Secure Communication Using Identity Based Encryption

Abstract

Abstract. Secured communication has been widely deployed to guarantee confidentiality and integrity of connections over untrusted networks, e.g., the Internet. Although secure connections are designed to prevent attacks on the connection, they hide attacks inside the channel from being analyzed by Intrusion Detection Systems (IDS). Furthermore, secure connections require a certain key exchange at the initialization phase, which is prone to Man-In-The-Middle (MITM) attacks. In this paper, we present a new method to secure connection which enables Intrusion Detection and overcomes the problem of MITM attacks. We propose to apply Identity Based Encryption (IBE) to secure a communication channel. The key escrow property of IBE is used to recover the decryption key, decrypt network traffic on the fly, and scan for malicious content. As the public key can be generated based on the identity of the connected server and its exchange is not necessary, MITM attacks are not easy to be carried out any more. A prototype of a modified TLS scheme is implemented and proved with a simple client-server application. Based on this prototype, a new IDS sensor is developed to be capable of identifying IBE encrypted secure traffic on the fly. A deployment architecture of the IBE sensor in a company network is proposed. Finally, we show the applicability by a practical experiment and some preliminary performance measurements.

Identity Based Encryption and Identity Based Signature Scheme on Security Schemes

“…The table 1 gives the overview of IBE systems related to security services provided by the system. Also, it provides information about the type of attack which has been detected or prevented by the system Intrusion Detection Sensor(IDS) using IBE [12] Authentication and Confidentiality…”

Public-Key Encryption with Delegated Search

“…Roschke et al [RICM10] propose a technique which detects malicious content in the encrypted data. The solution presented in [RICM10] is based on the IBE [BF01] scheme and suffers from the key escrow property where the compromise of the master secret key compromises the whole system.…”

“…Roschke et al [RICM10] propose a technique which detects malicious content in the encrypted data. The solution presented in [RICM10] is based on the IBE [BF01] scheme and suffers from the key escrow property where the compromise of the master secret key compromises the whole system. The conceptual difference between our approach and the approach presented in [RICM10], is that the technique in [RICM10] uses the master secret key of the IBE to decrypt the ciphertext and then uses the virus scanner to scan the plaintext, while in our approach scanning can be done in the encrypted data, without having to decrypt it.…”

Ctyptographically enforced distributed data access control

“…Roschke et al [9] propose a technique which detects malicious content in the encrypted data. The solution presented in [9] is based on the IBE [27] scheme and suffers from the key escrow property where the compromise of the master secret key breaks the whole system.…”

“…Roschke et al [9] propose a technique which detects malicious content in the encrypted data. The solution presented in [9] is based on the IBE [27] scheme and suffers from the key escrow property where the compromise of the master secret key breaks the whole system. The conceptual difference between PKEDS and the approach presented in [9] is, that the scheme in [9] uses the master secret key of the IBE to decrypt the ciphertext and then uses the virus scanner to scan the plaintext, while in PKEDS the scanning can be done in the encrypted data, without having to decrypt it.…”