- Email: [email protected]
Editorial for the special issue on Internet Communications Security
Computer Communications 29 (2006) 2737–2738 www.elsevier.com/locate/comcom
Editorial
Editorial for the special issue on Internet Communications Security
Since 2002, we have organized the Workshop on Internet Communications Security (WICS) because we believe that upcoming Internet is bound to the security techniques to protect it. Due to the high quality papers we received in past editions of WICS, we decided to select a short group of papers and invite to their authors to adapt them to the needs and problems of the future Internet. For the 2005 edition of the WICS we received 45 submissions, we selected 16 papers to be included in WICS05 and only 11 of those to be improved and adapted for being published in this special issue. There is no doubt about how difficult is to protect the Internet: its huge size, number of users, amount of software and platforms involved, protocols, etc., imply that great efforts have to be made in order to improve the security of network communications. Following this same goal, many cryptographic techniques have been included in communication protocols, and complete frameworks have been developed to establish secure channels among trusted computers. Nowadays, security protocols are used at every layer of the TCP/IP stack, protocols like SSL, IPSEC, and PPTP are only a few of the better known examples. Furthermore, if we think about the future of the Internet, the work of the IETF Security Area (The Internet Engineering Task Force) should be highlighted, where the currently used protocols are being reviewed and improved, and new protocols are being designed for future needs. The main core of the papers of this special issue is focused on improvements on mechanisms to be used in the Internet protocols. Two of them treat certain particularities of Key Establishment (KE) protocols: the authors of the paper ÔThe importance of Proofs of Security for Key Establishment ProtocolsÕ remark the importance of proof of security and examine several KE protocols without this proof. In the same way, the work of Phan, Goi, and Wong shows attacks for the Simple Authenticated Key Agreement protocol (SAKA) and highlights the dangers of relying too much on ‘‘improved’’ variants of weak protocols. Also presenting new techniques to be used in Internet protocols, the work ÔOn the Implementation of Security
0140-3664/$ - see front matter Ó 2005 Elsevier B.V. All rights reserved. doi:10.1016/j.comcom.2005.10.025
Policies with Adaptative EncryptionÕ presents a novel solution to adapt the encryption processes to the capabilities of the computing devices and security policies established. One of the most common risks for the companies connected to Internet is hacker attacks. To detect these attacks as soon as possible Intrusion Detection Systems (IDS) try to analyze network packets or logs in order to find suspicious activities. The contribution of Yan, Hou, and Ansari presents a grammar for improving the analysis of networking logs: they propose an autonomous event analysis system, which allows inferring attack scenarios and enabling the attacks knowledge semantic queries. The paper ÔIncorporating Trust and Reputation in the DSR Protocol for Dependable RoutingÕ is focused in the routing problems of ad-hoc networks. Pirzada, Datta, and McDonald present a system where each node maintains trust levels (called reputations) for its immediate neighbors based upon their current actions. This trust mechanism has been integrated with the DSR route discovery process in order to increase protocolÕs performance in the presence of malicious nodes. The Internet is bringing new business models, and some of them need to ensure high levels of security for an intrinsic insecure environment. To face up this situation, the papers ÔPractical Electronic Lotteries with offline TTPÕ and ÔBatch Verification of Validity of Bids in Homomorphic E-actionÕ represent, respectively, a new e-lottery scheme for the Internet and the improvement of the efficiency of bid validity check. However these papers go further beyond, as their proposed techniques provide security services that can be applied to other business models, current or future. Electronic transactions concern to many e-commerce models, and so, two papers of the special issue are related with this field. The paper ÔTowards Self-Authenticable SmartCardsÕ offers a new approach, in order to supply an autonomous and self-authenticable EAP protocol for smartcards. The contribution of Wang, Guo, Lin, Yin, He, and Zhang proposes a new dependable exchange protocol to be applied in critical transactions, such as electronic payment and electronic contract signing.
2738
Editorial / Computer Communications 29 (2006) 2737–2738
Other papers of this special issue are focused on Internet services widely used but with several security problems that affect their use. This is the case of Email, as the paper of Shao, Wang, and Zhou shows some common attacks against two of the latest certified Email protocols and purports some improvements to avoid those security flaws. Also, working in this same field, Roman, Zhou, and Lopez face one of the most important problems of email; they propose an anti-spam system that uses a pre-challenge scheme, which is based on challenge-response mechanism and takes advantage of some features of email systems.
