Browsing by Author "Shieh, SP"

Now showing 1 - 20 of 27

A distributed fault-tolerant design for multiple-server VOD systems
(1999-03-01)
Shyu, IJ
;
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
Fault tolerance is an important design criterion for reliable and robust video-on-demand systems. Conventional fault-tolerant designs use either a primary backup or an active replication method to provide system fault tolerance. However, these approaches suffer from low utilization of the backup or replication system. In this paper we propose two playback-recovery schemes for distributed video-on-demand systems called the forward playback-recovery scheme and the backward playback-recovery scheme. Unlike conventional fault-tolerant designs, our schemes use existing playback resources to recover faulty playbacks without allocating new resources, significantly reducing recovery overhead. To use the schemes effectively, we developed a distributed algorithm for determining the order and gap information between the playbacks on the distributed video-on-demand servers so that overhead for recovering from a server failure can be minimized. This algorithm achieves N - 1 fault-tolerant resiliency for N-server video-on-demand systems. In addition, three server-recovery policies are also presented to guide surviving servers in applying the proper scheme to recover faulty playbacks, thus reducing overall recovery costs. Simulation results show that the proposed recovery schemes are effective and useful in designing fault-tolerant multiple-server video-on-demand systems.
A generic electronic payment model supporting multiple merchant transactions
(2000)
Huang, YL
;
Shieh, SP
;
Ho, FS
;
資訊工程學系
;
Department of Computer Science
This paper presents a generic electronic payment model which is intended for a multi-merchant transaction, in which more than one merchant (the retailer, multiple resellers and content providers) are involved in the distribution of electronic contents. With our payment model, every involved merchant will be notified to verify the license information of a content on the settlement day before the customer actually pays for his purchase. Thus, piracy can be discouraged, intellectual property rights of electronic contents can be protected. Each of the involved merchants can obtain his own deserved share of the customer's payment in accordance with their union agreement on this content. As examples to demonstrate the applications of our generic payment model, two well-known payment systems are enhanced herein, based on our payment model.
A note on breaking and repairing a secure broadcasting in large networks
(1999-01-25)
Sun, HM
;
Shieh, SP
;
Sun, HM
;
資訊工程學系
;
Department of Computer Science
In this note, we show that a proposed secure broadcasting scheme is insecure. We also present a modified scheme to overcome this weakness. The modified scheme has the extra advantage that each participant can derive his group keys from group identities without the need of knowing other information. (C) 1999 Elsevier Science BV. All rights reserved.
A total ordering multicast protocol using propagation trees - Comment
(1997-10-01)
Shieh, SP
;
Ho, FS
;
交大名義發表
;
資訊工程學系
;
National Chiao Tung University
In this paper, we reevaluate the message cost of Jia's multicast mechanism. Our analysis shows that its message cost should be (D+k+1) instead of (D+2), where D is the the depth of the subtree and k is the number of metagroups containing the destination multicast group.
An efficient authentication protocol for mobile networks
(1999-07-01)
Shieh, SP
;
Ho, FS
;
Huang, YL
;
資訊工程學系
;
Department of Computer Science
Many existing authentication protocols supporting inter-domain authentication on the Internet require their clients to communicate with every involved key distribution center (KDC) directly. This is inefficient and costly when the client side is a wireless mobile unit, for wireless transmission has relatively lower bandwidth, and a mobile unit is battery powered. In this paper, we present a mobile authentication protocol which only needs seven messages for inter-domain initial authentication regardless of the number of hops transited between the visited and home domains; four messages for subsequent authentication when the mobile user requests a different service provided by the visited domain; and two messages when the same service is requested again. With the enhanced version of BAN logic we propose, it is proved that our protocol can achieve more goals of authentication than those required by the original BAN logic.
An efficient construction of perfect secret sharing schemes for graph-based structures
(1996-04-01)
Sun, HM
;
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
In this paper, we propose an efficient construction of perfect secret sharing schemes for graph-based access structures where a vertex denotes a participant and an edge does a qualified pair of participants. The secret sharing scheme is based on the assumptions that the pairs of participants corresponding to edges in the graph can compute the master key but the pairs of participants corresponding to nonedges in the graph cannot. The information rate of our scheme is 1/(n-1), where n is the number of participants. We also present an application of our scheme to the reduction of storage and computation loads on the communication granting server in a secure network.
