Overview of research activities
Stig F. Mjølsnes, ITEM, NTNU
June 10, 2005

Cryptographic Protocols

The general research aim is to understand cryptographic protocols, their design and potentiality for securing distributed computerized communication systems. Crypto-protocols can be considered distributed algorithms that employ cryptographic functions. Their computational multiparty goals are to restrict, establish and preserve information (security properties) robust against intentional modifications to the protocol rules. Currently, the research is focussed in three projects:

• Decentralized Credential Keepers . We investigate a credential system employing on-line electronic wallets that enable you to leave most of the content of your electronic wallet in the security of your residential (or trusted third party) electronic keeper. For instance, mobile handsets with both short range Bluetooth and cellular GPRS communications provide a sufficient communication platform for this electronic wallet system. Our aim is to show how to achieve payment privacy, mobility, loss-tolerance, and independence of both terminals and payment service providers while maintaining secure access to payment authorization credentials.

• Security and Privacy in location-based services . Mobile user-friendly multimedia terminals with broadband radio access combined with satellite receivers for geographical positioning signal will provide a ubiquitous platform for novel commercial services based on information about the geographical position, velocity and bearing of individuals or vehicles. The project's hypothesis is that this geographical data service will be best based on the federation of satellite and terrestrial mobile networks. Ad hoc radio access networks approach will be beneficial both to commercial service providers and public institutions like police, ambulance, fire and other rescue brigades for a more efficient operation during emergency situations in both urban and rural areas. Hence we will identify and investigate the technical challenges of information security resulting from such systems.

• Large scale PKI applications . The research is focussed on large scale PKI (Public Key Infrastructure) applications, that is, how to distribute and manage authenticated public keys for a large number of users by simple, efficient, secure and user-friendly methods.  The project cooperates with  Uninett in their effort to construct and identity management system (FEIDE) for  the University internet in Norway, with potentially over 200 000 users in 2005. This project is funded by Ministry of Trade and Industry and Microsoft. A realistic application area is user identity authentication services for access control of mobile terminals under strong requirements of privacy protection between service providers, possibly by employing digital pseudonym schemes. The user wants to generate and securely manage his service-specific private keys either by delegating to an independent trusted third party, or at the user's own discretion. This will establish usercontrolled mechanisms of linking transaction data between service providers.

Digital tracks

Information privacy concerns with respect to digital tracks made by using ICT have a long tradition of inquiry in the academic cryptographic literature, for instance in digital cash and e-voting schemes. Converseley, as people and commercial activites are introduced onto networked systems, the other side of the coin is bound to emerge too, namely the threats and incidents of illegal behaviour. Scientifically speaking, understanding the informational aspects of digital tracks has applications to both privacy and forensic concerns.

• Time stamps in digital forensics Knowledge about when an event took place can often be of vital importance as evidence, and it is fundamental forensic method to attempt to reconstruct a timeline of events. Timestamp mechanisms are commonly used in communication and storage media, and may provide information useful in deductions of a sequence of events. The notion of ”logical time” is well understood in distributed systems, where a lot of research results exist on how to enforce a well-ordered sequence of events out of time-indeterministic transactions. The basic idea of this project is to analyse a set of existing timestamped events after-the-fact , for instance by temporal logic, in search of inconsistencies under the assumption of enforced logical time. This research project is funded by NFR.