update messages in the case of
frequent join and leave operations induces “1 affects
n” phenomenon.
To overcome this problem, several approaches
propose a multicast group clustering. Clustering is
dividing the multicast group into several sub-groups.
Each sub group is managed by a Local controller
(LC) is responsible for local key management within
its cluster. Thus, after Join or Leave procedures, only
members within the concerned cluster are affected by
rekeying process, and the local dynamics of a cluster
does not affect the other clusters of the group.
Moreover, few solutions for multicast group
clustering did consider the energy and latency issues
to achieve an efficient key distribution process,
whereas energy and latency constitutes main issue in
ad hoc environments.
This paper presents a new clustering scheme for
multicast key distribution in mobile adhoc networks.
It uses MAC 802.11 for providing communication
between nodes. It provides channel bandwidth for
minimization of congestion that occurs during
transmission. It also uses congestion control
mechanism to control flooding message. It sends
acknowledgement for each transmission in order to
reduce the retransmission. It uses DSDV (Destination
Sequenced Distance Vector) routing protocol to
maintain routing table periodically and event-
triggered exchanges the routing table for electing the
cluster head and distributing the keys when a node
joins and leaves. Thus this new clustering scheme
deals with integrating OMCT (Optimized Multicast
Cluster Tree) a dynamic clustering scheme with
DSDV routing protocol, which becomes easy to elect
the local controllers of the clusters and updates
periodically as the node joins and leaves the cluster.
This integrated approach is demonstrated as
Optimize the bandwidth consumption: This induces
minimization of multi hop retransmission within the
cluster by providing acknowledgement.
2
ISSSIS 2009
Optimize the latency: Thus induces minimization of
data transmission time.
Optimize the energy consumption: This induces
minimization of number of transmissions for the
forwarding messages to all the clusters.
The remainder of this paper is structured as
follows. Section 2 presents the related works about
multicast key management protocols in MANETs.
Section 3 deals with the proposed approach, which
reduces rekeying overhead based on group clustering.
Section 4 presents the simulation results of the
proposed approach. Finally, Section 5 concludes the
paper.
II. RELATED WORKS
Key management is the core challenging area in
security. Existing multicast key management
approaches are presented in the coming section.
A. Multicast Key management approach
Several key management protocols for securing
multicast communications in ad hoc networks have
been proposed. They are basically classified into
three main approaches as shown in figure 1.
Key management Protocols
Centralized Distributed Decentralized
Static Dynamic
clustering clustering
Figure 1. Classification of multicast key management
Approaches
Centralized approach: In Centralized approach, a
designated single entity (eg. The global controller,
the group leader or a key server) is responsible for
generation and distribution of unique symmetric key
to all the group members. For example GKMAN[11]
and KAYA AND AL[8] belong to this approach.
Distributed approach: In Distributed approach, all
multicast group members cooperate and collaborate
to ensure a secure multicast communication between
them. For example Chiang and AL[6] proposes a
distributed group key management protocol for
NS | 24
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
MANET based on GPS measures and on the group
key exchange.
Decentralized approach, The decentralized approach
divides the multicast group into subgroups or
clusters, each sub-group is managed by a LC (Local
Controller) responsible for security management of
members and its subgroup. Two kinds of
decentralized protocols are distinguished as static
clustering and dynamic clustering.
In Static clustering approach, the multicast
group is initially divided into several subgroups.
Each subgroup shares a local session key managed by
LC. Example: IOLUS [9] and DEP[ 7] belongs to the
category which are more scalable than centralized
protocol.
Dynamic clustering approach aims to solve
the “1 affect n” phenomenon. This approach starts a
multicast session with centralized key management
and divide the group dynamically. Example: AKMP
[1], SAKM [5] belong to this approach and are
dedicated to wired networks. Enhanced BAAL [2]
and OMCT [3,4] proposes dynamic clustering
scheme for multicast key distribution in adhoc
networks.
OMCT [3,4] (Optimized Multicast Cluster
Tree) is a dynamic clustering scheme for multicast
key distribution dedicated to operate in ad hoc
networks. This scheme optimizes energy
consumption and latency for key delivery. OMCT
needs the geographical location information of all
group members in the construction of the key
distribution tree. Thus, a Global Positioning System
(GPS) is assumed to be available. During multicast
group initialization, every group member is attached
to the group source, called Global Controller (GC).
This entity is responsible for the TEK generation and
its distribution to all group receivers. In addition, the
GC periodically verifies whether the group is highly
correlated, and verifies whether the key distribution
process is optimal. This is done by evaluation of
cluster cohesion as
Cluster Cohesion = M
C reduce the retransmission.
M= members in the LC range
C = Cluster members number
This parameter measures the proximity of the
cluster members compared to their controller. This
cohesion parameter allows verifying if a cluster is
strongly correlated.
Once the clusters are created within the multicast
group, the new LC become responsible for the local
key management and distribution to their local
members, and also for the maintenance of the
3
ISSSIS 2009
strongly correlated clusters property. The election of
local controllers is done according to the localization
and GPS information of the group members, which
does not reflect the true connectivity between nodes.
B. DSDV
DSDV (Destination Sequenced Distance Vector)
is a table driven proactive routing protocol designed
for mobile ad hoc networks. This protocol maintains
routing table as a permanent storage. Routes are
maintained through periodically and event triggered
exchanges the routing table as the node join and
leave. Route selection is based on optimization of
distance vector. It avoids routing loops and each node
has a unique sequence number which updates
periodically. It is mainly used for intra cluster
routing. It allows fast reaction to topology changes.
Thus DSDV protocol is simple, more dynamic and
needs less convergence time. Thus the proposed
approach uses DSDV routing protocol to find 1-hop
neighborhood of each node.
Each node in the network selects, its own child
among its symmetric 1-hop neighborhood. It must
reach all its symmetric strict 2-hop neighbors,
through its LCs.
The proposal of this paper is to enhance OMCT
by integrating with DSDV routing protocol, which
makes easy to elect the Local Controllers of the
clusters and updates periodically as the node joins
and leaves the cluster.
III OMCT WITH DSDV
The main idea of this clustering key distribution
protocol is to use DSDV routing protocol to
elect the local controllers of the created clusters. It
uses MAC 802.11 for providing communication
between nodes. It provides channel bandwidth for
minimization of congestion that occurs during
transmission. It uses congestion control mechanism
to control flooding messages. It sends
acknowledgement for each transmission in order to
The principle of this clustering scheme is to start
with the group source GC, to collect its 1-hop
neighbors by DSDV, and to elect LCs which are
group members and which have child group members
(the LC belongs to the unicast path between the
source and the child group members). The selected
nodes will be elected as local controllers.
At this step, the group members which are 2-
hops neighbors of the group source are covered by
the elected LCs. This scheme iterates until LCs
NS | 25
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

