Identifying Potential Type Confusion in Authenticated Messages
نویسنده
چکیده
A type confusion attack is one in which a principal accepts data of one type as data of another. Although it has been shown by Heather et al. that there are simple formatting conventions that will guarantee that protocols are free from simple type confusions in which fields of one type are substituted for fields of another, it is not clear how well they defend against more complex attacks, or against attacks arising from interaction with protocols that are formatted according to different conventions. In this paper we show how type confusion attacks can arise in realistic situations even when the types are explicitly defined in at least some of the messages, using examples from our recent analysis of the Group Domain of Interpretation Protocol. We then develop a formal model of types that can capture potential ambiguity of type notation, and outline a procedure for determining whether or not the types of two messages can be confused. We also discuss some open issues.
منابع مشابه
Partially Authenticated Algorithms for Byzantine Agreement
Byzantine agreement is a fundamental issue in fault-tolerant and secure distributed computing. Protocols solving Byzantine agreement guarantee that a sender can transmit a value to a group of receivers consistently, even if some of the nodes, including the sender, are arbitrarily faulty. In the past, protocols for Byzantine agreement were generally either authenticated or non-authenticated. Non...
متن کاملAn efficient protocol for authenticated and secure message delivery in vehicular ad hoc networks
a r t i c l e i n f o a b s t r a c t In Vehicular Ad hoc Networks (VANETs), anonymity of the nodes sending messages should be preserved, while at the same time the law enforcement agencies should be able to trace the messages to the senders when necessary. It is also necessary that the messages sent are authenticated and delivered to the vehicles in the relevant areas quickly. In this paper, w...
متن کاملA Procedure for Verifying Security Against Type Confusion Attacks
A type confusion attack is one in which a principal accepts data of one type as data of another. Although it has been shown by Heather et al. that there are simple formatting conventions that will guarantee that protocols are free from simple type confusions in which fields of one type are substituted for fields of another, it is not clear how well they defend against more complex attacks, or a...
متن کاملExamination of Authors' Stylistic Elements of Electronic Messages based on Researched Studies
Identifying author is an important issue in natural language processing and text classification. It shows the author's characteristic in various texts. The rapid development of the Internet causes Web-based tools such as email and blogs with an anonymous identity become a popular method of communication for the perpetrators. Moreover, it creates some specific security issues. In this paper, we ...
متن کاملInternet - Draft SIP Identity
The existing security mechanisms in the Session Initiation Protocol are inadequate for cryptographically assuring the identity of the end users that originate SIP requests, especially in an interdomain context. This document recommends practices and conventions for identifying end users in SIP messages, and proposes a way to distribute cryptographically-secure authenticated identities. Peterson...
متن کامل