Design requirements to counter parallel session attacks in security protocols

Anca D. Jurcut; Tom Coffey; Reiner Dojen

doi:10.1109/PST.2014.6890952

Design requirements to counter parallel session attacks in security protocols

Anca D. Jurcut, Tom Coffey, Reiner Dojen

Department of Electronics & Computer Engineering

University of Limerick

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

This work is concerned with the possible exploitation of weaknesses in security protocols by attackers using parallel session attacks and discovering ways of eliminating these weaknesses. A new analysis is presented on the reasons why security protocols, with certain weaknesses in their design, are vulnerable to parallel session attacks. Building on this analysis a new set of design requirements is proposed, whose aim is to eliminate these vulnerabilities. The proposed set of design requirements is evaluated by applying them to a range of security protocols with known weaknesses as well as protocols known to be free of these weaknesses. The results of the evaluation indicate that the set of design requirements are effective as: protocols with known weaknesses violate some of the rules, while protocols without weaknesses do not violate any of the rules.

Original language	English
Title of host publication	2014 12th Annual Conference on Privacy, Security and Trust, PST 2014
Editors	Ali Miri, Audun Josang, Joaquin Garcia-Alfaro, Urs Hengartner, Nen-Fu Huang
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	298-305
Number of pages	8
ISBN (Electronic)	9781479935031
DOIs	https://doi.org/10.1109/PST.2014.6890952
Publication status	Published - 2014
Event	2014 12th Annual Conference on Privacy, Security and Trust, PST 2014 - Toronto, Canada Duration: 23 Jul 2014 → 24 Jul 2014

Publication series

Name	2014 12th Annual Conference on Privacy, Security and Trust, PST 2014

Conference

Conference	2014 12th Annual Conference on Privacy, Security and Trust, PST 2014
Country/Territory	Canada
City	Toronto
Period	23/07/14 → 24/07/14

Keywords

design requirements
parallel session attacks
security protocols

Access to Document

10.1109/PST.2014.6890952

Cite this

Jurcut, A. D., Coffey, T., & Dojen, R. (2014). Design requirements to counter parallel session attacks in security protocols. In A. Miri, A. Josang, J. Garcia-Alfaro, U. Hengartner, & N.-F. Huang (Eds.), 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014 (pp. 298-305). Article 6890952 (2014 12th Annual Conference on Privacy, Security and Trust, PST 2014). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/PST.2014.6890952

Jurcut, Anca D. ; Coffey, Tom ; Dojen, Reiner. / Design requirements to counter parallel session attacks in security protocols. 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014. editor / Ali Miri ; Audun Josang ; Joaquin Garcia-Alfaro ; Urs Hengartner ; Nen-Fu Huang. Institute of Electrical and Electronics Engineers Inc., 2014. pp. 298-305 (2014 12th Annual Conference on Privacy, Security and Trust, PST 2014).

@inproceedings{0faa0b19818941e9a7241e9f65b52901,

title = "Design requirements to counter parallel session attacks in security protocols",

abstract = "This work is concerned with the possible exploitation of weaknesses in security protocols by attackers using parallel session attacks and discovering ways of eliminating these weaknesses. A new analysis is presented on the reasons why security protocols, with certain weaknesses in their design, are vulnerable to parallel session attacks. Building on this analysis a new set of design requirements is proposed, whose aim is to eliminate these vulnerabilities. The proposed set of design requirements is evaluated by applying them to a range of security protocols with known weaknesses as well as protocols known to be free of these weaknesses. The results of the evaluation indicate that the set of design requirements are effective as: protocols with known weaknesses violate some of the rules, while protocols without weaknesses do not violate any of the rules.",

keywords = "design requirements, parallel session attacks, security protocols",

author = "Jurcut, {Anca D.} and Tom Coffey and Reiner Dojen",

note = "Publisher Copyright: {\textcopyright} 2014 IEEE.; 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014 ; Conference date: 23-07-2014 Through 24-07-2014",

year = "2014",

doi = "10.1109/PST.2014.6890952",

language = "English",

series = "2014 12th Annual Conference on Privacy, Security and Trust, PST 2014",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "298--305",

editor = "Ali Miri and Audun Josang and Joaquin Garcia-Alfaro and Urs Hengartner and Nen-Fu Huang",

booktitle = "2014 12th Annual Conference on Privacy, Security and Trust, PST 2014",

}

Jurcut, AD, Coffey, T & Dojen, R 2014, Design requirements to counter parallel session attacks in security protocols. in A Miri, A Josang, J Garcia-Alfaro, U Hengartner & N-F Huang (eds), 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014., 6890952, 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014, Institute of Electrical and Electronics Engineers Inc., pp. 298-305, 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014, Toronto, Canada, 23/07/14. https://doi.org/10.1109/PST.2014.6890952

Design requirements to counter parallel session attacks in security protocols. / Jurcut, Anca D.; Coffey, Tom; Dojen, Reiner.
2014 12th Annual Conference on Privacy, Security and Trust, PST 2014. ed. / Ali Miri; Audun Josang; Joaquin Garcia-Alfaro; Urs Hengartner; Nen-Fu Huang. Institute of Electrical and Electronics Engineers Inc., 2014. p. 298-305 6890952 (2014 12th Annual Conference on Privacy, Security and Trust, PST 2014).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Design requirements to counter parallel session attacks in security protocols

AU - Jurcut, Anca D.

AU - Coffey, Tom

AU - Dojen, Reiner

PY - 2014

Y1 - 2014

N2 - This work is concerned with the possible exploitation of weaknesses in security protocols by attackers using parallel session attacks and discovering ways of eliminating these weaknesses. A new analysis is presented on the reasons why security protocols, with certain weaknesses in their design, are vulnerable to parallel session attacks. Building on this analysis a new set of design requirements is proposed, whose aim is to eliminate these vulnerabilities. The proposed set of design requirements is evaluated by applying them to a range of security protocols with known weaknesses as well as protocols known to be free of these weaknesses. The results of the evaluation indicate that the set of design requirements are effective as: protocols with known weaknesses violate some of the rules, while protocols without weaknesses do not violate any of the rules.

AB - This work is concerned with the possible exploitation of weaknesses in security protocols by attackers using parallel session attacks and discovering ways of eliminating these weaknesses. A new analysis is presented on the reasons why security protocols, with certain weaknesses in their design, are vulnerable to parallel session attacks. Building on this analysis a new set of design requirements is proposed, whose aim is to eliminate these vulnerabilities. The proposed set of design requirements is evaluated by applying them to a range of security protocols with known weaknesses as well as protocols known to be free of these weaknesses. The results of the evaluation indicate that the set of design requirements are effective as: protocols with known weaknesses violate some of the rules, while protocols without weaknesses do not violate any of the rules.

KW - design requirements

KW - parallel session attacks

KW - security protocols

UR - http://www.scopus.com/inward/record.url?scp=84910104344&partnerID=8YFLogxK

U2 - 10.1109/PST.2014.6890952

DO - 10.1109/PST.2014.6890952

M3 - Conference contribution

AN - SCOPUS:84910104344

T3 - 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014

SP - 298

EP - 305

BT - 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014

A2 - Miri, Ali

A2 - Josang, Audun

A2 - Garcia-Alfaro, Joaquin

A2 - Hengartner, Urs

A2 - Huang, Nen-Fu

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014

Y2 - 23 July 2014 through 24 July 2014

ER -

Jurcut AD, Coffey T, Dojen R. Design requirements to counter parallel session attacks in security protocols. In Miri A, Josang A, Garcia-Alfaro J, Hengartner U, Huang NF, editors, 2014 12th Annual Conference on Privacy, Security and Trust, PST 2014. Institute of Electrical and Electronics Engineers Inc. 2014. p. 298-305. 6890952. (2014 12th Annual Conference on Privacy, Security and Trust, PST 2014). doi: 10.1109/PST.2014.6890952

Design requirements to counter parallel session attacks in security protocols

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this