This paper's aim is to design and implement a tool transforming REST Web APIs into APIs which facilitate the integration process. The improvement of integration is mainly divided into two parts: The embedding of semantic data in order to establish a common understanding of objects, properties and relations and the possibility to navigate through the API structure in an easy and automated way. The theoretical part is dealing with the fundamentals of Web APIs, today's related trends and the API's shortages and points of improvement. Another objective of this paper is to compare current data standards of output formats for so called Hypermedia APIs, whereas the most suitable components will be chosen as the output format of this paper's resulting tool. The practical part is dealing with the design and implementation of the tool being developed. Included, there is the description of test scenarios, related benefits for the tool's users as well as a final evaluation of the resulting tool and a discussion of the tool's future potential. The benefits of the tool are evaluated in a case study.

Tato diplomová práce se zabývá API a ABI kompatibilitou Java knihoven. Jsou popsány typy kompatibility a analyzovány změny API, které vedou k zdrojové či binárni nekompatibilitě. Dále je provedena analýza existujících nástrojů, které provádějí zjišťování nekompatibility. Vhodný nástroj z předchozí analýzy je vybrán a rozšířen. Na základě rozšířeného nástroje je vytvořena serverová aplikace, která poskytuje informace o kompatibilitě sledovaných knihoven.

Denna rapport avhandlar ett arbete inom ämnet datavetenskap och handlarom utvecklingen av ett system för att studera restidkvoten för sträckor somtrafikeras av Västtrafik, som är en av Sveriges största regionalakollektivtrafikmyndigheter. Restidskvoten anges som förhållandet mellanrestiden med kollektivtrafik och att resa med personbil ([restidkollektivtrafik] / [restid biltrafik]). Med detta som grund har ett system föratt inhämta data om restider med hjälp av Google Maps Directions API samtberäkna restidskvoter och annan metadata utifrån denna insamlade dataskapats. Systemet används till att göra dagliga körningar och lagrar inhämtaddata i en databas hos Västtrafik. Till systemet finns också en dashboard somkan användas för att göra sökningar i databasen som byggts upp och på såsätt hämta, visualisera och analysera önskad data. Restidsdata förkollektivtrafik som erhållits från Google har i stickprov jämförts medrestidsdata från Västtrafik och även om det fanns några avvikelser så stämdede väl överens. Därav dras slutsatsen att data från Google går att använda tillatt beräkna och analysera restidskvoter.

The Service Worker is a programmable proxy that allows the clients to keep offline parts of websites or even the whole domains, receive push notifications, have back-ground synchronization and other features. All of these features are available to the user without having to install an application - the user only visits a website. The service worker has gained popularity due to being a key component in the Progressive Web Applications (PWAs). PWAs have already proven to drastically increase the number of visits and the duration of browsing for websites such as Forbes [1], Twitter [2], and many others. The Service Worker is a powerful tool, yet it is hard for clients to understand the security implications of it. Therefore, all modern browser install the service workers without asking the client. While this offers many conveniences to the user, this powerful technology introduces new security risks. This thesis takes a closer look at the structure of the service worker and focuses on the vulnerabilities of its components. After the literature analysis and some testing using the demonstrator developed during this project, the vulnerabilities of the service worker components are classified and presented in the form of the vulnerability matrix; the mitigations to the vulnerabilities are then outlined, and the two are summarized in the form of security guidelines.

Web applications and APIs have become more popular every year, and security risks haveincreased. Along with more security risks and the large amount of sensitive informationshared on web applications today, the problem grows. I therefore wanted to explore morein security deficiencies to increase my own knowledge and others in the field. To do that,a web application was developed and a survey was made of what security threats existtoday and what solutions they have. Some of the solutions encountered during theinvestigation were then implemented and tested in the web application. The result showedsome general solutions such as validation, which was a solution to a number of threats.The investigation also showed that security is not black and white and that it is possibleto implement actions but attackers can still find ways to attack systems.

REpresentational State Transfer or REST is the software architecture style most commonly used for Web Application Programming Interfaces (APIs) and was first defined in 2000 by Roy Thomas Fielding in his PhD dissertation Styles and the Design of Network-based Software Architectures and became a standard for the design of the early World Wide Web and Web-based software. The REST standard continues to be influential in the design of Web systems today, however, it was defined over 15 years ago when the Web was still in its infancy. This paper analyzes REST as it was originally defined by Fielding in 2000 and investigates the validity of its original principles in the modern Internet and Web APIs by sampling a number of prominent APIs and their use of REST. REST definitely has drawbacks for certain types of APIs as evidenced by deviations in the majority of sampled APIs. It is not popular with services that are difficult to represent in REST's resource model. However, REST’s popularity has not noticeably decreased since it was defined rather it has most likely increased. Additionally, each use case that is unsupported by REST goes against some REST constraints that crucial in other areas of it implementation. In conclusion, RESTful properties were not only relevant in the late 1990s and early 2000s but continue to be relevant today as evidenced by its continued widespread use by reputable Web APIs.

This paper was made together withTechPay AB, by their request. The dissertation has been divided into two separate parts; one of which is fully theoretical, with the focus on the security requirements of a digital cash register, and how to meet these requirements. The second part covers the implementation of anAndroid-oriented Java-library,created with help from the security requirements found in the first part. The purpose of this library is to make it easier to develop a cash register that uses payment terminals from TechPay. This paper also covers different communication protocols, encryption techniques and recommendations from authorities, banks and Android. This paper also contains a small review of how users are validated in applications on the current market that handles money transactions.

Dans une infrastructure logicielle, les systèmes critiques ont souvent besoin de garder des clés cryptographiques sur des HSM ou des serveurs consacrés à la gestion de clés. Ils ont pour but de séparer les opérations cryptographiques, très critiques, du reste du réseau, qui est plus vulnérable. L'accès aux clés est fourni au travers des APIs de sécurité, comme par exemple le standard PKCS#11 de RSA, CCA d'IBM, ou encore l'API du TPM, qui ne permettent qu'un accès indirect aux clés. Cette thèse est composée de deux parties. La première introduit des méthodes formelles qui ont pour but l'identification des configurations dans lesquelles les APIs de sécurité peuvent améliorer le niveau de sûreté des protocoles existants, par exemple en cas de compromission d'un participant. Un paradigme prometteur considère les APIs de sécurité comme des participants d'un protocole afin d'étendre l'emploi des méthodes traditionnelles d'analyse de protocole à ces interfaces. À l'opposé des protocoles réseau, les APIs de sécurité utilisent souvent une base de données interne. Ces outils traditionnels d'analyse ne sont adaptés que pour le cas où le nombre des clés est borné a priori. Nous exposons également des arguments pour l'utilisation de la réécriture de multi-ensembles (MSR), lors de la vérification. De plus, nous proposons un langage dérivant du pi-calcul appliqué possédant des opérateurs qui permettent la manipulation d'un état explicite. Ce langage se traduit en règles MSR en préservant des propriétés de sécurité qui s'expriment dans une logique de premier ordre. La traduction a été implémentée sous forme d'un prototype produisant des règles spécifiquement adapté au prouveur tamarin. Plusieurs études de cas, dont un fragment de PKCS#11, le jeton d'authentification Yubikey, et un protocole de signature de contrat optimiste ont été effectuées. Le deuxième partie de la présente thèse a pour but l'identification des propriétés de sécurité qui a) peuvent être établies indépendamment du protocole b) permettent de trouver des failles au niveau de la cryptographie b) facilitent l'analyse des protocoles utilisant cette API de sécurité. Nous adoptons ici l'approche plus générale de Kremer et al. dans un cadre qui permet la composition universelle, à travers une fonctionnalité de gestion de clés. La nouveauté de ce genre de définition est qu'elle dépend des opérations mises à disposition par l'API. Ceci est seulement possible grâce à la composition universelle. Une API de sécurité n'est sûre que si elle réalise correctement la gestion des clés (selon la fonctionnalité présentée dans ce travail) et les opérations utilisant les clés (selon les fonctionalités qui les définissent). Pour finir, nous présentons aussi une implémentation de gestion de clés définie par rapport à des opérations arbitraires utilisant des clés non concernées par la gestion des clés. Cette réalisation représente ainsi un modèle générique pour le design des APIs de sécurité. / Security critical applications often store keys on dedicated HSM or key-management servers to separate highly sensitive cryptographic operations from more vulnerable parts of the network. Access to such devices is given to protocol parties by the means of Security APIs, e.g., the RSA PKCS#11 standard, IBM's CCA and the TPM API, all of which protect keys by providing an API that allows to address keys only indirectly. This thesis has two parts. The first part deals with formal methods that allow for the identification of secure configurations in which Security APIs improve the security of existing protocols, e.g., in scenarios where parties can be corrupted. A promising paradigm is to regard the Security API as a participant in a protocol and then use traditional protocol analysis techniques. But, in contrast to network protocols, Security APIs often rely on the state of an internal database. When it comes to an analysis of an unbounded number of keys, this is the reason why current tools for protocol analysis do not work well. We make a case for the use of MSR as the back-end for verification and propose a new process calculus, which is a variant of the applied pi calculus with constructs for manipulation of a global state. We show that this language can be translated to MSR rules while preserving all security properties expressible in a dedicated first-order logic for security properties. The translation has been implemented in a prototype tool which uses the tamarin prover as a back-end. We apply the tool to several case studies among which a simplified fragment of PKCS#11, the Yubikey security token, and a contract signing protocol. The second part of this thesis aims at identifying security properties that a) can be established independent of the protocol, b) allow to catch flaws on the cryptographic level, and c) facilitate the analysis of protocols using the Security API. We adapt the more general approach to API security of Kremer et.al. to a framework that allows for composition in form of a universally composable key-management functionality. The novelty, compared to other definitions, is that this functionality is parametric in the operations the Security API allows, which is only possible due to universal composability. A Security API is secure if it implements correctly both key-management (according to our functionality) and all operations that depend on keys (with respect to the functionalities defining those operations). We present an implementation which is defined with respect to arbitrary functionalities (for the operations that are not concerned with key-management), and hence represents a general design pattern for Security APIs.

<p>The programming languages that describe hardware circuits are important for circuit </p><p>designers to assist them to design and develop the hardware circuits. </p><p> </p><p>In this master’s project, the Lava hardware description language is used to design and </p><p>develop hardware components for a baseband processing API. Lava is a language </p><p>embedded in the general purpose language Haskell. </p><p> </p><p>The function for checking transmission errors in the baseband processing chain, Cyclic </p><p>Redundancy Check (CRC) is implemented in different ways and tested. </p><p>Linear Feedback Shift Registers (LFSRs) circuits for a particular polynomial generator </p><p>are developed, implemented and simulated by using Lava code to calculate the CRC. </p><p> </p><p>A generalized function of CRC is developed as a circuit generator for any given </p><p>polynomial generator. The circuit is tested by automatic test program.</p>

Building Information Modeling (BIM) has changed the ways buildings are designed and constructed. Along with design and construction, operation and maintenance of the built facility is also gaining importance in the Architecture-Engineering-Construction industry. Facility management (FM) is widely adopted by industrial, healthcare and other types of commercial facilities for better maintenance and management of assets. BIM is being adopted in the field of Facility management and has become one of the most important tools for better application of operation and maintenance. Facility management is performed by professionals with training and experience in the related fields of building operation, maintenance, upgrade and repair. BIM is a professional tool which requires intense training and knowledge. This tool cannot be used and is hard to understand for non-professionals and people who do not have training to use it. Management of residences is as important as management of commercial, industrial and healthcare facilities for the life and smooth running of such facilities. Residential facilities are properties with one or more residential units or buildings. These buildings could be low rise, high rise or individual units. This thesis will help in analyzing the scope of using BIM and Application Programming Interface (API) for management of maintenance in residences by the owner who are not professionally trained. The research analyzes a single, basic function of a BIM tool to determine the potential for such a tool to help non-expert, first time user to be able to understand their residential facilities maintenance requirements. It is an attempt to propose a system which provides alerts to the owners regarding required maintenance and which shows the location of the work in a 3D model. The system was designed and tested in Microsoft Windows 7 operating system by using Autodesk® Revit building information software to make the 3D model, a Revit API plug-in to craft the alerts and show the location of work and Open Database Connectivity (ODBC) to export the model to a web browser. The system worked through Revit program, but the concept of applying the system to work through web browser failed.