Public services called „e-anything” (e-government, e-banking, ecommerce, etc.) meet many different barriers, which reduce their efficient applicability. One of them is requirement of assurance of the information security when it is transmitted, transformed, and stored in the electronic service. It is possible to provide an appropriate level of security applying the present-day information technology. However, the level of the protection of information is often much higher than it is necessary to meet potential threats. Since the level of security strongly affects the performance of whole system, the excessive protection decreases the system's reliability and availability and, as a result, its global security. In this paper we present a model of scalable security for digital information transmission systems (being usually the crucial part of e-service). In our model the basic element of the security is the Public Key Infrastructure (PKI) enriched by specific cryptographic modules.
Advanced teleinformatic technologies nowadays provide a wide range of possibilities of development of industry or institutions of public services. The high stress is put on the development of well-available information services called “e-anything”, like egovernment, e-money, and e-banking. These mentioned processes are fulfilled mainly in an electronic way, thanks to which one can increase their availability, cutting down the expenses at the same time.
Implementation of these services is connected with the choice of a proper level of
security of information sent between parties of protocols [
The adequate solution such a case seems to be the introduction of scalable security model for the protocols, which can change security level depending on particular conditions that take place at a moment and in a given external conditions. In the paper we present a mechanism, which can modify the level of information security for each phase of protocol. The parameters, which influence modification of the security level, are: the risk of a successful attack, probability of a successful attack and independence of the security elements. The used security elements, which take care of the protection of information, are based mainly on PKI services and cryptographic modules. 2
In practice, realization of the electronic processes is connected with fulfilment of a
number of legal and technical standards. While projecting the systems, we can take
care of different security services [
Prevention against improper information modification or destruction Non-repudiation of sending a message (the fact of communication) Non-repudiation of sender’s identity and the fact of sending a message by the sender Non-repudiation of receiver’s identity and the fact of receiving a message by the receiver Guarantee of only authorized infor
data
mation access and disclosure
Correct authorization of the parties of
protocol is required to realize the
steps of protocol
The function of a party in the
protocol depends on his certain defined
permission level
Hiding the fact that there was a data
exchange (hiding the information
flow, hiding the network traffic)
Hiding the identity of message sender
(without network anonymity)
Hiding the identity of message
receiver (without network anonymity)
Ensuring timely and reliable access to
services and data and use of
information
Possibility of public verification of
action in protocol between parties of
protocol
Possibility of public verification of
action in protocol with TTP usage
Confidential and permanent storage
of information, available for legal
users
Events in network are registered to
restore past threats
Steps of protocols (access to services)
are registered to restore past threats
The postulated system conditions, which are described by the security services, can
be fulfilled with many different security elements. To achieve an appropriate level of
security we can use different mechanisms [
The realization of electronic process is dependent of a proper level of security. During the projecting of mentioned process the security mechanisms are established. They are usually overestimated according to real risk. One can notice that there are differences connected with information sent in the same electronic process. They concern different threats, which in the case of successful attack will affect the parties of a protocol. In a case of small threat, there is a great possibility of decreasing redundant resources of information security, which in fact will improve efficiency of the protocol, system availability and, as a consequence, will increase its security 3.1
General requirements Secure electronic processes are based on cryptographic protocols. Application of properly designed cryptographic protocol introduces many security services, which enable reliable realization of the electronic process. The protocols realize security services by means of various security elements: e.g. PKI-based services and cryptographic modules. The usage of these security elements is strictly defined in the steps of cryptographic protocols. As a result of that, any modification of their content is forbidden; otherwise it will ruin the whole concept of the protocols, what in fact negates an idea of scalable security.
Te solution of that contradiction is creating different protocols realizing the same service, applied on different level of security1. To precise a certain electronic service one constructs a protocol according to well-defined security requirements. Some security elements can be configured before the real process implementation, while the others introduced in a dynamic process of the system tuning. This can be done by using some unchangeable security elements whose change is critical for the processes. 3.2
Parameters of the scalable security The security level of an electronic process can depend on several different factors. The security can be modified by means of their proper choice. In the presented model of the scalable security, the resultant protection of information is the following function of three primary parameters2: 1 For simplicity, when we will change the element which is not important for the protocol’s functionality, but important for its security, we will call it a new protocol. 2 s is the security level, which is realized by a given version of cryptographic protocol; i is a number of subprotocols in a given protocol; j is a number of steps of parameters in a given subprotocol; x is a concrete security service; ωixj is the weight describing an average cost of loses after successful attack for a given service; ω ∈ (0,1) Lx is a value of security elements for a given service; L ∈ (0, 1)
ij Pijx is the probability of attack on a given service; P ∈ (0, 1) Z is a convergence exponent of the security elements. Z ∈ (1, 25) a i b
c j
x FS = ∑ ∑ ∑ (Lij )[ω ixj (1 − Pijx )]( x ω ixj Lixj Z
) ω ixj The three primary parameters in the equation (1) are: 1. The protection level: Lixj ; 2. The risk of attack on a given service: [ω ixj (1 − Pijx )] ;
ω ixj Lixj ) Z ; ω ixj (1) Each of the above parameters in the formula (1) is calculated for all cryptographic protocols, all subprotocols of these protocols and all steps of the subprotocols.
