Authenticated Key Exchange Using Image
Steganography for pNFS
Anisha Merin James, Devika K V, Athira Kunjumon, Athira P Haridas, Hari M
Computer Science and Engineering Department, Saintgits College of Engineering
Kottukulam Hills, Pathamuttom, Kottayam, India
[email protected] [email protected] [email protected] [email protected] [email protected]
Abstract— This project deals the problem of key
establishment for secure many-to-many communications. The
problem is inspired by the proliferation of large-scale
distributed file systems supporting parallel access to multiple
storage devices. Our work highlights the parallel Network
File System’s (pNFS) current Internet standard, that
establishes parallel session keys between clients and storage
devices using Kerberos. The existing Kerberos-based protocol
shows that it has a number of limitations: (i) the scalability of
the protocol is restricted because of the heavy workload due to
a metadata server facilitating key exchange between the
clients and the storage devices (ii) the protocol does not
provide data encoding property; (iii) all the session keys are
generated by the metadata server itself that are used between
the clients and storage devices, and this inherently leads
access by third party. Our project proposes a variety of
secured key exchange protocols that are designed to handle
the above issues. We show that our protocols are capable of
reducing up to approximately 54% of the workload of the
metadata server and concurrently supporting data encoding
and third party access.
Keywords- Parallel sessions, authenticated key exchange,
network file systems, forward secrecy, key escrow.
Best services for writing your paper according to Trustpilot
I. INTRODUCTION
In parallel file systems, the file data is distributed across
multiple storage devices or nodes to allow concurrent access
by multiple tasks of a parallel application. That is typically
used in large scale cluster computing that focuses on high
performance and reliable fetch to large datasets. That higher
I/O bandwidth is achieved through concurrent fetching data to
multiple storage devices within large computing clusters,
while data loss is protected through data mirroring using
defect tolerant striping algorithms. Few examples of high
performance parallel file systems that are in the production
use are the IBM General Parallel Files System. which are
usually required for advanced scientific or data intensive
applications such as digital animation studios, computational
fluid dynamics, and semiconductor manufacturing. In these
environments, hundreds or thousands of file system clients
share data and generate very much high aggregate I/O load on
the file system supporting petabytes or terabytes scale storage
capacities. Independent of the development of the cluster and
high performance computing, the emergence of clouds and the
MapReduce programming model has resulted in file system
such as the Hadoop Distributed File System (HDFS).
In this work, we investigate the issue of the secure many to
many communications in the large scale network file systems
which support parallel fetch to multiple storing devices. That
we considering the communication model where there are a
large number of the clients accessing multiple remote and
distributed storage devices in parallel. Particularly, we tries to
focus on how to exchange the key materials and establishment
of the parallel secure sessions between clients and storage
devices in the parallel Network File System (pNFS), the
current Internet standards in efficient and scalable manner.
Our main goal in this work is to design efficient and
secure authenticated key exchange protocols that meet
specific needs of pNFS. Particularly, we attempt to meet the
following desirable properties, which have not been
satisfactorily achieved or are not achievable by current
Kerberos-based solution.
II. RELATED WORKS
A. Password-based encrypted key exchange are protocols
that are designed to provide pair of users communicating over
an unreliable channel with a secure session key even when the
secret key or password shared between two users is drawn
from a small set of keys. In this, two simple passwords based
encrypted key exchange protocols based on that of Bellovin
and Merritt. While one protocol is more suitable to scenarios
in which the password is shared across various servers, the
other provides better security features. Both protocols are as
efficient, if not better, as any of the existing encrypted key
exchange protocols in the literature, and yet they only require
a single random oracle instance. The proof of security for both
protocols is in the random oracle model and based on hardness
of the computational Diffe-Hellman problem. However, some
of the techniques that we use are quite different from the usual
ones and make use of new variants of the Diffe-Hellman
problem, which are of independent interest. We also provide
concrete relations between the new variants and the standard
Diffe-Hellman problem. The advantage of this scheme it is
possible to find several flavors of key. In this different types
of protocols are used like SIGMA, IKE etc.
– Michel Abdalla, eta 1.