Auditing user queries in dynamic statistical databases
(1999-01-01)
Shieh, SP
;
Lin, CT
;
資訊工程學系
;
Department of Computer Science
Chin proposed an audit scheme for inference control in statistical databases (SDBs) which can determine whether or not a query will lead to the compromise of an SDB. As Chin points out that the dynamic updates of an SDB are prohibited in this scheme because, otherwise, the time and storage requirements will become infinite. The restriction limits the use of this scheme since many SDBs need to be dynamically updated. In this paper, we propose an algorithm to remove this restriction so that updates can be allowed. We also propose an efficient audit scheme for dynamic SDBs which requires less time and storage requirements, and does not have the space explosion problem that appears in Chin's scheme. (C) 1999 Elsevier Science Inc. All rights reserved.
Chain authentication in mobile communication systems
(2000)
Lin, CT
;
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
Digital mobile telecommunication systems have become a future trend in personal communications services (PCS) networks. To satisfy the demand for high quality services, security functions, including the authentications of communication parties and the confidentiality of communication channels, must be embedded into mobile communication systems. This work presents an authentication scheme to support the security functions. The proposed protocol significantly improves the performance of authentications and ensures the security of mobile communications in a large-scale communication network with multiple service providers.
Constructing perfect secret sharing schemes for general and uniform access structures
(1999-09-01)
Sun, HM
;
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
A perfect secret sharing scheme allows a secret K to be shared among a set of participants in such a way that only qualified subsets of participants can recover the secret, and unqualified subsets of participants obtain no information regarding the secret. In this paper, we propose a construction of perfect secret sharing schemes with uniform, generalized access structures of rank 3. Compared with other constructions, our construction has some improved lower bounds on the information rate. In addition, we also generalize the construction to perfect secret sharing schemes with uniform, generalized access structures of constant rank.
Designing authentication protocols for third generation mobile communication systems
(2005-03-01)
Cheng, SM
;
Shieh, SP
;
Yang, WH
;
Lee, FY
;
Luo, JN
Security is considered an important issue for mobile communication systems. In particular, the design of authentication mechanisms has received considerable research interest recently. However, most of the current authentication schemes for mobile systems only have simple security functions and usually have some weaknesses, such as leakage of user identities and high update overhead of temporary identities. Moreover, these schemes cannot fulfill the security requirements specified in third generation mobile systems (IMT-2000, UMTS). In this paper, we propose a secure and flexible authentication framework for mobile communication systems. In the proposed framework, service providers can dynamically choose authentication mechanisms without the cooperation of network operators in visited domains. Based on the new framework, a secure authentication protocol is proposed. The proposed protocol can satisfy the security requirements of third generation mobile systems and is secure against network attacks, such as the replay attack and substitution attack. In short, our approach is secure and practical such that it can satisfy the security requirements of third generation mobile communication systems.
Digital multisignature schemes for authenticating delegates in mobile code systems
(2000-07-01)
Shieh, SP
;
Lin, CT
;
Yang, WB
;
Sun, HM
;
資訊工程學系
In this paper, we motivate the need for efficient multisignature schemes in delegated mobile services. With the schemes, delegates can be identified and delegated accesses can be controlled. First, we give a new digital signature scheme with message recovery. Based on the digital signature scheme, two digital multisignature schemes are proposed: the parallel multisignature scheme and the serial multisignature scheme. The parallel multisignature scheme allows each user to sign the same message separately and independently, and then combines all individual signatures into a multisignature, The serial multisignature scheme allows a group of users to sign the message serially, and does not need to predetermine the signing order. Both multisignature schemes tan withstand the attacks that aim to forge the signatures or to get the private kegs of the signers.
Estimating and measuring covert channel bandwidth in multilevel secure operating systems
(1999-01-01)
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
Covert channels are illicit means of leaking sensitive or private information through system global variables that usually are not part of the interpretation of data objects in the security model. We discovered that some covert channels can be modeled as finite-stare graphs while others cannot. By using various techniques given in the paper, multiple bits of information can be simultaneously transferred through single or multiple covert channels. We present methods to determine and estimate the maximum bandwidths of both finite-state and infinite-state channels, and give the problems and basic rules for their measurement.
Network address translators: Effects on security protocols and applications in the TCP/IP stack
(2000-11-01)
Shieh, SP
;
Ho, FS
;
Huang, YL
;
Luo, JN
;
資訊工程學系
On a pattern-oriented model for intrusion detection
(1997-07-01)
Shieh, SP
;
Gligor, VD
;
資訊工程學系
;
Department of Computer Science
Operational security problems, which are often the result of access authorization misuse, can lead to intrusion in secure computer systems. We motivate the need for pattern-oriented intrusion detection, and present a model that tracks both data and privilege flows within secure systems to detect context-dependent intrusions caused by operational security problems. The model allows the uniform representation of various types of intrusion patterns, such as those caused by unintended use of foreign programs and input data, imprudent choice of default privileges, and use of weak protection mechanisms. As with all pattern-oriented models, this model cannot be used to detect new, unanticipated intrusion patterns that could be detected by statistical models. For this reason, we expect that this model will complement, not replace, statistical models for intrusion detection.