covers all the group members. The same rule is All the members reachable by this new LC will form
executed for a node, which is a group member, and a new cluster.
which has child group members, becomes a LC. The Step3:
multicast tree is thus constructed as shown in figure If group members exist which do not belong to
2. formed clusters due to the cohesion parameter
smaller than the threshold. This approach chooses
from these remaining group members the nodes that
have the maximum reachability to the others nodes in
one hop. This reachability information is collected
through the DSDV routing protocol, consolidated
through OMCT signaling. However, the created
clusters do not cover group members yet. Thus,
nodes are selected as local controllers for the
remaining group members.
The principles of the proposed clustering approach
are described in algorithm 1.
Algorithm 1 OMCT_with_DSDV (Clusterhead)
//STEP 1
Figure 2. OMCT with DSDV ListLCs = Cluster Head
In this example shown in figure 2, the group Listnodes = {1, 2, 3, ..., c} //c is the number of
source GC 0 collects its 1-hop neighbors by DSDV, cluster members
and elects LCs node 1 and 7, which are group //STEP 2
members and which have child group members as for ( i = 1 to List nodes ) do
2,3,4,5,6 and 8,9,10,11,12 respectively. The selected if (Listnodes ≠ φ ) then
nodes will be elected as local controllers. However, if ( i ε multicast group) && ( i has group
during the election of these LCs, their authentication members
must be checked to avoid malicious behaviors. To do Childs) then
so, authentication and identification of nodes are ListLCs = ListLCs ∪ { i } ; // Add i to the local
ensured via the CBIDs technique CryptoBased controllers list
IDentifiers [10]. Each node in the network generates Listnodes = Listnodes / {group members covered
its public and private keys and computes its CBID by i };
according to these keys. The crypto based identifiers // Remove members covered by i of the members
are statically unique and cryptographically verifiable, list
ensuring a strong cryptographic relation between OMCT_with_DSDV ( i ) ;
public and private keys, and it is almost impossible // Execute recursively the algorithm applied to i
that two entities in the network have the same end if
identifier. end if
A. OMCT with DSDV Algorithm end for
The main steps of OMCT with DSDV algorithm are //STEP 3
as follows: if (Listnodes ≠ φ ) then
Step1: for ( j = 1 to Listnodesnumber ) do
Initially, the list of LCs contains only the source Compute the reachability factor of j : number of
of the group, which computes the cohesion factor of members in List nodes, in 1-hop from the node
its group and decides to cluster it by electing new end for
local controllers and forming new clusters. The list of while (List nodes = i ) do
the current LC is collected. // Group of child nodes provide reachabi;ity
Step2: factor
Traverse the list nodes, while there are group ListLCs = Listnodes {i}; // LC joins the new
members not yet covered by LCs, and verify for each member lists
one if it is a group member and if it has a child group ListLCs ≠ Listnodes {i};
members. In case of success, add the LC to the list of // Remove from the members list
LCs, and withdraw from the list of group members. end while
end if
NS | 26

4
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
B. Key Distribution Scheme
The source encrypts multicast data with the
TEK, and then sends it to all the members of the
group following the multicast tree. The TEK
distribution is achieved in parallel, according to the
following steps.
Initially, the entire group members receive
from the source by unicast the session key KEKcsg-0
(key encryption key of the sub-group 0), encrypted
with their respective public keys. New clusters will
then be created dynamically.
Figure 3: Key Distribution Scheme
The local controllers form a multicast group
GLC (Group of Local Controllers), and share a key
called KEKccl. Each local controller should join this
group. The local controllers decrypt this message,
extract the TEK, re encrypt it with their respective
clusters keys and send it to all their local members.
To send the TEK to all the group members, the
source encrypts it with KEKcsg-0 and sends it to all
the members of its sub-group as shown in figure 3.
The major advantage of this solution is to
minimize the overhead of decryption and re-
encryption process for the local controllers. Hence
local controller should only to decrypt and re-encrypt
the TEK and not all the multicast flow.
IV EXPERIMENTAL RESULTS
The objective of the simulations is to enhance the
OMCT clustering algorithm with this new approach
of integrating OMCT and DSDV, based on the
following factors:
Latency: Average delay for keys delivery from a
sender to a receiver. This factor allows evaluating the
average latency to forward a key from a LC to its
5
ISSSIS 2009
cluster members. To achieve an efficient
synchronization between data encryption and
decryption, this factor should be optimized.
Energy: Sum of energy units required for keys
exchange messages transmissions throughout the
simulation duration. The evaluation of this factor is
necessary because the energy consumption is a major
challenge in ad hoc networks.
Key Delivery Ratio (KDR): Number of received keys
divided by number of sent keys. This metric allows to
evaluate the reliability of the protocol in term of key
transmission from the source to the group members.
This proposed approach is simulated under
linux Fedearo, using the network simulator NS2
version ns-allinone-2.29. The simulation environment
is composed of:
Area: 1000*1000 m.
Number of nodes: 13,28.
Simulation duration: 200 sec. During the first 100 sec
the nodes move in the network without generating
any traffic, allowing the stability of the simulator
system before the traffic generation.
Physical/Mac layer: IEEE 802.11.
Mobility model: random waypoint model with pause
time equal to 20 sec and with maximum nodes
movement speed equal to 3 m/s.
Routing protocol: DSDV
Traffic: only unicast distribution keys traffic exists in
the simulation. The source of the group sends the
TEK to the LCs, which forward it to their local
members. The results of this simulation are presented
in Figure 4. The OMCT with DSDV approach brings
a valuable profit in terms of key delivery ratio,
compared to the OMCT algorithm. Indeed, this
approach of combining OMCT and DSDV divides
the multicast group with the effective connectivity
between nodes.
Figure 4 a: Average Latency in OMCT with DSDV
NS | 27
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
Figure 4 b: Key Delivery Ratio in OMCT with
DSDV
Figure 4 c: Energy Consumption in OMCT with
DSDV
Thus, the keys distribution for a multicast tree
allows a better key delivery ratio. The average
latency of key delivery and the energy consumption
are better with this approach of integrating OMCT
with DSDV. This is due to the fact that the number of
clusters created is more in OMCT. So more local
controllers needs to forward keys from the source to
the group members. This consumes more energy and
cause more signals interferences, which in turn
increases the average delay of the key delivery.
V CONCLUSIONS
This paper provides a scalable approach for
secure multicast key distribution dedicated to operate
in MANETs. This approach is based on simple and
efficient technique of clustering for key distribution.
This approach enhances the OMCT algorithm by
integrating the DSDV routing protocol, for the
6
ISSSIS 2009
election of the local controllers. The efficiency of this
approach is validated through simulation, in terms of
average latency of key delivery, energy consumption
and key delivery ratio. Thus this approach ensures a
fast and efficient clustering for secure multicast key
distribution in mobile adhoc networks.
References
[1] H. Bettahar, A. Bouabdallah, and Y. Challal. An
adaptive key management protocol for secure
multicast. In ICCCN, Florida USA, October 2002.
[2] M. Bouassida, I. Chrisment, and O. Festor. An
Enhanced Hybrid Key Management Protocol for
Secure Multicast in Ad Hoc Networks. In Networking
2004, Greece, May 2004.
[3] M. Bouassida, I. Chrisment, and O. Festor.
Efficient Clustering for Multicast Key Distribution in
MANETs. In Networking 2005, International IFIP
TC6 Networking Conference, Waterloo, CANADA,
May 2005.
[4] M. Bouassida, I. Chrisment, and O. Festor:
Efficient Group Key Management Protocol in
MANETs using the Multipoint Relaying Technique.
International Conference on Mobile Communications
2006.
[5] Y. Challal, H. Bettahar, and A. Bouabdallah.
SAKM: A Scalable and Adaptive Key Management
Approach for Multicast Communications. ACM
SIGCOMM, April 2004.
[6] T. Chiang and Y. Huang. Group keys and the
multicast security in ad hoc networks. In Proceedings
of the 2003 International Conference on Parallel
Processing Workshops, 2003.
[7] L. Dondeti, S. Mukherjee, and A. Samal. Secure
one-to many group communication sing dual
encryption. In ComputCom-mun.23, 17 (November),
1999.
[8] T. Kaya, G. Lin, G. Noubir, and A. Yilmaz.
Secure multicast groups on ad hoc networks. In
Proceedings of the 1st ACM workshop on security of
ad hoc and sensor networks, pages 94–102. ACM
Press, 2003.
[9] S. Mittra. Iolus: A framework for scalable secure
multicasting. In SIGCOMM, pages 277–288, 1997.
[10] G. Montenegro and C. Castelluccia. Statistically
Unique and Cryptographically Verifiable Identifiers
and Addresses. In ISOC Network and Distributed
System Security Symposium(NDSS), February 2002.
[11] S. Zhu, S. Setia, S. Xu, and S. Jajodia. Gkmpan:
An efficient group rekeying scheme for secure
multicast in ad-hocnetworks. In MobiQuitous, pages
42–51, 2004.
NS | 28
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

