首页 > 最新文献

2011 Sixth International Conference on Availability, Reliability and Security最新文献

英文 中文
Secure Broadcast with One-Time Signatures in Controller Area Networks 控制器局域网中一次性签名的安全广播
Pub Date : 2011-08-22 DOI: 10.4018/jmcmc.2013070101
B. Groza, Pal-Stefan Murvay
We use one-time signatures to assure authenticity for messages that are broadcast over a Controller Area Network (CAN). The advantage is that we can use the simplest one-way functions which are computationally efficient while authentication does not depend on disclosure delays as in the case of protocols based on one-way chains and time synchronization. As the size of the one-time signatures is proportional to the bit length of the signed message, another benefit in using them is due to the reduced size of messages that are broadcast in CAN. To avoid the use of authentication trees, which will allow multiple uses of the one-time signature, but increases the size of signatures as well as memory requirements, we use an upper layer of key-chains with time synchronization in order to commit the public keys that can be further used for signing at any instant. The theoretical results are followed by experimental results on development boards equipped with Free scale S12, a commonly used automotive grade microcontroller. We also benefit from the acceleration offered by the XGATE coprocessor available on S12X derivatives which significantly increases computational performances. To further increase efficiency we also design and use a hardware random number generator which saves computational time that otherwise will be spent to derive fresh key material.
我们使用一次性签名来确保在控制器局域网(CAN)上广播的消息的真实性。其优点是我们可以使用最简单的单向函数,这是计算效率高的,而身份验证不依赖于基于单向链和时间同步的协议的披露延迟。由于一次性签名的大小与签名消息的位长度成正比,因此使用它们的另一个好处是可以减少在CAN中广播的消息的大小。为了避免使用身份验证树,这将允许多次使用一次性签名,但会增加签名的大小和内存需求,我们使用具有时间同步的上层密钥链,以便提交可以在任何时刻进一步用于签名的公钥。理论结果之后,在配备通用汽车级微控制器的自由比例尺S12的开发板上进行了实验结果。我们还受益于S12X衍生产品上可用的XGATE协处理器提供的加速,这大大提高了计算性能。为了进一步提高效率,我们还设计和使用了一个硬件随机数生成器,从而节省了计算时间,否则将花费在获取新的密钥材料上。
{"title":"Secure Broadcast with One-Time Signatures in Controller Area Networks","authors":"B. Groza, Pal-Stefan Murvay","doi":"10.4018/jmcmc.2013070101","DOIUrl":"https://doi.org/10.4018/jmcmc.2013070101","url":null,"abstract":"We use one-time signatures to assure authenticity for messages that are broadcast over a Controller Area Network (CAN). The advantage is that we can use the simplest one-way functions which are computationally efficient while authentication does not depend on disclosure delays as in the case of protocols based on one-way chains and time synchronization. As the size of the one-time signatures is proportional to the bit length of the signed message, another benefit in using them is due to the reduced size of messages that are broadcast in CAN. To avoid the use of authentication trees, which will allow multiple uses of the one-time signature, but increases the size of signatures as well as memory requirements, we use an upper layer of key-chains with time synchronization in order to commit the public keys that can be further used for signing at any instant. The theoretical results are followed by experimental results on development boards equipped with Free scale S12, a commonly used automotive grade microcontroller. We also benefit from the acceleration offered by the XGATE coprocessor available on S12X derivatives which significantly increases computational performances. To further increase efficiency we also design and use a hardware random number generator which saves computational time that otherwise will be spent to derive fresh key material.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131454114","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Introducing Verifiability in the POLYAS Remote Electronic Voting System 介绍POLYAS远程电子投票系统的可验证性
M. Olembo, Patrick Schmidt, M. Volkamer
Remote electronic voting continues to attract attention. A greater number of election officials are opting to enable a remote electronic voting channel. More and more scientific papers have been published introducing or improving existing remote electronic voting protocols. However, while the scientific papers focus on different aspects of verifiability, most of the systems in use do not provide verifiability. This gap is closed in this paper by extending a widely used remote electronic voting system, the POLYAS system, to provide verifiability. This approach has been tested in the 2010 election of the German Society for Computer Scientists and will be applied in future elections.