Trust Time- Information Audit TTP to TTP between stamping repository L_PTA3= interoperaparts of L_PTA1= L_PTA2= 20% bility protocol 30% 30% L_PTA4= (PTA) 20% TTP trust Time- Information Audit TTP to TTP Notary (PTT) stamping repository L_PTT3= interopera- L_PTT5=
L_PTT1= L_PTT2= 10% bility 30% 30% 20% L_PTT4=
10% Secure Encryption Time- Key Certificate Non- Information Directory Audit PKG storage of L_SS1=30% stamping management management repudiation repository services L_SS8=5% L_SS9=5% data (SS) L_SS2=10% L_SS3=10% L_SS4=10% PKI L_SS6=15% L_SS7=5%
L_SS5=10% Network Logging Audit Encryption Digital Information account- L_NA1= L_NA2= L_NA3= Signatures repository ability (NA) 50% 20% 10% L_NA4= L_NA5=
10% 10% Proto- Logging Audit Encryption Digital Information col/service L_PA1= L_PA2= L_PA3= Signatures repository account- 50% 20% 10% L_PA4= L_PA5= ability (PA) 50% 10%
The first parameter defines the protection level for a given cryptographic service in a given step of subprotocol. This is a sum of chosen security elements, which guarantee security of a given service.
The second parameter shows a risk of attack on a given security service. This is a multiplication of average losses made by successful attack and probability of attack on a given security service.
The third parameter describes independence of security elements used to gain a proper protection level. The security elements are mutually connected; missing some protection of information mechanisms in one subprotocol (e.g., at the beginning of the protocol) strongly influences the security of other subprotocols. The level of convergence can also be changeable; it depends on, e.g., a number of subprotocols and the security level.
The security level of electronic processes mainly depends on the used elements of protection of information required by the security services. In this paper, the security elements are based on PKI services and cryptographic modules. In Table 2, dependences of security services and security mechanisms are presented. Every security service can be realized by different security mechanisms. Security level of a given protocol will depend, among other things, on an appropriate selection of the elements. For every security elements their contribution to the global protection of services is defined as Lixj . The individual contribution of particular services is defined in percent.
Security dependencies of the security elements (Table 2) are only an example. It can be created in a free way using different security mechanisms. The value of the parameter L is constant for particular security requirements. Creating the cryptographic protocol on a different level of protection, we do not modify this parameter. 3.3
Impact of successful attack
The parameters, which are set up during the risk calculation are the weights for particular services ωixj . These weights indicate the average loses caused by a successful attack. In the risk modelling, the impact is the result of an information security incident, caused by a threat, which affects assets. In the presented model of scalable security the resultant impact is obtained by combination of two kinds of impact, caused by direct and indirect reasons. Below we present the parameters used during the impact calculation: The direct parameters:
LZixj are the assets gained during a successful attack on a given security elements (100% is the compromise of the whole protocol);
Fijx are the financial losses during a successful attack on given security elements (100% is the total financial loss); The indirect parameters:
α ixj are the financial costs, which are necessary for repairing the damages gained during a successful attack (100% is the maximal cost);
β ixj are the losses of the value of the company shares or the company reputation (100% is the maximal market loss).
To calculate the impact of a successful attack (ωixj ) we use a combination of the parameters described above. Thus, the parameter LZ ixj describes the influence of potential harm of a given threat to compromise the whole process. The Fijx describes direct financial losses during the attack on the particular step of the protocol.
The next parameters are connected with an indirect impact of the successful attack. The first group of parameters (α ixj ) is connected with the indirect financial losses, which must be taken after successful attack on the system. Those financial losses are due to damage and repairing of the information systems. The second group of parameters ( β ixj .) describes the loss of the company securities or a company reputation.
By combination of all the mentioned parameters we obtain the impact of an attack in a particular process:
ω ixj = (Fijx + β ixj +α ixj ) LZ ixj
The impact parameter is a changeable part of the Equation (1) for a particular processes, because losses connected with a successful attack can be different for a concrete information process. 4
The concept of scalable security can be realized for different types of cryptographic
protocols [
The e-auction model The analysed protocol of e-auction consists of four subprotocols: certification, notification of auction, notification of the offer, and the choice of the offer. In protocol take part N bidders (O1, ... ,ON), third trustworthy person that is GAP (central auction agency) as well as firm, which wants to announce the auction.