DESIGN OF THE GRID-WIDE INTRUSION DETECTION SYSTEM

G.Mohana Priya, V.K. Manavala Sundram

Velalar College of Engineering and Technology
Thindal, Erode-638 009
gvmohana@gmail.com, manosundar@gmail.com

Abstract shared resources from all possible security

Security is the most important aspect of
any networking environment. Recently, the
advancements in the field of Grid-Computing
have increased the need of more secure services.
Intrusion is one of the most alarming threats to
the security of Grid services and we have to
develop an easy, dynamic and effective method
to control intrusion without affecting the Quality
of Service. The main aim here is to detect the
Distributed Denial of Service (DDoS) attacks.
These attacks are directed at an Internet server.
In a Distributed denial-of-service (DDoS) attack,
a cohort of malicious or compromised hosts
coordinates to send a large volume of aggregate
traffic to a victim server. In such an episode,
server resources are usually under much more
stress than resources of the connecting network.
1. Introduction
Grid Computing enables the sharing of
heterogeneous resources within Virtual
Organizations. Since entities in virtual
organizations are independently administrated
without global trust, the management of access
control and providing Intrusion Detection is
critical for Grid services
The grid is a large scale distributed
computing environment that enables the sharing
and co-coordinated use of diverse resources
including computational resources, storage,
information and other devices. The grid supports
the simultaneous use of large number of
resources providing dynamic quality of service
enforcement, co-allocation, resource discovery
and other services for resource management.
The Grid is built from a dynamic
collection of individuals, institutions and enables
the creation of “virtual organizations”. Since
these virtual organizations extend across multi-
institutional domains, it is usually constructed
without global-trust. Therefore, security issues of
authentication, authorization, delegation,
certificate management and policy management
must be carefully considered to protect the
hazards including unauthorized use of resources,
misuse of resources, impersonation, etc.
Moreover to cope with platform heterogeneity
and administrative independence in Grid
environment, heterogeneous local security
mechanisms (Kerberos, etc) and diverse forms of
local security policies (file system access matrix,
configuration file, etc) should be incorporated.
Intrusions are defined as attempts to
compromise confidentiality, integrity, or
availability of data, or to bypass the security
mechanisms of an IT system. An intrusion may
be generally described as a sequence of related
actions by a malicious adversary that results in
the occurrence of unauthorized breaches to a
target system or network.
Intrusion detection has been an active
field of research for about two decades, starting
in 1980 with the publication of John Anderson’s
Computer Security Threat Monitoring and
Surveillance. Attacks on the nation’s computer
infrastructures are a growing problem. Many
early attackers simply wanted to prove that they
could break into systems; increasingly
nowadays, the trend is toward intrusions
motivated by financial, political, and military
objectives.
Security is a very important issue that
must exist to enable the creation of Grid
environments. The Grid needs intrusion detection
as a second line of defense. It is very important
because the current Grid security mechanisms
can be penetrated and to provide protection from
insiders. Intrusion detection systems are based on
the assumption that normal use of the system is
different from malicious use.
Effective intrusion detection systems are critical
components in the modern GRID systems. Up to
now, very few works discusses the GRID
intrusion detection techniques. So there is a lot of
scope for improvement in the field.
2. Related Work

