Introduction

Advanced teleinformatic technologies nowadays provide a wide range of possibilities of development of industry or institutions of public services. The high stress is put on the development of well-available information services called "e-anything", like egovernment, e-money, and e-banking. These mentioned processes are fulfilled mainly in an electronic way, thanks to which one can increase their availability, cutting down the expenses at the same time.

Implementation of these services is connected with the choice of a proper level of security of information sent between parties of protocols [12,14,16]. Among teleinformatic technologies and cryptographic modules there are such, which assure different information security services e.g.: confidentiality, integrity, non-repudiation, and anonymity of data. The important problem seems to be the establishing an appropriate the level of information security fulfilled by services in a given protocol. Every use of any Internet service is connected with information exchange, which in the case of successful attack causes different threats to the whole process. This problem can be solved by estimating the security levels for each phase of the protocol [1]. Such an approach seems to be only a partial solution, because using a given specific service one can send information of different level of threats. A common practice is to use exaggerated means to ensure information security, which decreases efficiency, system availability and introduces redundancy. Another effect of exaggeration of security mechanisms is increasing the system complexity, which later influences implementation of a given project in practice, imposing restrictions that decrease their functionality.

The adequate solution such a case seems to be the introduction of scalable security model for the protocols, which can change security level depending on particular conditions that take place at a moment and in a given external conditions. In the paper we present a mechanism, which can modify the level of information security for each phase of protocol. The parameters, which influence modification of the security level, are: the risk of a successful attack, probability of a successful attack and independence of the security elements. The used security elements, which take care of the protection of information, are based mainly on PKI services and cryptographic modules.

Security services and supporting elements

In practice, realization of the electronic processes is connected with fulfilment of a number of legal and technical standards. While projecting the systems, we can take care of different security services [1,2]. Among them we can enumerate: confidentiality of data, integrity of data, anonymity of the parties of protocols, non-repudiation of a sender and/or a receiver, authorization, secure data storage, management of privileges, public trust, and network and protocol/service accountability. Every security service has its own characteristics. A systematic presentation of the security services is given in Table 1.

Protocol/service accountability

Steps of protocols (access to services) are registered to restore past threats The postulated system conditions, which are described by the security services, can be fulfilled with many different security elements. To achieve an appropriate level of security we can use different mechanisms [3,4,5,6,7]. In the article we will focus on two groups of solutions: services based on PKI [1, 3 4, 9, 10, 13, 15] and independent cryptographic modules [4]. The detailed descriptions of the used security mechanisms can be found in the literature, e.g., in the articles cited in the bibliography of this paper.

The concept of scalable security

The realization of electronic process is dependent of a proper level of security. During the projecting of mentioned process the security mechanisms are established. They are usually overestimated according to real risk. One can notice that there are differences connected with information sent in the same electronic process. They concern different threats, which in the case of successful attack will affect the parties of a protocol. In a case of small threat, there is a great possibility of decreasing redundant resources of information security, which in fact will improve efficiency of the protocol, system availability and, as a consequence, will increase its security

General requirements

Secure electronic processes are based on cryptographic protocols. Application of properly designed cryptographic protocol introduces many security services, which enable reliable realization of the electronic process. The protocols realize security services by means of various security elements: e.g. PKI-based services and cryptographic modules. The usage of these security elements is strictly defined in the steps of cryptographic protocols. As a result of that, any modification of their content is forbidden; otherwise it will ruin the whole concept of the protocols, what in fact negates an idea of scalable security.

Te solution of that contradiction is creating different protocols realizing the same service, applied on different level of security 1 . To precise a certain electronic service one constructs a protocol according to well-defined security requirements. Some security elements can be configured before the real process implementation, while the others introduced in a dynamic process of the system tuning. This can be done by using some unchangeable security elements whose change is critical for the processes.