The first step of protocol is verification by GAP, the participants taking part in eauction, that is the bidders ON as well as firm F which wants to announce the auction (the subprotocol of certification). The next step is notification to GAP the auction by verified firm F. GAP publishes the conditions of notified auction, giving all requirements notified by F (the subprotocol of notification of auction). In the next step, person wanting to take part in auction, after the earlier verification, sends his offer to GAP (the subprotocol of notification of the offer). The last subprotocol is executed after elapsing of time for notification of offers, then the firm F as well as bidders ON, send their parts of secret (needed to read offers) to GAP. After decoding them, they will be sent to firm F, where victorious offer will be chosen. In the same subprotocol, the firm F sends information about the victorious offer to GAP, and then it will be published to (be generally known) public message (the subprotocol of choice of the offer).
The communication between participants of the protocol is safe. We achieve it thanks to using public key cryptography, where every participant of the protocol possesses his private key (SK) as well as public key (PK). Those practical keys are not permanent; their validity ends with the validity of the registration number, which is achieved in the subprotocol of certification. 4.2
Security of a chosen sub-protocol
As we mentioned, we present usage of the scalable security for the subprotocol of notification of electronic auction. The protocol (see Fig.1) can be notified by any person, which obtained suitable authorizations in the subprotocol of certification.
F Input =(NRF,SKF,TNRF ,WPF ) KG NF
GAP
WWW 2a. If (NRF, TNRF) = TRUE 2b. KG NP, (SKP,PKP) 2c. SKP = SKP(F) + SKP(GAP) + SKP(OF) 4. NP, WPF, PKP Fig. 1. A diagram of the subprotocol of the electronic auction notification Such a person, called F, should possess the registration number NRF, his time stamp TNRF, private key SKF as well as conditions of notified auction WPF . F generates with the help of the generator of random numbers (KG), his individual number NF. Step 1: In the first step, F sends to GAP, signed digitally (SKF) as well as coded (PKGAP) the following information: his registration number (NRF), his time stamp (TNRF), the conditions of auction (WPF), and his individual number (NF).
Step 2: The central auction agency (GAP) verifies the registration number of F, (NRF) and validity of his timestamp. After positive authorization, GAP generates the individual number of auction (NP) and the pair of keys for the concrete auction, (SKP,PKP). The private key of auction (SKP) is divided into parts by using the threshold scheme of secret sharing. Secret is divided into three parts, designed for F( SKP(F)), for GAP (SKP(GAP)) and for bidders in the auction (SKP(OF)). Each part is necessary to reproduce the private key (SKP).
Step 3: GAP sends digitally signed (SKGAP) and encrypted (PKF), the part of the secret designed for F (SKP(F)).
Step 4: GAP publishes, for example on WWW site, the number of auction (NP), conditions of it (WPF) and the public key of the auction (PKP). 4.3
Results The Step 1, which must be executed, defines weights, which describe the risk „ω ixj ” for particular security services in all the steps of subprotocol. In the described case the defined weights are constant for a given process. If any security service is not required in a given step, the weight of described risk is equal to zero. In Table 3 we present the values of weights for a given subprotocol.
PI PC PNRS PAu PSS PMP
During the Step 2, we define security elements, which realize chosen security elements (Table 4). This element is changeable for every version of described subprotocols. In the paper we describe three versions of the subprotocol, the first, basic (“A”), and others, with larger number of security elements (“B”) and smaller number of security elements (“C”).
During the Step 3, we set up probability of attack on a particular services in described steps of protocol. (Table 5). Those values are constant for a given process.
The last parameter is a parameter of function convergence whose characteristics are shown in Fig. 2. In the described subprotocol, the value of parameter Z = 3 was chosen.
In the last Step 4, checking the security level of the particular version of the subprotocol, we calculate the value of the function F, see Equation 1. The results of calculations are presented in Table 6.
Analysis of this paper shows that we three versions of described subprotocol, each with different level of protection. The basic level (“A”) is much higher than the level with a few security elements (“C”). Thus, the level (“C”) could be used only in a case of transporting unimportant data. The version with the highest security level (“B”), guarantee the strongest protection of the subprotocol. This version is adequate for transmission of critical data between the parties of the protocol.
The prior setting up different security levels for all subprotocols in the whole
eauction protocol helps us to change particular versions of subprotocol, creating freely
scalable with respect to the security level, final version of the protocol. Such a
possibility can be useful in a case of modifying the security levels in particular phases of
subprotocol [