NS | 29
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
There have been several efforts to
design reliable and efficient intrusion detection
systems for grid environment. We discuss some
which are relevant to our approach.
The first approach is the
Signature/pattern based IDS are also known as
the knowledge based IDS. This intrusion
detection system contains a database of known
vulnerabilities. It monitors traffic and seeks a
pattern or a signature match. The drawback of
this system is the Knowledge about attacks is
much focused, dependent on the operating
system, version, platform, and application. As a
result, intrusion detection tool is closely tied to a
given environment.
The second approach is the
Heuristic/Anomaly detection is also known as the
behavior based IDS. These types of IDS tools
analyze traffic patterns and infer normal activity.
It then, applies statistical or heuristic measures to
events to determine if they match the
model/statistical normal. Events outside accepted
normal behavior generate alerts. The drawback
of this system is Current implementations
provide high false alarms. Requires expertise to
figure out what triggered an alarm.
3. Background
The authorization is a continuous
process. Policies are written for each user of the
Grid Services and are continuously monitored of
their Identity, Amount of CPU usage, Frequency
of using the services, etc. According to the
behavior of the user, the policy decisions are
made and necessary actions are taken.
Authorization is the process of
ascertaining that an entity with a particular
identity or set of attributes has the permission to
perform a particular action on a particular
resource. This step is preceded by authentication
where the identity of the entity is established.
In Grid services, the server might
authorize the client when an operation is invoked
on the service. That is termed server-side
authorization. Similarly, the client might
authorize the server prior to or during an
invocation, which is known as client-side
authorization.
Intrusions are detected using the
Authorization policies written for each grid
service. The incoming client requests are
checked for their privileges and any client
surpassing the limit as mentioned in the policies
are treated as intruders for a specific amount of
time.
ISSSIS 2009
Distributed Denial of Service Attack
(DDoS) are directed at an Internet server. In a
DDoS attack, a cohort of malicious or
compromised hosts coordinates to send a large
volume of aggregate traffic to a victim server. In
such an episode, server resources are usually
under much more stress than resources of the
connecting network.
There are two reasons for overloading;
first commercial servers are typically hosted by
ISP’s at web centers quite close to the backbone
network with high capacity pipes.
Second, the server will generally see the
full force of the attack traffic, which has gone
through aggregation inside the network. Hence,
the server system can become totally
incapacitated under extreme overload conditions.
Some of the concepts which are used to
detect the intrusion in the grid environment are:
3.1 Access Control
Many applications require fine-grained
access controls, perhaps administered through a
number of different policy authorities and
distributed decision points. Languages exist for
the expression of those policies, but their
practical application -- usable policy design,
communication in an accessible form, and
rigorous validation remain to be thoroughly
explored. There is already considerable interest
in combination of these languages and their
appropriate use in Grid contexts.
3.2 A policy reference model and
supporting protocols.
The authorization and policy
management system is complex enough to need a
reference model that identifies the main
components and the protocols by which they
communicate. Delivery of such a model would
facilitate the development of inter operable
components, as opposed to the present situation
where each project tends to adopt its own policy
language. Emerging standards (SAML,
XACML) provide a starting point, but more
development and consolidation is needed to
create a comprehensive model.
3.3 Policy creation and management
The manageability of authorization
policies for both users and systems must be
addressed if more complex grids are to be
established, providing functionality, scale and
the capability to deal with the creation and
destruction of short-lived virtual organizations.
Interoperability and the capability to provide
NS | 30
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
authorization and delegation across domains as
disparate parties come together in virtual
organizations are critical.
3.4 An improved general model for
Delegation and Privacy.
In the long-term, scalability, functional
requirements and privacy considerations all
require a new, detailed, model of delegation and
token privacy. Fine grain delegation and pull as
well as push mechanisms for delegation need to
be considered.
4. Design
The grid-wide intrusion detection is
based on studying the behavior of the users who
are requesting for the service and compare them
with the policies written for that particular
service. Actions should be taken as specified in
the EACL listing. The design is discussed in
detail as follows.
4.1 EACL POLICY
The Extended Access Control List is the
language used to define policies for services. It
has been extended to include information such as
Time of day, Frequency and System load.
One may think about the security policy
associated with a protected resource as a set of
operations, which a defined set, of principals is
allowed to perform on the target resource, and
optional constraints placed on the granted
operations. For example, a system administrator
can define the following security policy to
govern access to a user: "The service can be
accessed only during Monday through Friday,
from 9:00AM to 6:00PM".
This policy can be described by an ACL
mechanism, where for each resource, a list of
valid entities is granted a set of access rights. The
same policy can be implemented using a
capability mechanism. EACL has the capability
abstractions and is extended to allow conditional
restrictions on access rights.
The EACL policy is written in an XML
file which is written using the XACML Schema
(Extensible Access Control Markup Language)
XACML provides a policy language,
which allows administrators to define the access
control requirements for their application
resources. The language and schema support
include data types, functions, and combining
logic which allow complex (or simple) rules to
be defined. XACML also includes an access
ISSSIS 2009
decision language used to represent the runtime
request for a resource.
When a policy is located which protects a
resource, functions compare attributes in the
request against attributes contained in the policy
rules ultimately yielding a permit or deny
decision.
Figure 1: Authorization process using XACML
4.2 Types of Intrusions
The main type of intrusion under which
all other intrusions are carried out is IP spoofing.
In this intrusion detection system, two types of
attacks are identified and corrected. The first one
is unnecessary use of services in a high
frequency and making the service unavailable to
another IP due to IP spoofing. The second one is
using all the services available in the server
thereby increasing the utilization of the CPU.
Due to this, the throughput and performance of
the CPU is highly degraded.
All these come under the denial of
service attack which is explained as follows. To
keep a large-scale attack on a machine or group
of machines from being detected, spoofing is
often used by the malefactors responsible for the
event to disguise the source of the attacks and
make it difficult to shut it off.
Spoofing takes on a whole new level of
severity when multiple hosts are sending
constant streams of packet to the DoS target. In
that case, all the transmissions are generally
spoofed, making it very difficult to track down
the sources of the storm.
These types of intrusions are detected by writing
EACL policies for each service and evaluating
them accordingly. The evaluation is carried out
in the Job Manager Service in the Globus-
Container.
NS | 31
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
The design of the project contains three steps:
1) Writing EACL policy for each policy
2) Parsing the XML file and passing the
values to the authorization program.
3) Performing each phase of policy
evaluation in the authorization module.
4.3 POLICY EVALUATION
The authorization module allows
applications to use the security infrastructure to
implement security policies. This framework is
based on evaluating the "policy set" of the EACL
consecutively, and trying to find a policy that the
current request can satisfy.
Also, each policy comprises a list of
conditions, which is the basic unit of EACL
policy.
Here, we have two types of policy:
positive policy GRANTS a request if all its
corresponding conditions are met.
In contrast, negative policy REJECTS a request if
all its corresponding conditions are unmet.
"Conditions" check access control
constraints for time, user identity, user location,
etc. imposed by local security mechanisms, grid
security mechanism and security variables.
Besides passively granting or denying an
incoming request, the GAA-API framework also
supports real-time inspection of suspicious
activity and dynamic reconfiguration of system
protection as responses.
For this purpose, we introduce a special
condition called "action". Instead of reporting
MET or UNMET to GAA-API, "actions"
perform logging, notification, modifying security
variables or other operations that apply to local
platforms or the Grid environment.
Most access control systems today are
based on the premise that once a request is
authorized for an operation, the access will be
granted unconditionally for all following
operations. This practice can not protect the
system from abuses of user privileges during
execution.
In contrast, this framework supports
real-time monitoring of the execution process
and allows dynamic revocation of granted access
rights.
This approach introduces a three-phase
policy enforcement scheme:
Pre-execution phase: decides whether to grant
or deny a request before its execution.
Mid-execution phase: checks whether there are
abuses of user privileges or resource
ISSSIS 2009
consumption exceeding quotas during the
execution. If yes, GAA-API will notify the grid
service to abort the current job. These checks can
be performed either on certain checkpoints or in
a periodic manner.
Post-execution phase: decides whether the job
is regarded as "successful" or "failed" after its
completion.
4.4JOB MANAGER IN GRID
A Virtual Organization (VO) wants to
provide limited services to its members. Allow
most users to only run a small number of
services but possibly with high resource limits. It
also allows developers to run a wider range of
programs such as compilers or debuggers but
with stricter resource limits. Administrators may
want to monitor jobs and kill misbehaving user
jobs.
Users in the grid-map file have the
equivalent of a login account on the host. No
limit on binaries that can be executed. No limit
on compute time or disk resources. All fine-grain
authorization is done by OS on the basis of the
local user id assigned to the job. Users can kill or
manage their own jobs, but no other party can.
A Job Manager does no authorization
on job startup. Gatekeeper verifies that the user
has privileges to run on the machine before
starting the job manager. It only allows the
initiator of the job to issue job control directives
but it also runs with uid of the user so it can only
control jobs started by the initial user.
This intrusion detection model detects
intrusions by checking the access behavior of
each user before providing the requested service.
The server contacts the job-manger for executing
the service in practice. But his authorization
module by-passes this step of checking the Grid-
map files for authenticated users. Instead the
service module calls the authorization module
which is mentioned in the “deploy-server.wsdd”,
a web-service description file which species the
file to be accessed for security purposes. The
class name of the authorization module is
specified in an XML file.
Figure 2::GridMap PDP
The authorization module is where the
policies are evaluated and the corresponding
actions are taken. Hence in the process of
NS | 32
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

authorization it is called the Policy Definition //

Point (a PDP). }
Figure 3: PermitOnlyPDP public void close() throws CloseException {
//
}

public String[] getPolicyNames() {

return null;
}

public Node getPolicy(Node node)

throws InvalidPolicyException {
return null;
}

The authorization chain can be public Node setPolicy(Node node)

configured at the (WSRF) resource, service, or throws InvalidPolicyException {
container level, and the chain to use is picked up return null;
in that order of precedence. If no resource-level }
chain is specified, the service-level chain is used, }
and if that is not specified, the container-level
chain is used.
The GT4 implementation uses deny
overrides as the combining algorithm, which
means that if a DENY decision is returned by any
one of the PDPs in the chain, the request is
denied. Furthermore, once a DENY is returned by
a PDP, subsequent PDPs in the chain are not
evaluated. The framework returns a PERMIT
only if all the PDP s in the chain return a
PERMIT.