Optimal assignment of mobile agents for software authorization and protection
(1999-01-15)
Shieh, SP
;
Lin, CT
;
Wu, SY
;
資訊工程學系
;
Department of Computer Science
In this paper, a model for software authorization and protection in mobile code systems is proposed. In the model, a software is partitioned into objects, called mobile agents, and the privileges to access these agents are separated and distributed to the user's local system and a number of trusted servers called trusted computational proxies. The execution of a program (software) is conducted by cooperation of the agents and the proxies that contain them. Two agents are dependent if there is a message passing between them. To reduce the risk of software being attacked,dependent agents are distributed to different proxies. In this way, if a proxy is compromized, minimal information of the software will be disclosed. Methods for assigning agents to proxies are also proposed to minimize, under the security constraints, computation load of the proxies as well as communication load between the user's local system and proxies. (C) 1999 Elsevier Science B.V. All rights reserved.
Optimal information-dispersal for fault-tolerant communication over a burst-error channel
(2003-09-01)
Shieh, SP
;
Tsai, YC
;
Huang, YL
;
資訊工程學系
;
Department of Computer Science
The (m, n) wireless information dispersal scheme (WIDS) is useful for fault-tolerant parallel wireless communications, where it can be used to tolerate up to n - m path (subchannel) failures. This paper constructs a performance model of (m, n) WIDS used in wireless communications, and proposes an algorithm to find the optimal set of (m, n) with the highest reliability. This algorithm reduces the complexity of finding the candidate set of (m, n) from O(N-2) to O(N); N is the maximum number of available sub-channels.
Optimal information-dispersal for increasing the reliability of a distributed service
(1997-12-01)
Sun, HM
;
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
This paper investigates the (m,n) information dispersal scheme (IDS) used to support fault-tolerant distributed servers in a distributed system. In an (m, n)-IDS, a file M is broken into n pieces such that any m pieces collected suffice for reconstructing M. The reliability of an (m, n)-IDS is primarily determined by 3 important factors: n = information dispersal degree (IDD), n/m = information expansion ratio (IER), P-a = success-probability of acquiring a correct piece. It is difficult to determine the optimal IDS with the highest reliability from very many choices. Our analysis shows: several novel features of (m, n)-IDS which can help reduce the complexity of finding the optimal IDS with the highest reliability; that an IDS with a higher IER might not have a higher reliability, even when P-s-->1. Based on the theorems given herein, we have developed a method that reduces the complexity for computing the highest reliability from, O(v) [v = number of servers] to O(1) when the 'upper bound of the IER' = 1, or O(v(2)) to O(1) when the 'upper bound of the IER' > 1.
Password authentication schemes with smart cards
(1999)
Yang, WH
;
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
In this paper, two password authentication schemes with smart cards are proposed. In the schemes, users can change their pass-words freely, and the remote system does nor need the directory of passwords or verification tables to authenticate users. Once the secure network environment is see up, authentication can be handled solely by the two parries involved. For a network without synchronized clocks, the proposed nonce-based authentication scheme is able to prevent malicious reply attacks.
Playback dispatch and fault recovery for a clustered video system with multiple servers
(1999-11-01)
Shyu, IJ
;
Shieh, SP
;
資訊工程學系
;
Department of Computer Science
Recent technology advances have made multimedia on-demand services feasible. One of the challenges is to provide fault-tolerant capability at system level for a practical video-on-demand system. The main concern on providing fault recovery is to minimize the consumption of system resources on the surviving servers in the event of server failure. In order to reduce the overhead on recovery, we present three schemes for recovering faulty playbacks through channel merging and sharing techniques on the surviving servers. Furthermore, to evenly distribute the recovery load among the surviving servers, we propose a balanced dispatch policy that ensures load balancing in both the normal server conditions and the presence of a server failure.
Protecting network users in mobile code systems
(2004-02-01)
Shieh, SP
;
Yang, WH
;
資訊工程學系
;
Department of Computer Science
Conventional access control mechanisms are rather insensitive to occurrences of context-dependent illegal accesses. Insensitivity to context-dependent accesses may lead to failure to protect network users and resources. Context-dependent illegal accesses resulting from data and privilege flows in open networks cannot be prevented by either authentication or access control mechanisms since unauthorized access need not be attempted. In this paper we present a protection model which tracks data and privilege flows in mobile code systems. It can uniformly define various types of illegal access patterns and has the advantage of preventing context-dependent illegal accesses such as those caused by inadvertent execution of remote mobile code containing viruses or Trojan Horses. The proposed flow control model is expected to complement the conventional model for access control. (C) 2003 Elsevier Inc. All rights reserved.