Khaled Masmoudi

Building identity-based security associations for provider-provisioned virtual private networks

Provider-provisioned virtual private networks are nowadays well-established networking concepts. They are envisaged as an extension of the basic VPN concept to securely network low-capacity nodes in large-scale personal networks, with the help of network providers. This article presents an adaptation of the Internet Key Exchange (IKEv2) protocol to the context of dynamic tunneling in personal networks. It relies on the providers’ infrastructure to build identity-based security associations. Results of a preliminary security analysis are also provided.

An Identity-Based Key Management Framework for Personal Networks

Personal networks and PN federations are new networking paradigms that merge concepts from ad hoc, P2P and wireless networks, built around users needs. Even though they are a promise of a practical achievement of ubiquitous computing, managing security associations in these frameworks proves to be a challenge. We present in this paper a security architecture, including a uniform personal namespace using crypto-based identifiers and a key management scheme based on identity-based cryptography. We also provide an evaluation of our scheme, in terms of computation complexity, communication cost and security.

An on-demand key establishment protocol for MANETs

Securing ad hoc networks is a challenging task due to their specific characteristics. One of the major challenges is that ad hoc networks typically lack a fixed infrastructure both inform of physical nodes such as routers, servers, and stable communication links and in the form of an organizational or administrative infrastructure. New nodes can hence, join and leave the network at any time, which appeals to an efficient and flexible trust establishment mechanism. We propose in this paper an efficient protocol for key management in ad hoc networks relying on the routing mechanism itself.

Efficient Group Management For Inter-PN Access Control

This paper presents an architecture for resource sharing in personal networks (PNs). Resources are not necessarily in the same authentication domain and the group that uses them is called a federation. The architecture is based on two components: a signaling protocol and a group key management system. Federation architecture, different interactions with the protocols and an efficient group key algorithm are explained in this work. The performance evaluation of different procedures has concluded and presented.

A secure P2P architecture for location management

Networking and computing have become so tied and have naturally integrated our daily life and are evolving to a ubiquitous and transparent interaction between users and information. Distributed and collaborative architectures particularly P2P solutions, proved to be the most efficient way to meet the requirements of pervasive computing. However, many security and mobility issues have to be considered. In this paper, we propose a secure architecture for location management in mobile environments. It inherits from the P2P paradigm features, such as scalability, flexibility and fault-tolerance; thus adapting to dynamic changes of information context.

Short paper: Tri-party TLS Adaptation for Trust Delegation in Home Networks

Home networking has come in wider use, thus appealing to an increasing need for security. Emerging social concepts such as telecommutation brought a new kind of security threats to the home environment. Besides, low-capacity devices in the home domain may need a central entity dedicated to security enforcement. As SSL-based VPN solutions don’t provide end-to-end tunnels, we have extended TLS protocol to delegate trust establishment between a home network server and an external client to a security gateway, acting as a reverse proxy. Moreover, we formally validated it using automatic protocol analyzer AVISPA.

A Cross-layer Aware Imprinting Protocol for Personal Networks

Trust establishment in pervasive environments, where distributed and resource-limited devices need to establish secure connections, has triggered much effort in the last years. One way to bring trust into a personal network (PN) is the use of imprinting, which consists in an agreement on a shared secret without any prior knowledge, giving expression to the trust relationship that links a pair of devices. In this paper, we introduce the PN formation protocol (PFP), an imprinting protocol that is extensible to three parties. We considered the use of imprinting through an out-of-band channel performed by the user itself in the bipartite version and an autonomic and collaborative one in the tripartite version of the protocol. We describe its implementation, test results as well as the proof of its security goals through an automatic protocol analyzer.