4.5 STRUCTURE OF A POLICY Figure 4: The three phases of policy evaluation

DEFINITION POINT

The three phases of condition is done using the

public class PermitOnlyPDP implements PDP {
policy definition point module:
static Log logger = LogFactory.getLog( 1) Get Object Policy:
PermitOnlyPDP.class.getName()); The policies are read from the XACML
file using the XML parsers DOM and
public boolean isPermitted(Subject subject, SAX parsers. The APIs are provided in
MessageContext ctx, the Java library
QName operation) 2) Check Authorization:
throws AuthorizationException { The incoming requests are monitored
using the GT4 resources.
logger.debug("decision = PERMIT"); 3) Execution-Action:
return true; Depending upon the behaviour of the
} users accessing the services, the
corresponding actions are taken
public void initialize(PDPConfig pdpConfig, according to the specifications in the
String name, policy file.
String id)
throws InitializeException {

NS | 33
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

5. Implementation 5.2 Example Policy:

The EACL policies are written <Policy type="negative">
according to the XACML schema, parsed using
SAX and DOM parser, evaluated in the
<pre>
authorization module as called by the Job <Condition>
manager and necessary actions are taken. <subject
value="/O=Grid/OU=GlobusTest/O
5.1 Writing EACL Policy U=simpleCA-
<PolicySet>: The root tag of EACL
policy. Attribute "domain" (optional) regulates test/OU=grid/CN=guser" />
whether it is a global, host or local security .
policy. .
<Policy>: Each <PolicySet> comprises
an ordered list of <Policy>. Attribute "type"
.
regulates whether it is a positive policy (default) .
or a negative policy. Attribute "auth" (optional) <Action when="succ"
and "right" (optional) specify the grid services type="append_log" value="id denied
and requested access rights to which the policy
applies. access"/>
<Pre> <Mid> <Post>: These tags <Action when="fail"
separate the three phases of policy enforcement. type="append_log"
They correspond to pre-execution phase, mid-
execution phase and post-execution phase
value="Authorization successful"/>
respectively.
<Condition>: Defines a condition that This is classified as a negative policy because
applies to this policy. Attribute "type" and "auth" when the condition is satisfied the IP should be
(optional) regulate its corresponding security denied authorization. The Banned Ips are listed
mechanism. in the Subject Element of the Condition element.
Also, we have three ways to define the The action taken when the condition is true is:
constraint of a condition. “id denied acces”
Defined by the attribute "value", which provides The action taken when the condition is false is:
the constraint directly. “Authorization successful"
Defined by the attribute "link", which extracts
the constraint from the external file referred to by 5.3 Writing XML Parser
a pathname or URL. The next step after writing the policy is
Defined in the domain of <Condition> tag. The to parse the file and send it to the authorization
constraint here could be specified in XML module. The XML Parser is written in JAVA
format. using the SAX and DOM packages available in
<Action>: Defines an action that may jdk 1.5.
be performed by this policy. Attributes "type", • SAX- Simple API for XML
"auth", "value" and "link" are identical to those • DOM-Document Object Model
of <Condition>. Moreover, we have an SAX is an Event Driven model, which triggers
additional attribute "when" (optional), which has the methods whenever an element is started.
three possible values: DOM uses Objects, which keeps track of each
Both: (default value) action is performed no element and its parents.
matter the previous condition is MET or The function is written in the
UNMET. PermitOnlyPDP which extends the PDP interface
Succ: action is performed only when the in is Permitted Boolean function. This function
previous condition is MET. takes the subject and the IP of the requesting
Fail: action is performed only when the client as a parameter. When the request arrives,
previous condition is UNMET. the function checks for the Spoof log which is
maintained. If the current user and the IP are
already present in the spoofed list and the time
difference is very less, then the user is treated as
an illegitimate user.