Parameters of the scalable security

The security level of an electronic process can depend on several different factors. The security can be modified by means of their proper choice. In the presented model of the scalable security, the resultant protection of information is the following function of three primary parameters 2 :

1 For simplicity, when we will change the element which is not important for the protocol's functionality, but important for its security, we will call it a new protocol. 2 s is the security level, which is realized by a given version of cryptographic protocol; i is a number of subprotocols in a given protocol; j is a number of steps of parameters in a given subprotocol;

x is a concrete security service;

x ij ω is the weight describing an average cost of loses after successful attack for a given service; ω ∈ (0,1)

x ij

L is a value of security elements for a given service; L ∈ (0, 1) x ij P is the probability of attack on a given service; P ∈ (0, 1) Z is a convergence exponent of the security elements. Z ∈ (1, 25)

∑∑∑ − = a i Z x ij x ij x ij b j x ij x ij c x x ij S L P L F ) ( )] 1 ( [ ) ( ω ω ω (1)

The three primary parameters in the equation ( 1) are:

1. The protection level: ;

x ij L 2. The risk of attack on a given service:

[ ; )] 1 ( x ij x ij P − ω 3. The dependence (coefficient) of security elements: Z x ij x ij x ij L ) ω ω ( ;

Each of the above parameters in the formula ( 1) is calculated for all cryptographic protocols, all subprotocols of these protocols and all steps of the subprotocols. The first parameter defines the protection level for a given cryptographic service in a given step of subprotocol. This is a sum of chosen security elements, which guarantee security of a given service.

The second parameter shows a risk of attack on a given security service. This is a multiplication of average losses made by successful attack and probability of attack on a given security service.

The third parameter describes independence of security elements used to gain a proper protection level. The security elements are mutually connected; missing some protection of information mechanisms in one subprotocol (e.g., at the beginning of the protocol) strongly influences the security of other subprotocols. The level of convergence can also be changeable; it depends on, e.g., a number of subprotocols and the security level.

The security level of electronic processes mainly depends on the used elements of protection of information required by the security services. In this paper, the security elements are based on PKI services and cryptographic modules. In Table 2, dependences of security services and security mechanisms are presented. Every security service can be realized by different security mechanisms. Security level of a given protocol will depend, among other things, on an appropriate selection of the elements. For every security elements their contribution to the global protection of services is defined as . The individual contribution of particular services is defined in percent.

x ij L Security dependencies of the security elements (Table 2) are only an example. It can be created in a free way using different security mechanisms. The value of the parameter L is constant for particular security requirements. Creating the cryptographic protocol on a different level of protection, we do not modify this parameter.

Impact of successful attack

The parameters, which are set up during the risk calculation are the weights for particular services . These weights indicate the average loses caused by a successful attack.

x ij ω

In the risk modelling, the impact is the result of an information security incident, caused by a threat, which affects assets. In the presented model of scalable security the resultant impact is obtained by combination of two kinds of impact, caused by direct and indirect reasons. Below we present the parameters used during the impact calculation:

The direct parameters:

x ij LZ are the assets gained during a successful attack on a given security elements (100% is the compromise of the whole protocol);

x ij F are the financial losses during a successful attack on given security elements (100% is the total financial loss); The indirect parameters:

x ij α are the financial costs, which are necessary for repairing the damages gained during a successful attack (100% is the maximal cost);

x ij β are the losses of the value of the company shares or the company reputation (100% is the maximal market loss).

To calculate the impact of a successful attack ( ) we use a combination of the parameters described above. Thus, the parameter describes the influence of potential harm of a given threat to compromise the whole process. The describes direct financial losses during the attack on the particular step of the protocol.

x ij ω LZ x ij x ij F

The next parameters are connected with an indirect impact of the successful attack. The first group of parameters ( ) is connected with the indirect financial losses, which must be taken after successful attack on the system. Those financial losses are due to damage and repairing of the information systems. The second group of parameters ( .) describes the loss of the company securities or a company reputation.

x ij α x ij β

By combination of all the mentioned parameters we obtain the impact of an attack in a particular process:

x ij x ij x ij x ij x ij LZ F ) ( α β ω + + =

The impact parameter is a changeable part of the Equation (1) for a particular processes, because losses connected with a successful attack can be different for a concrete information process.

Usage of the scalable security model: e-auction

The concept of scalable security can be realized for different types of cryptographic protocols [8,9]. In this paper we present an example, which implements the idea of scalable security for the electronic auction. The considered e-auction model is formulated as the cryptographic protocol [9].

The e-auction model

The analysed protocol of e-auction consists of four subprotocols: certification, notification of auction, notification of the offer, and the choice of the offer. In protocol take part N bidders (O 1 , ... ,O N ), third trustworthy person that is GAP (central auction agency) as well as firm, which wants to announce the auction.

