research-article

PEAR: a hardware based protocol authentication system

Authors:

Michael S. Kirkpatrick,

Elisa BertinoAuthors Info & Claims

SPRINGL '10: Proceedings of the 3rd ACM SIGSPATIAL International Workshop on Security and Privacy in GIS and LBS

Pages 18 - 25

https://doi.org/10.1145/1868470.1868476

Published: 02 November 2010 Publication History

Abstract

As users have to manage an increasing number of accounts, they have to balance password security and password usability. As such, many users use insecure passwords resulting in their accounts and data being vulnerable to unauthorized accesses. In this paper, we present Physically Enhanced Authentication Ring, or PEAR, a system that alleviates this problem. We leverage Physically Unclonable Functions (PUF) to create unclonable hardware devices, which users use to authenticate. Using a hardware device, our system uses zero-knowledge proofs, which provide better security than traditional passwords, yet users must only enter a simple PIN. As such, our system is very usable and imposes little to no burden on end users and service providers. We present transaction levels on top of PEAR of as an extension and then discuss some other work that could be done in the future.

References

[1]

J. Bonneau and S. Preibusch, "The password thicket: technical and market failures in human authentication on the web," in Ninth Workshop on the Economics of Information Security (WEIS), 2010.

[2]

R. M. Needham and M. D. Schroeder, "Using encryption for authentication in large networks of computers," Communications of the ACM, vol. 21, no. 12, pp. 993--999, December 1978.

Digital Library

[3]

D. J. Otway and O. Rees, "Efficient and timely mutual authentication," ACM SIGOPS Operating Systems Review, vol. 21, pp. 8--10, January 1987.

Digital Library

[4]

S. P. Miller, B. C. Neuman, J. I. Schiller, and J. H. Saltzer, "Kerberos authentication and authorization system," in Project Athena Technical Plan, 1987.

[5]

T. Y. Woo and S. S. Lam, "Authentication for distributed systems," vol. 25, no. 1, pp. 39--52, January 1992.

Digital Library

[6]

J. Clark, "Attacking authentication protocols," High Integrity Systems, vol. 1, 1996.

[7]

J. Heather, G. Lowe, and S. Schneider, "How to prevent type flaw attacks on security protocols," in Proceedings of the 13th IEEE Workshop on Computer Security Foundations (CSFW '00), 2000.

Digital Library

[8]

S. Malladi, J. Alves-foss, and R. B. Heckendorn, "On preventing replay attacks on security protocols," in Proceedings of the International Conference on Security and Management. CSREA Press, 2002, pp. 77--83.

[9]

J. M. McCune, A. Perrig, and M. K. Reiter, "Safe passage for passwords and other sensitive data," in Proceedings of the Symposium on Network and Distributed Systems Security (NDSS), Feb. 2009.

[10]

D. Chappell, "Introducing windows cardspace," http://msdn.microsoft.com/en-us/library/aa480189.aspx, 2006.

[11]

S. T. King, P. M. Chen, Y. min Wang, C. Verbowski, H. J. Wang, and J. R. Lorch, "Subvirt: Implementing malware with virtual machines," in In IEEE Symposium on Security and Privacy, 2006, pp. 314--327.

Digital Library

[12]

G. E. Suh and S. Devadas, "Physcal unclonable functions for device authentication and secret key generation," in Proceedings of the 44th IEEE Design Automation Conference (DAC). IEEE Press, 2007, pp. 9--14.

Digital Library

[13]

B. Gassend, D. Clarke, M. van Dijk, and S. Devadas, "Controlled physical random functions," in Proceedings of the 18th Annual Computer Security Applications Conference (ACSAC), 2002.

Digital Library

[14]

J. Guajardo, S. S. Kumar, G.-J. Schrijen, and P. Tuyls, "Physical unclonable functions and public-key crypto for FPGA IP protection," in International Conference on Field Programmable Logic and Applications, 2007, pp. 189--195.

[15]

K. B. Frikken, M. Blanton, and M. J. Atallah, "Robust authentication using physically unclonable functions," in Information Security Conference (ISC), September 2009.