NS | 34
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
If not present, the function checks for
the database whether the current IP is used by
any other user. And also checks for the other Ips
the currents user has used before. If the IP is
repeated and some other user has already used
this IP, the the current user is said to have
spoofed the IP and hence banned temporarily
from using the services with that spoofed IP
thereby preventing the illegal use of resources in
the name of an authorized USER.
6. Conclusion
This intrusion detection model provides
a straightforward and uniform interface for
access control. By integrating into grid services,
instead of rewriting and recompiling the source
code for access control, administrators can easily
customize their specific security requirements by
simply writing Extended Access Control List
(EACL) policies in plaintext.
By implementing each mechanism as a
condition, it can easily and seamlessly
incorporate multiple grid security mechanisms
and local security mechanisms together. The
interrelation (AND, OR, etc.) among these
mechanisms can be freely regulated by EACL.
Moreover, to introduce a new security
mechanism into the Grid system, we only need to
implement it as a new condition. This
mechanism could dynamically take effect as
soon as we add the corresponding condition into
the EACL policy.
Aided by GSTP(the database
maintaining all the details of the users identity,
timing and resource utilization), the model can
make interoperable access control decisions on
the basis of real-time information from other grid
services that are located remotely. Thus,
advanced access control in a distributed manner
such as global quota, dynamic lockdown, etc.
can be fulfilled straightforwardly.
This supports a hierarchy of security
policies. Besides the local policy defined for
each grid service, host administrators can impose
their host-wide policies, and virtual organization
administrators can impose its global policy on all
grid services within their corresponding
domains. Since it's difficult for every individual
grid service to define its local policy elaborately
enough to protect itself from all potential
security threats dynamically, conforming to host-
wide policies and global policies could give the
grid service a more robust level of security.
ISSSIS 2009
Besides making access control decisions, this
model also support functions such as
notification, logging, dynamic intrusion detection
& response that are correlated to the
authorization phase.
7. References
[1]GIDA: Toward Enabling Grid Intrusion Detection
SystemsM. F. Tolba M. S. Abdel-Wahab I. A. Taha A. M.
Al-Shishtaw 2006
[2]Towards a Grid-wide Intrusion Detection System Stuart
Kenny and Brian Coghlan Trinity College Dublin, Ireland
2005
[3]Simon Godik, Tim Moses, Extensible Access Control
Markup Language (XACML) Version 1.0
[4]IEEE: Defending Yourself:The Role of Intrusion
Detection Systems John McHugh, Alan Christie, and Julia
Allen,Software Engineering Institute, CERT Coordination
Center
Integrating Grid with Intrusion Detection Fang-Yie Leu*, Jia-
Chun Lin**, Ming-Chang Li, Chao-Tung Yang, Po-Chi Shih
Department of Computer Science and Information
Engineering, Tung-Hai University, Taiwan. -2006
[5]I. Foster, C. Kesselman, G. Tsudik, S. Tuecke, A Security
Architecture for Computational Grids.Proc. 5th ACM
Conference on Computer and Communications Security
Conference, pp. 83-92,1998.
[6]Federated Access Control and Intrusion Detection for Grid
Computing 2003,Li Zhou Clifford Neuman,Information
Science Institue,University of Southern California,Marina del
Ray, CA 90292 {zhou,bcn}@isi.edu
[7]The Anatomy of the Grid Enabling Scalable Virtual
Organizations *
Ian Foster Carl Kesselman § Steven Tuecke • {foster,
tuecke}@mcs.anl.gov, carl@isi.edu-2002
[8] The Physiology of the Grid An Open Grid Services
Architecture for Distributed Systems Integration Ian Foster,
Carl Kesselman, Jeffrey M. Nick, Steven Tuecke,2006
[9]Choon, O. T.; Samsudim, A. Grid-based Intrusion
Detection System. The 9th IEEE Asia-Pacific Conference
Communications, September 2003.
[10]Fang-Yie Leu , Jia-Chun Lin , Ming-Chang Li , Chao-
Tung Yang , Po-Chi Shih, Integrating Grid with Intrusion
Detection, Proceedings of the 19th International Conference
on Advanced Information Networking and Applications,
p.304-309, March 25-30, 2005
[11]Wood, M. Intrusion Detection message exchange
requirements. Draft-ietf-idwg-requirements-10, October
2002. Available at http://www.ietf.org/internet-drafts/draft-
ietf-idwg-requirements-10.txt. Access March 2006.
[12] FY Leu, JC Lin, MC Li, CT Yang - Proceedings of the
29th Annual International Computer, 2005 –
doi.ieeecomputersociety.org Page 1. A Performance-Based
Grid Intrusion Detection System Fang-Yie Leu,Jia-Chun
Lin, Ming-Chang Li, Chao-Tung Yang Department.
[13]Giles, K., Marchette, D. J., and Priebe, C. E. (2003).A
backscatter characterization of denial-of-service attacks in
Proceedings of the Joint Statistical Meetings
[14]Marchette, D.J. Computer Intrusion Detection and
Network Monitoring: A Statistical Viewpoint. Springer, New
York. 2001
[15]Marchette, D.J. (2002). A study of denial of service
attacks on the internet.
In Proceedings of the Army Conference on Applied
Statistics, pages 41-60.
[16]Moore, D., Voelker, G.M., and Savage, S. (2001).
Infering Internet denial-of-service activity. Available on the
web at www.usenix.org/publications/library/
NS | 35
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

proceedings/sec01/moore.html. for false positive reduction, April 07 2006. URL

USENIX Security '01 http://arxiv.org/ abs/cs/0604026.
[17]Giovanni Vigna, Richard A. Kemmerer, NetSTAT:a [32]InMon Corporation. Using sflow and inmon traffic
network-based Intrusion Detection Approach, Proceedings of server for intruion detection
14th Annual Computer SecurityApplications Conference, and other security applicaitons, 2001. URL
1998, pp. 25 –34. http://www.inmon.com/pdf/
[18] W. Lee, S. J. Stolfo, K. Mok, A Data MiningFramework sFlowSecurity.pdf.
for Building Intrusion Detection [33] Andy Cuff. Intrusion detection terminology, part i,
Models, Proceedings of 1999 IEEE Symposium of Security september 2003a. URL
and Privacy, pp. 120-132. http://www.securityfocus.com/infocus/1728.
[19] A. Valdes, D. Anderson, Statistical Methods for [34]Andy Cuff. Intrusion detection terminology, part ii,
Computer Usage Anomaly Detection Using september 2003b. URL
NIDES, Technical report, SRI International, January 1995. http://www.securityfocus.com/infocus/1733.
[20] Terran lane, Carla E. Brodley, Temporal Sequence [35]L. Deri. nprobe: an open source netflow probe for
Learning and Data Reduction for anomaly Detection, Vol. 2, gigabit networks, May 24
No. 3, August 1999, pp. 295-331. 2003. URL
[21] J. M. Bonifacio, et al., Neural Networks Applied in http://citeseer.ist.psu.edu/607433.html;http://jake.unipi.it/~de
Intrusion Detection System, IEEE, 1998, pp.205-210 ri/nProbe.pdf.
[22] H. S. Javitz, A. Valdes, the NIDES Statistical [36]L. Deri. ncap: wire-speed packet capture and
Component: Description and Justification, Technical report, transmission, 2005. URL
SRI International, March 1993. http://ieeexplore.ieee.org/search/srchabstract.jsp?
[23] R. M. Dillon, C. N. Manikopoulos, Neural Net Nolinear arnumber=1564468&isnumber=33206&punumber=10461&
Prediction for Speech Data, IEEE k2dockey=1564468@ieeecnfs&query=%28+deri%2C+l
Electronics Letters, Vol. 27, Issue 10, May 1991, pp. %3Cin%3Eau+%29&pos=2.
824-826. [37]Luca Deri. Improving passive packet capture: Beyond
[24] A.K. Ghosh, J. Wanken, F. Charron, Detecting device polling, august
Anomalous and Unknown Intrusions Against Programs, 2004. URL
Proceedings of IEEE 14th Annual Computer Security http://citeseer.ist.psu.edu/695645.html;http://jake.
Applications Conference, 1998 pp. 259 -267 unipi.it/~deri/Ring.pdf.
[25] Towards a taxonomy of intrusion-detection systems. [38]http://www.chinagrid.net/grid/paperppt/gct/ -2004
Comput. Networks, 31(9): [39]http://www.isi.edu/~annc/classes/grid/lectures/- 2005
805–822, 1999. ISSN 1389-1286. URL [40]http://www.globus.org/toolkit/downloads/
http://perso.rd.francetelecom.
fr/debar/papers/DebDacWes99.pdf.
[26] Spyros Antonatos, Kostas G. Anagnostakis, Evangelos
P. Markatos, and
Michalis Polychronakis. Performance analysis of content
matching intrusion
detection systems. In SAINT, pages 208–218. IEEE
Computer Society, 2004.
ISBN 0-7695-2068-5. URL
http://ieeexplore.ieee.org/xpls/abs_all.
jsp?arnumber=1266118.
[27]Paul Barford and David Plonka. Characteristics of
network traffic flow anomalies. In IMW ’01: Proceedings of
the 1st ACM SIGCOMM Workshop on
Internet Measurement, pages 69–73, New York, NY, USA,
2001. ACM Press. ISBN 1-58113-435-5.
[28] Jay Beale and James C. Foster. Snort 2.0 Intrusion
Detection. Syngress, Rockland,
MA, USA, 2003. ISBN 1-931836-74-4, 3-8266-1304-X.
Jeffrey Posluns, technical advisor and Brian Caswell,
technical editor.
[29]Jie Li Bo Song, Ming Ye. Intrusion detection technology
research based highspeed
network. In Parallel and Distributed Computing, Applications
and Technologies,
2003. PDCAT’2003. Proceedings of the Fourth International
Conference
on, pages 206 – 210, august 2003. URL
http://ieeexplore.ieee.
org/iel5/8749/27719/01236289.pdf.
[30] D. Bolzoni, E. Zambon, S. Etalle, and P. Hartel.
Poseidon: a 2-tier anomalybased
intrusion detection system. ArXiv Computer Science e-prints,
November 2005. URL
http://eprints.eemcs.utwente.nl/1326/02/01610007.Pdf.
[31] Damiano Bolzoni and Sandro Etalle. APHRODITE: an
anomaly-based architecture

NS | 36
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

AUTOMATIC PASSWORD SECURITY USING CRYPTOLOGY

AND RANDOM VERIFIER
T.S.Thangavel1 and Dr. A. Krishnan2
1
T.S. Thangavel , AP/ Dept of M.Sc(IT) , K.S.Rangasamy College of Technology
Tiruchengode.
tsthangavel123@yahoo.in
2
Dr. A. Krishnan , Dean , K.S.Rangasamy College of Technology Tiruchengode.