B. Passwords are one of the most common causes of
system crashes, because the low entropy of passwords makes
systems vulnerable to brute force guessing attacks. Due to
new technology passwords can be hacked easily. Automated
Turing Tests continue to be an effective, easy-to-deploy
approach to identify automated malicious login attempts with
reasonable cost of inconvenience to users. Hence in this
proposed scheme the inadequacy of existing and proposed
login protocols designed to address largescale online
dictionary attacks e.g. from a botnet of hundreds of thousands
of nodes. In this scheme proposed a simple scheme that
strengthens password based authentication protocols and helps
prevent online dictionary attacks as well as many-to-many
attacks common to 3-pass SPAKA protocols.
-*A. Sai Kumar ,eta 2
C. Proposed scheme Uses compositional method for
proving cryptographically sound security properties of key
exchange protocols, based on a symbolic logic that is
interpreted over conventional runs of a protocol against a
probabilistic polynomial time attacker. Since reasoning about
an unbounded number of runs of a protocol involves
induction-like arguments about properties preserved by each
run, we formulate a specification of secure key exchange that,
unlike conventional key in distinguish ability, is closed under
general composition with steps that use the key. We present
formal proof rules based on this game-based condition, and
prove that the proof rules are sound over a computational
semantics.
– Anupam Datta1, eta 3
D. In a public network, when a number of clusters
connected to each other is increased becomes a potential
threat to security applications running on the clusters. To
address this problem, a Message Passing Interface (MPI) is
developed to preserve security services in an unsecured
network. The proposed work focuses on MPI rather than other
protocols because MPI is one of the most popular
communication protocols on distributed clusters. Here AES
algorithm is used for encryption/decryption and interpolation
polynomial algorithm is used for key management which is
then integrated into Message Passing Interface Chameleon
version 2 (MPICH2) with standard MPI interface that
becomes ES-MPICH2. This ES-MPICH2 is a new MPI that
provides security and authentication for distributed clusters
which is unified into cryptographic and mathematical concept.
The major desire of ESMPICH2 is supporting a large variety
of computation and communication platforms. The proposed
system is based on both cryptographic and mathematical
concept which leads to full of error free message passing
interface with enhanced security.
– R.S.RamPriya, eta 4
E. Password Authenticated Key Exchange (PAKE) is one
of the important topics in cryptography. It aims to address a
practical security problem: how to establish secure
communication between two parties solely based on a shared
password without requiring a Public Key Infrastructure (PKI).
After more than a decade of extensive research in this field,
there have been several PAKE protocols available. The EKE
and SPEKE schemes are perhaps the two most notable
examples. Both techniques are however patented. In this paper,
we review these techniques in detail and summarize various
theoretical and practical weaknesses. In addition, we present a
new PAKE solution called J-PAKE. Our strategy is to depend
on well-established primitives such as the Zero-Knowledge
Proof (ZKP). So far, almost all of the past solutions have
avoided using ZKP for the concern on efficiency. We
demonstrate how to effectively integrate the ZKP into the
protocol design and meanwhile achieve good efficiency. Our
protocol has comparable computational efficiency to the EKE
and SPEKE schemes with clear advantages on security.
– Feng Hao1, eta 5
F. We present a mechanized proof of the password- based
protocol One-Encryption Key Exchange (OEKE) using the
computationally sound protocol prover CryptoVerif. OEKE is
a non-trivial protocol, and thus mechanizing its proof provides
additional confidence that it is correct. This case study was
also an opportunity to implement several important extensions
of CryptoVerif, useful for proving many other protocols. We
have indeed extended CryptoVerif to support the
computational Diffie-Hellman assumption. We have also
added support for proofs that rely on Shoup’s lemma and
additional game transformations. In particular, it is now
possible to insert case distinctions manually and to merge
cases that no longer need to be distinguished. Eventually,
some improvements have been added on the computation of
the probability bounds for attacks, providing better reductions.
In particular, we improve over the standard computation of
probabilities when Shoup’s lemma is used, which allows us to
improve the bound given in a previous manual proof of OEKE,
and to show that the adversary can test at most one password
per session of the protocol. In this paper, we present these
extensions, with their application to the proof of OEKE. All
steps of the proof, both automatic and manually guided, are
verified by CryptoVerif.
-Bruno Blanchet 6
G. Password-Authenticated Key Exchange (PAKE)
studies how to establish secure communication between two
remote parties solely based on their shared password, without
requiring a Public Key Infrastructure (PKI). Despite extensive
research in the past decade, this problem remains unsolved.
Patent has been one of the biggest brakes in deploying PAKE
solutions in practice. Besides, even for the patented schemes
like EKE and SPEKE, their security is only heuristic;
researchers have reported some subtle but worrying security
issues. In this paper, we propose to tackle this problem using
an approach different from all past solutions. Our protocol,
Password Authenticated Key Exchange by Juggling (J-PAKE),
achieves mutual authentication in two steps: first, two parties
send ephemeral public keys to each other; second, they
encrypt the shared password by juggling the public keys in a
variable way. The first use of such a juggling technique was
seen in solving the Dining Cryptographers problem in 2006.
Here, we apply it to solve the PAKE problem, and show that
the protocol is zero-knowledge as it reveals nothing except one-
bit information: whether the supplied passwords at two sides
are the same. With clear advantages in security, our scheme has
comparable efficiency to the EKE and SPEKE protocols.
– Peter Ryan, eta 7
III PROPOSED METHOD
Fig I : System architecture
Here we propose a system which uses the technique
called image steganography. The figure represent the system
design of the proposed system. Here we encrypt session key to
image.
The existing system has a metadata server facilitating
key exchange between client and the storage devices that has
heavy workload that restrict the scalability of protocol. This
protocol does not provide forward secrecy. The metadata server
generates itself all the session keys and finally leads to key
escrew.
The metadata server executing our protocol has much lower
workload than that of Kerberos based approach. So we have
designed a system that provides forward secrecy and is escrow
free.
The user upload image to the server and the server encrypt
key to the image .Then the user downloads the image. The user
then upload the image to the file system and the server generate
a session key to the file system. Verify the session key in the
image which is uploaded by the user with the session key
generated by the server to the file system. If verified access is
granted else access denied.
1V MODULE DESCRIPTION
Authenticated key exchange protocol for pNFS using
image steganography technique consists of three modules.
They are
? Parallel sessions
? Authenticated key exchange
? Validation
? Escrow free-the metadata server should not learn
any information about any session
A. PARALLEL SESSION
The parallel sessions are the parallel secure sessions
between the clients and storage devices which are in parallel
network file system (pNFS). Here the user logs in and the
login details are obtained from the login table. The user then
uploads image to the server. Then the user will download the
encrypted image from the server.
B. AUTHENTICATED KEY EXCHANGE
The primary goal in this work is to design the efficient
and secure authenticated key exchange protocol that meets the
specific requirements of pNFS. Three new provably secure
authenticated key exchange protocols are the main results of
this paper. The server encrypts session key to the image by the
technique called image steganography. The image is then
downloaded by the user. The server generates session key to
the file system for verification.
C. VALIDATION
The module includes validation process. Here the user
uploads the encrypted image to the file system. The image is
then verified with the session key generated by the server to
the file system. If the image is verified then access to file is
permitted else access is denied.
TABLE I LOGIN DETAILS
REFERENCES
1 Michel Abdalla, David Pointcheval., “Simple
PasswordBased Encrypted Key Exchange Protocols”.
2 *A. Sai Kumar **P. Subhadra., “User Authentication to
Provide Security against Online Guessing Attacks.”
3 Anupam Datta1, Ante Derek1, John C. Mitchell1, and
Bogdan Warinschi2., “Key Exchange Protocols: Security
Definition, Proof Method and Applications .”
4 R.S.RamPriya, M.A.Maffina., “A Secured and
Authenticated Message Passing Interface for Distributed
Clusters.”
5 Feng Hao1 and Peter Ryan2., “J-PAKE: Authenticated
Key Exchange Without PKI”
6 Bruno Blanchet., “Automatically Verified Mechanized
Proof of One-Encryptionkeexchange”
TABLE II FILESYSTEM DETAILS
Column Name Data type Description
Sysid Int Primary key
Fileid Int Id of file
Foreign key
Sessionkey Varchar(50) Key generated for
image
Lid Int Foreign key
V. CONCLUSION
We proposed three authenticated key exchange
protocols for parallel network file system (pNFS). Our
protocols offer the advantages over the existing Kerberos-
based pNFS protocol. Firstly, the metadata server executing
the protocols has much lower workload than that of the
Kerberos-based approach. Secondly, two of our protocols
provide forward secrecy: one is partially forward secure (with
respect to the multiple sessions within a time period), while
the other is fully forward secure (with respect to a session).
Thirdly, we have designed a protocol such that it provide both
forward secrecy and is escrow-free.
Column Name Data type Description
Loginid Int Primary key
username Varchar(50) Username of user
password Varchar(50) Password of user
usertype Varchar(50) Type of user
status Varchar(50) Status of user