Digital Library

[16]

K. Lofstrom, W. Daasch, and D. Taylor, "IC identification circuit using device mismatch," in Solid-State Circuits Conference, 2000. Digest of Technical Papers. ISSCC. 2000 IEEE International, 2000, pp. 372--373.

[17]

B. Gassend, D. Clarke, M. van Dijk, and S. Devadas, "Silicon physical random functions," in Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS '02), 2002.

Digital Library

[18]

S. Stanzione and G. Iannaccone, "Silicon physical unclonable function resistant to a 10²⁵-trial brute force attack in 90 nm cmos," in Symposium on VLSI Circuits, 2009, pp. 116--117.

[19]

R. Pappu, B. Recht, J. Taylor, and N. Gershenfeld, "Physical one-way functions," Science, vol. 297, pp. 2026--2030, September 2002.

[20]

G. E. Suh, C. W. O'Donnell, and S. Devadas, "Aegis: A single-chip secure processor," IEEE Design and Test of Computers, vol. 24, no. 6, pp. 570--580, 2007.

Digital Library

[21]

G. E. Suh, "AEGIS: A single-chip secure processor," in Elsevier Information Security Technical Report, vol. 10, 2005, pp. 63--73.

Digital Library

[22]

S. Devadas, E. Suh, S. Paral, R. Sowell, T. Ziola, and V. Khandelwal, "Design and implementation of PUF-based "unclonable" RFID ICs for anti-counterfeiting and security applications," in 2008 IEEE International Conference on RFID, 2008, pp. 58--64.

[23]

B. Danev, T. S. Heydt-Benjamin, and S. Capkun, "Physical-layer identification of RFID devices," in Proceedings of the USENIX Security Symposium, 2009.

Digital Library

[24]

N. Saparkhojayev and D. R. Thompson, "Matching electronic fingerprints of RFID tags using the hotelling's algorithm," in IEEE Sensors Applications Symposium (SAS), February 2009.

[25]

U. Feige, A. Fiat, and A. Shamir, "Zero knowledge proofs of identity," in Proceedings of the 19th Annual ACM Symposium on Theory of Computing, 1987, pp. 210--217.

Digital Library

[26]

"Polarssl: Small cryptographic library," http://www.polarssl.org/, 2008.

Cited By

Waseem SFatima A(2018)Cellular Automata and Arbiter PUF-Based Security Architecture for System-on-Chip DesignsMicroelectronics, Electromagnetics and Telecommunications10.1007/978-981-13-1906-8_28(271-278)Online publication date: 3-Nov-2018
https://doi.org/10.1007/978-981-13-1906-8_28
Jang MYoon MSong YChang J(2015)A Signature-based Data Authentication Method with Bitmap-based Transformed Datain Database OutsourcingProcedia Computer Science10.1016/j.procs.2015.05.07352(680-684)Online publication date: 2015
https://doi.org/10.1016/j.procs.2015.05.073
Jang MJo AChang J(2015)Encrypted Data Group Authentication for Outsourced DatabasesUbiquitous Computing Application and Wireless Sensor10.1007/978-94-017-9618-7_74(695-705)Online publication date: 5-Mar-2015
https://doi.org/10.1007/978-94-017-9618-7_74
Show More Cited By

Index Terms

PEAR: a hardware based protocol authentication system
1. Security and privacy
  1. Security services
    1. Authentication

Recommendations

A novel approach for privacy homomorphism using attribute-based encryption

In CRYPTO'13, Gentry et al. proposed the first homomorphic encryption HE scheme for the attribute-based encryption ABE. However, Gentry's scheme requires the same index for encryption of each ciphertext and supports only the key-policy ABE. Indeed, in ...
BAF and FI-BAF: Efficient and Publicly Verifiable Cryptographic Schemes for Secure Logging in Resource-Constrained Systems

Audit logs are an integral part of modern computer systems due to their forensic value. Protecting audit logs on a physically unprotected machine in hostile environments is a challenging task, especially in the presence of active adversaries. It is ...
Verifiable memory leakage-resilient dynamic searchable encryption