远程电子投票继续引起人们的关注。越来越多的选举官员选择启用远程电子投票渠道。越来越多的科学论文已经发表,介绍或改进现有的远程电子投票协议。然而,虽然科学论文关注可验证性的不同方面,但大多数使用的系统都不提供可验证性。本文通过扩展广泛使用的远程电子投票系统POLYAS系统来提供可验证性,从而缩小了这一差距。这种方法已经在2010年德国计算机科学家协会的选举中得到了测试,并将在未来的选举中应用。
{"title":"Introducing Verifiability in the POLYAS Remote Electronic Voting System","authors":"M. Olembo, Patrick Schmidt, M. Volkamer","doi":"10.1109/ARES.2011.26","DOIUrl":"https://doi.org/10.1109/ARES.2011.26","url":null,"abstract":"Remote electronic voting continues to attract attention. A greater number of election officials are opting to enable a remote electronic voting channel. More and more scientific papers have been published introducing or improving existing remote electronic voting protocols. However, while the scientific papers focus on different aspects of verifiability, most of the systems in use do not provide verifiability. This gap is closed in this paper by extending a widely used remote electronic voting system, the POLYAS system, to provide verifiability. This approach has been tested in the 2010 election of the German Society for Computer Scientists and will be applied in future elections.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116923127","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 13
Security Issues in a Synchronous e-Training Platform 同步电子培训平台的安全问题
J. C. Granda, Pelayo Nuño, D. García, F. J. Suárez
Synchronous e-training is emerging as an alternative for developing human resources training plans in large organizations. Real-time communications are used to emulate face-to-face interaction that occurs in on-campus learning environments. However, the security concerns that a synchronous e-training platform must face may compromise the integrity, availability and confidentiality of corporate information, which may lead to serious economic and legal consequences. The disclosure of corporate information or the unauthorized participation in e-training activities must be prevented. In this paper, the security issues in synchronous e-training are identified, and the threats to a real e-training platform are analyzed. The platform is organized into four virtual networks with different security requirements and vulnerabilities. The platform assumes that multicast communications are available in the underlying corporate network. The threats affecting each element of the platform and their impact on e-training activities are discussed. Finally, a security scheme is proposed fixing the aforementioned vulnerabilities. Digital certificates and encryption algorithms solve most of the vulnerabilities, but other techniques such as access control lists and user skills on security basics are essential. Most of the proposed scheme is applicable to other real-time communication systems, since the e-training platform is built using standard technologies commonly used in voice over IP systems.
同步电子培训正在成为大型组织开发人力资源培训计划的一种替代方案。实时通信用于模拟校园学习环境中发生的面对面互动。然而,同步电子培训平台必须面对的安全问题可能会损害企业信息的完整性、可用性和保密性,从而可能导致严重的经济和法律后果。必须防止泄露企业信息或未经授权参与电子培训活动。本文分析了同步电子培训中存在的安全问题,分析了实际电子培训平台所面临的威胁。该平台被组织成四个具有不同安全要求和漏洞的虚拟网络。该平台假定在底层公司网络中可以使用多播通信。讨论了影响平台每个元素的威胁及其对电子培训活动的影响。最后,提出了一种针对上述漏洞的安全方案。数字证书和加密算法解决了大多数漏洞,但访问控制列表和用户安全基础技能等其他技术也是必不可少的。由于电子培训平台是使用IP语音系统中常用的标准技术构建的,因此所提出的方案大部分适用于其他实时通信系统。
{"title":"Security Issues in a Synchronous e-Training Platform","authors":"J. C. Granda, Pelayo Nuño, D. García, F. J. Suárez","doi":"10.1109/ARES.2011.75","DOIUrl":"https://doi.org/10.1109/ARES.2011.75","url":null,"abstract":"Synchronous e-training is emerging as an alternative for developing human resources training plans in large organizations. Real-time communications are used to emulate face-to-face interaction that occurs in on-campus learning environments. However, the security concerns that a synchronous e-training platform must face may compromise the integrity, availability and confidentiality of corporate information, which may lead to serious economic and legal consequences. The disclosure of corporate information or the unauthorized participation in e-training activities must be prevented. In this paper, the security issues in synchronous e-training are identified, and the threats to a real e-training platform are analyzed. The platform is organized into four virtual networks with different security requirements and vulnerabilities. The platform assumes that multicast communications are available in the underlying corporate network. The threats affecting each element of the platform and their impact on e-training activities are discussed. Finally, a security scheme is proposed fixing the aforementioned vulnerabilities. Digital certificates and encryption algorithms solve most of the vulnerabilities, but other techniques such as access control lists and user skills on security basics are essential. Most of the proposed scheme is applicable to other real-time communication systems, since the e-training platform is built using standard technologies commonly used in voice over IP systems.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"185 5-6","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114027184","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Tag Impersonation Attack on Two RFID Mutual Authentication Protocols 两种RFID互认证协议的标签冒充攻击
M. Safkhani, N. Bagheri, M. Naderi, Yiyuan Luo, Qi Chai
Security concerns of RFID systems engaged a lot of researchers to design and to cryptanalyze RFID mutual authentication protocols. A suitable mutual authentication protocol for an RFID system should provide mutual authentication along with user privacy. In addition, such protocol must be resistant to active and passive attacks, e.g. man-in-the-middle attack, reply attack, reader-/tag-impersonation, denial of service and traceability attack. Among them, tag-impersonation refers to a process that the adversary’s tag fools the legitimate reader to authenticate it as a valid tag. In this paper we exam the security of two RFID mutual authentication protocols, i.e., [6] and [17], under tag impersonation attack. We found that these two protocols share a same vulnerability – in each session, the tag and the reader generates a random value respectively and they use the exclusiveor (XOR) of those random values in the authentication process. We exploit this vulnerability to present two effective and efficient tag impersonation attacks against these protocols, e.g., the success probabilities of our attacks are ”1” and the complexity is at most two runs of each protocol. At last, we exhibit the improved version of these protocols, which are immune from tag impersonation attacks.
RFID系统的安全问题吸引了许多研究者设计和分析RFID互认证协议。适合RFID系统的相互认证协议应该提供相互认证以及用户隐私。此外,这种协议必须能够抵抗主动和被动攻击,例如中间人攻击、应答攻击、阅读器/标签冒充、拒绝服务和可追溯性攻击。其中,标记模拟指的是攻击者的标记欺骗合法的读取器以将其验证为有效标记的过程。本文研究了两种RFID互认证协议[6]和[17]在标签冒充攻击下的安全性。我们发现这两个协议有一个相同的漏洞——在每个会话中,标签和阅读器分别生成一个随机值,并在身份验证过程中使用这些随机值的排他值(XOR)。我们利用这个漏洞对这些协议进行了两种有效的标签模拟攻击,例如,我们攻击的成功概率为“1”,复杂度最多为每个协议的两次运行。最后,我们展示了这些协议的改进版本,该版本可以免受标签冒充攻击。
{"title":"Tag Impersonation Attack on Two RFID Mutual Authentication Protocols","authors":"M. Safkhani, N. Bagheri, M. Naderi, Yiyuan Luo, Qi Chai","doi":"10.1109/ARES.2011.87","DOIUrl":"https://doi.org/10.1109/ARES.2011.87","url":null,"abstract":"Security concerns of RFID systems engaged a lot of researchers to design and to cryptanalyze RFID mutual authentication protocols. A suitable mutual authentication protocol for an RFID system should provide mutual authentication along with user privacy. In addition, such protocol must be resistant to active and passive attacks, e.g. man-in-the-middle attack, reply attack, reader-/tag-impersonation, denial of service and traceability attack. Among them, tag-impersonation refers to a process that the adversary’s tag fools the legitimate reader to authenticate it as a valid tag. In this paper we exam the security of two RFID mutual authentication protocols, i.e., [6] and [17], under tag impersonation attack. We found that these two protocols share a same vulnerability – in each session, the tag and the reader generates a random value respectively and they use the exclusiveor (XOR) of those random values in the authentication process. We exploit this vulnerability to present two effective and efficient tag impersonation attacks against these protocols, e.g., the success probabilities of our attacks are ”1” and the complexity is at most two runs of each protocol. At last, we exhibit the improved version of these protocols, which are immune from tag impersonation attacks.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"85 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121689276","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
Seamless Fusion of Secure Software and Trusted USB Token for Protecting Enterprise & Government Data 安全软件和可信USB令牌的无缝融合,以保护企业和政府数据
Asad M. Ali
Smart cards have been used in a wide variety of vertical markets delivering security services related to physical access control, user authentication and high value data transactions. However, their adoption in plug-n-play removable data storage markets is generally hindered by their dependence on external smart card reader hardware, their proprietary communication protocol that requires installation of card specific middle-ware, and their limited storage capacity. This is particularly true when using smart cards to store encrypted bulk data that meets the stringent security requirements of government agencies and enterprise IT departments. This paper outlines some of these requirements and presents a unique hardware and software architecture to address them. It combines the copious storage capacity of USB mass storage tokens with the proven security features of smart cards without requiring any smart card specific infrastructure. The resulting USB composite token can be used as a secure flexible platform to build advanced data protection applications.
智能卡已广泛应用于各种垂直市场,提供与物理访问控制、用户认证和高价值数据交易相关的安全服务。然而,它们在即插即用可移动数据存储市场的采用通常受到以下因素的阻碍:它们依赖外部智能卡读卡器硬件、它们的专有通信协议(需要安装特定于卡的中间件)以及它们有限的存储容量。当使用智能卡存储符合政府机构和企业IT部门严格安全要求的加密批量数据时,尤其如此。本文概述了其中的一些需求,并提出了一种独特的硬件和软件体系结构来解决这些需求。它将USB海量存储令牌的丰富存储容量与智能卡的成熟安全功能相结合,而不需要任何智能卡特定的基础设施。由此产生的USB复合令牌可以用作构建高级数据保护应用程序的安全灵活平台。
{"title":"Seamless Fusion of Secure Software and Trusted USB Token for Protecting Enterprise & Government Data","authors":"Asad M. Ali","doi":"10.1109/ARES.2011.67","DOIUrl":"https://doi.org/10.1109/ARES.2011.67","url":null,"abstract":"Smart cards have been used in a wide variety of vertical markets delivering security services related to physical access control, user authentication and high value data transactions. However, their adoption in plug-n-play removable data storage markets is generally hindered by their dependence on external smart card reader hardware, their proprietary communication protocol that requires installation of card specific middle-ware, and their limited storage capacity. This is particularly true when using smart cards to store encrypted bulk data that meets the stringent security requirements of government agencies and enterprise IT departments. This paper outlines some of these requirements and presents a unique hardware and software architecture to address them. It combines the copious storage capacity of USB mass storage tokens with the proven security features of smart cards without requiring any smart card specific infrastructure. The resulting USB composite token can be used as a secure flexible platform to build advanced data protection applications.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126176348","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
A Novel Phase Coding Technique for Steganography in Auditive Media 一种用于听觉媒体隐写的相位编码新技术
M. Nutzinger, Jürgen Wurzer
Steganography is used to embed secret messages in cover media. This is especially important in areas where the use of cryptography is prohibited. In this paper we introduce a novel steganographic algorithm applicable for audio data as cover media. The proposed algorithm is based on the phase coding technique which embeds data in the phase spectrum of the frequency domain signal. Differing from previous works we retain the original phase values in order to best keep the quality of the cover audio signal. Secret bits are embedded by introducing a configurable phase difference between selected chunks of blocks from the cover medium instead of discarding the original phase values and introducing a random phase like other approaches. Variable parameters guarantee the security of our system and we show that the wrong selection leads to high reception errors. Also robustness tests were performed using popular signal processing operations like noise addition, cropping and resampling, giving reasonable results. In addition listening tests show that the original audio quality is not noticeable reduced by our algorithm. After pointing out related approaches we highlight our contributions with respect to the embedding and extraction processes. Also a view on the synchronization issue at reception is given. This is a vital part for the steganographic receiver when the communication happens for example over a mobile network. Following to that the results from tests with our working prototype are presented and further usage scenarios in relation to future research are given.
隐写术用于在封面媒体中嵌入秘密信息。这在禁止使用加密技术的领域尤为重要。本文提出了一种新的隐写算法,适用于音频数据作为覆盖介质的隐写。该算法基于相位编码技术,将数据嵌入到频域信号的相位谱中。与以前的作品不同,我们保留了原始相位值,以便最好地保持覆盖音频信号的质量。通过在从覆盖介质中选择的块之间引入可配置的相位差来嵌入秘密位,而不是像其他方法那样丢弃原始相位值并引入随机相位。可变参数保证了系统的安全性,并证明了错误的选择会导致较高的接收误差。采用噪声添加、裁剪和重采样等常用的信号处理操作进行鲁棒性测试,得到了合理的结果。此外,听力测试表明,我们的算法没有明显降低原始音频质量。在指出相关方法后,我们强调了我们在嵌入和提取过程方面的贡献。并对接收时的同步问题提出了看法。当通信发生时,例如在移动网络上,这对隐写接收器来说是至关重要的一部分。然后介绍了我们的工作样机的测试结果,并给出了与未来研究相关的进一步使用场景。
{"title":"A Novel Phase Coding Technique for Steganography in Auditive Media","authors":"M. Nutzinger, Jürgen Wurzer","doi":"10.1109/ARES.2011.22","DOIUrl":"https://doi.org/10.1109/ARES.2011.22","url":null,"abstract":"Steganography is used to embed secret messages in cover media. This is especially important in areas where the use of cryptography is prohibited. In this paper we introduce a novel steganographic algorithm applicable for audio data as cover media. The proposed algorithm is based on the phase coding technique which embeds data in the phase spectrum of the frequency domain signal. Differing from previous works we retain the original phase values in order to best keep the quality of the cover audio signal. Secret bits are embedded by introducing a configurable phase difference between selected chunks of blocks from the cover medium instead of discarding the original phase values and introducing a random phase like other approaches. Variable parameters guarantee the security of our system and we show that the wrong selection leads to high reception errors. Also robustness tests were performed using popular signal processing operations like noise addition, cropping and resampling, giving reasonable results. In addition listening tests show that the original audio quality is not noticeable reduced by our algorithm. After pointing out related approaches we highlight our contributions with respect to the embedding and extraction processes. Also a view on the synchronization issue at reception is given. This is a vital part for the steganographic receiver when the communication happens for example over a mobile network. Following to that the results from tests with our working prototype are presented and further usage scenarios in relation to future research are given.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"358 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133200553","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 38
Information Security Integral Engineering Technique and its Application in ISMS Design 信息安全集成工程技术及其在ISMS设计中的应用
A. Lyubimov, Dmitry V. Cheremushkin, N. Andreeva, Sergey Shustikov
This paper proposes a technique for the design and implementation of the information security management system (ISMS) for small and medium enterprises (SMEs). The technique is based on ISO 27001 standard ISMS requirements object model. The model was designed using methods and tools of the information security integral engineering (ISIE) framework, so the first part of the paper also briefly describes some features, components and engineering methods within the ISIE framework, which are important in practical applications but were presented insufficiently or were not presented at all in the previous papers. Along with the description of a general ISMS design and implementation method, the paper provides an example of the application of this method to design ISMS for city medium telecommunication SME. The paper also gives the evaluation of the technique's efficiency.
本文提出了一种面向中小企业的信息安全管理系统(ISMS)的设计与实现技术。该技术基于ISO 27001标准ISMS需求对象模型。模型的设计使用了信息安全集成工程(information security integral engineering, ISIE)框架的方法和工具,因此本文的第一部分还简要描述了在实际应用中很重要的一些特征、组件和工程方法,这些在以往的文章中都没有得到充分的介绍或根本没有介绍。在介绍了一种通用的信息管理系统设计与实现方法的基础上,给出了应用该方法设计城市中小电信企业信息管理系统的实例。并对该技术的有效性进行了评价。
{"title":"Information Security Integral Engineering Technique and its Application in ISMS Design","authors":"A. Lyubimov, Dmitry V. Cheremushkin, N. Andreeva, Sergey Shustikov","doi":"10.1109/ARES.2011.121","DOIUrl":"https://doi.org/10.1109/ARES.2011.121","url":null,"abstract":"This paper proposes a technique for the design and implementation of the information security management system (ISMS) for small and medium enterprises (SMEs). The technique is based on ISO 27001 standard ISMS requirements object model. The model was designed using methods and tools of the information security integral engineering (ISIE) framework, so the first part of the paper also briefly describes some features, components and engineering methods within the ISIE framework, which are important in practical applications but were presented insufficiently or were not presented at all in the previous papers. Along with the description of a general ISMS design and implementation method, the paper provides an example of the application of this method to design ISMS for city medium telecommunication SME. The paper also gives the evaluation of the technique's efficiency.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131337352","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 20
Characterising and Analysing Security Requirements Modelling Initiatives 描述和分析安全需求建模计划
P. Kárpáti, G. Sindre, A. Opdahl
With the continuously developing technology and growing complexity of software and systems, new demands and challenges appear for security, calling for new techniques and methods in addition to the already existing ones. The variety of initiatives and the variations in the characterizations makes it hard for users to select the most appropriate one for their needs. We propose a set of uniform characterizing dimensions with sub-categories for security requirements initiatives. The set is derived by analyzing classifications and comparison frameworks from review papers on modelling techniques for security requirements engineering. The dimensions can be used to guide context-dependent choices of initiatives and further research of their combination and integration.
随着技术的不断发展,软件和系统的复杂性不断增加,对安全提出了新的要求和挑战,要求在现有技术和方法的基础上增加新的技术和方法。各种各样的计划和特征的变化使得用户很难选择最适合他们需要的计划。我们为安全需求计划提出了一组具有子类别的统一特征维度。该集合是通过分析安全需求工程建模技术综述论文中的分类和比较框架得出的。这些维度可以用来指导与上下文相关的计划选择,并进一步研究它们的组合和集成。
{"title":"Characterising and Analysing Security Requirements Modelling Initiatives","authors":"P. Kárpáti, G. Sindre, A. Opdahl","doi":"10.1109/ARES.2011.113","DOIUrl":"https://doi.org/10.1109/ARES.2011.113","url":null,"abstract":"With the continuously developing technology and growing complexity of software and systems, new demands and challenges appear for security, calling for new techniques and methods in addition to the already existing ones. The variety of initiatives and the variations in the characterizations makes it hard for users to select the most appropriate one for their needs. We propose a set of uniform characterizing dimensions with sub-categories for security requirements initiatives. The set is derived by analyzing classifications and comparison frameworks from review papers on modelling techniques for security requirements engineering. The dimensions can be used to guide context-dependent choices of initiatives and further research of their combination and integration.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116346972","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 15
Support Access to Distributed EPRs with Three Levels of Identity Privacy Preservation 支持访问具有三级身份隐私保护的分布式epr
Rima Addas, Ning Zhang
The emergence of e-health has put an enormous amount of sensitive data in the hands of service providers or other third parties, where privacy risks might exist when accessing sensitive data stored in electronic patient records (EPRs). EPRs support efficient access to patient data by multiple healthcare providers and third party users, which will consequently, improve patient care. However, the sensitive nature of patient data requires access restrictions to only those `who needs to know'. How to achieve this without compromising patient privacy remains an open issue that needs further consideration. This paper, therefore, presents a novel method to support access to distributed EPRs with three levels of patient identity privacy preservation. The method makes use of cryptographic primitives. In comparison with related work, the method supports three levels of access requirements while preserving data owner's privacy on a single platform.
电子保健的出现使大量敏感数据落入服务提供商或其他第三方手中,在访问存储在电子病历中的敏感数据时可能存在隐私风险。epr支持多个医疗保健提供者和第三方用户对患者数据的有效访问,从而改善患者护理。然而,患者数据的敏感性要求只有那些“需要知道的人”才能访问。如何在不损害患者隐私的情况下实现这一目标仍然是一个需要进一步考虑的开放性问题。因此,本文提出了一种新的方法来支持访问具有三级患者身份隐私保护的分布式epr。该方法使用了加密原语。与相关工作相比,该方法支持三层访问需求,同时在单一平台上保护数据所有者的隐私。
{"title":"Support Access to Distributed EPRs with Three Levels of Identity Privacy Preservation","authors":"Rima Addas, Ning Zhang","doi":"10.1109/ARES.2011.16","DOIUrl":"https://doi.org/10.1109/ARES.2011.16","url":null,"abstract":"The emergence of e-health has put an enormous amount of sensitive data in the hands of service providers or other third parties, where privacy risks might exist when accessing sensitive data stored in electronic patient records (EPRs). EPRs support efficient access to patient data by multiple healthcare providers and third party users, which will consequently, improve patient care. However, the sensitive nature of patient data requires access restrictions to only those `who needs to know'. How to achieve this without compromising patient privacy remains an open issue that needs further consideration. This paper, therefore, presents a novel method to support access to distributed EPRs with three levels of patient identity privacy preservation. The method makes use of cryptographic primitives. In comparison with related work, the method supports three levels of access requirements while preserving data owner's privacy on a single platform.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122417911","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Van Wijngaarden Grammars and Metamorphism Van Wijngaarden语法和变形
Gueguen Geoffroy
Grammars are used to describe sentences structure, thanks to some sets of rules, which depends on the grammar type. A classification of grammars has been made by Noam Chomsky, which led to four well-known types. Yet, there are other types of grammars, which do not exactly fit in Chomsky's classification, such as the two-level grammars. As their name suggests it, the main idea behind these grammars is that they are composed of two grammars. Van Wijngaarden grammars, particularly, are such grammars. They are interesting by their power (expressiveness), which can be the same, under some hypotheses, as the most powerful grammars of Chomsky's classification, i.e. Type 0 grammars. Another point of interest is their relative conciseness and readability. Van Wijngaarden grammars can describe static and dynamic semantic of a language. So, by using them as a generative engine, it is possible to generate a possibly infinite set of words, while assuring us that they all have the same semantic.
语法是用来描述句子结构的,这要归功于一些规则集,这取决于语法类型。诺姆·乔姆斯基(Noam Chomsky)对语法进行了分类,并将其分为四种著名的类型。然而,还有其他类型的语法,并不完全符合乔姆斯基的分类,如两级语法。顾名思义,这些语法背后的主要思想是它们由两种语法组成。Van Wijngaarden语法就是这样的语法。它们的强大(表现力)是有趣的,在某些假设下,它可以与乔姆斯基分类中最强大的语法相同,即0型语法。另一个有趣的地方是它们的相对简洁性和可读性。Van Wijngaarden语法可以描述语言的静态和动态语义。因此,通过使用它们作为生成引擎,有可能生成无限的单词集合,同时保证它们都具有相同的语义。
{"title":"Van Wijngaarden Grammars and Metamorphism","authors":"Gueguen Geoffroy","doi":"10.1109/ARES.2011.72","DOIUrl":"https://doi.org/10.1109/ARES.2011.72","url":null,"abstract":"Grammars are used to describe sentences structure, thanks to some sets of rules, which depends on the grammar type. A classification of grammars has been made by Noam Chomsky, which led to four well-known types. Yet, there are other types of grammars, which do not exactly fit in Chomsky's classification, such as the two-level grammars. As their name suggests it, the main idea behind these grammars is that they are composed of two grammars. Van Wijngaarden grammars, particularly, are such grammars. They are interesting by their power (expressiveness), which can be the same, under some hypotheses, as the most powerful grammars of Chomsky's classification, i.e. Type 0 grammars. Another point of interest is their relative conciseness and readability. Van Wijngaarden grammars can describe static and dynamic semantic of a language. So, by using them as a generative engine, it is possible to generate a possibly infinite set of words, while assuring us that they all have the same semantic.","PeriodicalId":254443,"journal":{"name":"2011 Sixth International Conference on Availability, Reliability and Security","volume":"196 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122972675","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
期刊
2011 Sixth International Conference on Availability, Reliability and Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1