The first step of protocol is verification by GAP, the participants taking part in eauction, that is the bidders O N as well as firm F which wants to announce the auction (the subprotocol of certification). The next step is notification to GAP the auction by verified firm F. GAP publishes the conditions of notified auction, giving all requirements notified by F (the subprotocol of notification of auction). In the next step, person wanting to take part in auction, after the earlier verification, sends his offer to GAP (the subprotocol of notification of the offer). The last subprotocol is executed after elapsing of time for notification of offers, then the firm F as well as bidders O N , send their parts of secret (needed to read offers) to GAP. After decoding them, they will be sent to firm F, where victorious offer will be chosen. In the same subprotocol, the firm F sends information about the victorious offer to GAP, and then it will be published to (be generally known) public message (the subprotocol of choice of the offer).

The communication between participants of the protocol is safe. We achieve it thanks to using public key cryptography, where every participant of the protocol possesses his private key (SK) as well as public key (PK). Those practical keys are not permanent; their validity ends with the validity of the registration number, which is achieved in the subprotocol of certification.

Security of a chosen sub-protocol

As we mentioned, we present usage of the scalable security for the subprotocol of notification of electronic auction. The protocol (see Fig. 1) can be notified by any person, which obtained suitable authorizations in the subprotocol of certification. Step 1:

In the first step, F sends to GAP, signed digitally (SK F ) as well as coded (PK GAP ) the following information: his registration number (NR F ), his time stamp (T NRF ), the conditions of auction (WP F ), and his individual number (N F ).

Step 2:

The central auction agency (GAP) verifies the registration number of F, (NR F ) and validity of his timestamp. After positive authorization, GAP generates the individual number of auction (N P ) and the pair of keys for the concrete auction, (SK P ,PK P ). The private key of auction (SK P ) is divided into parts by using the threshold scheme of secret sharing. Secret is divided into three parts, designed for F( SK P(F) ), for GAP (SK P(GAP) ) and for bidders in the auction (SK P(OF) ). Each part is necessary to reproduce the private key (SK P ).

Step 3: GAP sends digitally signed (SK GAP ) and encrypted (PK F ), the part of the secret designed for F (SK P(F) ).

Step 4: GAP publishes, for example on WWW site, the number of auction (N P ), conditions of it (WP F ) and the public key of the auction (PK P ).

Results

The Step 1, which must be executed, defines weights, which describe the risk " " for particular security services in all the steps of subprotocol. In the described case the defined weights are constant for a given process. If any security service is not required in a given step, the weight of described risk is equal to zero. In Table 3 we present the values of weights for a given subprotocol.

x ij ω During the Step 2, we define security elements, which realize chosen security elements (Table 4). This element is changeable for every version of described subprotocols. In the paper we describe three versions of the subprotocol, the first, basic ("A"), and others, with larger number of security elements ("B") and smaller number of security elements ("C").

During the Step 3, we set up probability of attack on a particular services in described steps of protocol. (Table 5). Those values are constant for a given process. Step 1

Step 2

Step 3

Step 4 P I 0,8 0,3 0,3 0,7 P C 0,7 0,9 0,8 0 P NRS 0,4 0 0,2 0,6 The last parameter is a parameter of function convergence whose characteristics are shown in Fig. 2. In the described subprotocol, the value of parameter Z = 3 was chosen.

P

In the last Step 4, checking the security level of the particular version of the subprotocol, we calculate the value of the function F, see Equation 1. The results of calculations are presented in Table 6.

Conclusions

Analysis of this paper shows that we three versions of described subprotocol, each with different level of protection. The basic level ("A") is much higher than the level with a few security elements ("C"). Thus, the level ("C") could be used only in a case of transporting unimportant data. The version with the highest security level ("B"), guarantee the strongest protection of the subprotocol. This version is adequate for transmission of critical data between the parties of the protocol. The prior setting up different security levels for all subprotocols in the whole eauction protocol helps us to change particular versions of subprotocol, creating freely scalable with respect to the security level, final version of the protocol. Such a possibility can be useful in a case of modifying the security levels in particular phases of subprotocol [17], which can decrease system performance and, as a result, its security.