Searchable symmetric encryption (SSE) allows a data owner to outsource his encrypted data to a cloud server while retaining the ability to perform keyword search over encrypted data. The security guarantees of existing SSE schemes require that the ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

SPRINGL '10: Proceedings of the 3rd ACM SIGSPATIAL International Workshop on Security and Privacy in GIS and LBS

November 2010

76 pages

ISBN:9781450304351

DOI:10.1145/1868470

General Chair:
Elisa Bertino
Purdue University
,
Program Chairs:
Maria Luisa Damiani
University of Milan, Italy
,
Yücel Saygin
Sabanci University, Turkey

Copyright © 2010 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSPATIAL: ACM Special Interest Group on Spatial Information

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 02 November 2010

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

GIS '10

Sponsor:

SIGSPATIAL

GIS '10: 18th SIGSPATIAL International Conference on Advances in Geographic Information Systems

November 2, 2010

California, San Jose

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

8
Total Citations
View Citations
236
Total Downloads

Downloads (Last 12 months)5
Downloads (Last 6 weeks)2

Reflects downloads up to 13 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

Waseem SFatima A(2018)Cellular Automata and Arbiter PUF-Based Security Architecture for System-on-Chip DesignsMicroelectronics, Electromagnetics and Telecommunications10.1007/978-981-13-1906-8_28(271-278)Online publication date: 3-Nov-2018
https://doi.org/10.1007/978-981-13-1906-8_28
Jang MYoon MSong YChang J(2015)A Signature-based Data Authentication Method with Bitmap-based Transformed Datain Database OutsourcingProcedia Computer Science10.1016/j.procs.2015.05.07352(680-684)Online publication date: 2015
https://doi.org/10.1016/j.procs.2015.05.073
Jang MJo AChang J(2015)Encrypted Data Group Authentication for Outsourced DatabasesUbiquitous Computing Application and Wireless Sensor10.1007/978-94-017-9618-7_74(695-705)Online publication date: 5-Mar-2015
https://doi.org/10.1007/978-94-017-9618-7_74
Jang MYoon MYoun DChang J(2014)Clustering-Based Query Result Authentication for Encrypted Databases in CloudProceedings of the 2014 IEEE Intl Conf on High Performance Computing and Communications, 2014 IEEE 6th Intl Symp on Cyberspace Safety and Security, 2014 IEEE 11th Intl Conf on Embedded Software and Syst (HPCC,CSS,ICESS)10.1109/HPCC.2014.181(1076-1082)Online publication date: 20-Aug-2014
https://dl.acm.org/doi/10.1109/HPCC.2014.181
Miyoung Jang Min Yoon Jae-Woo Chang (2014)A privacy-aware query authentication index for database outsourcing2014 International Conference on Big Data and Smart Computing (BIGCOMP)10.1109/BIGCOMP.2014.6741410(72-76)Online publication date: Jan-2014
https://doi.org/10.1109/BIGCOMP.2014.6741410
Miyoung Jang Ara Jo Jae-Woo Chang (2013)A privacy-aware query authentication index for encrypted database in cloud8th International Conference for Internet Technology and Secured Transactions (ICITST-2013)10.1109/ICITST.2013.6750176(126-131)Online publication date: Dec-2013
https://doi.org/10.1109/ICITST.2013.6750176
Kumar RBurleson W(2012)PHAPProceedings of the 2012 45th Annual IEEE/ACM International Symposium on Microarchitecture Workshops10.1109/MICROW.2012.14(24-31)Online publication date: 1-Dec-2012
https://dl.acm.org/doi/10.1109/MICROW.2012.14
Choi PKim D(2012)Design of security enhanced TPM chip against invasive physical attacks2012 IEEE International Symposium on Circuits and Systems10.1109/ISCAS.2012.6271612(1787-1790)Online publication date: May-2012
https://doi.org/10.1109/ISCAS.2012.6271612

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents