Thesis (Ph. D.) University of Missouri-Columbia, 2006. / The entire dissertation/thesis text is included in the research.pdf file; the official abstract appears in the short.pdf file (which also appears in the research.pdf); a non-technical general description, or public abstract, appears in the public.pdf file. Title from title screen of research.pdf file (viewed on July 31, 2007) Includes bibliographical references.

Thesis (M.S. in Computer Science and M.S. in Information Technology Management)--Naval Postgraduate School, September 2002. / Thesis advisor(s): Cynthia E. Irvine, Timothy E. Levin. Includes bibliographical references (p. 71-72). Also available online.

Thesis (M.S. in Computer Science)--Naval Postgraduate School, June 2005. / Thesis Advisor(s): Cynthia E. Irvine, Thuy D. Nguyen. Includes bibliographical references (p. 107-109). Also available online.

It is recognized that security services in information-processing systems require access to finite resources in the execution of their duties. In response to the changing threats faced by a system and/or the availability of system resources, it is desired that the system be able to adjust its operational security policies automatically while continuing to function under an acceptable global security policy. This work involves the analysis and integration of a dynamic security service (DSS)-enabled IPsec implementation into a form ready for installation into the MYSEA environment. The feasibility of dynamic security services is demonstrated with support for secrecy and/or integrity protection of MLS server-to-end-user communication via a Trusted Path Extension. This is accomplished through the modulation of the IPsec security associations to adapt to operational needs. The result of this research is beneficial to Homeland Security, the Department of Defense, and the intelligence community by enabling remote distributed computing clients to operate in a secure manner that remains flexible to adapt to changing requirements of protection on the network and the availability of resources on terminating hosts. Furthermore, these methods can aid the realization of high-assurance edge-client connectivity in the creation and extension of the Global Information Grid (GIG).

In this dissertation, we discuss the design of a reconfigurable, unified HMAC-hash unit for IPSec authentication. The proposed unit is reconfigurable at runtime to enable implementing any of six standard algorithms: MD5, SHA-1, RIPEMD-160. HMAC-MD5. HMAC-SHA-1, and HMAC-RIPEMD-160. The designed unit can be used for IPSec or any other security application that uses hash functions, such as digital signature. We applied speedup techniques, such as pipelining and parallelism, to enhance the design of the HMAC-hash unit. We also proposed a key reuse technique to improve the HMAC through-put. We used an emerging system design methodology in designing the HNLAC-hash unit. This methodology uses a high level language, Handel-C, to implement the designed unit and directly map it to FPGA platforms. We used the available constructs of Handel-C to conduct a design space exploration of the HMAC-hash unit. The performance of the designed unit was analyzed and compared to performance reported in previous work. To our knowledge, this work is the first in the literature that integrates six standard hash algorithms in one unified, reconfigurable unit. It is also the first in the literature that implements HMAC-RIPEMD-160 on FPGA. The work reported in this dissertation is the first to integrate HMAC with three hash functions. The achieved throughput is 173.69 Mbps for MD5 and 139.38 Mbps for each of SHA-I and RIPEMD-160. Compared to results reported in previous work, our unit achieves better throughput than those integrating three or more hash functions and a comparable throughput to those integrating two hash functions. We achieved better maximum frequency, which is 44.1 MHz. than all other work. We achieved comparable results to those integrating HMAC with some hash functions. The area utilization of the designed unit is less than 33% of the available logic on the FPGA chip we used. Thus, the designed unit can fit on a single FPGA chip as an SoC.