Browsing by Author "Shieh, S"

Now showing 1 - 5 of 5

Accelerating network security services with fast packet classification
(2004-10-15)
Shieh, S
;
Lee, FY
;
Lin, YW
;
資訊工程學系
;
Department of Computer Science
To protect a network, secure network systems such as intrusion detection system (IDS) and firewall are often installed to control or monitor network traffic. These systems often incur substantial delay for analyzing network packets. The delay can be reduced with fast packet classification, which can effectively classify network traffic, and consequently accelerate the analysis of network packets. In the last few years, many researchers devoted to providing fast packet classification methods for multidimensional classifier. However, these methods either suffer from poor performance and huge storage requirement, or are lack of dimension scalability. In this paper, we propose a packet classification method based on tuple space search, and use the multidimensional binary search tree (Kd-tree) to improve search performance. The proposed scheme requires only O(d log W) search time and controlled storage requirement, where d is the number of dimensions, and W is the utmost bit length for specifying prefixes in a classification rule. It features fast packet classification, and supports dynamic update which is a basic requirement of many secure network services, such as IDS and firewall. (C) 2004 Elsevier B.V. All rights reserved.
Defending against spoofed DDoS attacks with path fingerprint
(2005-10-01)
Lee, FY
;
Shieh, S
;
資訊工程學系
;
Department of Computer Science
In this paper, we propose anew scheme, called ANTI D, for detecting and filtering DDoS attacks which use spoofed packets to circumvent the conventional intrusion detection schemes. The proposed anti-DDoS scheme intends to complement, rather than replace conventional schemes. By embedding in each IP packet a unique path fingerprint that represents the route an IP packet has traversed, ANTID is able to distinguish IP packets that traverse different Internet paths. In ANTID, a server maintains for each of its communicating clients the mapping from the client's IP address to the corresponding path fingerprint. The construction and renewal of these mappings is performed in an on-demand fashion that helps to reduce the cost of maintenance. With presence of the mapping table, the onset of a spoofed DDoS attack can be detected by observing a surge of spoofed packets. Consequently, spoofed attack packets are filtered so as to sustain the quality of protected Internet services. ANTID is lightweight, robust, and incrementally deployable. Our experiment results showed that the proposed scheme can detect 99.95% spoofed IP packets and can discard them with little collateral damage to legitimate clients. It also showed that the higher the aggregated attack rate is, the sooner the attack can be detected. (C) 2005 Elsevier Ltd. All rights reserved.
Efficient key distribution schemes for secure media delivery in pay-TV systems
(2004-10-01)
Huang, YL
;
Shieh, S
;
Ho, FS
;
Wang, JC
;
資訊工程學系
To provide secure media delivery in pay-TV systems, a large number of messages are exchanged for key updates in the conventional key distribution schemes. This is inefficient and costly when the client side (set-top box) uses a smart card with limited computing power. In this paper, we present three key distribution schemes for channel protection and secure media delivery in pay-TV systems. With the proposed schemes, encryption keys of the subscribed programs can be efficiently and securely distributed to the authorized subscribers. Only one message is needed to renew key in the key distribution schemes for subscription channel protection. In addition, we use simpler computation functions, including one-way hash function and exclusive-OR operation, for key updates to reduce the computation cost. With our key distribution schemes, only authorized subscribers can watch the subscribed programs correctly. Unauthorized subscribers have no information to retrieve the correct programs over the networks. Thus, service providers can charge their subscribers according to their subscriptions, and the illegal access of the media and video programs from networks can be prevented, based on the proposed schemes.
Efficient key-evolving protocol for the GQ signature
(2004-07-01)
Lu, CF
;
Shieh, S
;
資訊工程學系
;
Department of Computer Science
Several key-evolving protocols for the Guillou-Quisquater (GQ) signature have been proposed. However, the computational loads are still high, which require the multiplication of several modular exponentiations of at least 1024-bit length. In this paper, we present a low-complexity key-evolving protocol with two additional benefits. First, it ensures the secrecy of other signing keys, even when the si.-ning keys in some periods are compromised. Second, it provides the basic time-stamping service, which is important for legal or notary applications. Related schemes are also compared with our scheme.
Packet classification using diagonal-based tuple space search
(2006-06-20)
Lee, FY
;
Shieh, S
;
資訊工程學系
;
Department of Computer Science
Multidimensional packet classification has attracted considerable research interests in the past few years due to the increasing demand on policy based packet forwarding and security services. These network services typically involve determining the action to take on packets according to a set of rules. As the number of rules increases, time for determining the best matched rule for an incoming IP packet will increase and subsequently incur long processing delay. To address this issue, in this paper we propose a two-dimensional packet classification algorithm which focuses on reducing time for classification while keeping reasonable memory requirement in practice. Our approach extends the tuple space framework and then allows performing binary search on the tuple space. To our knowledge, the proposed scheme is the first binary search scheme on two-dimensional tuples. With the proposed scheme, given a filter set with n two-dimensional filters, it requires only O(log(w)) hash operations to determine the best matched filter, where w is the maximum prefix length of filters. The proposed scheme achieves fast packet classification, and according to our experimental results, it does not require huge memory space. This makes it useful for network applications that require high speed packet classification. (c) 2005 Elsevier B.V. All rights reserved.