ABSTRACT
The techniques such as secured
socket layer (SSL) with client-side
certificates are well known in the
security research community. Most
commercial web sites rely on a relatively
weak form of password authentication,
the browser simply sends a user’s
plaintext password to a remote web
server, often using SSL. Even when used
over an encrypted connection, this form
of password authentication is vulnerable
to attack.
The proposal design and develop
a user interface, and implementation of a
browser extension, password hash, that
strengthens web password
authentication. Providing customized
passwords, can reduce the threat of
password attacks with no server changes
and little or no change to the user
experience. The proposed techniques are
designed to transparently provide novice
users with the benefits of password
practices that are otherwise only feasible
for security experts. Experimentation are
done with Internet Explorer and Fire fox
implementations and report the result of
initial user.
1. INTRODUCTION
A random password generator is
software program or hardware device
that takes input from a random or
pseudo-random number generator and
automatically generates a password.
Random passwords can be generated
manually, using simple sources of
randomness such as dice or coins, or
they can be generated using a computer.
While there are many examples
of "random" password generator
programs available on the Internet,
generating randomness can be tricky and
many programs do not generate random
characters in a way that ensures strong
security. A common recommendation is
to use open source security tools where
possible, since they allow independent
checks on the quality of the methods
used. Note that simply generating a
password at random does not ensure the
password is a strong password, because
it is possible, although highly unlikely,
to generate an easily guessed or cracked
password.
A password generator can be part
of a password manager. When a

NS | 37
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
password policy enforces complex rules,
it can be easier to use a password
generator based on that set of rules than
to manually create passwords. In
situations where the attacker can obtain
an encrypted version of the password,
such testing can be performed rapidly
enough so that a few million trial
passwords can be checked in a matter of
seconds.
The function rand presents
another problem. All pseudo-random
number generators have an internal
memory or state. The size of that state
determines the maximum number of
different values it can produce, an n-bit
state can produce at most 2 n different
values. On many systems rand has a 31
or 32 bit state, which is already a
significant security limitation.
Some computer operating
systems provide much stronger random
number generators. Windows
programmers can use the Cryptographic
Application Programming Interface
function CryptGenRandom. Another
possibility, is to derive randomness by
measuring some external phenomenon,
such as timing user keyboard input.
Using random bytes from any of these
sources should prove adequate for most
password generation needs.
2. LITERATURE REVIEW
Computer applications may
require random numbers in many
contexts. Random numbers can be used
to simulate natural or artificial
phenomena in computer simulations,
many algorithms that require
randomness have been developed that
outperform deterministic algorithms for
the same problem, and random numbers
ISSSIS 2009
can be used to generate or verify
passwords for cryptography-based
computer security systems.
The present invention relates to
the use of random numbers in such
security systems, called as cryptographic
applications. Specifically, the present
invention pertains to generating a
random number in a secure manner for
such cryptographic applications. In the
context of cryptographic applications,
there may be an hostile trespasser or
agent, who desires to infiltrate the
security of cryptographic security system
in order to gain access to sensitive,
confidential, or valuable information
contained therein. For example, banks
often encrypt their transactions and
accounts[1].
One common method for
circumventing a cryptographic
application is to guess at potential
passwords or cryptographic key, which
are then submitted on a trial basis. This
process is repeated until, by
happenstance, the valid password is
chanced upon. Fortunately, this process
is extremely time consuming and
inefficient. Also, preventative action can
be taken to render this type of attack
highly ineffective. However, if the
random number generator used in
generating valid passwords is somehow
flawed in any way, the hostile agent can
potentially take advantage of this flaw to
circumvent the security of the system.
Many prior art methods exist for
generating random numbers. These prior
art methods typically involve the use of
some type of chaotic system. A
chaotic system is one with a state that
changes over time in a largely
unpredictable manner. To use the chaotic
NS | 38
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
system to generate a random
number, there is some means of
converting the state of the system into a
sequence of bits (i.e., a binary number).
In the past, chaotic systems
were based on various sources, such as
the sound of radio static, the
output of a noisy diode, output of a
Geiger counter, or even the motion of
clouds. These chaotic systems can be
converted to produce binary numbers
by using standard techniques [4].
For instance, a pseudo-random
binary string can be generated from the
digital recording of static noise via a
digital microphone. Alternatively, a
noisy diode can be sampled at a suitable
frequency and converted into a digital
signal, or a picture of an area of the sky
can be taken and subsequently scanned
and digitized. These resulting binary
strings that are generated over time are
generally random in nature.
However, there are several
problems associated with simply using a
chaotic system as a source of random
numbers. First, chaotic systems can be
completely or partially predicted over
small amounts of time. For example,
the position of clouds in some area of the
sky at some time can be used to
achieve reasonably accurate predictions
of the position of clouds in the
same area a short time into the future.[3]
The time bottleneck can be
avoided in most computer applications
by using pseudo-random numbers
instead of random numbers [5].
A pseudo-random number
generator deterministically generates a
sequence of numbers by some
computational process from an initial
ISSSIS 2009
number, called a seed. The goal of the
computational process is to generate a
sequence of numbers from the seed that
appear to be random. In other words, an
outside observer cannot predict the next
number to be generated from the list of
numbers previously generated without
expending a great deal of computational
effort. Thus, to generate a long sequence
of pseudo-random numbers, one need
only generate a much shorter random
number to use as the seed for the
pseudo-random number generator.
Web password hashing is often
implemented incorrectly by giving the
remote site the freedom to choose the
salt. Using an online attack, a phisher
could send to the user the realm and
nonce the phisher received from the
victim site. The user’s response provides
the phisher with a valid password digest
for the victim site. Password hashing
implemented in Kerberos has a similar
vulnerability.
Finally, a number of existing
applications including Mozilla, Firefox
provide convenient password
management by storing the user’s web
passwords on disk, encrypted under
some master password. When the user
tries to log in to a site, the application
asks for the master password and then
releases the user’s password for that site.
Thus, the user need only remember the
master password. The main drawback
compared to PwdHash is that the user
can only use the web on the machine that
stores his passwords. On the plus side,
password management systems do
provide stronger protection against
dictionary attacks when the user chooses
a unique, high entropy password for
each site
NS | 39
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

