An environment for security protocol intrusion detection

Article type: Research Article

Authors: Yasinsac, Alec

Affiliations: Department of Computer Science, Florida State University, 214A James Jay Love Building, Tallahassee, FL 32306-4530, USA. Tel.: +1 850 644 6407; Fax: +1 850 644 0058; E-mail: [email protected]

Abstract: Secure electronic communication relies on cryptography. Even with perfect encryption, communication may be compromised without effective security protocols for key exchange, authentication, etc. We are now seeing proliferation of large secure environments characterized by high volume, encrypted traffic between principals, facilitated by Public Key Infrastructures (PKI). PKI's are dependent on security protocols. Unfortunately, security protocols are susceptible to subtle errors. To date, we have relied on formal methods to tell us if security protocols are effective. These methods do not provide complete or measurable protocol security. Security protocols are also subject to the same implementation and administrative vulnerabilities as communication protocols. As a result, we will continue to operate security protocols that have flaws. In this paper, we describe a method and architecture to detect intrusions in security protocol environments such as Public Key Infrastructures. Our method is based on classic techniques of knowledge-based and behavior-based intrusion detection systems.

DOI: 10.3233/JCS-2002-101-208

Journal: Journal of Computer Security, vol. 10, no. 1-2, pp. 177-188, 2002