The organization of this special issue has been a great pleasure for me, and I would like to thank the authors for their research, the program committee for their efforts and, finally, the Computer Communications Editor for his endless patient and help. Jose´ Marı´a Sierra Computer Science Department, University Carlos III of Madrid, Spain E-mail address: [email protected] Available online 5 December 2005
Editorial
Editorial for the special issue on Internet Communications Security
Since 2002, we have organized the Workshop on Internet Communications Security (WICS) because we believe that upcoming Internet is bound to the security techniques to protect it. Due to the high quality papers we received in past editions of WICS, we decided to select a short group of papers and invite to their authors to adapt them to the needs and problems of the future Internet. For the 2005 edition of the WICS we received 45 submissions, we selected 16 papers to be included in WICS05 and only 11 of those to be improved and adapted for being published in this special issue. There is no doubt about how difficult is to protect the Internet: its huge size, number of users, amount of software and platforms involved, protocols, etc., imply that great efforts have to be made in order to improve the security of network communications. Following this same goal, many cryptographic techniques have been included in communication protocols, and complete frameworks have been developed to establish secure channels among trusted computers. Nowadays, security protocols are used at every layer of the TCP/IP stack, protocols like SSL, IPSEC, and PPTP are only a few of the better known examples. Furthermore, if we think about the future of the Internet, the work of the IETF Security Area (The Internet Engineering Task Force) should be highlighted, where the currently used protocols are being reviewed and improved, and new protocols are being designed for future needs. The main core of the papers of this special issue is focused on improvements on mechanisms to be used in the Internet protocols. Two of them treat certain particularities of Key Establishment (KE) protocols: the authors of the paper ÔThe importance of Proofs of Security for Key Establishment ProtocolsÕ remark the importance of proof of security and examine several KE protocols without this proof. In the same way, the work of Phan, Goi, and Wong shows attacks for the Simple Authenticated Key Agreement protocol (SAKA) and highlights the dangers of relying too much on ‘‘improved’’ variants of weak protocols. Also presenting new techniques to be used in Internet protocols, the work ÔOn the Implementation of Security
0140-3664/$ - see front matter Ó 2005 Elsevier B.V. All rights reserved. doi:10.1016/j.comcom.2005.10.025
Policies with Adaptative EncryptionÕ presents a novel solution to adapt the encryption processes to the capabilities of the computing devices and security policies established. One of the most common risks for the companies connected to Internet is hacker attacks. To detect these attacks as soon as possible Intrusion Detection Systems (IDS) try to analyze network packets or logs in order to find suspicious activities. The contribution of Yan, Hou, and Ansari presents a grammar for improving the analysis of networking logs: they propose an autonomous event analysis system, which allows inferring attack scenarios and enabling the attacks knowledge semantic queries. The paper ÔIncorporating Trust and Reputation in the DSR Protocol for Dependable RoutingÕ is focused in the routing problems of ad-hoc networks. Pirzada, Datta, and McDonald present a system where each node maintains trust levels (called reputations) for its immediate neighbors based upon their current actions. This trust mechanism has been integrated with the DSR route discovery process in order to increase protocolÕs performance in the presence of malicious nodes. The Internet is bringing new business models, and some of them need to ensure high levels of security for an intrinsic insecure environment. To face up this situation, the papers ÔPractical Electronic Lotteries with offline TTPÕ and ÔBatch Verification of Validity of Bids in Homomorphic E-actionÕ represent, respectively, a new e-lottery scheme for the Internet and the improvement of the efficiency of bid validity check. However these papers go further beyond, as their proposed techniques provide security services that can be applied to other business models, current or future. Electronic transactions concern to many e-commerce models, and so, two papers of the special issue are related with this field. The paper ÔTowards Self-Authenticable SmartCardsÕ offers a new approach, in order to supply an autonomous and self-authenticable EAP protocol for smartcards. The contribution of Wang, Guo, Lin, Yin, He, and Zhang proposes a new dependable exchange protocol to be applied in critical transactions, such as electronic payment and electronic contract signing.
2738
Editorial / Computer Communications 29 (2006) 2737–2738
Other papers of this special issue are focused on Internet services widely used but with several security problems that affect their use. This is the case of Email, as the paper of Shao, Wang, and Zhou shows some common attacks against two of the latest certified Email protocols and purports some improvements to avoid those security flaws. Also, working in this same field, Roman, Zhou, and Lopez face one of the most important problems of email; they propose an anti-spam system that uses a pre-challenge scheme, which is based on challenge-response mechanism and takes advantage of some features of email systems.
The organization of this special issue has been a great pleasure for me, and I would like to thank the authors for their research, the program committee for their efforts and, finally, the Computer Communications Editor for his endless patient and help. Jose´ Marı´a Sierra Computer Science Department, University Carlos III of Madrid, Spain E-mail address: [email protected] Available online 5 December 2005