HongQian Karen Lu

Prevent Online Identity Theft – Using Network Smart Cards for Secure Online Transactions

This paper presents a novel method that can be used to prevent online identity theft and thereby ensure secure online transactions. In particular, the method combats online identity theft mechanisms that capture information on the computer before the information is encrypted. The key feature of this method is the use of secure network smart cards to establish secure connections between the smart card and remote Internet nodes. Using this end-to-end secure connection, one can securely exchange confidential information between the smart card and a trusted remote server. Any intermediate node, including the host computer to which the smart card is connected, cannot compromise this secure connection.

Communication Security between a Computer and a Hardware Token

Hardware security tokens are gradually gaining popularity as tools for strong online authentication and secure storage of personal information. The security services they offer protect online service providers as well as consumers. These tokens are small embedded systems that typically have little or no human interface themselves. They work with software on the host computer for human interface and for interaction with programs on the computer or over the Internet. Since these security tokens typically provide cryptographic services and secure storage, the security of communication between the token and the host computer is a critical piece of the overall security framework. The design of this piece is a challenging task. It requires solving multiple problems, such as ensuring that the hardware token only talks with a legitimate host application; exchanging encryption keys; and minimizing the impact on communication performance. This paper presents our solutions to these problems. These solutions are applicable in a variety of hardware security tokens.

Attack Detection for Resource-Constrained Network Devices

Many small devices are capable of connecting to the Internet now. The trend of pervasive computing and networking is going strong. At the same time, security threats on the Internet continue to increase. Existing defense mechanisms against network-based attacks can hardly apply to small network devices due to limitations of their computing resources. This paper presents a method to mitigate this problem. The approach embeds the attack detection mechanism inside the devices network module. It focuses on the operational behavior of the module to identify abnormal events. The mechanism does not compete for resources with the main function of the device. It has little impact on the system performance. Furthermore, the method may detect unknown attacks.