(a-z, 0-9)
3. METHODOLOGY
Mixed case 62 5.95 bits
Random password generators letters and digits
normally output a string of symbols of (a-z, A-Z, 0-9)
specified length. These can be individual
characters from some character set,
syllables designed to form All standard U.S. 94 6.55 bits
pronounceable passwords, or words keyboard
from some word list to form a characters
passphrase. The program can be
customized to ensure the resulting
Dice ware word 7776 12.9 bits
password complies with the local
list
password policy, say by always
producing a mix of letters, numbers and
special characters. Thus an eight character password
of single case letters and digits would
The strength of a random have 41 bits of entropy (8 x 5.17). The
password can be calculated by same length password selected at
computing the information entropy of random from all U.S. computer
the random process that produced it. If keyboard characters would have 52 bit
each symbol in the password is produced entropy; however such a password
independently, the entropy is just given would be harder to memorize and might
by the formula be difficult to enter on non-U.S.
keyboards. A ten character password of
H = Llog2 N = L (log N/ log 2) single case letters and digits would have
essentailly the same strength (51.7 bits).
where N is the number of possible
symbols and L is the number of symbols Any password generator is
in the password. The function log2 is the limited by the state space of the pseudo-
base-2 logarithm. H is measured in bits. random number generator, if one is used.
Thus a password generated using a 32-
bit generator has a maximum entropy of
Symbol set N Entropy/sy 32 bits, regardless of the number of
mbol characters the password contains.

Digits only (0-9) 10 3.32 bits 4. SYSTEM MODEL

(e.g. PIN) The system model concerned
with attacks on the extension that
originate on malicious phishing sites.
Single case 26 4.7 bits Password hashing is computed using a
letters (a-z) Pseudo Random Function (PRF) as
follows:
Single case 36 5.17 bits
hash(pwd,dom) = PRFpwd(dom)
letters and digits

NS | 40
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA
where the user’s password pwd is
used as the PRF key and the remote
site’s domain name dom or some variant
is used as the input to the PRF. The hash
value is then encoded as a string that
satisfies the site’s password encoding
rules, under control of a configuration
file used by the browser extension.
The goal, however, is to defend
against web scripting attacks with
minimal change to the user experience.
For this leverage the browser extension
as a protective but largely transparent
intermediary between the user and the
web application. All input can be first
monitored and secured by the browser
extension before the web application is
aware that the user is interacting with it.
This requires a mechanism by
which users can notify password hash
browser extension that they are about to
enter a password. Password has can then
take steps to protect the password as it is
being entered. There are two closely
related methods i.e., password-prefix
and the second password-key.
Password Prefix
Password-prefix is an elegantly
unobtrusive mechanism to defend
against the JavaScript attacks. Users are
asked to prefix their passwords with a
short, publicly known sequence of
printable characters. Password hash
monitors the entire key stream and takes
protective action when it detects the
password-prefix sequence. The
password-prefix must be short but
unlikely to appear frequently in normal
text input fields. A common prefix
shared among all users of the extension
allows the extension to be portable
without requiring any changes of
ISSSIS 2009
settings. For internationalization, the
password prefix should not be an
English word at all, but something that
could be easily remembered and typed.
The extension has two modes
i.e., normal mode and password mode.
The extension monitors all keyboard
events. In normal mode, it passes all
keyboard events to the page as is. When
the password-prefix is detected in the
key stream, the extension switches to
password mode and does the following
i.e., it internally records all subsequent
key presses, and it replaces the user’s
keystrokes with a fixed sequence and
passes the resulting events to the
browser.
The first keystroke following the
password-prefix is replaced with “A,”
the second with “B,” and so on. This
translation continues until focus leaves
the password field, at which point the
extension reverts back to normal mode.
In other words, all keystrokes entered
following the password-prefix are
hidden from the browser and from
scripts running inside the browser until
focus leaves the field.
Users are protected from mock
password field attacks that confuse them
into entering a password into an insecure
location. This password-prefix approach
blocks the JavaScript attacks and
provides a number of additional benefits:
Legitimate web pages often
collect PIN’s or social security numbers
via password fields. Password Hash will
not hash the data in such fields because
this data does not contain the password
prefix.
NS | 41
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

The password prefix mechanism

automatically provides the right
functionality, assuming the old password
does not contain the password-prefix.
The password-prefix conveniently lets
users decide which passwords they want
to protect using hashing and which
passwords they want left as is.
The password hashing method is
extremely simple, rather than send the
user’s clear text password to a remote
site, it sends a hash value derived from
the user’s password, and the site domain
name. Password Hash captures all user
input to a password field and sends hash
(pwd, dom) to the remote site.

6. IMPLEMENTATION The hash is implemented using a

Pseudo Random Function keyed by the
The system implemented the
password. Since the hash output is
prototype as a Browser Helper Object
tailored to meet server password
for Internet Explorer. The extension
requirements, the resulting hashed
registers three new objects i.e., an entry
password is handled normally at the
in the Tools menu (to access extension
server; no server modifications are
options), an optional new toolbar, and
required. This technique deters password
the password protection service itself.
phishing since the password received at
Internet Explorer support COM event
a phishing site is not useful at any other
sinks that enable Browser Helper
domain. The proposed model
Objects to react to website events. Use
implements the password hashing as a
these sinks to detect focus entering and
secure and transparent extension to
leaving password fields, drag and drop
modern browsers.
events, paste events and double click
events.
REFERENCES
For the Internet Explorer version
1) N. Chou, R. Ledesma, Y. Teraguchi,
of the extension, leave the masked
and J. Mitchell, “ Client-side defense
characters in the field until the user
against web based identity theft “, In
submits the form, then we intercept the
Proceedings of Network and Distributed
submission event with a Before Navigate
Systems Security (NDSS), 2004.
handler. Internet Explorer does not allow
extensions to edit the form data in
2) J. A. Halderman, B.Waters, and E.
Before Navigate directly. Rather, cancel
Felten “A convenient method for
the original Navigate event and fire a
securely managing passwords” To
new, modified one. The extension
appear in Proceedings of the 14th
includes a data structure to detect which
International World Wide Web
Navigate events were fired by the
Conference (WWW 2005), 2005.
extension, and which ones were fired as
a result of user action, so that it does not
3) F. Hao, P. Zieli´nski, “A 2-round
attempt to translate the form data more
anonymous veto protocol,” Proceedings
than once and get stuck in a loop.
of the 14th International Workshop on
Security Protocols, SPW’06, Cambridge,
UK, May 2006.
CONCLUSION

NS | 42
International Conference on Sensors,Security,Software and Intelligent Systems
8 - 10, January 2009
Organized by Coimbatore Institute of Technology,Coimbatore and Oklahoma State University USA ISSSIS 2009

4) Muxiang Zhang, “Analysis of the

SPEKE password-authenticated key
exchange protocol,” IEEE
Communications Letters, Vol. 8, No. 1,
pp. 63-65, January 2004.

5) Z. Zhao, Z. Dong, Y. Wang, “Security

analysis of a password-based
authentication protocol proposed to
IEEE 1363,” Theoretical Computer
Science, Vol. 352, No. 1, pp. 280–287,
2006.

NS | 43